505 files changed, 21096 insertions, 8720 deletions

diff --git a/drivers/atm/firestream.h b/drivers/atm/firestream.h
index 49e783e35ee9..364eded31881 100644
--- a/drivers/atm/firestream.h
+++ b/drivers/atm/firestream.h
@@ -420,7 +420,6 @@ struct fs_transmit_config {
 #define RC_FLAGS_BFPS_BFP27 (0xd << 17)
 #define RC_FLAGS_BFPS_BFP47 (0xe << 17)
 
-#define RC_FLAGS_BFPS       (0x1 << 17)
 #define RC_FLAGS_BFPP       (0x1 << 21)
 #define RC_FLAGS_TEVC       (0x1 << 22)
 #define RC_FLAGS_TEP        (0x1 << 23)
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index a355e63a3838..6fb98b53533f 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -188,8 +188,11 @@ static int bcma_host_pci_probe(struct pci_dev *dev,
                 pci_write_config_dword(dev, 0x40, val & 0xffff00ff);
 
         /* SSB needed additional powering up, do we have any AMBA PCI cards? */
-        if (!pci_is_pcie(dev))
-                bcma_err(bus, "PCI card detected, report problems.\n");
+        if (!pci_is_pcie(dev)) {
+                bcma_err(bus, "PCI card detected, they are not supported.\n");
+                err = -ENXIO;
+                goto err_pci_release_regions;
+        }
 
         /* Map MMIO */
         err = -ENOMEM;
@@ -269,6 +272,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 
 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index 4afae20df512..9fe8a875a827 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -30,3 +30,5 @@ hci_uart-$(CONFIG_BT_HCIUART_LL)	+= hci_ll.o
 hci_uart-$(CONFIG_BT_HCIUART_ATH3K)     += hci_ath.o
 hci_uart-$(CONFIG_BT_HCIUART_3WIRE)     += hci_h5.o
 hci_uart-objs                           := $(hci_uart-y)
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h
index 27068d149380..f9d183387f45 100644
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -23,6 +23,8 @@
 #include <linux/bitops.h>
 #include <linux/slab.h>
 #include <net/bluetooth/bluetooth.h>
+#include <linux/ctype.h>
+#include <linux/firmware.h>
 
 #define BTM_HEADER_LEN                  4
 #define BTM_UPLD_SIZE                   2312
@@ -41,6 +43,8 @@ struct btmrvl_thread {
 struct btmrvl_device {
         void *card;
         struct hci_dev *hcidev;
+        struct device *dev;
+        const char *cal_data;
 
         u8 dev_type;
 
@@ -91,6 +95,7 @@ struct btmrvl_private {
 #define BT_CMD_HOST_SLEEP_CONFIG        0x59
 #define BT_CMD_HOST_SLEEP_ENABLE        0x5A
 #define BT_CMD_MODULE_CFG_REQ           0x5B
+#define BT_CMD_LOAD_CONFIG_DATA         0x61
 
 /* Sub-commands: Module Bringup/Shutdown Request/Response */
 #define MODULE_BRINGUP_REQ              0xF1
@@ -116,11 +121,8 @@ struct btmrvl_private {
 #define PS_SLEEP                        0x01
 #define PS_AWAKE                        0x00
 
-struct btmrvl_cmd {
-        __le16 ocf_ogf;
-        u8 length;
-        u8 data[4];
-} __packed;
+#define BT_CMD_DATA_SIZE                32
+#define BT_CAL_DATA_SIZE                28
 
 struct btmrvl_event {
         u8 ec;          /* event counter */
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 9a9f51875df5..6e7bd4e4adbb 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -57,8 +57,7 @@ bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb)
                 ocf = hci_opcode_ocf(opcode);
                 ogf = hci_opcode_ogf(opcode);
 
-                if (ocf == BT_CMD_MODULE_CFG_REQ &&
-                                        priv->btmrvl_dev.sendcmdflag) {
+                if (priv->btmrvl_dev.sendcmdflag) {
                         priv->btmrvl_dev.sendcmdflag = false;
                         priv->adapter->cmd_complete = true;
                         wake_up_interruptible(&priv->adapter->cmd_wait_q);
@@ -116,7 +115,6 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
                         adapter->hs_state = HS_ACTIVATED;
                         if (adapter->psmode)
                                 adapter->ps_state = PS_SLEEP;
-                        wake_up_interruptible(&adapter->cmd_wait_q);
                         BT_DBG("HS ACTIVATED!");
                 } else {
                         BT_DBG("HS Enable failed");
@@ -168,22 +166,24 @@ exit:
 }
 EXPORT_SYMBOL_GPL(btmrvl_process_event);
 
-int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+static int btmrvl_send_sync_cmd(struct btmrvl_private *priv, u16 cmd_no,
+                                const void *param, u8 len)
 {
         struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
+        struct hci_command_hdr *hdr;
 
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
+        skb = bt_skb_alloc(HCI_COMMAND_HDR_SIZE + len, GFP_ATOMIC);
         if (skb == NULL) {
                 BT_ERR("No free skb");
                 return -ENOMEM;
         }
 
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_MODULE_CFG_REQ));
-        cmd->length = 1;
-        cmd->data[0] = subcmd;
+        hdr = (struct hci_command_hdr *)skb_put(skb, HCI_COMMAND_HDR_SIZE);
+        hdr->opcode = cpu_to_le16(hci_opcode_pack(OGF, cmd_no));
+        hdr->plen = len;
+
+        if (len)
+                memcpy(skb_put(skb, len), param, len);
 
         bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
 
@@ -194,19 +194,23 @@ int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
 
         priv->adapter->cmd_complete = false;
 
-        BT_DBG("Queue module cfg Command");
-
         wake_up_interruptible(&priv->main_thread.wait_q);
 
         if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
                                 priv->adapter->cmd_complete,
-                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("module_cfg_cmd(%x): timeout: %d",
-                                        subcmd, priv->btmrvl_dev.sendcmdflag);
-        }
+                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP)))
+                return -ETIMEDOUT;
 
-        BT_DBG("module cfg Command done");
+        return 0;
+}
+
+int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+{
+        int ret;
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_MODULE_CFG_REQ, &subcmd, 1);
+        if (ret)
+                BT_ERR("module_cfg_cmd(%x) failed\n", subcmd);
 
         return ret;
 }
@@ -214,61 +218,36 @@ EXPORT_SYMBOL_GPL(btmrvl_send_module_cfg_cmd);
 
 int btmrvl_send_hscfg_cmd(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (!skb) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                                   BT_CMD_HOST_SLEEP_CONFIG));
-        cmd->length = 2;
-        cmd->data[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
-        cmd->data[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
+        int ret;
+        u8 param[2];
 
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+        param[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
+        param[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
+        BT_DBG("Sending HSCFG Command, gpio=0x%x, gap=0x%x",
+               param[0], param[1]);
 
-        BT_DBG("Queue HSCFG Command, gpio=0x%x, gap=0x%x", cmd->data[0],
-               cmd->data[1]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_CONFIG, param, 2);
+        if (ret)
+                BT_ERR("HSCFG command failed\n");
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_send_hscfg_cmd);
 
 int btmrvl_enable_ps(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                        BT_CMD_AUTO_SLEEP_MODE));
-        cmd->length = 1;
+        int ret;
+        u8 param;
 
         if (priv->btmrvl_dev.psmode)
-                cmd->data[0] = BT_PS_ENABLE;
+                param = BT_PS_ENABLE;
         else
-                cmd->data[0] = BT_PS_DISABLE;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+                param = BT_PS_DISABLE;
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue PSMODE Command:%d", cmd->data[0]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_AUTO_SLEEP_MODE, &param, 1);
+        if (ret)
+                BT_ERR("PSMODE command failed\n");
 
         return 0;
 }
@@ -276,37 +255,11 @@ EXPORT_SYMBOL_GPL(btmrvl_enable_ps);
 
 int btmrvl_enable_hs(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_HOST_SLEEP_ENABLE));
-        cmd->length = 0;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
-
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue hs enable Command");
-
-        wake_up_interruptible(&priv->main_thread.wait_q);
+        int ret;
 
-        if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
-                        priv->adapter->hs_state,
-                        msecs_to_jiffies(WAIT_UNTIL_HS_STATE_CHANGED))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("timeout: %d, %d,%d", priv->adapter->hs_state,
-                                                priv->adapter->ps_state,
-                                                priv->adapter->wakeup_tries);
-        }
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_ENABLE, NULL, 0);
+        if (ret)
+                BT_ERR("Host sleep enable command failed\n");
 
         return ret;
 }
@@ -480,6 +433,137 @@ static int btmrvl_open(struct hci_dev *hdev)
 }
 
 /*
+ * This function parses provided calibration data input. It should contain
+ * hex bytes separated by space or new line character. Here is an example.
+ * 00 1C 01 37 FF FF FF FF 02 04 7F 01
+ * CE BA 00 00 00 2D C6 C0 00 00 00 00
+ * 00 F0 00 00
+ */
+static int btmrvl_parse_cal_cfg(const u8 *src, u32 len, u8 *dst, u32 dst_size)
+{
+        const u8 *s = src;
+        u8 *d = dst;
+        int ret;
+        u8 tmp[3];
+
+        tmp[2] = '\0';
+        while ((s - src) <= len - 2) {
+                if (isspace(*s)) {
+                        s++;
+                        continue;
+                }
+
+                if (isxdigit(*s)) {
+                        if ((d - dst) >= dst_size) {
+                                BT_ERR("calibration data file too big!!!");
+                                return -EINVAL;
+                        }
+
+                        memcpy(tmp, s, 2);
+
+                        ret = kstrtou8(tmp, 16, d++);
+                        if (ret < 0)
+                                return ret;
+
+                        s += 2;
+                } else {
+                        return -EINVAL;
+                }
+        }
+        if (d == dst)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int btmrvl_load_cal_data(struct btmrvl_private *priv,
+                                u8 *config_data)
+{
+        int i, ret;
+        u8 data[BT_CMD_DATA_SIZE];
+
+        data[0] = 0x00;
+        data[1] = 0x00;
+        data[2] = 0x00;
+        data[3] = BT_CMD_DATA_SIZE - 4;
+
+        /* Swap cal-data bytes. Each four bytes are swapped. Considering 4
+         * byte SDIO header offset, mapping of input and output bytes will be
+         * {3, 2, 1, 0} -> {0+4, 1+4, 2+4, 3+4},
+         * {7, 6, 5, 4} -> {4+4, 5+4, 6+4, 7+4} */
+        for (i = 4; i < BT_CMD_DATA_SIZE; i++)
+                data[i] = config_data[(i / 4) * 8 - 1 - i];
+
+        print_hex_dump_bytes("Calibration data: ",
+                             DUMP_PREFIX_OFFSET, data, BT_CMD_DATA_SIZE);
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_LOAD_CONFIG_DATA, data,
+                                   BT_CMD_DATA_SIZE);
+        if (ret)
+                BT_ERR("Failed to download caibration data\n");
+
+        return 0;
+}
+
+static int
+btmrvl_process_cal_cfg(struct btmrvl_private *priv, u8 *data, u32 size)
+{
+        u8 cal_data[BT_CAL_DATA_SIZE];
+        int ret;
+
+        ret = btmrvl_parse_cal_cfg(data, size, cal_data, sizeof(cal_data));
+        if (ret)
+                return ret;
+
+        ret = btmrvl_load_cal_data(priv, cal_data);
+        if (ret) {
+                BT_ERR("Fail to load calibrate data");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int btmrvl_cal_data_config(struct btmrvl_private *priv)
+{
+        const struct firmware *cfg;
+        int ret;
+        const char *cal_data = priv->btmrvl_dev.cal_data;
+
+        if (!cal_data)
+                return 0;
+
+        ret = request_firmware(&cfg, cal_data, priv->btmrvl_dev.dev);
+        if (ret < 0) {
+                BT_DBG("Failed to get %s file, skipping cal data download",
+                       cal_data);
+                return 0;
+        }
+
+        ret = btmrvl_process_cal_cfg(priv, (u8 *)cfg->data, cfg->size);
+        release_firmware(cfg);
+        return ret;
+}
+
+static int btmrvl_setup(struct hci_dev *hdev)
+{
+        struct btmrvl_private *priv = hci_get_drvdata(hdev);
+
+        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+
+        if (btmrvl_cal_data_config(priv))
+                BT_ERR("Set cal data failed");
+
+        priv->btmrvl_dev.psmode = 1;
+        btmrvl_enable_ps(priv);
+
+        priv->btmrvl_dev.gpio_gap = 0xffff;
+        btmrvl_send_hscfg_cmd(priv);
+
+        return 0;
+}
+
+/*
  * This function handles the event generated by firmware, rx data
  * received from firmware, and tx data sent from kernel.
  */
@@ -572,8 +656,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
         hdev->flush = btmrvl_flush;
         hdev->send = btmrvl_send_frame;
         hdev->ioctl = btmrvl_ioctl;
-
-        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+        hdev->setup = btmrvl_setup;
 
         hdev->dev_type = priv->btmrvl_dev.dev_type;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 00da6df9f71e..332475e400cf 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -18,7 +18,6 @@
  * this warranty disclaimer.
  **/
 
-#include <linux/firmware.h>
 #include <linux/slab.h>
 
 #include <linux/mmc/sdio_ids.h>
@@ -102,6 +101,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
         .helper         = "mrvl/sd8688_helper.bin",
         .firmware       = "mrvl/sd8688.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_8688,
         .sd_blksz_fw_dl = 64,
 };
@@ -109,6 +109,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8787_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -116,6 +117,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8797_uapsta.bin",
+        .cal_data       = "mrvl/sd8797_caldata.conf",
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -123,6 +125,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8897_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_88xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -1006,6 +1009,7 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 struct btmrvl_sdio_device *data = (void *) id->driver_data;
                 card->helper = data->helper;
                 card->firmware = data->firmware;
+                card->cal_data = data->cal_data;
                 card->reg = data->reg;
                 card->sd_blksz_fw_dl = data->sd_blksz_fw_dl;
         }
@@ -1034,6 +1038,8 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
         }
 
         card->priv = priv;
+        priv->btmrvl_dev.dev = &card->func->dev;
+        priv->btmrvl_dev.cal_data = card->cal_data;
 
         /* Initialize the interface specific function pointers */
         priv->hw_host_to_card = btmrvl_sdio_host_to_card;
@@ -1046,12 +1052,6 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 goto disable_host_int;
         }
 
-        priv->btmrvl_dev.psmode = 1;
-        btmrvl_enable_ps(priv);
-
-        priv->btmrvl_dev.gpio_gap = 0xffff;
-        btmrvl_send_hscfg_cmd(priv);
-
         return 0;
 
 disable_host_int:
@@ -1222,4 +1222,5 @@ MODULE_FIRMWARE("mrvl/sd8688_helper.bin");
 MODULE_FIRMWARE("mrvl/sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
 MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
+MODULE_FIRMWARE("mrvl/sd8797_caldata.conf");
 MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
diff --git a/drivers/bluetooth/btmrvl_sdio.h b/drivers/bluetooth/btmrvl_sdio.h
index 43d35a609ca9..6872d9ecac07 100644
--- a/drivers/bluetooth/btmrvl_sdio.h
+++ b/drivers/bluetooth/btmrvl_sdio.h
@@ -85,6 +85,7 @@ struct btmrvl_sdio_card {
         u32 ioport;
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
         u8 rx_unit;
@@ -94,6 +95,7 @@ struct btmrvl_sdio_card {
 struct btmrvl_sdio_device {
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
 };
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index d8b7aed6e4a9..c04a3e6fb37c 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/module.h>
+#include <asm/unaligned.h>
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -39,17 +40,17 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-#define VERSION "1.3"
+#define VERSION "1.4"
 
 static bool amp;
 
 struct vhci_data {
         struct hci_dev *hdev;
 
-        unsigned long flags;
-
         wait_queue_head_t read_wait;
         struct sk_buff_head readq;
+
+        struct delayed_work open_timeout;
 };
 
 static int vhci_open_dev(struct hci_dev *hdev)
@@ -99,16 +100,62 @@ static int vhci_send_frame(struct sk_buff *skb)
         skb_queue_tail(&data->readq, skb);
 
         wake_up_interruptible(&data->read_wait);
+        return 0;
+}
+
+static int vhci_create_device(struct vhci_data *data, __u8 dev_type)
+{
+        struct hci_dev *hdev;
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(4, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        hdev = hci_alloc_dev();
+        if (!hdev) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        data->hdev = hdev;
+
+        hdev->bus = HCI_VIRTUAL;
+        hdev->dev_type = dev_type;
+        hci_set_drvdata(hdev, data);
+
+        hdev->open  = vhci_open_dev;
+        hdev->close = vhci_close_dev;
+        hdev->flush = vhci_flush;
+        hdev->send  = vhci_send_frame;
 
+        if (hci_register_dev(hdev) < 0) {
+                BT_ERR("Can't register HCI device");
+                hci_free_dev(hdev);
+                data->hdev = NULL;
+                kfree_skb(skb);
+                return -EBUSY;
+        }
+
+        bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
+
+        *skb_put(skb, 1) = 0xff;
+        *skb_put(skb, 1) = dev_type;
+        put_unaligned_le16(hdev->id, skb_put(skb, 2));
+        skb_queue_tail(&data->readq, skb);
+
+        wake_up_interruptible(&data->read_wait);
         return 0;
 }
 
 static inline ssize_t vhci_get_user(struct vhci_data *data,
-                                        const char __user *buf, size_t count)
+                                    const char __user *buf, size_t count)
 {
         struct sk_buff *skb;
+        __u8 pkt_type, dev_type;
+        int ret;
 
-        if (count > HCI_MAX_FRAME_SIZE)
+        if (count < 2 || count > HCI_MAX_FRAME_SIZE)
                 return -EINVAL;
 
         skb = bt_skb_alloc(count, GFP_KERNEL);
@@ -120,27 +167,70 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
                 return -EFAULT;
         }
 
-        skb->dev = (void *) data->hdev;
-        bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
+        pkt_type = *((__u8 *) skb->data);
         skb_pull(skb, 1);
 
-        hci_recv_frame(skb);
+        switch (pkt_type) {
+        case HCI_EVENT_PKT:
+        case HCI_ACLDATA_PKT:
+        case HCI_SCODATA_PKT:
+                if (!data->hdev) {
+                        kfree_skb(skb);
+                        return -ENODEV;
+                }
+
+                skb->dev = (void *) data->hdev;
+                bt_cb(skb)->pkt_type = pkt_type;
+
+                ret = hci_recv_frame(skb);
+                break;
+
+        case HCI_VENDOR_PKT:
+                if (data->hdev) {
+                        kfree_skb(skb);
+                        return -EBADFD;
+                }
 
-        return count;
+                cancel_delayed_work_sync(&data->open_timeout);
+
+                dev_type = *((__u8 *) skb->data);
+                skb_pull(skb, 1);
+
+                if (skb->len > 0) {
+                        kfree_skb(skb);
+                        return -EINVAL;
+                }
+
+                kfree_skb(skb);
+
+                if (dev_type != HCI_BREDR && dev_type != HCI_AMP)
+                        return -EINVAL;
+
+                ret = vhci_create_device(data, dev_type);
+                break;
+
+        default:
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        return (ret < 0) ? ret : count;
 }
 
 static inline ssize_t vhci_put_user(struct vhci_data *data,
-                        struct sk_buff *skb, char __user *buf, int count)
+                                    struct sk_buff *skb,
+                                    char __user *buf, int count)
 {
         char __user *ptr = buf;
-        int len, total = 0;
+        int len;
 
         len = min_t(unsigned int, skb->len, count);
 
         if (copy_to_user(ptr, skb->data, len))
                 return -EFAULT;
 
-        total += len;
+        if (!data->hdev)
+                return len;
 
         data->hdev->stat.byte_tx += len;
 
@@ -148,21 +238,19 @@ static inline ssize_t vhci_put_user(struct vhci_data *data,
         case HCI_COMMAND_PKT:
                 data->hdev->stat.cmd_tx++;
                 break;
-
         case HCI_ACLDATA_PKT:
                 data->hdev->stat.acl_tx++;
                 break;
-
         case HCI_SCODATA_PKT:
                 data->hdev->stat.sco_tx++;
                 break;
         }
 
-        return total;
+        return len;
 }
 
 static ssize_t vhci_read(struct file *file,
-                                char __user *buf, size_t count, loff_t *pos)
+                         char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
         struct sk_buff *skb;
@@ -185,7 +273,7 @@ static ssize_t vhci_read(struct file *file,
                 }
 
                 ret = wait_event_interruptible(data->read_wait,
-                                        !skb_queue_empty(&data->readq));
+                                               !skb_queue_empty(&data->readq));
                 if (ret < 0)
                         break;
         }
@@ -194,7 +282,7 @@ static ssize_t vhci_read(struct file *file,
 }
 
 static ssize_t vhci_write(struct file *file,
-                        const char __user *buf, size_t count, loff_t *pos)
+                          const char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
 
@@ -213,10 +301,17 @@ static unsigned int vhci_poll(struct file *file, poll_table *wait)
         return POLLOUT | POLLWRNORM;
 }
 
+static void vhci_open_timeout(struct work_struct *work)
+{
+        struct vhci_data *data = container_of(work, struct vhci_data,
+                                              open_timeout.work);
+
+        vhci_create_device(data, amp ? HCI_AMP : HCI_BREDR);
+}
+
 static int vhci_open(struct inode *inode, struct file *file)
 {
         struct vhci_data *data;
-        struct hci_dev *hdev;
 
         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
         if (!data)
@@ -225,35 +320,13 @@ static int vhci_open(struct inode *inode, struct file *file)
         skb_queue_head_init(&data->readq);
         init_waitqueue_head(&data->read_wait);
 
-        hdev = hci_alloc_dev();
-        if (!hdev) {
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        data->hdev = hdev;
-
-        hdev->bus = HCI_VIRTUAL;
-        hci_set_drvdata(hdev, data);
-
-        if (amp)
-                hdev->dev_type = HCI_AMP;
-
-        hdev->open     = vhci_open_dev;
-        hdev->close    = vhci_close_dev;
-        hdev->flush    = vhci_flush;
-        hdev->send     = vhci_send_frame;
-
-        if (hci_register_dev(hdev) < 0) {
-                BT_ERR("Can't register HCI device");
-                kfree(data);
-                hci_free_dev(hdev);
-                return -EBUSY;
-        }
+        INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 
         file->private_data = data;
         nonseekable_open(inode, file);
 
+        schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
+
         return 0;
 }
 
@@ -262,8 +335,12 @@ static int vhci_release(struct inode *inode, struct file *file)
         struct vhci_data *data = file->private_data;
         struct hci_dev *hdev = data->hdev;
 
-        hci_unregister_dev(hdev);
-        hci_free_dev(hdev);
+        cancel_delayed_work_sync(&data->open_timeout);
+
+        if (hdev) {
+                hci_unregister_dev(hdev);
+                hci_free_dev(hdev);
+        }
 
         file->private_data = NULL;
         kfree(data);
@@ -309,3 +386,4 @@ MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("devname:vhci");
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index dab4b41f1715..a082fd9e7ebe 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2294,7 +2294,7 @@ static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
         int low, high, remaining;
         unsigned int rover;
 
-        inet_get_local_port_range(&low, &high);
+        inet_get_local_port_range(&init_net, &low, &high);
         remaining = (high - low) + 1;
         rover = net_random() % remaining + low;
 retry:
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index 52377b4bf039..a2e0ed6c9a4d 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -481,7 +481,7 @@ void __inline__ outpp(void __iomem *addr, word p)
 int diva_os_register_irq(void *context, byte irq, const char *name)
 {
         int result = request_irq(irq, diva_os_irq_wrapper,
-                                 IRQF_DISABLED | IRQF_SHARED, name, context);
+                                 IRQF_SHARED, name, context);
         return (result);
 }
 
diff --git a/drivers/isdn/hardware/eicon/um_idi.c b/drivers/isdn/hardware/eicon/um_idi.c
index 7cab5c3276c2..e1519718ce67 100644
--- a/drivers/isdn/hardware/eicon/um_idi.c
+++ b/drivers/isdn/hardware/eicon/um_idi.c
@@ -288,9 +288,9 @@ int divas_um_idi_delete_entity(int adapter_nr, void *entity)
         cleanup_entity(e);
         diva_os_free(0, e->os_context);
         memset(e, 0x00, sizeof(*e));
-        diva_os_free(0, e);
 
         DBG_LOG(("A(%d) remove E:%08x", adapter_nr, e));
+        diva_os_free(0, e);
 
         return (0);
 }
diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c
index ca997bd4e818..92acc81f844d 100644
--- a/drivers/isdn/sc/init.c
+++ b/drivers/isdn/sc/init.c
@@ -336,7 +336,7 @@ static int __init sc_init(void)
                  */
                 sc_adapter[cinst]->interrupt = irq[b];
                 if (request_irq(sc_adapter[cinst]->interrupt, interrupt_handler,
-                                IRQF_DISABLED, interface->id,
+                                0, interface->id,
                                 (void *)(unsigned long) cinst))
                 {
                         kfree(sc_adapter[cinst]->channel);
diff --git a/drivers/net/bonding/Makefile b/drivers/net/bonding/Makefile
index 4c21bf6b8b2f..5a5d720da929 100644
--- a/drivers/net/bonding/Makefile
+++ b/drivers/net/bonding/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_BONDING) += bonding.o
 
-bonding-objs := bond_main.o bond_3ad.o bond_alb.o bond_sysfs.o bond_debugfs.o
+bonding-objs := bond_main.o bond_3ad.o bond_alb.o bond_sysfs.o bond_debugfs.o bond_netlink.o bond_options.o
 
 proc-$(CONFIG_PROC_FS) += bond_procfs.o
 bonding-objs += $(proc-y)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 0d8f427ade93..187b1b7772ef 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -136,41 +136,6 @@ static inline struct bonding *__get_bond_by_port(struct port *port)
 }
 
 /**
- * __get_first_port - get the first port in the bond
- * @bond: the bond we're looking at
- *
- * Return the port of the first slave in @bond, or %NULL if it can't be found.
- */
-static inline struct port *__get_first_port(struct bonding *bond)
-{
-        struct slave *first_slave = bond_first_slave(bond);
-
-        return first_slave ? &(SLAVE_AD_INFO(first_slave).port) : NULL;
-}
-
-/**
- * __get_next_port - get the next port in the bond
- * @port: the port we're looking at
- *
- * Return the port of the slave that is next in line of @port's slave in the
- * bond, or %NULL if it can't be found.
- */
-static inline struct port *__get_next_port(struct port *port)
-{
-        struct bonding *bond = __get_bond_by_port(port);
-        struct slave *slave = port->slave, *slave_next;
-
-        // If there's no bond for this port, or this is the last slave
-        if (bond == NULL)
-                return NULL;
-        slave_next = bond_next_slave(bond, slave);
-        if (!slave_next || bond_is_first_slave(bond, slave_next))
-                return NULL;
-
-        return &(SLAVE_AD_INFO(slave_next).port);
-}
-
-/**
  * __get_first_agg - get the first aggregator in the bond
  * @bond: the bond we're looking at
  *
@@ -190,28 +155,6 @@ static inline struct aggregator *__get_first_agg(struct port *port)
         return first_slave ? &(SLAVE_AD_INFO(first_slave).aggregator) : NULL;
 }
 
-/**
- * __get_next_agg - get the next aggregator in the bond
- * @aggregator: the aggregator we're looking at
- *
- * Return the aggregator of the slave that is next in line of @aggregator's
- * slave in the bond, or %NULL if it can't be found.
- */
-static inline struct aggregator *__get_next_agg(struct aggregator *aggregator)
-{
-        struct slave *slave = aggregator->slave, *slave_next;
-        struct bonding *bond = bond_get_bond_by_slave(slave);
-
-        // If there's no bond for this aggregator, or this is the last slave
-        if (bond == NULL)
-                return NULL;
-        slave_next = bond_next_slave(bond, slave);
-        if (!slave_next || bond_is_first_slave(bond, slave_next))
-                return NULL;
-
-        return &(SLAVE_AD_INFO(slave_next).aggregator);
-}
-
 /*
  * __agg_has_partner
  *
@@ -755,16 +698,15 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
  */
 static struct aggregator *__get_active_agg(struct aggregator *aggregator)
 {
-        struct aggregator *retval = NULL;
+        struct bonding *bond = aggregator->slave->bond;
+        struct list_head *iter;
+        struct slave *slave;
 
-        for (; aggregator; aggregator = __get_next_agg(aggregator)) {
-                if (aggregator->is_active) {
-                        retval = aggregator;
-                        break;
-                }
-        }
+        bond_for_each_slave(bond, slave, iter)
+                if (SLAVE_AD_INFO(slave).aggregator.is_active)
+                        return &(SLAVE_AD_INFO(slave).aggregator);
 
-        return retval;
+        return NULL;
 }
 
 /**
@@ -1274,12 +1216,17 @@ static void ad_port_selection_logic(struct port *port)
 {
         struct aggregator *aggregator, *free_aggregator = NULL, *temp_aggregator;
         struct port *last_port = NULL, *curr_port;
+        struct list_head *iter;
+        struct bonding *bond;
+        struct slave *slave;
         int found = 0;
 
         // if the port is already Selected, do nothing
         if (port->sm_vars & AD_PORT_SELECTED)
                 return;
 
+        bond = __get_bond_by_port(port);
+
         // if the port is connected to other aggregator, detach it
         if (port->aggregator) {
                 // detach the port from its former aggregator
@@ -1320,8 +1267,8 @@ static void ad_port_selection_logic(struct port *port)
                 }
         }
         // search on all aggregators for a suitable aggregator for this port
-        for (aggregator = __get_first_agg(port); aggregator;
-             aggregator = __get_next_agg(aggregator)) {
+        bond_for_each_slave(bond, slave, iter) {
+                aggregator = &(SLAVE_AD_INFO(slave).aggregator);
 
                 // keep a free aggregator for later use(if needed)
                 if (!aggregator->lag_ports) {
@@ -1515,19 +1462,23 @@ static int agg_device_up(const struct aggregator *agg)
 static void ad_agg_selection_logic(struct aggregator *agg)
 {
         struct aggregator *best, *active, *origin;
+        struct bonding *bond = agg->slave->bond;
+        struct list_head *iter;
+        struct slave *slave;
         struct port *port;
 
         origin = agg;
         active = __get_active_agg(agg);
         best = (active && agg_device_up(active)) ? active : NULL;
 
-        do {
+        bond_for_each_slave(bond, slave, iter) {
+                agg = &(SLAVE_AD_INFO(slave).aggregator);
+
                 agg->is_active = 0;
 
                 if (agg->num_of_ports && agg_device_up(agg))
                         best = ad_agg_selection_test(best, agg);
-
-        } while ((agg = __get_next_agg(agg)));
+        }
 
         if (best &&
             __get_agg_selection_mode(best->lag_ports) == BOND_AD_STABLE) {
@@ -1565,8 +1516,8 @@ static void ad_agg_selection_logic(struct aggregator *agg)
                          best->lag_ports, best->slave,
                          best->slave ? best->slave->dev->name : "NULL");
 
-                for (agg = __get_first_agg(best->lag_ports); agg;
-                     agg = __get_next_agg(agg)) {
+                bond_for_each_slave(bond, slave, iter) {
+                        agg = &(SLAVE_AD_INFO(slave).aggregator);
 
                         pr_debug("Agg=%d; P=%d; a k=%d; p k=%d; Ind=%d; Act=%d\n",
                                  agg->aggregator_identifier, agg->num_of_ports,
@@ -1614,13 +1565,7 @@ static void ad_agg_selection_logic(struct aggregator *agg)
                 }
         }
 
-        if (origin->slave) {
-                struct bonding *bond;
-
-                bond = bond_get_bond_by_slave(origin->slave);
-                if (bond)
-                        bond_3ad_set_carrier(bond);
-        }
+        bond_3ad_set_carrier(bond);
 }
 
 /**
@@ -1969,6 +1914,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
         struct port *port, *prev_port, *temp_port;
         struct aggregator *aggregator, *new_aggregator, *temp_aggregator;
         int select_new_active_agg = 0;
+        struct bonding *bond = slave->bond;
+        struct slave *slave_iter;
+        struct list_head *iter;
 
         // find the aggregator related to this slave
         aggregator = &(SLAVE_AD_INFO(slave).aggregator);
@@ -1998,14 +1946,16 @@ void bond_3ad_unbind_slave(struct slave *slave)
                 // reason to search for new aggregator, and that we will find one
                 if ((aggregator->lag_ports != port) || (aggregator->lag_ports->next_port_in_aggregator)) {
                         // find new aggregator for the related port(s)
-                        new_aggregator = __get_first_agg(port);
-                        for (; new_aggregator; new_aggregator = __get_next_agg(new_aggregator)) {
+                        bond_for_each_slave(bond, slave_iter, iter) {
+                                new_aggregator = &(SLAVE_AD_INFO(slave_iter).aggregator);
                                 // if the new aggregator is empty, or it is connected to our port only
                                 if (!new_aggregator->lag_ports
                                     || ((new_aggregator->lag_ports == port)
                                         && !new_aggregator->lag_ports->next_port_in_aggregator))
                                         break;
                         }
+                        if (!slave_iter)
+                                new_aggregator = NULL;
                         // if new aggregator found, copy the aggregator's parameters
                         // and connect the related lag_ports to the new aggregator
                         if ((new_aggregator) && ((!new_aggregator->lag_ports) || ((new_aggregator->lag_ports == port) && !new_aggregator->lag_ports->next_port_in_aggregator))) {
@@ -2056,15 +2006,17 @@ void bond_3ad_unbind_slave(struct slave *slave)
                                 pr_info("%s: Removing an active aggregator\n",
                                         slave->bond->dev->name);
                                 // select new active aggregator
-                                ad_agg_selection_logic(__get_first_agg(port));
+                                temp_aggregator = __get_first_agg(port);
+                                if (temp_aggregator)
+                                        ad_agg_selection_logic(temp_aggregator);
                         }
                 }
         }
 
         pr_debug("Unbinding port %d\n", port->actor_port_number);
         // find the aggregator that this port is connected to
-        temp_aggregator = __get_first_agg(port);
-        for (; temp_aggregator; temp_aggregator = __get_next_agg(temp_aggregator)) {
+        bond_for_each_slave(bond, slave_iter, iter) {
+                temp_aggregator = &(SLAVE_AD_INFO(slave_iter).aggregator);
                 prev_port = NULL;
                 // search the port in the aggregator's related ports
                 for (temp_port = temp_aggregator->lag_ports; temp_port;
@@ -2111,19 +2063,24 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
 {
         struct bonding *bond = container_of(work, struct bonding,
                                             ad_work.work);
-        struct port *port;
         struct aggregator *aggregator;
+        struct list_head *iter;
+        struct slave *slave;
+        struct port *port;
 
         read_lock(&bond->lock);
 
         //check if there are any slaves
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto re_arm;
 
         // check if agg_select_timer timer after initialize is timed out
         if (BOND_AD_INFO(bond).agg_select_timer && !(--BOND_AD_INFO(bond).agg_select_timer)) {
+                slave = bond_first_slave(bond);
+                port = slave ? &(SLAVE_AD_INFO(slave).port) : NULL;
+
                 // select the active aggregator for the bond
-                if ((port = __get_first_port(bond))) {
+                if (port) {
                         if (!port->slave) {
                                 pr_warning("%s: Warning: bond's first port is uninitialized\n",
                                            bond->dev->name);
@@ -2137,7 +2094,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         }
 
         // for each port run the state machines
-        for (port = __get_first_port(bond); port; port = __get_next_port(port)) {
+        bond_for_each_slave(bond, slave, iter) {
+                port = &(SLAVE_AD_INFO(slave).port);
                 if (!port->slave) {
                         pr_warning("%s: Warning: Found an uninitialized port\n",
                                    bond->dev->name);
@@ -2382,9 +2340,12 @@ int __bond_3ad_get_active_agg_info(struct bonding *bond,
                                    struct ad_info *ad_info)
 {
         struct aggregator *aggregator = NULL;
+        struct list_head *iter;
+        struct slave *slave;
         struct port *port;
 
-        for (port = __get_first_port(bond); port; port = __get_next_port(port)) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                port = &(SLAVE_AD_INFO(slave).port);
                 if (port->aggregator && port->aggregator->is_active) {
                         aggregator = port->aggregator;
                         break;
@@ -2408,25 +2369,25 @@ int bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info)
 {
         int ret;
 
-        read_lock(&bond->lock);
+        rcu_read_lock();
         ret = __bond_3ad_get_active_agg_info(bond, ad_info);
-        read_unlock(&bond->lock);
+        rcu_read_unlock();
 
         return ret;
 }
 
 int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 {
-        struct slave *slave, *start_at;
         struct bonding *bond = netdev_priv(dev);
-        int slave_agg_no;
-        int slaves_in_agg;
-        int agg_id;
-        int i;
+        struct slave *slave, *first_ok_slave;
+        struct aggregator *agg;
         struct ad_info ad_info;
+        struct list_head *iter;
+        int slaves_in_agg;
+        int slave_agg_no;
         int res = 1;
+        int agg_id;
 
-        read_lock(&bond->lock);
         if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
                 pr_debug("%s: Error: __bond_3ad_get_active_agg_info failed\n",
                          dev->name);
@@ -2437,20 +2398,28 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
         agg_id = ad_info.aggregator_id;
 
         if (slaves_in_agg == 0) {
-                /*the aggregator is empty*/
                 pr_debug("%s: Error: active aggregator is empty\n", dev->name);
                 goto out;
         }
 
-        slave_agg_no = bond->xmit_hash_policy(skb, slaves_in_agg);
+        slave_agg_no = bond_xmit_hash(bond, skb, slaves_in_agg);
+        first_ok_slave = NULL;
 
-        bond_for_each_slave(bond, slave) {
-                struct aggregator *agg = SLAVE_AD_INFO(slave).port.aggregator;
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                agg = SLAVE_AD_INFO(slave).port.aggregator;
+                if (!agg || agg->aggregator_identifier != agg_id)
+                        continue;
 
-                if (agg && (agg->aggregator_identifier == agg_id)) {
+                if (slave_agg_no >= 0) {
+                        if (!first_ok_slave && SLAVE_IS_OK(slave))
+                                first_ok_slave = slave;
                         slave_agg_no--;
-                        if (slave_agg_no < 0)
-                                break;
+                        continue;
+                }
+
+                if (SLAVE_IS_OK(slave)) {
+                        res = bond_dev_queue_xmit(bond, skb, slave->dev);
+                        goto out;
                 }
         }
 
@@ -2460,23 +2429,12 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
                 goto out;
         }
 
-        start_at = slave;
-
-        bond_for_each_slave_from(bond, slave, i, start_at) {
-                int slave_agg_id = 0;
-                struct aggregator *agg = SLAVE_AD_INFO(slave).port.aggregator;
-
-                if (agg)
-                        slave_agg_id = agg->aggregator_identifier;
-
-                if (SLAVE_IS_OK(slave) && agg && (slave_agg_id == agg_id)) {
-                        res = bond_dev_queue_xmit(bond, skb, slave->dev);
-                        break;
-                }
-        }
+        /* we couldn't find any suitable slave after the agg_no, so use the
+         * first suitable found, if found. */
+        if (first_ok_slave)
+                res = bond_dev_queue_xmit(bond, skb, first_ok_slave->dev);
 
 out:
-        read_unlock(&bond->lock);
         if (res) {
                 /* no suitable interface, frame not sent */
                 kfree_skb(skb);
@@ -2515,11 +2473,12 @@ int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
 void bond_3ad_update_lacp_rate(struct bonding *bond)
 {
         struct port *port = NULL;
+        struct list_head *iter;
         struct slave *slave;
         int lacp_fast;
 
         lacp_fast = bond->params.lacp_fast;
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 port = &(SLAVE_AD_INFO(slave).port);
                 __get_state_machine_lock(port);
                 if (lacp_fast)
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index f428ef574372..02872405d35d 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -223,13 +223,14 @@ static long long compute_gap(struct slave *slave)
 static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)
 {
         struct slave *slave, *least_loaded;
+        struct list_head *iter;
         long long max_gap;
 
         least_loaded = NULL;
         max_gap = LLONG_MIN;
 
         /* Find the slave with the largest gap */
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (SLAVE_IS_OK(slave)) {
                         long long gap = compute_gap(slave);
 
@@ -382,30 +383,64 @@ out:
 static struct slave *rlb_next_rx_slave(struct bonding *bond)
 {
         struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
-        struct slave *rx_slave, *slave, *start_at;
-        int i = 0;
+        struct slave *before = NULL, *rx_slave = NULL, *slave;
+        struct list_head *iter;
+        bool found = false;
 
-        if (bond_info->next_rx_slave)
-                start_at = bond_info->next_rx_slave;
-        else
-                start_at = bond_first_slave(bond);
+        bond_for_each_slave(bond, slave, iter) {
+                if (!SLAVE_IS_OK(slave))
+                        continue;
+                if (!found) {
+                        if (!before || before->speed < slave->speed)
+                                before = slave;
+                } else {
+                        if (!rx_slave || rx_slave->speed < slave->speed)
+                                rx_slave = slave;
+                }
+                if (slave == bond_info->rx_slave)
+                        found = true;
+        }
+        /* we didn't find anything after the current or we have something
+         * better before and up to the current slave
+         */
+        if (!rx_slave || (before && rx_slave->speed < before->speed))
+                rx_slave = before;
 
-        rx_slave = NULL;
+        if (rx_slave)
+                bond_info->rx_slave = rx_slave;
 
-        bond_for_each_slave_from(bond, slave, i, start_at) {
-                if (SLAVE_IS_OK(slave)) {
-                        if (!rx_slave) {
-                                rx_slave = slave;
-                        } else if (slave->speed > rx_slave->speed) {
+        return rx_slave;
+}
+
+/* Caller must hold rcu_read_lock() for read */
+static struct slave *__rlb_next_rx_slave(struct bonding *bond)
+{
+        struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
+        struct slave *before = NULL, *rx_slave = NULL, *slave;
+        struct list_head *iter;
+        bool found = false;
+
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (!SLAVE_IS_OK(slave))
+                        continue;
+                if (!found) {
+                        if (!before || before->speed < slave->speed)
+                                before = slave;
+                } else {
+                        if (!rx_slave || rx_slave->speed < slave->speed)
                                 rx_slave = slave;
-                        }
                 }
+                if (slave == bond_info->rx_slave)
+                        found = true;
         }
+        /* we didn't find anything after the current or we have something
+         * better before and up to the current slave
+         */
+        if (!rx_slave || (before && rx_slave->speed < before->speed))
+                rx_slave = before;
 
-        if (rx_slave) {
-                slave = bond_next_slave(bond, rx_slave);
-                bond_info->next_rx_slave = slave;
-        }
+        if (rx_slave)
+                bond_info->rx_slave = rx_slave;
 
         return rx_slave;
 }
@@ -626,12 +661,14 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
 {
         struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
         struct arp_pkt *arp = arp_pkt(skb);
-        struct slave *assigned_slave;
+        struct slave *assigned_slave, *curr_active_slave;
         struct rlb_client_info *client_info;
         u32 hash_index = 0;
 
         _lock_rx_hashtbl(bond);
 
+        curr_active_slave = rcu_dereference(bond->curr_active_slave);
+
         hash_index = _simple_hash((u8 *)&arp->ip_dst, sizeof(arp->ip_dst));
         client_info = &(bond_info->rx_hashtbl[hash_index]);
 
@@ -656,14 +693,14 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                          * that the new client can be assigned to this entry.
                          */
                         if (bond->curr_active_slave &&
-                            client_info->slave != bond->curr_active_slave) {
-                                client_info->slave = bond->curr_active_slave;
+                            client_info->slave != curr_active_slave) {
+                                client_info->slave = curr_active_slave;
                                 rlb_update_client(client_info);
                         }
                 }
         }
         /* assign a new slave */
-        assigned_slave = rlb_next_rx_slave(bond);
+        assigned_slave = __rlb_next_rx_slave(bond);
 
         if (assigned_slave) {
                 if (!(client_info->assigned &&
@@ -726,7 +763,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
         /* Don't modify or load balance ARPs that do not originate locally
          * (e.g.,arrive via a bridge).
          */
-        if (!bond_slave_has_mac(bond, arp->mac_src))
+        if (!bond_slave_has_mac_rcu(bond, arp->mac_src))
                 return NULL;
 
         if (arp->op_code == htons(ARPOP_REPLY)) {
@@ -1019,7 +1056,7 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
 
         /* loop through vlans and send one packet for each */
         rcu_read_lock();
-        netdev_for_each_upper_dev_rcu(bond->dev, upper, iter) {
+        netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
                 if (upper->priv_flags & IFF_802_1Q_VLAN)
                         alb_send_lp_vid(slave, mac_addr,
                                         vlan_dev_vlan_id(upper));
@@ -1172,10 +1209,11 @@ static void alb_change_hw_addr_on_detach(struct bonding *bond, struct slave *sla
  */
 static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slave *slave)
 {
-        struct slave *tmp_slave1, *free_mac_slave = NULL;
         struct slave *has_bond_addr = bond->curr_active_slave;
+        struct slave *tmp_slave1, *free_mac_slave = NULL;
+        struct list_head *iter;
 
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 /* this is the first slave */
                 return 0;
         }
@@ -1196,7 +1234,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
         /* The slave's address is equal to the address of the bond.
          * Search for a spare address in the bond for this slave.
          */
-        bond_for_each_slave(bond, tmp_slave1) {
+        bond_for_each_slave(bond, tmp_slave1, iter) {
                 if (!bond_slave_has_mac(bond, tmp_slave1->perm_hwaddr)) {
                         /* no slave has tmp_slave1's perm addr
                          * as its curr addr
@@ -1246,15 +1284,16 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
  */
 static int alb_set_mac_address(struct bonding *bond, void *addr)
 {
-        char tmp_addr[ETH_ALEN];
-        struct slave *slave;
+        struct slave *slave, *rollback_slave;
+        struct list_head *iter;
         struct sockaddr sa;
+        char tmp_addr[ETH_ALEN];
         int res;
 
         if (bond->alb_info.rlb_enabled)
                 return 0;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 /* save net_device's current hw address */
                 memcpy(tmp_addr, slave->dev->dev_addr, ETH_ALEN);
 
@@ -1274,10 +1313,12 @@ unwind:
         sa.sa_family = bond->dev->type;
 
         /* unwind from head to the slave that failed */
-        bond_for_each_slave_continue_reverse(bond, slave) {
-                memcpy(tmp_addr, slave->dev->dev_addr, ETH_ALEN);
-                dev_set_mac_address(slave->dev, &sa);
-                memcpy(slave->dev->dev_addr, tmp_addr, ETH_ALEN);
+        bond_for_each_slave(bond, rollback_slave, iter) {
+                if (rollback_slave == slave)
+                        break;
+                memcpy(tmp_addr, rollback_slave->dev->dev_addr, ETH_ALEN);
+                dev_set_mac_address(rollback_slave->dev, &sa);
+                memcpy(rollback_slave->dev->dev_addr, tmp_addr, ETH_ALEN);
         }
 
         return res;
@@ -1337,11 +1378,6 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
         skb_reset_mac_header(skb);
         eth_data = eth_hdr(skb);
 
-        /* make sure that the curr_active_slave do not change during tx
-         */
-        read_lock(&bond->lock);
-        read_lock(&bond->curr_slave_lock);
-
         switch (ntohs(skb->protocol)) {
         case ETH_P_IP: {
                 const struct iphdr *iph = ip_hdr(skb);
@@ -1423,12 +1459,12 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
 
         if (!tx_slave) {
                 /* unbalanced or unassigned, send through primary */
-                tx_slave = bond->curr_active_slave;
+                tx_slave = rcu_dereference(bond->curr_active_slave);
                 bond_info->unbalanced_load += skb->len;
         }
 
         if (tx_slave && SLAVE_IS_OK(tx_slave)) {
-                if (tx_slave != bond->curr_active_slave) {
+                if (tx_slave != rcu_dereference(bond->curr_active_slave)) {
                         memcpy(eth_data->h_source,
                                tx_slave->dev->dev_addr,
                                ETH_ALEN);
@@ -1443,8 +1479,6 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
                 }
         }
 
-        read_unlock(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
         if (res) {
                 /* no suitable interface, frame not sent */
                 kfree_skb(skb);
@@ -1458,11 +1492,12 @@ void bond_alb_monitor(struct work_struct *work)
         struct bonding *bond = container_of(work, struct bonding,
                                             alb_work.work);
         struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
+        struct list_head *iter;
         struct slave *slave;
 
         read_lock(&bond->lock);
 
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 bond_info->tx_rebalance_counter = 0;
                 bond_info->lp_counter = 0;
                 goto re_arm;
@@ -1480,7 +1515,7 @@ void bond_alb_monitor(struct work_struct *work)
                  */
                 read_lock(&bond->curr_slave_lock);
 
-                bond_for_each_slave(bond, slave)
+                bond_for_each_slave(bond, slave, iter)
                         alb_send_learning_packets(slave, slave->dev->dev_addr);
 
                 read_unlock(&bond->curr_slave_lock);
@@ -1493,7 +1528,7 @@ void bond_alb_monitor(struct work_struct *work)
 
                 read_lock(&bond->curr_slave_lock);
 
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         tlb_clear_slave(bond, slave, 1);
                         if (slave == bond->curr_active_slave) {
                                 SLAVE_TLB_INFO(slave).load =
@@ -1599,13 +1634,13 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
  */
 void bond_alb_deinit_slave(struct bonding *bond, struct slave *slave)
 {
-        if (!list_empty(&bond->slave_list))
+        if (bond_has_slaves(bond))
                 alb_change_hw_addr_on_detach(bond, slave);
 
         tlb_clear_slave(bond, slave, 0);
 
         if (bond->alb_info.rlb_enabled) {
-                bond->alb_info.next_rx_slave = NULL;
+                bond->alb_info.rx_slave = NULL;
                 rlb_clear_slave(bond, slave);
         }
 }
@@ -1669,7 +1704,7 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
         swap_slave = bond->curr_active_slave;
         rcu_assign_pointer(bond->curr_active_slave, new_slave);
 
-        if (!new_slave || list_empty(&bond->slave_list))
+        if (!new_slave || !bond_has_slaves(bond))
                 return;
 
         /* set the new curr_active_slave to the bonds mac address
@@ -1692,6 +1727,23 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
 
         ASSERT_RTNL();
 
+        /* in TLB mode, the slave might flip down/up with the old dev_addr,
+         * and thus filter bond->dev_addr's packets, so force bond's mac
+         */
+        if (bond->params.mode == BOND_MODE_TLB) {
+                struct sockaddr sa;
+                u8 tmp_addr[ETH_ALEN];
+
+                memcpy(tmp_addr, new_slave->dev->dev_addr, ETH_ALEN);
+
+                memcpy(sa.sa_data, bond->dev->dev_addr, bond->dev->addr_len);
+                sa.sa_family = bond->dev->type;
+                /* we don't care if it can't change its mac, best effort */
+                dev_set_mac_address(new_slave->dev, &sa);
+
+                memcpy(new_slave->dev->dev_addr, tmp_addr, ETH_ALEN);
+        }
+
         /* curr_active_slave must be set before calling alb_swap_mac_addr */
         if (swap_slave) {
                 /* swap mac address */
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index c5eff5dafdfe..4226044efd08 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -154,9 +154,7 @@ struct alb_bond_info {
         u8                      rx_ntt; /* flag - need to transmit
                                          * to all rx clients
                                          */
-        struct slave            *next_rx_slave;/* next slave to be assigned
-                                                * to a new rx client for
-                                                */
+        struct slave            *rx_slave;/* last slave to xmit from */
         u8                      primary_is_promisc;        /* boolean */
         u32                     rlb_promisc_timeout_counter;/* counts primary
                                                              * promiscuity time
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e883bfe2e727..2daa066c6cdd 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -78,6 +78,7 @@
 #include <net/netns/generic.h>
 #include <net/pkt_sched.h>
 #include <linux/rculist.h>
+#include <net/flow_keys.h>
 #include "bonding.h"
 #include "bond_3ad.h"
 #include "bond_alb.h"
@@ -159,7 +160,8 @@ MODULE_PARM_DESC(min_links, "Minimum number of available links before turning on
 module_param(xmit_hash_policy, charp, 0);
 MODULE_PARM_DESC(xmit_hash_policy, "balance-xor and 802.3ad hashing method; "
                                    "0 for layer 2 (default), 1 for layer 3+4, "
-                                   "2 for layer 2+3");
+                                   "2 for layer 2+3, 3 for encap layer 2+3, "
+                                   "4 for encap layer 3+4");
 module_param(arp_interval, int, 0);
 MODULE_PARM_DESC(arp_interval, "arp interval in milliseconds");
 module_param_array(arp_ip_target, charp, NULL, 0);
@@ -217,6 +219,8 @@ const struct bond_parm_tbl xmit_hashtype_tbl[] = {
 {       "layer2",               BOND_XMIT_POLICY_LAYER2},
 {       "layer3+4",             BOND_XMIT_POLICY_LAYER34},
 {       "layer2+3",             BOND_XMIT_POLICY_LAYER23},
+{       "encap2+3",             BOND_XMIT_POLICY_ENCAP23},
+{       "encap3+4",             BOND_XMIT_POLICY_ENCAP34},
 {       NULL,                   -1},
 };
 
@@ -332,10 +336,11 @@ static int bond_vlan_rx_add_vid(struct net_device *bond_dev,
                                 __be16 proto, u16 vid)
 {
         struct bonding *bond = netdev_priv(bond_dev);
-        struct slave *slave;
+        struct slave *slave, *rollback_slave;
+        struct list_head *iter;
         int res;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 res = vlan_vid_add(slave->dev, proto, vid);
                 if (res)
                         goto unwind;
@@ -344,9 +349,13 @@ static int bond_vlan_rx_add_vid(struct net_device *bond_dev,
         return 0;
 
 unwind:
-        /* unwind from the slave that failed */
-        bond_for_each_slave_continue_reverse(bond, slave)
-                vlan_vid_del(slave->dev, proto, vid);
+        /* unwind to the slave that failed */
+        bond_for_each_slave(bond, rollback_slave, iter) {
+                if (rollback_slave == slave)
+                        break;
+
+                vlan_vid_del(rollback_slave->dev, proto, vid);
+        }
 
         return res;
 }
@@ -360,9 +369,10 @@ static int bond_vlan_rx_kill_vid(struct net_device *bond_dev,
                                  __be16 proto, u16 vid)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct list_head *iter;
         struct slave *slave;
 
-        bond_for_each_slave(bond, slave)
+        bond_for_each_slave(bond, slave, iter)
                 vlan_vid_del(slave->dev, proto, vid);
 
         if (bond_is_lb(bond))
@@ -382,15 +392,16 @@ static int bond_vlan_rx_kill_vid(struct net_device *bond_dev,
  */
 static int bond_set_carrier(struct bonding *bond)
 {
+        struct list_head *iter;
         struct slave *slave;
 
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto down;
 
         if (bond->params.mode == BOND_MODE_8023AD)
                 return bond_3ad_set_carrier(bond);
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (slave->link == BOND_LINK_UP) {
                         if (!netif_carrier_ok(bond->dev)) {
                                 netif_carrier_on(bond->dev);
@@ -522,7 +533,9 @@ static int bond_check_dev_link(struct bonding *bond,
  */
 static int bond_set_promiscuity(struct bonding *bond, int inc)
 {
+        struct list_head *iter;
         int err = 0;
+
         if (USES_PRIMARY(bond->params.mode)) {
                 /* write lock already acquired */
                 if (bond->curr_active_slave) {
@@ -532,7 +545,7 @@ static int bond_set_promiscuity(struct bonding *bond, int inc)
         } else {
                 struct slave *slave;
 
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         err = dev_set_promiscuity(slave->dev, inc);
                         if (err)
                                 return err;
@@ -546,7 +559,9 @@ static int bond_set_promiscuity(struct bonding *bond, int inc)
  */
 static int bond_set_allmulti(struct bonding *bond, int inc)
 {
+        struct list_head *iter;
         int err = 0;
+
         if (USES_PRIMARY(bond->params.mode)) {
                 /* write lock already acquired */
                 if (bond->curr_active_slave) {
@@ -556,7 +571,7 @@ static int bond_set_allmulti(struct bonding *bond, int inc)
         } else {
                 struct slave *slave;
 
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         err = dev_set_allmulti(slave->dev, inc);
                         if (err)
                                 return err;
@@ -774,43 +789,24 @@ static bool bond_should_change_active(struct bonding *bond)
 /**
  * find_best_interface - select the best available slave to be the active one
  * @bond: our bonding struct
- *
- * Warning: Caller must hold curr_slave_lock for writing.
  */
 static struct slave *bond_find_best_slave(struct bonding *bond)
 {
-        struct slave *new_active, *old_active;
-        struct slave *bestslave = NULL;
+        struct slave *slave, *bestslave = NULL;
+        struct list_head *iter;
         int mintime = bond->params.updelay;
-        int i;
-
-        new_active = bond->curr_active_slave;
 
-        if (!new_active) { /* there were no active slaves left */
-                new_active = bond_first_slave(bond);
-                if (!new_active)
-                        return NULL; /* still no slave, return NULL */
-        }
-
-        if ((bond->primary_slave) &&
-            bond->primary_slave->link == BOND_LINK_UP &&
-            bond_should_change_active(bond)) {
-                new_active = bond->primary_slave;
-        }
-
-        /* remember where to stop iterating over the slaves */
-        old_active = new_active;
-
-        bond_for_each_slave_from(bond, new_active, i, old_active) {
-                if (new_active->link == BOND_LINK_UP) {
-                        return new_active;
-                } else if (new_active->link == BOND_LINK_BACK &&
-                           IS_UP(new_active->dev)) {
-                        /* link up, but waiting for stabilization */
-                        if (new_active->delay < mintime) {
-                                mintime = new_active->delay;
-                                bestslave = new_active;
-                        }
+        if (bond->primary_slave && bond->primary_slave->link == BOND_LINK_UP &&
+            bond_should_change_active(bond))
+                return bond->primary_slave;
+
+        bond_for_each_slave(bond, slave, iter) {
+                if (slave->link == BOND_LINK_UP)
+                        return slave;
+                if (slave->link == BOND_LINK_BACK && IS_UP(slave->dev) &&
+                    slave->delay < mintime) {
+                        mintime = slave->delay;
+                        bestslave = slave;
                 }
         }
 
@@ -971,35 +967,6 @@ void bond_select_active_slave(struct bonding *bond)
         }
 }
 
-/*--------------------------- slave list handling ---------------------------*/
-
-/*
- * This function attaches the slave to the end of list.
- *
- * bond->lock held for writing by caller.
- */
-static void bond_attach_slave(struct bonding *bond, struct slave *new_slave)
-{
-        list_add_tail_rcu(&new_slave->list, &bond->slave_list);
-        bond->slave_cnt++;
-}
-
-/*
- * This function detaches the slave from the list.
- * WARNING: no check is made to verify if the slave effectively
- * belongs to <bond>.
- * Nothing is freed on return, structures are just unchained.
- * If any slave pointer in bond was pointing to <slave>,
- * it should be changed by the calling function.
- *
- * bond->lock held for writing by caller.
- */
-static void bond_detach_slave(struct bonding *bond, struct slave *slave)
-{
-        list_del_rcu(&slave->list);
-        bond->slave_cnt--;
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static inline int slave_enable_netpoll(struct slave *slave)
 {
@@ -1046,9 +1013,10 @@ static void bond_poll_controller(struct net_device *bond_dev)
 static void bond_netpoll_cleanup(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct list_head *iter;
         struct slave *slave;
 
-        bond_for_each_slave(bond, slave)
+        bond_for_each_slave(bond, slave, iter)
                 if (IS_UP(slave->dev))
                         slave_disable_netpoll(slave);
 }
@@ -1056,10 +1024,11 @@ static void bond_netpoll_cleanup(struct net_device *bond_dev)
 static int bond_netpoll_setup(struct net_device *dev, struct netpoll_info *ni, gfp_t gfp)
 {
         struct bonding *bond = netdev_priv(dev);
+        struct list_head *iter;
         struct slave *slave;
         int err = 0;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 err = slave_enable_netpoll(slave);
                 if (err) {
                         bond_netpoll_cleanup(dev);
@@ -1087,10 +1056,11 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
                                            netdev_features_t features)
 {
         struct bonding *bond = netdev_priv(dev);
+        struct list_head *iter;
         netdev_features_t mask;
         struct slave *slave;
 
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 /* Disable adding VLANs to empty bond. But why? --mq */
                 features |= NETIF_F_VLAN_CHALLENGED;
                 return features;
@@ -1100,7 +1070,7 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
         features &= ~NETIF_F_ONE_FOR_ALL;
         features |= NETIF_F_ALL_FOR_ALL;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 features = netdev_increment_features(features,
                                                      slave->dev->features,
                                                      mask);
@@ -1118,16 +1088,17 @@ static void bond_compute_features(struct bonding *bond)
 {
         unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
         netdev_features_t vlan_features = BOND_VLAN_FEATURES;
+        struct net_device *bond_dev = bond->dev;
+        struct list_head *iter;
+        struct slave *slave;
         unsigned short max_hard_header_len = ETH_HLEN;
         unsigned int gso_max_size = GSO_MAX_SIZE;
-        struct net_device *bond_dev = bond->dev;
         u16 gso_max_segs = GSO_MAX_SEGS;
-        struct slave *slave;
 
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto done;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 vlan_features = netdev_increment_features(vlan_features,
                         slave->dev->vlan_features, BOND_VLAN_FEATURES);
 
@@ -1233,11 +1204,12 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
 }
 
 static int bond_master_upper_dev_link(struct net_device *bond_dev,
-                                      struct net_device *slave_dev)
+                                      struct net_device *slave_dev,
+                                      struct slave *slave)
 {
         int err;
 
-        err = netdev_master_upper_dev_link(slave_dev, bond_dev);
+        err = netdev_master_upper_dev_link_private(slave_dev, bond_dev, slave);
         if (err)
                 return err;
         slave_dev->flags |= IFF_SLAVE;
@@ -1258,7 +1230,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
-        struct slave *new_slave = NULL;
+        struct slave *new_slave = NULL, *prev_slave;
         struct sockaddr addr;
         int link_reporting;
         int res = 0, i;
@@ -1313,7 +1285,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
          * bond ether type mutual exclusion - don't allow slaves of dissimilar
          * ether type (eg ARPHRD_ETHER and ARPHRD_INFINIBAND) share the same bond
          */
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 if (bond_dev->type != slave_dev->type) {
                         pr_debug("%s: change device type from %d to %d\n",
                                  bond_dev->name,
@@ -1352,7 +1324,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         }
 
         if (slave_ops->ndo_set_mac_address == NULL) {
-                if (list_empty(&bond->slave_list)) {
+                if (!bond_has_slaves(bond)) {
                         pr_warning("%s: Warning: The first slave device specified does not support setting the MAC address. Setting fail_over_mac to active.",
                                    bond_dev->name);
                         bond->params.fail_over_mac = BOND_FOM_ACTIVE;
@@ -1368,7 +1340,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         /* If this is the first slave, then we need to set the master's hardware
          * address to be the same as the slave's. */
-        if (list_empty(&bond->slave_list) &&
+        if (!bond_has_slaves(bond) &&
             bond->dev->addr_assign_type == NET_ADDR_RANDOM)
                 bond_set_dev_addr(bond->dev, slave_dev);
 
@@ -1377,7 +1349,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 res = -ENOMEM;
                 goto err_undo_flags;
         }
-        INIT_LIST_HEAD(&new_slave->list);
         /*
          * Set the new_slave's queue_id to be zero.  Queue ID mapping
          * is set via sysfs or module option if desired.
@@ -1413,17 +1384,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 }
         }
 
-        res = bond_master_upper_dev_link(bond_dev, slave_dev);
-        if (res) {
-                pr_debug("Error %d calling bond_master_upper_dev_link\n", res);
-                goto err_restore_mac;
-        }
-
         /* open the slave since the application closed it */
         res = dev_open(slave_dev);
         if (res) {
                 pr_debug("Opening slave %s failed\n", slave_dev->name);
-                goto err_unset_master;
+                goto err_restore_mac;
         }
 
         new_slave->bond = bond;
@@ -1479,21 +1444,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 goto err_close;
         }
 
-        write_lock_bh(&bond->lock);
-
-        bond_attach_slave(bond, new_slave);
+        prev_slave = bond_last_slave(bond);
 
         new_slave->delay = 0;
         new_slave->link_failure_count = 0;
 
-        write_unlock_bh(&bond->lock);
-
-        bond_compute_features(bond);
-
         bond_update_speed_duplex(new_slave);
 
-        read_lock(&bond->lock);
-
         new_slave->last_arp_rx = jiffies -
                 (msecs_to_jiffies(bond->params.arp_interval) + 1);
         for (i = 0; i < BOND_MAX_ARP_TARGETS; i++)
@@ -1554,12 +1511,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 }
         }
 
-        write_lock_bh(&bond->curr_slave_lock);
-
         switch (bond->params.mode) {
         case BOND_MODE_ACTIVEBACKUP:
                 bond_set_slave_inactive_flags(new_slave);
-                bond_select_active_slave(bond);
                 break;
         case BOND_MODE_8023AD:
                 /* in 802.3ad mode, the internal mechanism
@@ -1568,16 +1522,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                  */
                 bond_set_slave_inactive_flags(new_slave);
                 /* if this is the first slave */
-                if (bond_first_slave(bond) == new_slave) {
+                if (!prev_slave) {
                         SLAVE_AD_INFO(new_slave).id = 1;
                         /* Initialize AD with the number of times that the AD timer is called in 1 second
                          * can be called only after the mac address of the bond is set
                          */
                         bond_3ad_initialize(bond, 1000/AD_TIMER_INTERVAL);
                 } else {
-                        struct slave *prev_slave;
-
-                        prev_slave = bond_prev_slave(bond, new_slave);
                         SLAVE_AD_INFO(new_slave).id =
                                 SLAVE_AD_INFO(prev_slave).id + 1;
                 }
@@ -1588,7 +1539,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         case BOND_MODE_ALB:
                 bond_set_active_slave(new_slave);
                 bond_set_slave_inactive_flags(new_slave);
-                bond_select_active_slave(bond);
                 break;
         default:
                 pr_debug("This slave is always active in trunk mode\n");
@@ -1606,10 +1556,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 break;
         } /* switch(bond_mode) */
 
-        write_unlock_bh(&bond->curr_slave_lock);
-
-        bond_set_carrier(bond);
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
         slave_dev->npinfo = bond->dev->npinfo;
         if (slave_dev->npinfo) {
@@ -1624,17 +1570,29 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         }
 #endif
 
-        read_unlock(&bond->lock);
-
-        res = bond_create_slave_symlinks(bond_dev, slave_dev);
-        if (res)
-                goto err_detach;
-
         res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
                                          new_slave);
         if (res) {
                 pr_debug("Error %d calling netdev_rx_handler_register\n", res);
-                goto err_dest_symlinks;
+                goto err_detach;
+        }
+
+        res = bond_master_upper_dev_link(bond_dev, slave_dev, new_slave);
+        if (res) {
+                pr_debug("Error %d calling bond_master_upper_dev_link\n", res);
+                goto err_unregister;
+        }
+
+        bond->slave_cnt++;
+        bond_compute_features(bond);
+        bond_set_carrier(bond);
+
+        if (USES_PRIMARY(bond->params.mode)) {
+                read_lock(&bond->lock);
+                write_lock_bh(&bond->curr_slave_lock);
+                bond_select_active_slave(bond);
+                write_unlock_bh(&bond->curr_slave_lock);
+                read_unlock(&bond->lock);
         }
 
         pr_info("%s: enslaving %s as a%s interface with a%s link.\n",
@@ -1646,8 +1604,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         return 0;
 
 /* Undo stages on error */
-err_dest_symlinks:
-        bond_destroy_slave_symlinks(bond_dev, slave_dev);
+err_unregister:
+        netdev_rx_handler_unregister(slave_dev);
 
 err_detach:
         if (!USES_PRIMARY(bond->params.mode))
@@ -1655,7 +1613,6 @@ err_detach:
 
         vlan_vids_del_by_dev(slave_dev, bond_dev);
         write_lock_bh(&bond->lock);
-        bond_detach_slave(bond, new_slave);
         if (bond->primary_slave == new_slave)
                 bond->primary_slave = NULL;
         if (bond->curr_active_slave == new_slave) {
@@ -1675,9 +1632,6 @@ err_close:
         slave_dev->priv_flags &= ~IFF_BONDING;
         dev_close(slave_dev);
 
-err_unset_master:
-        bond_upper_dev_unlink(bond_dev, slave_dev);
-
 err_restore_mac:
         if (!bond->params.fail_over_mac) {
                 /* XXX TODO - fom follow mode needs to change master's
@@ -1696,9 +1650,8 @@ err_free:
         kfree(new_slave);
 
 err_undo_flags:
-        bond_compute_features(bond);
         /* Enslave of first slave has failed and we need to fix master's mac */
-        if (list_empty(&bond->slave_list) &&
+        if (!bond_has_slaves(bond) &&
             ether_addr_equal(bond_dev->dev_addr, slave_dev->dev_addr))
                 eth_hw_addr_random(bond_dev);
 
@@ -1749,6 +1702,11 @@ static int __bond_release_one(struct net_device *bond_dev,
         }
 
         write_unlock_bh(&bond->lock);
+
+        /* release the slave from its bond */
+        bond->slave_cnt--;
+
+        bond_upper_dev_unlink(bond_dev, slave_dev);
         /* unregister rx_handler early so bond_handle_frame wouldn't be called
          * for this slave anymore.
          */
@@ -1772,12 +1730,9 @@ static int __bond_release_one(struct net_device *bond_dev,
 
         bond->current_arp_slave = NULL;
 
-        /* release the slave from its bond */
-        bond_detach_slave(bond, slave);
-
         if (!all && !bond->params.fail_over_mac) {
                 if (ether_addr_equal(bond_dev->dev_addr, slave->perm_hwaddr) &&
-                    !list_empty(&bond->slave_list))
+                    bond_has_slaves(bond))
                         pr_warn("%s: Warning: the permanent HWaddr of %s - %pM - is still in use by %s. Set the HWaddr of %s to a different address to avoid conflicts.\n",
                                    bond_dev->name, slave_dev->name,
                                    slave->perm_hwaddr,
@@ -1820,7 +1775,7 @@ static int __bond_release_one(struct net_device *bond_dev,
                 write_lock_bh(&bond->lock);
         }
 
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 bond_set_carrier(bond);
                 eth_hw_addr_random(bond_dev);
 
@@ -1836,7 +1791,7 @@ static int __bond_release_one(struct net_device *bond_dev,
         unblock_netpoll_tx();
         synchronize_rcu();
 
-        if (list_empty(&bond->slave_list)) {
+        if (!bond_has_slaves(bond)) {
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
                 call_netdevice_notifiers(NETDEV_RELEASE, bond->dev);
         }
@@ -1848,8 +1803,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                         bond_dev->name, slave_dev->name, bond_dev->name);
 
         /* must do this from outside any spinlocks */
-        bond_destroy_slave_symlinks(bond_dev, slave_dev);
-
         vlan_vids_del_by_dev(slave_dev, bond_dev);
 
         /* If the mode USES_PRIMARY, then this cases was handled above by
@@ -1873,8 +1826,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                 bond_hw_addr_flush(bond_dev, slave_dev);
         }
 
-        bond_upper_dev_unlink(bond_dev, slave_dev);
-
         slave_disable_netpoll(slave);
 
         /* close slave before restoring its mac address */
@@ -1913,7 +1864,7 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
         int ret;
 
         ret = bond_release(bond_dev, slave_dev);
-        if (ret == 0 && list_empty(&bond->slave_list)) {
+        if (ret == 0 && !bond_has_slaves(bond)) {
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
                 pr_info("%s: destroying bond %s.\n",
                         bond_dev->name, bond_dev->name);
@@ -1922,61 +1873,6 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
         return ret;
 }
 
-/*
- * This function changes the active slave to slave <slave_dev>.
- * It returns -EINVAL in the following cases.
- *  - <slave_dev> is not found in the list.
- *  - There is not active slave now.
- *  - <slave_dev> is already active.
- *  - The link state of <slave_dev> is not BOND_LINK_UP.
- *  - <slave_dev> is not running.
- * In these cases, this function does nothing.
- * In the other cases, current_slave pointer is changed and 0 is returned.
- */
-static int bond_ioctl_change_active(struct net_device *bond_dev, struct net_device *slave_dev)
-{
-        struct bonding *bond = netdev_priv(bond_dev);
-        struct slave *old_active = NULL;
-        struct slave *new_active = NULL;
-        int res = 0;
-
-        if (!USES_PRIMARY(bond->params.mode))
-                return -EINVAL;
-
-        /* Verify that bond_dev is indeed the master of slave_dev */
-        if (!(slave_dev->flags & IFF_SLAVE) ||
-            !netdev_has_upper_dev(slave_dev, bond_dev))
-                return -EINVAL;
-
-        read_lock(&bond->lock);
-
-        old_active = bond->curr_active_slave;
-        new_active = bond_get_slave_by_dev(bond, slave_dev);
-        /*
-         * Changing to the current active: do nothing; return success.
-         */
-        if (new_active && new_active == old_active) {
-                read_unlock(&bond->lock);
-                return 0;
-        }
-
-        if (new_active &&
-            old_active &&
-            new_active->link == BOND_LINK_UP &&
-            IS_UP(new_active->dev)) {
-                block_netpoll_tx();
-                write_lock_bh(&bond->curr_slave_lock);
-                bond_change_active_slave(bond, new_active);
-                write_unlock_bh(&bond->curr_slave_lock);
-                unblock_netpoll_tx();
-        } else
-                res = -EINVAL;
-
-        read_unlock(&bond->lock);
-
-        return res;
-}
-
 static int bond_info_query(struct net_device *bond_dev, struct ifbond *info)
 {
         struct bonding *bond = netdev_priv(bond_dev);
@@ -1994,11 +1890,12 @@ static int bond_info_query(struct net_device *bond_dev, struct ifbond *info)
 static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *info)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct list_head *iter;
         int i = 0, res = -ENODEV;
         struct slave *slave;
 
         read_lock(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (i++ == (int)info->slave_id) {
                         res = 0;
                         strcpy(info->slave_name, slave->dev->name);
@@ -2019,12 +1916,13 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 static int bond_miimon_inspect(struct bonding *bond)
 {
         int link_state, commit = 0;
+        struct list_head *iter;
         struct slave *slave;
         bool ignore_updelay;
 
         ignore_updelay = !bond->curr_active_slave ? true : false;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 slave->new_link = BOND_LINK_NOCHANGE;
 
                 link_state = bond_check_dev_link(bond, slave->dev, 0);
@@ -2118,9 +2016,10 @@ static int bond_miimon_inspect(struct bonding *bond)
 
 static void bond_miimon_commit(struct bonding *bond)
 {
+        struct list_head *iter;
         struct slave *slave;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 switch (slave->new_link) {
                 case BOND_LINK_NOCHANGE:
                         continue;
@@ -2225,7 +2124,7 @@ void bond_mii_monitor(struct work_struct *work)
 
         delay = msecs_to_jiffies(bond->params.miimon);
 
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto re_arm;
 
         should_notify_peers = bond_should_notify_peers(bond);
@@ -2274,7 +2173,7 @@ static bool bond_has_this_ip(struct bonding *bond, __be32 ip)
                 return true;
 
         rcu_read_lock();
-        netdev_for_each_upper_dev_rcu(bond->dev, upper, iter) {
+        netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
                 if (ip == bond_confirm_addr(upper, 0, ip)) {
                         ret = true;
                         break;
@@ -2349,10 +2248,12 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                  *
                  * TODO: QinQ?
                  */
-                netdev_for_each_upper_dev_rcu(bond->dev, vlan_upper, vlan_iter) {
+                netdev_for_each_all_upper_dev_rcu(bond->dev, vlan_upper,
+                                                  vlan_iter) {
                         if (!is_vlan_dev(vlan_upper))
                                 continue;
-                        netdev_for_each_upper_dev_rcu(vlan_upper, upper, iter) {
+                        netdev_for_each_all_upper_dev_rcu(vlan_upper, upper,
+                                                          iter) {
                                 if (upper == rt->dst.dev) {
                                         vlan_id = vlan_dev_vlan_id(vlan_upper);
                                         rcu_read_unlock();
@@ -2365,7 +2266,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                  * our upper vlans, then just search for any dev that
                  * matches, and in case it's a vlan - save the id
                  */
-                netdev_for_each_upper_dev_rcu(bond->dev, upper, iter) {
+                netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
                         if (upper == rt->dst.dev) {
                                 /* if it's a vlan - get its VID */
                                 if (is_vlan_dev(upper))
@@ -2512,11 +2413,12 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
         struct bonding *bond = container_of(work, struct bonding,
                                             arp_work.work);
         struct slave *slave, *oldcurrent;
+        struct list_head *iter;
         int do_failover = 0;
 
         read_lock(&bond->lock);
 
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto re_arm;
 
         oldcurrent = bond->curr_active_slave;
@@ -2528,7 +2430,7 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
          * TODO: what about up/down delay in arp mode? it wasn't here before
          *       so it can wait
          */
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 unsigned long trans_start = dev_trans_start(slave->dev);
 
                 if (slave->link != BOND_LINK_UP) {
@@ -2619,10 +2521,11 @@ re_arm:
 static int bond_ab_arp_inspect(struct bonding *bond)
 {
         unsigned long trans_start, last_rx;
+        struct list_head *iter;
         struct slave *slave;
         int commit = 0;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 slave->new_link = BOND_LINK_NOCHANGE;
                 last_rx = slave_last_rx(bond, slave);
 
@@ -2689,9 +2592,10 @@ static int bond_ab_arp_inspect(struct bonding *bond)
 static void bond_ab_arp_commit(struct bonding *bond)
 {
         unsigned long trans_start;
+        struct list_head *iter;
         struct slave *slave;
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 switch (slave->new_link) {
                 case BOND_LINK_NOCHANGE:
                         continue;
@@ -2762,8 +2666,9 @@ do_failover:
  */
 static void bond_ab_arp_probe(struct bonding *bond)
 {
-        struct slave *slave, *next_slave;
-        int i;
+        struct slave *slave, *before = NULL, *new_slave = NULL;
+        struct list_head *iter;
+        bool found = false;
 
         read_lock(&bond->curr_slave_lock);
 
@@ -2793,18 +2698,12 @@ static void bond_ab_arp_probe(struct bonding *bond)
 
         bond_set_slave_inactive_flags(bond->current_arp_slave);
 
-        /* search for next candidate */
-        next_slave = bond_next_slave(bond, bond->current_arp_slave);
-        bond_for_each_slave_from(bond, slave, i, next_slave) {
-                if (IS_UP(slave->dev)) {
-                        slave->link = BOND_LINK_BACK;
-                        bond_set_slave_active_flags(slave);
-                        bond_arp_send_all(bond, slave);
-                        slave->jiffies = jiffies;
-                        bond->current_arp_slave = slave;
-                        break;
-                }
+        bond_for_each_slave(bond, slave, iter) {
+                if (!found && !before && IS_UP(slave->dev))
+                        before = slave;
 
+                if (found && !new_slave && IS_UP(slave->dev))
+                        new_slave = slave;
                 /* if the link state is up at this point, we
                  * mark it down - this can happen if we have
                  * simultaneous link failures and
@@ -2812,7 +2711,7 @@ static void bond_ab_arp_probe(struct bonding *bond)
                  * one the current slave so it is still marked
                  * up when it is actually down
                  */
-                if (slave->link == BOND_LINK_UP) {
+                if (!IS_UP(slave->dev) && slave->link == BOND_LINK_UP) {
                         slave->link = BOND_LINK_DOWN;
                         if (slave->link_failure_count < UINT_MAX)
                                 slave->link_failure_count++;
@@ -2822,7 +2721,22 @@ static void bond_ab_arp_probe(struct bonding *bond)
                         pr_info("%s: backup interface %s is now down.\n",
                                 bond->dev->name, slave->dev->name);
                 }
+                if (slave == bond->current_arp_slave)
+                        found = true;
         }
+
+        if (!new_slave && before)
+                new_slave = before;
+
+        if (!new_slave)
+                return;
+
+        new_slave->link = BOND_LINK_BACK;
+        bond_set_slave_active_flags(new_slave);
+        bond_arp_send_all(bond, new_slave);
+        new_slave->jiffies = jiffies;
+        bond->current_arp_slave = new_slave;
+
 }
 
 void bond_activebackup_arp_mon(struct work_struct *work)
@@ -2836,7 +2750,7 @@ void bond_activebackup_arp_mon(struct work_struct *work)
 
         delta_in_ticks = msecs_to_jiffies(bond->params.arp_interval);
 
-        if (list_empty(&bond->slave_list))
+        if (!bond_has_slaves(bond))
                 goto re_arm;
 
         should_notify_peers = bond_should_notify_peers(bond);
@@ -3033,99 +2947,85 @@ static struct notifier_block bond_netdev_notifier = {
 
 /*---------------------------- Hashing Policies -----------------------------*/
 
-/*
- * Hash for the output device based upon layer 2 data
- */
-static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
+/* L2 hash helper */
+static inline u32 bond_eth_hash(struct sk_buff *skb)
 {
         struct ethhdr *data = (struct ethhdr *)skb->data;
 
         if (skb_headlen(skb) >= offsetof(struct ethhdr, h_proto))
-                return (data->h_dest[5] ^ data->h_source[5]) % count;
+                return data->h_dest[5] ^ data->h_source[5];
 
         return 0;
 }
 
-/*
- * Hash for the output device based upon layer 2 and layer 3 data. If
- * the packet is not IP, fall back on bond_xmit_hash_policy_l2()
- */
-static int bond_xmit_hash_policy_l23(struct sk_buff *skb, int count)
+/* Extract the appropriate headers based on bond's xmit policy */
+static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb,
+                              struct flow_keys *fk)
 {
-        const struct ethhdr *data;
+        const struct ipv6hdr *iph6;
         const struct iphdr *iph;
-        const struct ipv6hdr *ipv6h;
-        u32 v6hash;
-        const __be32 *s, *d;
+        int noff, proto = -1;
 
-        if (skb->protocol == htons(ETH_P_IP) &&
-            pskb_network_may_pull(skb, sizeof(*iph))) {
+        if (bond->params.xmit_policy > BOND_XMIT_POLICY_LAYER23)
+                return skb_flow_dissect(skb, fk);
+
+        fk->ports = 0;
+        noff = skb_network_offset(skb);
+        if (skb->protocol == htons(ETH_P_IP)) {
+                if (!pskb_may_pull(skb, noff + sizeof(*iph)))
+                        return false;
                 iph = ip_hdr(skb);
-                data = (struct ethhdr *)skb->data;
-                return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
-                        (data->h_dest[5] ^ data->h_source[5])) % count;
-        } else if (skb->protocol == htons(ETH_P_IPV6) &&
-                   pskb_network_may_pull(skb, sizeof(*ipv6h))) {
-                ipv6h = ipv6_hdr(skb);
-                data = (struct ethhdr *)skb->data;
-                s = &ipv6h->saddr.s6_addr32[0];
-                d = &ipv6h->daddr.s6_addr32[0];
-                v6hash = (s[1] ^ d[1]) ^ (s[2] ^ d[2]) ^ (s[3] ^ d[3]);
-                v6hash ^= (v6hash >> 24) ^ (v6hash >> 16) ^ (v6hash >> 8);
-                return (v6hash ^ data->h_dest[5] ^ data->h_source[5]) % count;
-        }
-
-        return bond_xmit_hash_policy_l2(skb, count);
+                fk->src = iph->saddr;
+                fk->dst = iph->daddr;
+                noff += iph->ihl << 2;
+                if (!ip_is_fragment(iph))
+                        proto = iph->protocol;
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                if (!pskb_may_pull(skb, noff + sizeof(*iph6)))
+                        return false;
+                iph6 = ipv6_hdr(skb);
+                fk->src = (__force __be32)ipv6_addr_hash(&iph6->saddr);
+                fk->dst = (__force __be32)ipv6_addr_hash(&iph6->daddr);
+                noff += sizeof(*iph6);
+                proto = iph6->nexthdr;
+        } else {
+                return false;
+        }
+        if (bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER34 && proto >= 0)
+                fk->ports = skb_flow_get_ports(skb, noff, proto);
+
+        return true;
 }
 
-/*
- * Hash for the output device based upon layer 3 and layer 4 data. If
- * the packet is a frag or not TCP or UDP, just use layer 3 data.  If it is
- * altogether not IP, fall back on bond_xmit_hash_policy_l2()
+/**
+ * bond_xmit_hash - generate a hash value based on the xmit policy
+ * @bond: bonding device
+ * @skb: buffer to use for headers
+ * @count: modulo value
+ *
+ * This function will extract the necessary headers from the skb buffer and use
+ * them to generate a hash based on the xmit_policy set in the bonding device
+ * which will be reduced modulo count before returning.
  */
-static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
+int bond_xmit_hash(struct bonding *bond, struct sk_buff *skb, int count)
 {
-        u32 layer4_xor = 0;
-        const struct iphdr *iph;
-        const struct ipv6hdr *ipv6h;
-        const __be32 *s, *d;
-        const __be16 *l4 = NULL;
-        __be16 _l4[2];
-        int noff = skb_network_offset(skb);
-        int poff;
-
-        if (skb->protocol == htons(ETH_P_IP) &&
-            pskb_may_pull(skb, noff + sizeof(*iph))) {
-                iph = ip_hdr(skb);
-                poff = proto_ports_offset(iph->protocol);
+        struct flow_keys flow;
+        u32 hash;
 
-                if (!ip_is_fragment(iph) && poff >= 0) {
-                        l4 = skb_header_pointer(skb, noff + (iph->ihl << 2) + poff,
-                                                sizeof(_l4), &_l4);
-                        if (l4)
-                                layer4_xor = ntohs(l4[0] ^ l4[1]);
-                }
-                return (layer4_xor ^
-                        ((ntohl(iph->saddr ^ iph->daddr)) & 0xffff)) % count;
-        } else if (skb->protocol == htons(ETH_P_IPV6) &&
-                   pskb_may_pull(skb, noff + sizeof(*ipv6h))) {
-                ipv6h = ipv6_hdr(skb);
-                poff = proto_ports_offset(ipv6h->nexthdr);
-                if (poff >= 0) {
-                        l4 = skb_header_pointer(skb, noff + sizeof(*ipv6h) + poff,
-                                                sizeof(_l4), &_l4);
-                        if (l4)
-                                layer4_xor = ntohs(l4[0] ^ l4[1]);
-                }
-                s = &ipv6h->saddr.s6_addr32[0];
-                d = &ipv6h->daddr.s6_addr32[0];
-                layer4_xor ^= (s[1] ^ d[1]) ^ (s[2] ^ d[2]) ^ (s[3] ^ d[3]);
-                layer4_xor ^= (layer4_xor >> 24) ^ (layer4_xor >> 16) ^
-                               (layer4_xor >> 8);
-                return layer4_xor % count;
-        }
+        if (bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER2 ||
+            !bond_flow_dissect(bond, skb, &flow))
+                return bond_eth_hash(skb) % count;
+
+        if (bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER23 ||
+            bond->params.xmit_policy == BOND_XMIT_POLICY_ENCAP23)
+                hash = bond_eth_hash(skb);
+        else
+                hash = (__force u32)flow.ports;
+        hash ^= (__force u32)flow.dst ^ (__force u32)flow.src;
+        hash ^= (hash >> 16);
+        hash ^= (hash >> 8);
 
-        return bond_xmit_hash_policy_l2(skb, count);
+        return hash % count;
 }
 
 /*-------------------------- Device entry points ----------------------------*/
@@ -3155,13 +3055,14 @@ static void bond_work_cancel_all(struct bonding *bond)
 static int bond_open(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct list_head *iter;
         struct slave *slave;
 
         /* reset slave->backup and slave->inactive */
         read_lock(&bond->lock);
-        if (!list_empty(&bond->slave_list)) {
+        if (bond_has_slaves(bond)) {
                 read_lock(&bond->curr_slave_lock);
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                                 && (slave != bond->curr_active_slave)) {
                                 bond_set_slave_inactive_flags(slave);
@@ -3221,12 +3122,13 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct rtnl_link_stats64 temp;
+        struct list_head *iter;
         struct slave *slave;
 
         memset(stats, 0, sizeof(*stats));
 
         read_lock_bh(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 const struct rtnl_link_stats64 *sstats =
                         dev_get_stats(slave->dev, &temp);
 
@@ -3263,6 +3165,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
 
 static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd)
 {
+        struct bonding *bond = netdev_priv(bond_dev);
         struct net_device *slave_dev = NULL;
         struct ifbond k_binfo;
         struct ifbond __user *u_binfo = NULL;
@@ -3293,7 +3196,6 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
 
 
                 if (mii->reg_num == 1) {
-                        struct bonding *bond = netdev_priv(bond_dev);
                         mii->val_out = 0;
                         read_lock(&bond->lock);
                         read_lock(&bond->curr_slave_lock);
@@ -3365,7 +3267,7 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
                         break;
                 case BOND_CHANGE_ACTIVE_OLD:
                 case SIOCBONDCHANGEACTIVE:
-                        res = bond_ioctl_change_active(bond_dev, slave_dev);
+                        res = bond_option_active_slave_set(bond, slave_dev);
                         break;
                 default:
                         res = -EOPNOTSUPP;
@@ -3393,22 +3295,24 @@ static void bond_change_rx_flags(struct net_device *bond_dev, int change)
 static void bond_set_rx_mode(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct list_head *iter;
         struct slave *slave;
 
-        ASSERT_RTNL();
 
+        rcu_read_lock();
         if (USES_PRIMARY(bond->params.mode)) {
-                slave = rtnl_dereference(bond->curr_active_slave);
+                slave = rcu_dereference(bond->curr_active_slave);
                 if (slave) {
                         dev_uc_sync(slave->dev, bond_dev);
                         dev_mc_sync(slave->dev, bond_dev);
                 }
         } else {
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave_rcu(bond, slave, iter) {
                         dev_uc_sync_multiple(slave->dev, bond_dev);
                         dev_mc_sync_multiple(slave->dev, bond_dev);
                 }
         }
+        rcu_read_unlock();
 }
 
 static int bond_neigh_init(struct neighbour *n)
@@ -3471,7 +3375,8 @@ static int bond_neigh_setup(struct net_device *dev,
 static int bond_change_mtu(struct net_device *bond_dev, int new_mtu)
 {
         struct bonding *bond = netdev_priv(bond_dev);
-        struct slave *slave;
+        struct slave *slave, *rollback_slave;
+        struct list_head *iter;
         int res = 0;
 
         pr_debug("bond=%p, name=%s, new_mtu=%d\n", bond,
@@ -3492,10 +3397,9 @@ static int bond_change_mtu(struct net_device *bond_dev, int new_mtu)
          * call to the base driver.
          */
 
-        bond_for_each_slave(bond, slave) {
-                pr_debug("s %p s->p %p c_m %p\n",
+        bond_for_each_slave(bond, slave, iter) {
+                pr_debug("s %p c_m %p\n",
                          slave,
-                         bond_prev_slave(bond, slave),
                          slave->dev->netdev_ops->ndo_change_mtu);
 
                 res = dev_set_mtu(slave->dev, new_mtu);
@@ -3520,13 +3424,16 @@ static int bond_change_mtu(struct net_device *bond_dev, int new_mtu)
 
 unwind:
         /* unwind from head to the slave that failed */
-        bond_for_each_slave_continue_reverse(bond, slave) {
+        bond_for_each_slave(bond, rollback_slave, iter) {
                 int tmp_res;
 
-                tmp_res = dev_set_mtu(slave->dev, bond_dev->mtu);
+                if (rollback_slave == slave)
+                        break;
+
+                tmp_res = dev_set_mtu(rollback_slave->dev, bond_dev->mtu);
                 if (tmp_res) {
                         pr_debug("unwind err %d dev %s\n",
-                                 tmp_res, slave->dev->name);
+                                 tmp_res, rollback_slave->dev->name);
                 }
         }
 
@@ -3543,8 +3450,9 @@ unwind:
 static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave, *rollback_slave;
         struct sockaddr *sa = addr, tmp_sa;
-        struct slave *slave;
+        struct list_head *iter;
         int res = 0;
 
         if (bond->params.mode == BOND_MODE_ALB)
@@ -3578,7 +3486,7 @@ static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
          * call to the base driver.
          */
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 const struct net_device_ops *slave_ops = slave->dev->netdev_ops;
                 pr_debug("slave %p %s\n", slave, slave->dev->name);
 
@@ -3610,13 +3518,16 @@ unwind:
         tmp_sa.sa_family = bond_dev->type;
 
         /* unwind from head to the slave that failed */
-        bond_for_each_slave_continue_reverse(bond, slave) {
+        bond_for_each_slave(bond, rollback_slave, iter) {
                 int tmp_res;
 
-                tmp_res = dev_set_mac_address(slave->dev, &tmp_sa);
+                if (rollback_slave == slave)
+                        break;
+
+                tmp_res = dev_set_mac_address(rollback_slave->dev, &tmp_sa);
                 if (tmp_res) {
                         pr_debug("unwind err %d dev %s\n",
-                                 tmp_res, slave->dev->name);
+                                 tmp_res, rollback_slave->dev->name);
                 }
         }
 
@@ -3635,11 +3546,12 @@ unwind:
  */
 void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id)
 {
+        struct list_head *iter;
         struct slave *slave;
         int i = slave_id;
 
         /* Here we start from the slave with slave_id */
-        bond_for_each_slave_rcu(bond, slave) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (--i < 0) {
                         if (slave_can_tx(slave)) {
                                 bond_dev_queue_xmit(bond, skb, slave->dev);
@@ -3650,7 +3562,7 @@ void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id)
 
         /* Here we start from the first slave up to slave_id */
         i = slave_id;
-        bond_for_each_slave_rcu(bond, slave) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (--i < 0)
                         break;
                 if (slave_can_tx(slave)) {
@@ -3707,8 +3619,7 @@ static int bond_xmit_activebackup(struct sk_buff *skb, struct net_device *bond_d
         return NETDEV_TX_OK;
 }
 
-/*
- * In bond_xmit_xor() , we determine the output device by using a pre-
+/* In bond_xmit_xor() , we determine the output device by using a pre-
  * determined xmit_hash_policy(), If the selected device is not enabled,
  * find the next active slave.
  */
@@ -3716,8 +3627,7 @@ static int bond_xmit_xor(struct sk_buff *skb, struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
 
-        bond_xmit_slave_id(bond, skb,
-                           bond->xmit_hash_policy(skb, bond->slave_cnt));
+        bond_xmit_slave_id(bond, skb, bond_xmit_hash(bond, skb, bond->slave_cnt));
 
         return NETDEV_TX_OK;
 }
@@ -3727,8 +3637,9 @@ static int bond_xmit_broadcast(struct sk_buff *skb, struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave = NULL;
+        struct list_head *iter;
 
-        bond_for_each_slave_rcu(bond, slave) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (bond_is_last_slave(bond, slave))
                         break;
                 if (IS_UP(slave->dev) && slave->link == BOND_LINK_UP) {
@@ -3753,22 +3664,6 @@ static int bond_xmit_broadcast(struct sk_buff *skb, struct net_device *bond_dev)
 
 /*------------------------- Device initialization ---------------------------*/
 
-static void bond_set_xmit_hash_policy(struct bonding *bond)
-{
-        switch (bond->params.xmit_policy) {
-        case BOND_XMIT_POLICY_LAYER23:
-                bond->xmit_hash_policy = bond_xmit_hash_policy_l23;
-                break;
-        case BOND_XMIT_POLICY_LAYER34:
-                bond->xmit_hash_policy = bond_xmit_hash_policy_l34;
-                break;
-        case BOND_XMIT_POLICY_LAYER2:
-        default:
-                bond->xmit_hash_policy = bond_xmit_hash_policy_l2;
-                break;
-        }
-}
-
 /*
  * Lookup the slave that corresponds to a qid
  */
@@ -3777,13 +3672,14 @@ static inline int bond_slave_override(struct bonding *bond,
 {
         struct slave *slave = NULL;
         struct slave *check_slave;
+        struct list_head *iter;
         int res = 1;
 
         if (!skb->queue_mapping)
                 return 1;
 
         /* Find out if any slaves have the same mapping as this skb. */
-        bond_for_each_slave_rcu(bond, check_slave) {
+        bond_for_each_slave_rcu(bond, check_slave, iter) {
                 if (check_slave->queue_id == skb->queue_mapping) {
                         slave = check_slave;
                         break;
@@ -3869,7 +3765,7 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
 
         rcu_read_lock();
-        if (!list_empty(&bond->slave_list))
+        if (bond_has_slaves(bond))
                 ret = __bond_start_xmit(skb, dev);
         else
                 kfree_skb(skb);
@@ -3878,43 +3774,12 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return ret;
 }
 
-/*
- * set bond mode specific net device operations
- */
-void bond_set_mode_ops(struct bonding *bond, int mode)
-{
-        struct net_device *bond_dev = bond->dev;
-
-        switch (mode) {
-        case BOND_MODE_ROUNDROBIN:
-                break;
-        case BOND_MODE_ACTIVEBACKUP:
-                break;
-        case BOND_MODE_XOR:
-                bond_set_xmit_hash_policy(bond);
-                break;
-        case BOND_MODE_BROADCAST:
-                break;
-        case BOND_MODE_8023AD:
-                bond_set_xmit_hash_policy(bond);
-                break;
-        case BOND_MODE_ALB:
-                /* FALLTHRU */
-        case BOND_MODE_TLB:
-                break;
-        default:
-                /* Should never happen, mode already checked */
-                pr_err("%s: Error: Unknown bonding mode %d\n",
-                       bond_dev->name, mode);
-                break;
-        }
-}
-
 static int bond_ethtool_get_settings(struct net_device *bond_dev,
                                      struct ethtool_cmd *ecmd)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         unsigned long speed = 0;
+        struct list_head *iter;
         struct slave *slave;
 
         ecmd->duplex = DUPLEX_UNKNOWN;
@@ -3926,7 +3791,7 @@ static int bond_ethtool_get_settings(struct net_device *bond_dev,
          * this is an accurate maximum.
          */
         read_lock(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (SLAVE_IS_OK(slave)) {
                         if (slave->speed != SPEED_UNKNOWN)
                                 speed += slave->speed;
@@ -3994,14 +3859,13 @@ static void bond_destructor(struct net_device *bond_dev)
         free_netdev(bond_dev);
 }
 
-static void bond_setup(struct net_device *bond_dev)
+void bond_setup(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
 
         /* initialize rwlocks */
         rwlock_init(&bond->lock);
         rwlock_init(&bond->curr_slave_lock);
-        INIT_LIST_HEAD(&bond->slave_list);
         bond->params = bonding_defaults;
 
         /* Initialize pointers */
@@ -4011,7 +3875,6 @@ static void bond_setup(struct net_device *bond_dev)
         ether_setup(bond_dev);
         bond_dev->netdev_ops = &bond_netdev_ops;
         bond_dev->ethtool_ops = &bond_ethtool_ops;
-        bond_set_mode_ops(bond, bond->params.mode);
 
         bond_dev->destructor = bond_destructor;
 
@@ -4057,12 +3920,13 @@ static void bond_setup(struct net_device *bond_dev)
 static void bond_uninit(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
-        struct slave *slave, *tmp_slave;
+        struct list_head *iter;
+        struct slave *slave;
 
         bond_netpoll_cleanup(bond_dev);
 
         /* Release the bonded slaves */
-        list_for_each_entry_safe(slave, tmp_slave, &bond->slave_list, list)
+        bond_for_each_slave(bond, slave, iter)
                 __bond_release_one(bond_dev, slave->dev, true);
         pr_info("%s: released all slaves\n", bond_dev->name);
 
@@ -4495,32 +4359,11 @@ static int bond_init(struct net_device *bond_dev)
         return 0;
 }
 
-static int bond_validate(struct nlattr *tb[], struct nlattr *data[])
-{
-        if (tb[IFLA_ADDRESS]) {
-                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
-                        return -EINVAL;
-                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
-                        return -EADDRNOTAVAIL;
-        }
-        return 0;
-}
-
-static unsigned int bond_get_num_tx_queues(void)
+unsigned int bond_get_num_tx_queues(void)
 {
         return tx_queues;
 }
 
-static struct rtnl_link_ops bond_link_ops __read_mostly = {
-        .kind                   = "bond",
-        .priv_size              = sizeof(struct bonding),
-        .setup                  = bond_setup,
-        .validate               = bond_validate,
-        .get_num_tx_queues      = bond_get_num_tx_queues,
-        .get_num_rx_queues      = bond_get_num_tx_queues, /* Use the same number
-                                                             as for TX queues */
-};
-
 /* Create a new bond based on the specified name and bonding parameters.
  * If name is NULL, obtain a suitable "bond%d" name for us.
  * Caller must NOT hold rtnl_lock; we need to release it here before we
@@ -4607,7 +4450,7 @@ static int __init bonding_init(void)
         if (res)
                 goto out;
 
-        res = rtnl_link_register(&bond_link_ops);
+        res = bond_netlink_init();
         if (res)
                 goto err_link;
 
@@ -4623,7 +4466,7 @@ static int __init bonding_init(void)
 out:
         return res;
 err:
-        rtnl_link_unregister(&bond_link_ops);
+        bond_netlink_fini();
 err_link:
         unregister_pernet_subsys(&bond_net_ops);
         goto out;
@@ -4636,7 +4479,7 @@ static void __exit bonding_exit(void)
 
         bond_destroy_debugfs();
 
-        rtnl_link_unregister(&bond_link_ops);
+        bond_netlink_fini();
         unregister_pernet_subsys(&bond_net_ops);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -4653,4 +4496,3 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DESCRIPTION(DRV_DESCRIPTION ", v" DRV_VERSION);
 MODULE_AUTHOR("Thomas Davis, tadavis@lbl.gov and many others");
-MODULE_ALIAS_RTNL_LINK("bond");
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
new file mode 100644
index 000000000000..7661261de2f0
--- /dev/null
+++ b/drivers/net/bonding/bond_netlink.c
@@ -0,0 +1,131 @@
+/*
+ * drivers/net/bond/bond_netlink.c - Netlink interface for bonding
+ * Copyright (c) 2013 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_link.h>
+#include <linux/if_ether.h>
+#include <net/netlink.h>
+#include <net/rtnetlink.h>
+#include "bonding.h"
+
+static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = {
+        [IFLA_BOND_MODE]                = { .type = NLA_U8 },
+        [IFLA_BOND_ACTIVE_SLAVE]        = { .type = NLA_U32 },
+};
+
+static int bond_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        if (tb[IFLA_ADDRESS]) {
+                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+                        return -EINVAL;
+                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
+                        return -EADDRNOTAVAIL;
+        }
+        return 0;
+}
+
+static int bond_changelink(struct net_device *bond_dev,
+                           struct nlattr *tb[], struct nlattr *data[])
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+        int err;
+
+        if (data && data[IFLA_BOND_MODE]) {
+                int mode = nla_get_u8(data[IFLA_BOND_MODE]);
+
+                err = bond_option_mode_set(bond, mode);
+                if (err)
+                        return err;
+        }
+        if (data && data[IFLA_BOND_ACTIVE_SLAVE]) {
+                int ifindex = nla_get_u32(data[IFLA_BOND_ACTIVE_SLAVE]);
+                struct net_device *slave_dev;
+
+                if (ifindex == 0) {
+                        slave_dev = NULL;
+                } else {
+                        slave_dev = __dev_get_by_index(dev_net(bond_dev),
+                                                       ifindex);
+                        if (!slave_dev)
+                                return -ENODEV;
+                }
+                err = bond_option_active_slave_set(bond, slave_dev);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
+                        struct nlattr *tb[], struct nlattr *data[])
+{
+        int err;
+
+        err = bond_changelink(bond_dev, tb, data);
+        if (err < 0)
+                return err;
+
+        return register_netdevice(bond_dev);
+}
+
+static size_t bond_get_size(const struct net_device *bond_dev)
+{
+        return nla_total_size(sizeof(u8));      /* IFLA_BOND_MODE */
+                + nla_total_size(sizeof(u32));  /* IFLA_BOND_ACTIVE_SLAVE */
+}
+
+static int bond_fill_info(struct sk_buff *skb,
+                          const struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+        struct net_device *slave_dev = bond_option_active_slave_get(bond);
+
+        if (nla_put_u8(skb, IFLA_BOND_MODE, bond->params.mode) ||
+            (slave_dev &&
+             nla_put_u32(skb, IFLA_BOND_ACTIVE_SLAVE, slave_dev->ifindex)))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
+struct rtnl_link_ops bond_link_ops __read_mostly = {
+        .kind                   = "bond",
+        .priv_size              = sizeof(struct bonding),
+        .setup                  = bond_setup,
+        .maxtype                = IFLA_BOND_MAX,
+        .policy                 = bond_policy,
+        .validate               = bond_validate,
+        .newlink                = bond_newlink,
+        .changelink             = bond_changelink,
+        .get_size               = bond_get_size,
+        .fill_info              = bond_fill_info,
+        .get_num_tx_queues      = bond_get_num_tx_queues,
+        .get_num_rx_queues      = bond_get_num_tx_queues, /* Use the same number
+                                                             as for TX queues */
+};
+
+int __init bond_netlink_init(void)
+{
+        return rtnl_link_register(&bond_link_ops);
+}
+
+void bond_netlink_fini(void)
+{
+        rtnl_link_unregister(&bond_link_ops);
+}
+
+MODULE_ALIAS_RTNL_LINK("bond");
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
new file mode 100644
index 000000000000..9a5223c7b4d1
--- /dev/null
+++ b/drivers/net/bonding/bond_options.c
@@ -0,0 +1,142 @@
+/*
+ * drivers/net/bond/bond_options.c - bonding options
+ * Copyright (c) 2013 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/errno.h>
+#include <linux/if.h>
+#include <linux/netdevice.h>
+#include <linux/rwlock.h>
+#include <linux/rcupdate.h>
+#include "bonding.h"
+
+static bool bond_mode_is_valid(int mode)
+{
+        int i;
+
+        for (i = 0; bond_mode_tbl[i].modename; i++);
+
+        return mode >= 0 && mode < i;
+}
+
+int bond_option_mode_set(struct bonding *bond, int mode)
+{
+        if (!bond_mode_is_valid(mode)) {
+                pr_err("invalid mode value %d.\n", mode);
+                return -EINVAL;
+        }
+
+        if (bond->dev->flags & IFF_UP) {
+                pr_err("%s: unable to update mode because interface is up.\n",
+                       bond->dev->name);
+                return -EPERM;
+        }
+
+        if (bond_has_slaves(bond)) {
+                pr_err("%s: unable to update mode because bond has slaves.\n",
+                        bond->dev->name);
+                return -EPERM;
+        }
+
+        if (BOND_MODE_IS_LB(mode) && bond->params.arp_interval) {
+                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
+                       bond->dev->name, bond_mode_tbl[mode].modename);
+                return -EINVAL;
+        }
+
+        /* don't cache arp_validate between modes */
+        bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
+        bond->params.mode = mode;
+        return 0;
+}
+
+static struct net_device *__bond_option_active_slave_get(struct bonding *bond,
+                                                         struct slave *slave)
+{
+        return USES_PRIMARY(bond->params.mode) && slave ? slave->dev : NULL;
+}
+
+struct net_device *bond_option_active_slave_get_rcu(struct bonding *bond)
+{
+        struct slave *slave = rcu_dereference(bond->curr_active_slave);
+
+        return __bond_option_active_slave_get(bond, slave);
+}
+
+struct net_device *bond_option_active_slave_get(struct bonding *bond)
+{
+        return __bond_option_active_slave_get(bond, bond->curr_active_slave);
+}
+
+int bond_option_active_slave_set(struct bonding *bond,
+                                 struct net_device *slave_dev)
+{
+        int ret = 0;
+
+        if (slave_dev) {
+                if (!netif_is_bond_slave(slave_dev)) {
+                        pr_err("Device %s is not bonding slave.\n",
+                               slave_dev->name);
+                        return -EINVAL;
+                }
+
+                if (bond->dev != netdev_master_upper_dev_get(slave_dev)) {
+                        pr_err("%s: Device %s is not our slave.\n",
+                               bond->dev->name, slave_dev->name);
+                        return -EINVAL;
+                }
+        }
+
+        if (!USES_PRIMARY(bond->params.mode)) {
+                pr_err("%s: Unable to change active slave; %s is in mode %d\n",
+                       bond->dev->name, bond->dev->name, bond->params.mode);
+                return -EINVAL;
+        }
+
+        block_netpoll_tx();
+        read_lock(&bond->lock);
+        write_lock_bh(&bond->curr_slave_lock);
+
+        /* check to see if we are clearing active */
+        if (!slave_dev) {
+                pr_info("%s: Clearing current active slave.\n",
+                bond->dev->name);
+                rcu_assign_pointer(bond->curr_active_slave, NULL);
+                bond_select_active_slave(bond);
+        } else {
+                struct slave *old_active = bond->curr_active_slave;
+                struct slave *new_active = bond_slave_get_rtnl(slave_dev);
+
+                BUG_ON(!new_active);
+
+                if (new_active == old_active) {
+                        /* do nothing */
+                        pr_info("%s: %s is already the current active slave.\n",
+                                bond->dev->name, new_active->dev->name);
+                } else {
+                        if (old_active && (new_active->link == BOND_LINK_UP) &&
+                            IS_UP(new_active->dev)) {
+                                pr_info("%s: Setting %s as active slave.\n",
+                                        bond->dev->name, new_active->dev->name);
+                                bond_change_active_slave(bond, new_active);
+                        } else {
+                                pr_err("%s: Could not set %s as active slave; either %s is down or the link is down.\n",
+                                       bond->dev->name, new_active->dev->name,
+                                       new_active->dev->name);
+                                ret = -EINVAL;
+                        }
+                }
+        }
+
+        write_unlock_bh(&bond->curr_slave_lock);
+        read_unlock(&bond->lock);
+        unblock_netpoll_tx();
+        return ret;
+}
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index 20a6ee25bb63..fb868d6c22da 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -10,8 +10,9 @@ static void *bond_info_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(&bond->lock)
 {
         struct bonding *bond = seq->private;
-        loff_t off = 0;
+        struct list_head *iter;
         struct slave *slave;
+        loff_t off = 0;
 
         /* make sure the bond won't be taken away */
         rcu_read_lock();
@@ -20,7 +21,7 @@ static void *bond_info_seq_start(struct seq_file *seq, loff_t *pos)
         if (*pos == 0)
                 return SEQ_START_TOKEN;
 
-        bond_for_each_slave(bond, slave)
+        bond_for_each_slave(bond, slave, iter)
                 if (++off == *pos)
                         return slave;
 
@@ -30,17 +31,25 @@ static void *bond_info_seq_start(struct seq_file *seq, loff_t *pos)
 static void *bond_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct bonding *bond = seq->private;
-        struct slave *slave = v;
+        struct list_head *iter;
+        struct slave *slave;
+        bool found = false;
 
         ++*pos;
         if (v == SEQ_START_TOKEN)
                 return bond_first_slave(bond);
 
-        if (bond_is_last_slave(bond, slave))
+        if (bond_is_last_slave(bond, v))
                 return NULL;
-        slave = bond_next_slave(bond, slave);
 
-        return slave;
+        bond_for_each_slave(bond, slave, iter) {
+                if (found)
+                        return slave;
+                if (slave == v)
+                        found = true;
+        }
+
+        return NULL;
 }
 
 static void bond_info_seq_stop(struct seq_file *seq, void *v)
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index c29b836749b6..47749c970a01 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -168,41 +168,6 @@ static const struct class_attribute class_attr_bonding_masters = {
         .namespace = bonding_namespace,
 };
 
-int bond_create_slave_symlinks(struct net_device *master,
-                               struct net_device *slave)
-{
-        char linkname[IFNAMSIZ+7];
-        int ret = 0;
-
-        /* first, create a link from the slave back to the master */
-        ret = sysfs_create_link(&(slave->dev.kobj), &(master->dev.kobj),
-                                "master");
-        if (ret)
-                return ret;
-        /* next, create a link from the master to the slave */
-        sprintf(linkname, "slave_%s", slave->name);
-        ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj),
-                                linkname);
-
-        /* free the master link created earlier in case of error */
-        if (ret)
-                sysfs_remove_link(&(slave->dev.kobj), "master");
-
-        return ret;
-
-}
-
-void bond_destroy_slave_symlinks(struct net_device *master,
-                                 struct net_device *slave)
-{
-        char linkname[IFNAMSIZ+7];
-
-        sysfs_remove_link(&(slave->dev.kobj), "master");
-        sprintf(linkname, "slave_%s", slave->name);
-        sysfs_remove_link(&(master->dev.kobj), linkname);
-}
-
-
 /*
  * Show the slaves in the current bond.
  */
@@ -210,11 +175,14 @@ static ssize_t bonding_show_slaves(struct device *d,
                                    struct device_attribute *attr, char *buf)
 {
         struct bonding *bond = to_bond(d);
+        struct list_head *iter;
         struct slave *slave;
         int res = 0;
 
-        read_lock(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        bond_for_each_slave(bond, slave, iter) {
                 if (res > (PAGE_SIZE - IFNAMSIZ)) {
                         /* not enough space for another interface name */
                         if ((PAGE_SIZE - res) > 10)
@@ -224,7 +192,9 @@ static ssize_t bonding_show_slaves(struct device *d,
                 }
                 res += sprintf(buf + res, "%s ", slave->dev->name);
         }
-        read_unlock(&bond->lock);
+
+        rtnl_unlock();
+
         if (res)
                 buf[res-1] = '\n'; /* eat the leftover space */
 
@@ -313,50 +283,26 @@ static ssize_t bonding_store_mode(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        int new_value, ret = count;
+        int new_value, ret;
         struct bonding *bond = to_bond(d);
 
-        if (!rtnl_trylock())
-                return restart_syscall();
-
-        if (bond->dev->flags & IFF_UP) {
-                pr_err("unable to update mode of %s because interface is up.\n",
-                       bond->dev->name);
-                ret = -EPERM;
-                goto out;
-        }
-
-        if (!list_empty(&bond->slave_list)) {
-                pr_err("unable to update mode of %s because it has slaves.\n",
-                        bond->dev->name);
-                ret = -EPERM;
-                goto out;
-        }
-
         new_value = bond_parse_parm(buf, bond_mode_tbl);
         if (new_value < 0)  {
                 pr_err("%s: Ignoring invalid mode value %.*s.\n",
                        bond->dev->name, (int)strlen(buf) - 1, buf);
-                ret = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
-        if ((new_value == BOND_MODE_ALB ||
-             new_value == BOND_MODE_TLB) &&
-            bond->params.arp_interval) {
-                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
-                       bond->dev->name, bond_mode_tbl[new_value].modename);
-                ret = -EINVAL;
-                goto out;
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        ret = bond_option_mode_set(bond, new_value);
+        if (!ret) {
+                pr_info("%s: setting mode to %s (%d).\n",
+                        bond->dev->name, bond_mode_tbl[new_value].modename,
+                        new_value);
+                ret = count;
         }
 
-        /* don't cache arp_validate between modes */
-        bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
-        bond->params.mode = new_value;
-        bond_set_mode_ops(bond, bond->params.mode);
-        pr_info("%s: setting mode to %s (%d).\n",
-                bond->dev->name, bond_mode_tbl[new_value].modename,
-                new_value);
-out:
         rtnl_unlock();
         return ret;
 }
@@ -392,7 +338,6 @@ static ssize_t bonding_store_xmit_hash(struct device *d,
                 ret = -EINVAL;
         } else {
                 bond->params.xmit_policy = new_value;
-                bond_set_mode_ops(bond, bond->params.mode);
                 pr_info("%s: setting xmit hash policy to %s (%d).\n",
                         bond->dev->name,
                         xmit_hashtype_tbl[new_value].modename, new_value);
@@ -522,7 +467,7 @@ static ssize_t bonding_store_fail_over_mac(struct device *d,
         if (!rtnl_trylock())
                 return restart_syscall();
 
-        if (!list_empty(&bond->slave_list)) {
+        if (bond_has_slaves(bond)) {
                 pr_err("%s: Can't alter fail_over_mac with slaves in bond.\n",
                        bond->dev->name);
                 ret = -EPERM;
@@ -656,11 +601,15 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                                          const char *buf, size_t count)
 {
         struct bonding *bond = to_bond(d);
+        struct list_head *iter;
         struct slave *slave;
         __be32 newtarget, *targets;
         unsigned long *targets_rx;
         int ind, i, j, ret = -EINVAL;
 
+        if (!rtnl_trylock())
+                return restart_syscall();
+
         targets = bond->params.arp_targets;
         newtarget = in_aton(buf + 1);
         /* look for adds */
@@ -688,7 +637,7 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                          &newtarget);
                 /* not to race with bond_arp_rcv */
                 write_lock_bh(&bond->lock);
-                bond_for_each_slave(bond, slave)
+                bond_for_each_slave(bond, slave, iter)
                         slave->target_last_arp_rx[ind] = jiffies;
                 targets[ind] = newtarget;
                 write_unlock_bh(&bond->lock);
@@ -714,7 +663,7 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                         &newtarget);
 
                 write_lock_bh(&bond->lock);
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         targets_rx = slave->target_last_arp_rx;
                         j = ind;
                         for (; (j < BOND_MAX_ARP_TARGETS-1) && targets[j+1]; j++)
@@ -734,6 +683,7 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 
         ret = count;
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(arp_ip_target, S_IRUGO | S_IWUSR , bonding_show_arp_targets, bonding_store_arp_targets);
@@ -1111,6 +1061,7 @@ static ssize_t bonding_store_primary(struct device *d,
                                      const char *buf, size_t count)
 {
         struct bonding *bond = to_bond(d);
+        struct list_head *iter;
         char ifname[IFNAMSIZ];
         struct slave *slave;
 
@@ -1138,7 +1089,7 @@ static ssize_t bonding_store_primary(struct device *d,
                 goto out;
         }
 
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
                         pr_info("%s: Setting %s as primary slave.\n",
                                 bond->dev->name, slave->dev->name);
@@ -1268,13 +1219,13 @@ static ssize_t bonding_show_active_slave(struct device *d,
                                          char *buf)
 {
         struct bonding *bond = to_bond(d);
-        struct slave *curr;
+        struct net_device *slave_dev;
         int count = 0;
 
         rcu_read_lock();
-        curr = rcu_dereference(bond->curr_active_slave);
-        if (USES_PRIMARY(bond->params.mode) && curr)
-                count = sprintf(buf, "%s\n", curr->dev->name);
+        slave_dev = bond_option_active_slave_get_rcu(bond);
+        if (slave_dev)
+                count = sprintf(buf, "%s\n", slave_dev->name);
         rcu_read_unlock();
 
         return count;
@@ -1284,80 +1235,33 @@ static ssize_t bonding_store_active_slave(struct device *d,
                                           struct device_attribute *attr,
                                           const char *buf, size_t count)
 {
-        struct slave *slave, *old_active, *new_active;
+        int ret;
         struct bonding *bond = to_bond(d);
         char ifname[IFNAMSIZ];
+        struct net_device *dev;
 
         if (!rtnl_trylock())
                 return restart_syscall();
 
-        old_active = new_active = NULL;
-        block_netpoll_tx();
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
-
-        if (!USES_PRIMARY(bond->params.mode)) {
-                pr_info("%s: Unable to change active slave; %s is in mode %d\n",
-                        bond->dev->name, bond->dev->name, bond->params.mode);
-                goto out;
-        }
-
         sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
-
-        /* check to see if we are clearing active */
         if (!strlen(ifname) || buf[0] == '\n') {
-                pr_info("%s: Clearing current active slave.\n",
-                        bond->dev->name);
-                rcu_assign_pointer(bond->curr_active_slave, NULL);
-                bond_select_active_slave(bond);
-                goto out;
-        }
-
-        bond_for_each_slave(bond, slave) {
-                if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
-                        old_active = bond->curr_active_slave;
-                        new_active = slave;
-                        if (new_active == old_active) {
-                                /* do nothing */
-                                pr_info("%s: %s is already the current"
-                                        " active slave.\n",
-                                        bond->dev->name,
-                                        slave->dev->name);
-                                goto out;
-                        } else {
-                                if ((new_active) &&
-                                    (old_active) &&
-                                    (new_active->link == BOND_LINK_UP) &&
-                                    IS_UP(new_active->dev)) {
-                                        pr_info("%s: Setting %s as active"
-                                                " slave.\n",
-                                                bond->dev->name,
-                                                slave->dev->name);
-                                        bond_change_active_slave(bond,
-                                                                 new_active);
-                                } else {
-                                        pr_info("%s: Could not set %s as"
-                                                " active slave; either %s is"
-                                                " down or the link is down.\n",
-                                                bond->dev->name,
-                                                slave->dev->name,
-                                                slave->dev->name);
-                                }
-                                goto out;
-                        }
+                dev = NULL;
+        } else {
+                dev = __dev_get_by_name(dev_net(bond->dev), ifname);
+                if (!dev) {
+                        ret = -ENODEV;
+                        goto out;
                 }
         }
 
-        pr_info("%s: Unable to set %.*s as active slave.\n",
-                bond->dev->name, (int)strlen(buf) - 1, buf);
- out:
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
-        unblock_netpoll_tx();
+        ret = bond_option_active_slave_set(bond, dev);
+        if (!ret)
+                ret = count;
 
+ out:
         rtnl_unlock();
 
-        return count;
+        return ret;
 
 }
 static DEVICE_ATTR(active_slave, S_IRUGO | S_IWUSR,
@@ -1493,14 +1397,14 @@ static ssize_t bonding_show_queue_id(struct device *d,
                                      char *buf)
 {
         struct bonding *bond = to_bond(d);
+        struct list_head *iter;
         struct slave *slave;
         int res = 0;
 
         if (!rtnl_trylock())
                 return restart_syscall();
 
-        read_lock(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (res > (PAGE_SIZE - IFNAMSIZ - 6)) {
                         /* not enough space for another interface_name:queue_id pair */
                         if ((PAGE_SIZE - res) > 10)
@@ -1511,9 +1415,9 @@ static ssize_t bonding_show_queue_id(struct device *d,
                 res += sprintf(buf + res, "%s:%d ",
                                slave->dev->name, slave->queue_id);
         }
-        read_unlock(&bond->lock);
         if (res)
                 buf[res-1] = '\n'; /* eat the leftover space */
+
         rtnl_unlock();
 
         return res;
@@ -1529,6 +1433,7 @@ static ssize_t bonding_store_queue_id(struct device *d,
 {
         struct slave *slave, *update_slave;
         struct bonding *bond = to_bond(d);
+        struct list_head *iter;
         u16 qid;
         int ret = count;
         char *delim;
@@ -1561,11 +1466,9 @@ static ssize_t bonding_store_queue_id(struct device *d,
         if (!sdev)
                 goto err_no_cmd;
 
-        read_lock(&bond->lock);
-
         /* Search for thes slave and check for duplicate qids */
         update_slave = NULL;
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (sdev == slave->dev)
                         /*
                          * We don't need to check the matching
@@ -1573,23 +1476,20 @@ static ssize_t bonding_store_queue_id(struct device *d,
                          */
                         update_slave = slave;
                 else if (qid && qid == slave->queue_id) {
-                        goto err_no_cmd_unlock;
+                        goto err_no_cmd;
                 }
         }
 
         if (!update_slave)
-                goto err_no_cmd_unlock;
+                goto err_no_cmd;
 
         /* Actually set the qids for the slave */
         update_slave->queue_id = qid;
 
-        read_unlock(&bond->lock);
 out:
         rtnl_unlock();
         return ret;
 
-err_no_cmd_unlock:
-        read_unlock(&bond->lock);
 err_no_cmd:
         pr_info("invalid input for queue_id set for %s.\n",
                 bond->dev->name);
@@ -1619,8 +1519,12 @@ static ssize_t bonding_store_slaves_active(struct device *d,
 {
         struct bonding *bond = to_bond(d);
         int new_value, ret = count;
+        struct list_head *iter;
         struct slave *slave;
 
+        if (!rtnl_trylock())
+                return restart_syscall();
+
         if (sscanf(buf, "%d", &new_value) != 1) {
                 pr_err("%s: no all_slaves_active value specified.\n",
                        bond->dev->name);
@@ -1640,8 +1544,7 @@ static ssize_t bonding_store_slaves_active(struct device *d,
                 goto out;
         }
 
-        read_lock(&bond->lock);
-        bond_for_each_slave(bond, slave) {
+        bond_for_each_slave(bond, slave, iter) {
                 if (!bond_is_active_slave(slave)) {
                         if (new_value)
                                 slave->inactive = 0;
@@ -1649,8 +1552,8 @@ static ssize_t bonding_store_slaves_active(struct device *d,
                                 slave->inactive = 1;
                 }
         }
-        read_unlock(&bond->lock);
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(all_slaves_active, S_IRUGO | S_IWUSR,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 03cf3fd14490..046a60535e04 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -58,6 +58,11 @@
 #define TX_QUEUE_OVERRIDE(mode)                         \
                         (((mode) == BOND_MODE_ACTIVEBACKUP) ||  \
                          ((mode) == BOND_MODE_ROUNDROBIN))
+
+#define BOND_MODE_IS_LB(mode)                   \
+                (((mode) == BOND_MODE_TLB) ||   \
+                 ((mode) == BOND_MODE_ALB))
+
 /*
  * Less bad way to call ioctl from within the kernel; this needs to be
  * done some other way to get the call out of interrupt context.
@@ -72,63 +77,37 @@
         res; })
 
 /* slave list primitives */
-#define bond_to_slave(ptr) list_entry(ptr, struct slave, list)
+#define bond_slave_list(bond) (&(bond)->dev->adj_list.lower)
+
+#define bond_has_slaves(bond) !list_empty(bond_slave_list(bond))
 
 /* IMPORTANT: bond_first/last_slave can return NULL in case of an empty list */
 #define bond_first_slave(bond) \
-        list_first_entry_or_null(&(bond)->slave_list, struct slave, list)
+        (bond_has_slaves(bond) ? \
+                netdev_adjacent_get_private(bond_slave_list(bond)->next) : \
+                NULL)
 #define bond_last_slave(bond) \
-        (list_empty(&(bond)->slave_list) ? NULL : \
-                                           bond_to_slave((bond)->slave_list.prev))
+        (bond_has_slaves(bond) ? \
+                netdev_adjacent_get_private(bond_slave_list(bond)->prev) : \
+                NULL)
 
-#define bond_is_first_slave(bond, pos) ((pos)->list.prev == &(bond)->slave_list)
-#define bond_is_last_slave(bond, pos) ((pos)->list.next == &(bond)->slave_list)
-
-/* Since bond_first/last_slave can return NULL, these can return NULL too */
-#define bond_next_slave(bond, pos) \
-        (bond_is_last_slave(bond, pos) ? bond_first_slave(bond) : \
-                                         bond_to_slave((pos)->list.next))
-
-#define bond_prev_slave(bond, pos) \
-        (bond_is_first_slave(bond, pos) ? bond_last_slave(bond) : \
-                                          bond_to_slave((pos)->list.prev))
-
-/**
- * bond_for_each_slave_from - iterate the slaves list from a starting point
- * @bond:       the bond holding this list.
- * @pos:        current slave.
- * @cnt:        counter for max number of moves
- * @start:      starting point.
- *
- * Caller must hold bond->lock
- */
-#define bond_for_each_slave_from(bond, pos, cnt, start) \
-        for (cnt = 0, pos = start; pos && cnt < (bond)->slave_cnt; \
-             cnt++, pos = bond_next_slave(bond, pos))
+#define bond_is_first_slave(bond, pos) (pos == bond_first_slave(bond))
+#define bond_is_last_slave(bond, pos) (pos == bond_last_slave(bond))
 
 /**
  * bond_for_each_slave - iterate over all slaves
  * @bond:       the bond holding this list
  * @pos:        current slave
+ * @iter:       list_head * iterator
  *
  * Caller must hold bond->lock
  */
-#define bond_for_each_slave(bond, pos) \
-        list_for_each_entry(pos, &(bond)->slave_list, list)
+#define bond_for_each_slave(bond, pos, iter) \
+        netdev_for_each_lower_private((bond)->dev, pos, iter)
 
 /* Caller must have rcu_read_lock */
-#define bond_for_each_slave_rcu(bond, pos) \
-        list_for_each_entry_rcu(pos, &(bond)->slave_list, list)
-
-/**
- * bond_for_each_slave_reverse - iterate in reverse from a given position
- * @bond:       the bond holding this list
- * @pos:        slave to continue from
- *
- * Caller must hold bond->lock
- */
-#define bond_for_each_slave_continue_reverse(bond, pos) \
-        list_for_each_entry_continue_reverse(pos, &(bond)->slave_list, list)
+#define bond_for_each_slave_rcu(bond, pos, iter) \
+        netdev_for_each_lower_private_rcu((bond)->dev, pos, iter)
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 extern atomic_t netpoll_block_tx;
@@ -188,7 +167,6 @@ struct bond_parm_tbl {
 
 struct slave {
         struct net_device *dev; /* first - useful for panic debug */
-        struct list_head list;
         struct bonding *bond; /* our master */
         int    delay;
         unsigned long jiffies;
@@ -228,7 +206,6 @@ struct slave {
  */
 struct bonding {
         struct   net_device *dev; /* first - useful for panic debug */
-        struct   list_head slave_list;
         struct   slave *curr_active_slave;
         struct   slave *current_arp_slave;
         struct   slave *primary_slave;
@@ -245,7 +222,6 @@ struct bonding {
         char     proc_file_name[IFNAMSIZ];
 #endif /* CONFIG_PROC_FS */
         struct   list_head bond_list;
-        int      (*xmit_hash_policy)(struct sk_buff *, int);
         u16      rr_tx_counter;
         struct   ad_bond_info ad_info;
         struct   alb_bond_info alb_info;
@@ -276,13 +252,7 @@ struct bonding {
 static inline struct slave *bond_get_slave_by_dev(struct bonding *bond,
                                                   struct net_device *slave_dev)
 {
-        struct slave *slave = NULL;
-
-        bond_for_each_slave(bond, slave)
-                if (slave->dev == slave_dev)
-                        return slave;
-
-        return NULL;
+        return netdev_lower_dev_get_private(bond->dev, slave_dev);
 }
 
 static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
@@ -294,8 +264,7 @@ static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
 
 static inline bool bond_is_lb(const struct bonding *bond)
 {
-        return (bond->params.mode == BOND_MODE_TLB ||
-                bond->params.mode == BOND_MODE_ALB);
+        return BOND_MODE_IS_LB(bond->params.mode);
 }
 
 static inline void bond_set_active_slave(struct slave *slave)
@@ -432,21 +401,18 @@ static inline bool slave_can_tx(struct slave *slave)
 struct bond_net;
 
 int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
-struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr);
 int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
 void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id);
 int bond_create(struct net *net, const char *name);
 int bond_create_sysfs(struct bond_net *net);
 void bond_destroy_sysfs(struct bond_net *net);
 void bond_prepare_sysfs_group(struct bonding *bond);
-int bond_create_slave_symlinks(struct net_device *master, struct net_device *slave);
-void bond_destroy_slave_symlinks(struct net_device *master, struct net_device *slave);
 int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev);
 int bond_release(struct net_device *bond_dev, struct net_device *slave_dev);
 void bond_mii_monitor(struct work_struct *);
 void bond_loadbalance_arp_mon(struct work_struct *);
 void bond_activebackup_arp_mon(struct work_struct *);
-void bond_set_mode_ops(struct bonding *bond, int mode);
+int bond_xmit_hash(struct bonding *bond, struct sk_buff *skb, int count);
 int bond_parse_parm(const char *mode_arg, const struct bond_parm_tbl *tbl);
 void bond_select_active_slave(struct bonding *bond);
 void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
@@ -456,6 +422,14 @@ void bond_debug_register(struct bonding *bond);
 void bond_debug_unregister(struct bonding *bond);
 void bond_debug_reregister(struct bonding *bond);
 const char *bond_mode_name(int mode);
+void bond_setup(struct net_device *bond_dev);
+unsigned int bond_get_num_tx_queues(void);
+int bond_netlink_init(void);
+void bond_netlink_fini(void);
+int bond_option_mode_set(struct bonding *bond, int mode);
+int bond_option_active_slave_set(struct bonding *bond, struct net_device *slave_dev);
+struct net_device *bond_option_active_slave_get_rcu(struct bonding *bond);
+struct net_device *bond_option_active_slave_get(struct bonding *bond);
 
 struct bond_net {
         struct net *            net;    /* Associated network namespace */
@@ -492,9 +466,24 @@ static inline void bond_destroy_proc_dir(struct bond_net *bn)
 static inline struct slave *bond_slave_has_mac(struct bonding *bond,
                                                const u8 *mac)
 {
+        struct list_head *iter;
         struct slave *tmp;
 
-        bond_for_each_slave(bond, tmp)
+        bond_for_each_slave(bond, tmp, iter)
+                if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+                        return tmp;
+
+        return NULL;
+}
+
+/* Caller must hold rcu_read_lock() for read */
+static inline struct slave *bond_slave_has_mac_rcu(struct bonding *bond,
+                                               const u8 *mac)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave_rcu(bond, tmp, iter)
                 if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
                         return tmp;
 
@@ -528,4 +517,7 @@ extern const struct bond_parm_tbl fail_over_mac_tbl[];
 extern const struct bond_parm_tbl pri_reselect_tbl[];
 extern struct bond_parm_tbl ad_select_tbl[];
 
+/* exported from bond_netlink.c */
+extern struct rtnl_link_ops bond_link_ops;
+
 #endif /* _LINUX_BONDING_H */
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 693d8ffe4653..cf0f63e14e53 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -1347,7 +1347,7 @@ static int at91_can_probe(struct platform_device *pdev)
         priv->reg_base = addr;
         priv->devtype_data = *devtype_data;
         priv->clk = clk;
-        priv->pdata = pdev->dev.platform_data;
+        priv->pdata = dev_get_platdata(&pdev->dev);
         priv->mb0_id = 0x7ff;
 
         netif_napi_add(dev, &priv->napi, at91_poll, get_mb_rx_num(priv));
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index a2700d25ff0e..8a0b515b33ea 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -539,7 +539,7 @@ static int bfin_can_probe(struct platform_device *pdev)
         struct resource *res_mem, *rx_irq, *tx_irq, *err_irq;
         unsigned short *pdata;
 
-        pdata = pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (!pdata) {
                 dev_err(&pdev->dev, "No platform data provided!\n");
                 err = -EINVAL;
diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
index b374be7891a2..bce0be54c2f5 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -160,7 +160,6 @@ static int c_can_pci_probe(struct pci_dev *pdev,
         return 0;
 
 out_free_c_can:
-        pci_set_drvdata(pdev, NULL);
         free_c_can_dev(dev);
 out_iounmap:
         pci_iounmap(pdev, addr);
@@ -181,7 +180,6 @@ static void c_can_pci_remove(struct pci_dev *pdev)
 
         unregister_c_can_dev(dev);
 
-        pci_set_drvdata(pdev, NULL);
         free_c_can_dev(dev);
 
         pci_iounmap(pdev, priv->base);
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 294ced3cc227..d66ac265269c 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -322,7 +322,7 @@ static struct platform_driver c_can_plat_driver = {
         .driver = {
                 .name = KBUILD_MODNAME,
                 .owner = THIS_MODULE,
-                .of_match_table = of_match_ptr(c_can_of_table),
+                .of_match_table = c_can_of_table,
         },
         .probe = c_can_plat_probe,
         .remove = c_can_plat_remove,
diff --git a/drivers/net/can/cc770/cc770_platform.c b/drivers/net/can/cc770/cc770_platform.c
index 034bdd816a60..ad76734b3ecc 100644
--- a/drivers/net/can/cc770/cc770_platform.c
+++ b/drivers/net/can/cc770/cc770_platform.c
@@ -152,7 +152,7 @@ static int cc770_get_platform_data(struct platform_device *pdev,
                                    struct cc770_priv *priv)
 {
 
-        struct cc770_platform_data *pdata = pdev->dev.platform_data;
+        struct cc770_platform_data *pdata = dev_get_platdata(&pdev->dev);
 
         priv->can.clock.freq = pdata->osc_freq;
         if (priv->cpu_interface & CPUIF_DSC)
@@ -203,7 +203,7 @@ static int cc770_platform_probe(struct platform_device *pdev)
 
         if (pdev->dev.of_node)
                 err = cc770_get_of_node_data(pdev, priv);
-        else if (pdev->dev.platform_data)
+        else if (dev_get_platdata(&pdev->dev))
                 err = cc770_get_platform_data(pdev, priv);
         else
                 err = -ENODEV;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 8f5ce747feb5..ae08cf129ebb 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1068,7 +1068,7 @@ static int flexcan_probe(struct platform_device *pdev)
         priv->dev = dev;
         priv->clk_ipg = clk_ipg;
         priv->clk_per = clk_per;
-        priv->pdata = pdev->dev.platform_data;
+        priv->pdata = dev_get_platdata(&pdev->dev);
         priv->devtype_data = devtype_data;
 
         priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index 36bd6fa1c7f3..ab5909a7bae9 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1769,7 +1769,7 @@ static int ican3_probe(struct platform_device *pdev)
         struct device *dev;
         int ret;
 
-        pdata = pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (!pdata)
                 return -ENXIO;
 
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index fe7dd696957e..08ac401e0214 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -999,7 +999,7 @@ static int mcp251x_can_probe(struct spi_device *spi)
 {
         struct net_device *net;
         struct mcp251x_priv *priv;
-        struct mcp251x_platform_data *pdata = spi->dev.platform_data;
+        struct mcp251x_platform_data *pdata = dev_get_platdata(&spi->dev);
         int ret = -ENODEV;
 
         if (!pdata)
diff --git a/drivers/net/can/mscan/mscan.h b/drivers/net/can/mscan/mscan.h
index 9c24d60a23b1..e98abb97a050 100644
--- a/drivers/net/can/mscan/mscan.h
+++ b/drivers/net/can/mscan/mscan.h
@@ -297,8 +297,8 @@ struct mscan_priv {
         struct napi_struct napi;
 };
 
-extern struct net_device *alloc_mscandev(void);
-extern int register_mscandev(struct net_device *dev, int mscan_clksrc);
-extern void unregister_mscandev(struct net_device *dev);
+struct net_device *alloc_mscandev(void);
+int register_mscandev(struct net_device *dev, int mscan_clksrc);
+void unregister_mscandev(struct net_device *dev);
 
 #endif /* __MSCAN_H__ */
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index 5c314a961970..5f0e9b3bfa7b 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -964,7 +964,6 @@ static void pch_can_remove(struct pci_dev *pdev)
                 pci_disable_msi(priv->dev);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         pch_can_reset(priv);
         pci_iounmap(pdev, priv->regs);
         free_candev(priv->ndev);
diff --git a/drivers/net/can/sja1000/ems_pci.c b/drivers/net/can/sja1000/ems_pci.c
index 3752342a678a..835921388e7b 100644
--- a/drivers/net/can/sja1000/ems_pci.c
+++ b/drivers/net/can/sja1000/ems_pci.c
@@ -207,7 +207,6 @@ static void ems_pci_del_card(struct pci_dev *pdev)
         kfree(card);
 
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static void ems_pci_card_reset(struct ems_pci_card *card)
diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 217585b97cd3..087b13bd300e 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -387,7 +387,6 @@ static void kvaser_pci_remove_one(struct pci_dev *pdev)
 
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static struct pci_driver kvaser_pci_driver = {
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index 6b6f0ad75090..065ca49eb45e 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -744,8 +744,6 @@ static void peak_pci_remove(struct pci_dev *pdev)
         pci_iounmap(pdev, cfg_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-
-        pci_set_drvdata(pdev, NULL);
 }
 
 static struct pci_driver peak_pci_driver = {
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index c52c1e96bf90..f9b4f81cd86a 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -477,7 +477,6 @@ static void plx_pci_del_card(struct pci_dev *pdev)
         kfree(card);
 
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 /*
diff --git a/drivers/net/can/sja1000/sja1000_platform.c b/drivers/net/can/sja1000/sja1000_platform.c
index 8e259c541036..29f9b6321187 100644
--- a/drivers/net/can/sja1000/sja1000_platform.c
+++ b/drivers/net/can/sja1000/sja1000_platform.c
@@ -76,7 +76,7 @@ static int sp_probe(struct platform_device *pdev)
         struct resource *res_mem, *res_irq;
         struct sja1000_platform_data *pdata;
 
-        pdata = pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (!pdata) {
                 dev_err(&pdev->dev, "No platform data provided!\n");
                 err = -ENODEV;
diff --git a/drivers/net/can/softing/softing.h b/drivers/net/can/softing/softing.h
index afd7d85b6915..35f062282dbd 100644
--- a/drivers/net/can/softing/softing.h
+++ b/drivers/net/can/softing/softing.h
@@ -71,34 +71,34 @@ struct softing {
         } id;
 };
 
-extern int softing_default_output(struct net_device *netdev);
+int softing_default_output(struct net_device *netdev);
 
-extern ktime_t softing_raw2ktime(struct softing *card, u32 raw);
+ktime_t softing_raw2ktime(struct softing *card, u32 raw);
 
-extern int softing_chip_poweron(struct softing *card);
+int softing_chip_poweron(struct softing *card);
 
-extern int softing_bootloader_command(struct softing *card, int16_t cmd,
-                const char *msg);
+int softing_bootloader_command(struct softing *card, int16_t cmd,
+                               const char *msg);
 
 /* Load firmware after reset */
-extern int softing_load_fw(const char *file, struct softing *card,
-                        __iomem uint8_t *virt, unsigned int size, int offset);
+int softing_load_fw(const char *file, struct softing *card,
+                    __iomem uint8_t *virt, unsigned int size, int offset);
 
 /* Load final application firmware after bootloader */
-extern int softing_load_app_fw(const char *file, struct softing *card);
+int softing_load_app_fw(const char *file, struct softing *card);
 
 /*
  * enable or disable irq
  * only called with fw.lock locked
  */
-extern int softing_enable_irq(struct softing *card, int enable);
+int softing_enable_irq(struct softing *card, int enable);
 
 /* start/stop 1 bus on card */
-extern int softing_startstop(struct net_device *netdev, int up);
+int softing_startstop(struct net_device *netdev, int up);
 
 /* netif_rx() */
-extern int softing_netdev_rx(struct net_device *netdev,
-                const struct can_frame *msg, ktime_t ktime);
+int softing_netdev_rx(struct net_device *netdev, const struct can_frame *msg,
+                      ktime_t ktime);
 
 /* SOFTING DPRAM mappings */
 #define DPRAM_RX                0x0000
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 65eef1eea2e2..6cd5c01b624d 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -768,7 +768,7 @@ static int softing_pdev_remove(struct platform_device *pdev)
 
 static int softing_pdev_probe(struct platform_device *pdev)
 {
-        const struct softing_platform_data *pdat = pdev->dev.platform_data;
+        const struct softing_platform_data *pdat = dev_get_platdata(&pdev->dev);
         struct softing *card;
         struct net_device *netdev;
         struct softing_priv *priv;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 3a349a22d5bc..beb5ef834f0f 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -894,7 +894,7 @@ static int ti_hecc_probe(struct platform_device *pdev)
         void __iomem *addr;
         int err = -ENODEV;
 
-        pdata = pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (!pdata) {
                 dev_err(&pdev->dev, "No platform data\n");
                 goto probe_exit;
diff --git a/drivers/net/ethernet/3com/Kconfig b/drivers/net/ethernet/3com/Kconfig
index f00c76377b44..65b735d4a6ad 100644
--- a/drivers/net/ethernet/3com/Kconfig
+++ b/drivers/net/ethernet/3com/Kconfig
@@ -35,7 +35,7 @@ config EL3
 
 config 3C515
         tristate "3c515 ISA \"Fast EtherLink\""
-        depends on (ISA || EISA) && ISA_DMA_API
+        depends on ISA && ISA_DMA_API
         ---help---
           If you have a 3Com ISA EtherLink XL "Corkscrew" 3c515 Fast Ethernet
           network card, say Y and read the Ethernet-HOWTO, available from
@@ -70,7 +70,7 @@ config VORTEX
         select MII
         ---help---
           This option enables driver support for a large number of 10Mbps and
-          10/100Mbps EISA, PCI and PCMCIA 3Com network cards:
+          10/100Mbps EISA, PCI and Cardbus 3Com network cards:
 
           "Vortex"    (Fast EtherLink 3c590/3c592/3c595/3c597) EISA and PCI
           "Boomerang" (EtherLink XL 3c900 or 3c905)            PCI
diff --git a/drivers/net/ethernet/3com/typhoon.c b/drivers/net/ethernet/3com/typhoon.c
index 144942f6372b..465cc7108d8a 100644
--- a/drivers/net/ethernet/3com/typhoon.c
+++ b/drivers/net/ethernet/3com/typhoon.c
@@ -2525,7 +2525,6 @@ typhoon_remove_one(struct pci_dev *pdev)
         pci_release_regions(pdev);
         pci_clear_mwi(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/ethernet/8390/8390.h b/drivers/net/ethernet/8390/8390.h
index ef325ffa1b5a..2923c51bb351 100644
--- a/drivers/net/ethernet/8390/8390.h
+++ b/drivers/net/ethernet/8390/8390.h
@@ -28,42 +28,42 @@ extern int ei_debug;
 #endif
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-extern void ei_poll(struct net_device *dev);
-extern void eip_poll(struct net_device *dev);
+void ei_poll(struct net_device *dev);
+void eip_poll(struct net_device *dev);
 #endif
 
 
 /* Without I/O delay - non ISA or later chips */
-extern void NS8390_init(struct net_device *dev, int startp);
-extern int ei_open(struct net_device *dev);
-extern int ei_close(struct net_device *dev);
-extern irqreturn_t ei_interrupt(int irq, void *dev_id);
-extern void ei_tx_timeout(struct net_device *dev);
-extern netdev_tx_t ei_start_xmit(struct sk_buff *skb, struct net_device *dev);
-extern void ei_set_multicast_list(struct net_device *dev);
-extern struct net_device_stats *ei_get_stats(struct net_device *dev);
+void NS8390_init(struct net_device *dev, int startp);
+int ei_open(struct net_device *dev);
+int ei_close(struct net_device *dev);
+irqreturn_t ei_interrupt(int irq, void *dev_id);
+void ei_tx_timeout(struct net_device *dev);
+netdev_tx_t ei_start_xmit(struct sk_buff *skb, struct net_device *dev);
+void ei_set_multicast_list(struct net_device *dev);
+struct net_device_stats *ei_get_stats(struct net_device *dev);
 
 extern const struct net_device_ops ei_netdev_ops;
 
-extern struct net_device *__alloc_ei_netdev(int size);
+struct net_device *__alloc_ei_netdev(int size);
 static inline struct net_device *alloc_ei_netdev(void)
 {
         return __alloc_ei_netdev(0);
 }
 
 /* With I/O delay form */
-extern void NS8390p_init(struct net_device *dev, int startp);
-extern int eip_open(struct net_device *dev);
-extern int eip_close(struct net_device *dev);
-extern irqreturn_t eip_interrupt(int irq, void *dev_id);
-extern void eip_tx_timeout(struct net_device *dev);
-extern netdev_tx_t eip_start_xmit(struct sk_buff *skb, struct net_device *dev);
-extern void eip_set_multicast_list(struct net_device *dev);
-extern struct net_device_stats *eip_get_stats(struct net_device *dev);
+void NS8390p_init(struct net_device *dev, int startp);
+int eip_open(struct net_device *dev);
+int eip_close(struct net_device *dev);
+irqreturn_t eip_interrupt(int irq, void *dev_id);
+void eip_tx_timeout(struct net_device *dev);
+netdev_tx_t eip_start_xmit(struct sk_buff *skb, struct net_device *dev);
+void eip_set_multicast_list(struct net_device *dev);
+struct net_device_stats *eip_get_stats(struct net_device *dev);
 
 extern const struct net_device_ops eip_netdev_ops;
 
-extern struct net_device *__alloc_eip_netdev(int size);
+struct net_device *__alloc_eip_netdev(int size);
 static inline struct net_device *alloc_eip_netdev(void)
 {
         return __alloc_eip_netdev(0);
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index f92f001551da..36fa577970bb 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -702,7 +702,7 @@ static int ax_init_dev(struct net_device *dev)
                         for (i = 0; i < 16; i++)
                                 SA_prom[i] = SA_prom[i+i];
 
-                memcpy(dev->dev_addr, SA_prom, 6);
+                memcpy(dev->dev_addr, SA_prom, ETH_ALEN);
         }
 
 #ifdef CONFIG_AX88796_93CX6
diff --git a/drivers/net/ethernet/8390/ne2k-pci.c b/drivers/net/ethernet/8390/ne2k-pci.c
index 92201080e07a..fc14a85e4d5f 100644
--- a/drivers/net/ethernet/8390/ne2k-pci.c
+++ b/drivers/net/ethernet/8390/ne2k-pci.c
@@ -389,9 +389,7 @@ err_out_free_netdev:
         free_netdev (dev);
 err_out_free_res:
         release_region (ioaddr, NE_IO_EXTENT);
-        pci_set_drvdata (pdev, NULL);
         return -ENODEV;
-
 }
 
 /*
@@ -655,7 +653,6 @@ static void ne2k_pci_remove_one(struct pci_dev *pdev)
         release_region(dev->base_addr, NE_IO_EXTENT);
         free_netdev(dev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/ethernet/adaptec/starfire.c b/drivers/net/ethernet/adaptec/starfire.c
index 8b04bfc20cfb..171d73c1d3c2 100644
--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -835,7 +835,6 @@ static int starfire_init_one(struct pci_dev *pdev,
         return 0;
 
 err_out_cleardev:
-        pci_set_drvdata(pdev, NULL);
         iounmap(base);
 err_out_free_res:
         pci_release_regions (pdev);
@@ -2012,7 +2011,6 @@ static void starfire_remove_one(struct pci_dev *pdev)
         iounmap(np->base);
         pci_release_regions(pdev);
 
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);                       /* Will also free np!! */
 }
 
diff --git a/drivers/net/ethernet/adi/bfin_mac.h b/drivers/net/ethernet/adi/bfin_mac.h
index 7a07ee07906b..6dec86ac97cd 100644
--- a/drivers/net/ethernet/adi/bfin_mac.h
+++ b/drivers/net/ethernet/adi/bfin_mac.h
@@ -104,6 +104,6 @@ struct bfin_mac_local {
 #endif
 };
 
-extern int bfin_get_ether_addr(char *addr);
+int bfin_get_ether_addr(char *addr);
 
 #endif
diff --git a/drivers/net/ethernet/amd/7990.h b/drivers/net/ethernet/amd/7990.h
index 0a5837b96421..ae33a99bf476 100644
--- a/drivers/net/ethernet/amd/7990.h
+++ b/drivers/net/ethernet/amd/7990.h
@@ -242,13 +242,13 @@ struct lance_private
 #define LANCE_ADDR(x) ((int)(x) & ~0xff000000)
 
 /* Now the prototypes we export */
-extern int lance_open(struct net_device *dev);
-extern int lance_close (struct net_device *dev);
-extern int lance_start_xmit (struct sk_buff *skb, struct net_device *dev);
-extern void lance_set_multicast (struct net_device *dev);
-extern void lance_tx_timeout(struct net_device *dev);
+int lance_open(struct net_device *dev);
+int lance_close (struct net_device *dev);
+int lance_start_xmit (struct sk_buff *skb, struct net_device *dev);
+void lance_set_multicast (struct net_device *dev);
+void lance_tx_timeout(struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-extern void lance_poll(struct net_device *dev);
+void lance_poll(struct net_device *dev);
 #endif
 
 #endif /* ndef _7990_H */
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index 1b1429d5d5c2..d042511bdc13 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -1711,7 +1711,6 @@ static void amd8111e_remove_one(struct pci_dev *pdev)
                 free_netdev(dev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 static void amd8111e_config_ipg(struct net_device* dev)
@@ -1967,7 +1966,6 @@ err_free_reg:
 
 err_disable_pdev:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return err;
 
 }
diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
index 10ceca523fc0..e07ce5ff2d48 100644
--- a/drivers/net/ethernet/amd/atarilance.c
+++ b/drivers/net/ethernet/amd/atarilance.c
@@ -586,10 +586,10 @@ static unsigned long __init lance_probe1( struct net_device *dev,
         switch( lp->cardtype ) {
           case OLD_RIEBL:
                 /* No ethernet address! (Set some default address) */
-                memcpy( dev->dev_addr, OldRieblDefHwaddr, 6 );
+                memcpy(dev->dev_addr, OldRieblDefHwaddr, ETH_ALEN);
                 break;
           case NEW_RIEBL:
-                lp->memcpy_f( dev->dev_addr, RIEBL_HWADDR_ADDR, 6 );
+                lp->memcpy_f(dev->dev_addr, RIEBL_HWADDR_ADDR, ETH_ALEN);
                 break;
           case PAM_CARD:
                 i = IO->eeprom;
diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
index 91d52b495848..427c148bb643 100644
--- a/drivers/net/ethernet/amd/au1000_eth.c
+++ b/drivers/net/ethernet/amd/au1000_eth.c
@@ -1138,7 +1138,7 @@ static int au1000_probe(struct platform_device *pdev)
                 aup->phy1_search_mac0 = 1;
         } else {
                 if (is_valid_ether_addr(pd->mac)) {
-                        memcpy(dev->dev_addr, pd->mac, 6);
+                        memcpy(dev->dev_addr, pd->mac, ETH_ALEN);
                 } else {
                         /* Set a random MAC since no valid provided by platform_data. */
                         eth_hw_addr_random(dev);
diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
index 94edc9c6fbbf..cc35f6f4e703 100644
--- a/drivers/net/ethernet/amd/declance.c
+++ b/drivers/net/ethernet/amd/declance.c
@@ -344,8 +344,8 @@ static void cp_to_buf(const int type, void *to, const void *from, int len)
                 }
 
                 clen = len & 1;
-                rtp = tp;
-                rfp = fp;
+                rtp = (unsigned char *)tp;
+                rfp = (const unsigned char *)fp;
                 while (clen--) {
                         *rtp++ = *rfp++;
                 }
@@ -372,8 +372,8 @@ static void cp_to_buf(const int type, void *to, const void *from, int len)
                  * do the rest, if any.
                  */
                 clen = len & 15;
-                rtp = (unsigned char *) tp;
-                rfp = (unsigned char *) fp;
+                rtp = (unsigned char *)tp;
+                rfp = (const unsigned char *)fp;
                 while (clen--) {
                         *rtp++ = *rfp++;
                 }
@@ -403,8 +403,8 @@ static void cp_from_buf(const int type, void *to, const void *from, int len)
 
                 clen = len & 1;
 
-                rtp = tp;
-                rfp = fp;
+                rtp = (unsigned char *)tp;
+                rfp = (const unsigned char *)fp;
 
                 while (clen--) {
                         *rtp++ = *rfp++;
@@ -433,8 +433,8 @@ static void cp_from_buf(const int type, void *to, const void *from, int len)
                  * do the rest, if any.
                  */
                 clen = len & 15;
-                rtp = (unsigned char *) tp;
-                rfp = (unsigned char *) fp;
+                rtp = (unsigned char *)tp;
+                rfp = (const unsigned char *)fp;
                 while (clen--) {
                         *rtp++ = *rfp++;
                 }
diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
index 5c728436b85e..256f590f6bb1 100644
--- a/drivers/net/ethernet/amd/lance.c
+++ b/drivers/net/ethernet/amd/lance.c
@@ -754,7 +754,7 @@ lance_open(struct net_device *dev)
         int i;
 
         if (dev->irq == 0 ||
-                request_irq(dev->irq, lance_interrupt, 0, lp->name, dev)) {
+                request_irq(dev->irq, lance_interrupt, 0, dev->name, dev)) {
                 return -EAGAIN;
         }
 
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 2d8e28819779..38492e0b704e 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1675,7 +1675,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                                 pr_cont(" warning: CSR address invalid,\n");
                                 pr_info("    using instead PROM address of");
                         }
-                        memcpy(dev->dev_addr, promaddr, 6);
+                        memcpy(dev->dev_addr, promaddr, ETH_ALEN);
                 }
         }
 
@@ -2818,7 +2818,6 @@ static void pcnet32_remove_one(struct pci_dev *pdev)
                                     lp->init_block, lp->init_dma_addr);
                 free_netdev(dev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index a597b766f080..daae0e016253 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -1220,8 +1220,8 @@ static void bmac_reset_and_enable(struct net_device *dev)
         if (skb != NULL) {
                 data = skb_put(skb, ETHERMINPACKET);
                 memset(data, 0, ETHERMINPACKET);
-                memcpy(data, dev->dev_addr, 6);
-                memcpy(data+6, dev->dev_addr, 6);
+                memcpy(data, dev->dev_addr, ETH_ALEN);
+                memcpy(data + ETH_ALEN, dev->dev_addr, ETH_ALEN);
                 bmac_transmit_packet(skb, dev);
         }
         spin_unlock_irqrestore(&bp->lock, flags);
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index fc95b235e210..5aa5e8146496 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1367,7 +1367,6 @@ static void alx_remove(struct pci_dev *pdev)
 
         pci_disable_pcie_error_reporting(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         free_netdev(alx->dev);
 }
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
index 0f0556526ba9..7f9369a3b378 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
@@ -600,7 +600,7 @@ struct atl1c_adapter {
 extern char atl1c_driver_name[];
 extern char atl1c_driver_version[];
 
-extern void atl1c_reinit_locked(struct atl1c_adapter *adapter);
-extern s32 atl1c_reset_hw(struct atl1c_hw *hw);
-extern void atl1c_set_ethtool_ops(struct net_device *netdev);
+void atl1c_reinit_locked(struct atl1c_adapter *adapter);
+s32 atl1c_reset_hw(struct atl1c_hw *hw);
+void atl1c_set_ethtool_ops(struct net_device *netdev);
 #endif /* _ATL1C_H_ */
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_hw.c b/drivers/net/ethernet/atheros/atl1c/atl1c_hw.c
index 3ef7092e3f1c..1cda49a28f7f 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_hw.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_hw.c
@@ -153,7 +153,7 @@ static int atl1c_get_permanent_address(struct atl1c_hw *hw)
 bool atl1c_read_eeprom(struct atl1c_hw *hw, u32 offset, u32 *p_value)
 {
         int i;
-        int ret = false;
+        bool ret = false;
         u32 otp_ctrl_data;
         u32 control;
         u32 data;
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
index b5fd934585e9..1b0fe2d04a0e 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
@@ -499,10 +499,10 @@ struct atl1e_adapter {
 extern char atl1e_driver_name[];
 extern char atl1e_driver_version[];
 
-extern void atl1e_check_options(struct atl1e_adapter *adapter);
-extern int atl1e_up(struct atl1e_adapter *adapter);
-extern void atl1e_down(struct atl1e_adapter *adapter);
-extern void atl1e_reinit_locked(struct atl1e_adapter *adapter);
-extern s32 atl1e_reset_hw(struct atl1e_hw *hw);
-extern void atl1e_set_ethtool_ops(struct net_device *netdev);
+void atl1e_check_options(struct atl1e_adapter *adapter);
+int atl1e_up(struct atl1e_adapter *adapter);
+void atl1e_down(struct atl1e_adapter *adapter);
+void atl1e_reinit_locked(struct atl1e_adapter *adapter);
+s32 atl1e_reset_hw(struct atl1e_hw *hw);
+void atl1e_set_ethtool_ops(struct net_device *netdev);
 #endif /* _ATL1_E_H_ */
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index 1966444590f6..7a73f3a9fcb5 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -313,6 +313,34 @@ static void atl1e_set_multi(struct net_device *netdev)
         }
 }
 
+static void __atl1e_rx_mode(netdev_features_t features, u32 *mac_ctrl_data)
+{
+
+        if (features & NETIF_F_RXALL) {
+                /* enable RX of ALL frames */
+                *mac_ctrl_data |= MAC_CTRL_DBG;
+        } else {
+                /* disable RX of ALL frames */
+                *mac_ctrl_data &= ~MAC_CTRL_DBG;
+        }
+}
+
+static void atl1e_rx_mode(struct net_device *netdev,
+        netdev_features_t features)
+{
+        struct atl1e_adapter *adapter = netdev_priv(netdev);
+        u32 mac_ctrl_data = 0;
+
+        netdev_dbg(adapter->netdev, "%s\n", __func__);
+
+        atl1e_irq_disable(adapter);
+        mac_ctrl_data = AT_READ_REG(&adapter->hw, REG_MAC_CTRL);
+        __atl1e_rx_mode(features, &mac_ctrl_data);
+        AT_WRITE_REG(&adapter->hw, REG_MAC_CTRL, mac_ctrl_data);
+        atl1e_irq_enable(adapter);
+}
+
+
 static void __atl1e_vlan_mode(netdev_features_t features, u32 *mac_ctrl_data)
 {
         if (features & NETIF_F_HW_VLAN_CTAG_RX) {
@@ -394,6 +422,10 @@ static int atl1e_set_features(struct net_device *netdev,
         if (changed & NETIF_F_HW_VLAN_CTAG_RX)
                 atl1e_vlan_mode(netdev, features);
 
+        if (changed & NETIF_F_RXALL)
+                atl1e_rx_mode(netdev, features);
+
+
         return 0;
 }
 
@@ -1057,7 +1089,8 @@ static void atl1e_setup_mac_ctrl(struct atl1e_adapter *adapter)
                 value |= MAC_CTRL_PROMIS_EN;
         if (netdev->flags & IFF_ALLMULTI)
                 value |= MAC_CTRL_MC_ALL_EN;
-
+        if (netdev->features & NETIF_F_RXALL)
+                value |= MAC_CTRL_DBG;
         AT_WRITE_REG(hw, REG_MAC_CTRL, value);
 }
 
@@ -1405,7 +1438,8 @@ static void atl1e_clean_rx_irq(struct atl1e_adapter *adapter, u8 que,
                         rx_page_desc[que].rx_nxseq++;
 
                         /* error packet */
-                        if (prrs->pkt_flag & RRS_IS_ERR_FRAME) {
+                        if ((prrs->pkt_flag & RRS_IS_ERR_FRAME) &&
+                            !(netdev->features & NETIF_F_RXALL)) {
                                 if (prrs->err_flag & (RRS_ERR_BAD_CRC |
                                         RRS_ERR_DRIBBLE | RRS_ERR_CODE |
                                         RRS_ERR_TRUNC)) {
@@ -1418,7 +1452,10 @@ static void atl1e_clean_rx_irq(struct atl1e_adapter *adapter, u8 que,
                         }
 
                         packet_size = ((prrs->word1 >> RRS_PKT_SIZE_SHIFT) &
-                                        RRS_PKT_SIZE_MASK) - 4; /* CRC */
+                                        RRS_PKT_SIZE_MASK);
+                        if (likely(!(netdev->features & NETIF_F_RXFCS)))
+                                packet_size -= 4; /* CRC */
+
                         skb = netdev_alloc_skb_ip_align(netdev, packet_size);
                         if (skb == NULL)
                                 goto skip_pkt;
@@ -2245,7 +2282,8 @@ static int atl1e_init_netdev(struct net_device *netdev, struct pci_dev *pdev)
                               NETIF_F_HW_VLAN_CTAG_RX;
         netdev->features = netdev->hw_features | NETIF_F_LLTX |
                            NETIF_F_HW_VLAN_CTAG_TX;
-
+        /* not enabled by default */
+        netdev->hw_features |= NETIF_F_RXALL | NETIF_F_RXFCS;
         return 0;
 }
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.h b/drivers/net/ethernet/atheros/atlx/atl2.h
index 3ebe19f7242b..2f27d4c4c3ad 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.h
+++ b/drivers/net/ethernet/atheros/atlx/atl2.h
@@ -42,7 +42,7 @@
 #include "atlx.h"
 
 #ifdef ETHTOOL_OPS_COMPAT
-extern int ethtool_ioctl(struct ifreq *ifr);
+int ethtool_ioctl(struct ifreq *ifr);
 #endif
 
 #define PCI_COMMAND_REGISTER    PCI_COMMAND
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 9b017d9c58e9..079a597fa20c 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -596,6 +596,7 @@ static void b44_timer(unsigned long __opaque)
 static void b44_tx(struct b44 *bp)
 {
         u32 cur, cons;
+        unsigned bytes_compl = 0, pkts_compl = 0;
 
         cur  = br32(bp, B44_DMATX_STAT) & DMATX_STAT_CDMASK;
         cur /= sizeof(struct dma_desc);
@@ -612,9 +613,14 @@ static void b44_tx(struct b44 *bp)
                                  skb->len,
                                  DMA_TO_DEVICE);
                 rp->skb = NULL;
+
+                bytes_compl += skb->len;
+                pkts_compl++;
+
                 dev_kfree_skb_irq(skb);
         }
 
+        netdev_completed_queue(bp->dev, pkts_compl, bytes_compl);
         bp->tx_cons = cons;
         if (netif_queue_stopped(bp->dev) &&
             TX_BUFFS_AVAIL(bp) > B44_TX_WAKEUP_THRESH)
@@ -1018,6 +1024,8 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (bp->flags & B44_FLAG_REORDER_BUG)
                 br32(bp, B44_DMATX_PTR);
 
+        netdev_sent_queue(dev, skb->len);
+
         if (TX_BUFFS_AVAIL(bp) < 1)
                 netif_stop_queue(dev);
 
@@ -1416,6 +1424,8 @@ static void b44_init_hw(struct b44 *bp, int reset_kind)
 
         val = br32(bp, B44_ENET_CTRL);
         bw32(bp, B44_ENET_CTRL, (val | ENET_CTRL_ENABLE));
+
+        netdev_reset_queue(bp->dev);
 }
 
 static int b44_open(struct net_device *dev)
@@ -2101,7 +2111,7 @@ static int b44_get_invariants(struct b44 *bp)
          * valid PHY address. */
         bp->phy_addr &= 0x1F;
 
-        memcpy(bp->dev->dev_addr, addr, 6);
+        memcpy(bp->dev->dev_addr, addr, ETH_ALEN);
 
         if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
                 pr_err("Invalid MAC address found in EEPROM\n");
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 249468f95365..7eca5a174733 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -149,6 +149,8 @@ static netdev_tx_t bgmac_dma_tx_add(struct bgmac *bgmac,
         dma_desc->ctl0 = cpu_to_le32(ctl0);
         dma_desc->ctl1 = cpu_to_le32(ctl1);
 
+        netdev_sent_queue(net_dev, skb->len);
+
         wmb();
 
         /* Increase ring->end to point empty slot. We tell hardware the first
@@ -178,6 +180,7 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
         struct device *dma_dev = bgmac->core->dma_dev;
         int empty_slot;
         bool freed = false;
+        unsigned bytes_compl = 0, pkts_compl = 0;
 
         /* The last slot that hardware didn't consume yet */
         empty_slot = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_TX_STATUS);
@@ -195,6 +198,9 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
                                          slot->skb->len, DMA_TO_DEVICE);
                         slot->dma_addr = 0;
 
+                        bytes_compl += slot->skb->len;
+                        pkts_compl++;
+
                         /* Free memory! :) */
                         dev_kfree_skb(slot->skb);
                         slot->skb = NULL;
@@ -208,6 +214,8 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
                 freed = true;
         }
 
+        netdev_completed_queue(bgmac->net_dev, pkts_compl, bytes_compl);
+
         if (freed && netif_queue_stopped(bgmac->net_dev))
                 netif_wake_queue(bgmac->net_dev);
 }
@@ -988,6 +996,8 @@ static void bgmac_chip_reset(struct bgmac *bgmac)
         bgmac_miiconfig(bgmac);
         bgmac_phy_init(bgmac);
 
+        netdev_reset_queue(bgmac->net_dev);
+
         bgmac->int_status = 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index e838a3f74b69..d9980ad00b4b 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -5761,8 +5761,8 @@ bnx2_run_loopback(struct bnx2 *bp, int loopback_mode)
         if (!skb)
                 return -ENOMEM;
         packet = skb_put(skb, pkt_size);
-        memcpy(packet, bp->dev->dev_addr, 6);
-        memset(packet + 6, 0x0, 8);
+        memcpy(packet, bp->dev->dev_addr, ETH_ALEN);
+        memset(packet + ETH_ALEN, 0x0, 8);
         for (i = 14; i < pkt_size; i++)
                 packet[i] = (unsigned char) (i & 0xff);
 
@@ -8413,7 +8413,6 @@ err_out_release:
 
 err_out_disable:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
 err_out:
         return rc;
@@ -8514,7 +8513,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_set_drvdata(pdev, dev);
 
-        memcpy(dev->dev_addr, bp->mac_addr, 6);
+        memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
                 NETIF_F_TSO | NETIF_F_TSO_ECN |
@@ -8546,7 +8545,6 @@ error:
         pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 err_free:
         free_netdev(dev);
         return rc;
@@ -8578,7 +8576,6 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static int
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index c5e375ddd6c0..4e01c57d8c8d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1546,6 +1546,7 @@ struct bnx2x {
 #define IS_VF_FLAG                      (1 << 22)
 #define INTERRUPTS_ENABLED_FLAG         (1 << 23)
 #define BC_SUPPORTS_RMMOD_CMD           (1 << 24)
+#define HAS_PHYS_PORT_ID                (1 << 25)
 
 #define BP_NOMCP(bp)                    ((bp)->flags & NO_MCP_FLAG)
 
@@ -1876,6 +1877,8 @@ struct bnx2x {
         u32 dump_preset_idx;
         bool                                    stats_started;
         struct semaphore                        stats_sema;
+
+        u8                                      phys_port_id[ETH_ALEN];
 };
 
 /* Tx queues may be less or equal to Rx queues */
@@ -2232,7 +2235,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
 #define BNX2X_NUM_TESTS_SF              7
 #define BNX2X_NUM_TESTS_MF              3
 #define BNX2X_NUM_TESTS(bp)             (IS_MF(bp) ? BNX2X_NUM_TESTS_MF : \
-                                                     BNX2X_NUM_TESTS_SF)
+                                             IS_VF(bp) ? 0 : BNX2X_NUM_TESTS_SF)
 
 #define BNX2X_PHY_LOOPBACK              0
 #define BNX2X_MAC_LOOPBACK              1
@@ -2492,12 +2495,6 @@ enum {
 
 #define NUM_MACS        8
 
-enum bnx2x_pci_bus_speed {
-        BNX2X_PCI_LINK_SPEED_2500 = 2500,
-        BNX2X_PCI_LINK_SPEED_5000 = 5000,
-        BNX2X_PCI_LINK_SPEED_8000 = 8000
-};
-
 void bnx2x_set_local_cmng(struct bnx2x *bp);
 
 #define MCPR_SCRATCH_BASE(bp) \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4ab4c89c60cd..6e46cff5236d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3256,14 +3256,16 @@ static u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
         if (prot == IPPROTO_TCP)
                 rc |= XMIT_CSUM_TCP;
 
-        if (skb_is_gso_v6(skb)) {
-                rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP);
-                if (rc & XMIT_CSUM_ENC)
-                        rc |= XMIT_GSO_ENC_V6;
-        } else if (skb_is_gso(skb)) {
-                rc |= (XMIT_GSO_V4 | XMIT_CSUM_TCP);
-                if (rc & XMIT_CSUM_ENC)
-                        rc |= XMIT_GSO_ENC_V4;
+        if (skb_is_gso(skb)) {
+                if (skb_is_gso_v6(skb)) {
+                        rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP);
+                        if (rc & XMIT_CSUM_ENC)
+                                rc |= XMIT_GSO_ENC_V6;
+                } else {
+                        rc |= (XMIT_GSO_V4 | XMIT_CSUM_TCP);
+                        if (rc & XMIT_CSUM_ENC)
+                                rc |= XMIT_GSO_ENC_V4;
+                }
         }
 
         return rc;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index e8efa1c93ffe..32d0f1435fb4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -639,6 +639,9 @@ static int bnx2x_get_regs_len(struct net_device *dev)
         struct bnx2x *bp = netdev_priv(dev);
         int regdump_len = 0;
 
+        if (IS_VF(bp))
+                return 0;
+
         regdump_len = __bnx2x_get_regs_len(bp);
         regdump_len *= 4;
         regdump_len += sizeof(struct dump_header);
@@ -2864,9 +2867,16 @@ static void bnx2x_self_test(struct net_device *dev,
 
         memset(buf, 0, sizeof(u64) * BNX2X_NUM_TESTS(bp));
 
+        if (bnx2x_test_nvram(bp) != 0) {
+                if (!IS_MF(bp))
+                        buf[4] = 1;
+                else
+                        buf[0] = 1;
+                etest->flags |= ETH_TEST_FL_FAILED;
+        }
+
         if (!netif_running(dev)) {
-                DP(BNX2X_MSG_ETHTOOL,
-                   "Can't perform self-test when interface is down\n");
+                DP(BNX2X_MSG_ETHTOOL, "Interface is down\n");
                 return;
         }
 
@@ -2928,13 +2938,7 @@ static void bnx2x_self_test(struct net_device *dev,
                 /* wait until link state is restored */
                 bnx2x_wait_for_link(bp, link_up, is_serdes);
         }
-        if (bnx2x_test_nvram(bp) != 0) {
-                if (!IS_MF(bp))
-                        buf[4] = 1;
-                else
-                        buf[0] = 1;
-                etest->flags |= ETH_TEST_FL_FAILED;
-        }
+
         if (bnx2x_test_intr(bp) != 0) {
                 if (!IS_MF(bp))
                         buf[5] = 1;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
index 32767f6aa33f..cf1df8b62e2c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
@@ -172,6 +172,7 @@ struct shared_hw_cfg {			 /* NVRAM Offset */
                 #define SHARED_HW_CFG_LED_MAC4                       0x000c0000
                 #define SHARED_HW_CFG_LED_PHY8                       0x000d0000
                 #define SHARED_HW_CFG_LED_EXTPHY1                    0x000e0000
+                #define SHARED_HW_CFG_LED_EXTPHY2                    0x000f0000
 
 
         #define SHARED_HW_CFG_AN_ENABLE_MASK                0x3f000000
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 51468227bf3b..20dcc02431ca 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -3122,7 +3122,7 @@ static void bnx2x_bsc_module_sel(struct link_params *params)
 }
 
 static int bnx2x_bsc_read(struct link_params *params,
-                          struct bnx2x_phy *phy,
+                          struct bnx2x *bp,
                           u8 sl_devid,
                           u16 sl_addr,
                           u8 lc_addr,
@@ -3131,7 +3131,6 @@ static int bnx2x_bsc_read(struct link_params *params,
 {
         u32 val, i;
         int rc = 0;
-        struct bnx2x *bp = params->bp;
 
         if (xfer_cnt > 16) {
                 DP(NETIF_MSG_LINK, "invalid xfer_cnt %d. Max is 16 bytes\n",
@@ -6371,9 +6370,15 @@ int bnx2x_set_led(struct link_params *params,
                          * intended override.
                          */
                         break;
-                } else
+                } else {
+                        u32 nig_led_mode = ((params->hw_led_mode <<
+                                             SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                                            SHARED_HW_CFG_LED_EXTPHY2) ?
+                                (SHARED_HW_CFG_LED_PHY1 >>
+                                 SHARED_HW_CFG_LED_MODE_SHIFT) : hw_led_mode;
                         REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4,
-                               hw_led_mode);
+                               nig_led_mode);
+                }
 
                 REG_WR(bp, NIG_REG_LED_CONTROL_OVERRIDE_TRAFFIC_P0 + port*4, 0);
                 /* Set blinking rate to ~15.9Hz */
@@ -7917,7 +7922,7 @@ static int bnx2x_warpcore_read_sfp_module_eeprom(struct bnx2x_phy *phy,
                         usleep_range(1000, 2000);
                         bnx2x_warpcore_power_module(params, 1);
                 }
-                rc = bnx2x_bsc_read(params, phy, dev_addr, addr32, 0, byte_cnt,
+                rc = bnx2x_bsc_read(params, bp, dev_addr, addr32, 0, byte_cnt,
                                     data_array);
         } while ((rc != 0) && (++cnt < I2C_WA_RETRY_CNT));
 
@@ -10653,10 +10658,18 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          0x40);
 
                 } else {
+                        /* EXTPHY2 LED mode indicate that the 100M/1G/10G LED
+                         * sources are all wired through LED1, rather than only
+                         * 10G in other modes.
+                         */
+                        val = ((params->hw_led_mode <<
+                                SHARED_HW_CFG_LED_MODE_SHIFT) ==
+                               SHARED_HW_CFG_LED_EXTPHY2) ? 0x98 : 0x80;
+
                         bnx2x_cl45_write(bp, phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
-                                         0x80);
+                                         val);
 
                         /* Tell LED3 to blink on source */
                         bnx2x_cl45_read(bp, phy,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index b42f89ce02ef..bb2f20291509 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9916,7 +9916,7 @@ static int bnx2x_prev_path_mark_eeh(struct bnx2x *bp)
 static bool bnx2x_prev_is_path_marked(struct bnx2x *bp)
 {
         struct bnx2x_prev_path_list *tmp_list;
-        int rc = false;
+        bool rc = false;
 
         if (down_trylock(&bnx2x_prev_sem))
                 return false;
@@ -11186,6 +11186,14 @@ static void bnx2x_get_mac_hwinfo(struct bnx2x *bp)
                         bnx2x_get_cnic_mac_hwinfo(bp);
         }
 
+        if (!BP_NOMCP(bp)) {
+                /* Read physical port identifier from shmem */
+                val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_upper);
+                val = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_lower);
+                bnx2x_set_mac_buf(bp->phys_port_id, val, val2);
+                bp->flags |= HAS_PHYS_PORT_ID;
+        }
+
         memcpy(bp->link_params.mac_addr, bp->dev->dev_addr, ETH_ALEN);
 
         if (!bnx2x_is_valid_ether_addr(bp, bp->dev->dev_addr))
@@ -11784,7 +11792,7 @@ static int bnx2x_open(struct net_device *dev)
         rc = bnx2x_nic_load(bp, LOAD_OPEN);
         if (rc)
                 return rc;
-        return bnx2x_open_epilog(bp);
+        return 0;
 }
 
 /* called with rtnl_lock */
@@ -12082,6 +12090,20 @@ static int bnx2x_validate_addr(struct net_device *dev)
         return 0;
 }
 
+static int bnx2x_get_phys_port_id(struct net_device *netdev,
+                                  struct netdev_phys_port_id *ppid)
+{
+        struct bnx2x *bp = netdev_priv(netdev);
+
+        if (!(bp->flags & HAS_PHYS_PORT_ID))
+                return -EOPNOTSUPP;
+
+        ppid->id_len = sizeof(bp->phys_port_id);
+        memcpy(ppid->id, bp->phys_port_id, ppid->id_len);
+
+        return 0;
+}
+
 static const struct net_device_ops bnx2x_netdev_ops = {
         .ndo_open               = bnx2x_open,
         .ndo_stop               = bnx2x_close,
@@ -12111,6 +12133,7 @@ static const struct net_device_ops bnx2x_netdev_ops = {
 #ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = bnx2x_low_latency_recv,
 #endif
+        .ndo_get_phys_port_id   = bnx2x_get_phys_port_id,
 };
 
 static int bnx2x_set_coherency_mask(struct bnx2x *bp)
@@ -12274,10 +12297,13 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                 NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                 NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
         if (!CHIP_IS_E1x(bp)) {
-                dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL;
+                dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
+                                    NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                 dev->hw_enc_features =
                         NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_SG |
                         NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
+                        NETIF_F_GSO_IPIP |
+                        NETIF_F_GSO_SIT |
                         NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL;
         }
 
@@ -12310,34 +12336,11 @@ err_out_release:
 
 err_out_disable:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
 err_out:
         return rc;
 }
 
-static void bnx2x_get_pcie_width_speed(struct bnx2x *bp, int *width,
-                                       enum bnx2x_pci_bus_speed *speed)
-{
-        u32 link_speed, val = 0;
-
-        pci_read_config_dword(bp->pdev, PCICFG_LINK_CONTROL, &val);
-        *width = (val & PCICFG_LINK_WIDTH) >> PCICFG_LINK_WIDTH_SHIFT;
-
-        link_speed = (val & PCICFG_LINK_SPEED) >> PCICFG_LINK_SPEED_SHIFT;
-
-        switch (link_speed) {
-        case 3:
-                *speed = BNX2X_PCI_LINK_SPEED_8000;
-                break;
-        case 2:
-                *speed = BNX2X_PCI_LINK_SPEED_5000;
-                break;
-        default:
-                *speed = BNX2X_PCI_LINK_SPEED_2500;
-        }
-}
-
 static int bnx2x_check_firmware(struct bnx2x *bp)
 {
         const struct firmware *firmware = bp->firmware;
@@ -12694,8 +12697,8 @@ static int bnx2x_init_one(struct pci_dev *pdev,
 {
         struct net_device *dev = NULL;
         struct bnx2x *bp;
-        int pcie_width;
-        enum bnx2x_pci_bus_speed pcie_speed;
+        enum pcie_link_width pcie_width;
+        enum pci_bus_speed pcie_speed;
         int rc, max_non_def_sbs;
         int rx_count, tx_count, rss_count, doorbell_size;
         int max_cos_est;
@@ -12844,18 +12847,19 @@ static int bnx2x_init_one(struct pci_dev *pdev,
                 dev_addr_add(bp->dev, bp->fip_mac, NETDEV_HW_ADDR_T_SAN);
                 rtnl_unlock();
         }
-
-        bnx2x_get_pcie_width_speed(bp, &pcie_width, &pcie_speed);
-        BNX2X_DEV_INFO("got pcie width %d and speed %d\n",
-                       pcie_width, pcie_speed);
-
-        BNX2X_DEV_INFO("%s (%c%d) PCI-E x%d %s found at mem %lx, IRQ %d, node addr %pM\n",
+        if (pcie_get_minimum_link(bp->pdev, &pcie_speed, &pcie_width) ||
+            pcie_speed == PCI_SPEED_UNKNOWN ||
+            pcie_width == PCIE_LNK_WIDTH_UNKNOWN)
+                BNX2X_DEV_INFO("Failed to determine PCI Express Bandwidth\n");
+        else
+                BNX2X_DEV_INFO(
+                       "%s (%c%d) PCI-E x%d %s found at mem %lx, IRQ %d, node addr %pM\n",
                        board_info[ent->driver_data].name,
                        (CHIP_REV(bp) >> 12) + 'A', (CHIP_METAL(bp) >> 4),
                        pcie_width,
-                       pcie_speed == BNX2X_PCI_LINK_SPEED_2500 ? "2.5GHz" :
-                       pcie_speed == BNX2X_PCI_LINK_SPEED_5000 ? "5.0GHz" :
-                       pcie_speed == BNX2X_PCI_LINK_SPEED_8000 ? "8.0GHz" :
+                       pcie_speed == PCIE_SPEED_2_5GT ? "2.5GHz" :
+                       pcie_speed == PCIE_SPEED_5_0GT ? "5.0GHz" :
+                       pcie_speed == PCIE_SPEED_8_0GT ? "8.0GHz" :
                        "Unknown",
                        dev->base_addr, bp->pdev->irq, dev->dev_addr);
 
@@ -12874,7 +12878,6 @@ init_one_exit:
                 pci_release_regions(pdev);
 
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         return rc;
 }
@@ -12957,7 +12960,6 @@ static void __bnx2x_remove(struct pci_dev *pdev,
                 pci_release_regions(pdev);
 
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static void bnx2x_remove_one(struct pci_dev *pdev)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index bf08ad68b405..71fffad94aff 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -2802,7 +2802,7 @@ struct set_vf_state_cookie {
         u8 state;
 };
 
-void bnx2x_set_vf_state(void *cookie)
+static void bnx2x_set_vf_state(void *cookie)
 {
         struct set_vf_state_cookie *p = (struct set_vf_state_cookie *)cookie;
 
@@ -3225,8 +3225,9 @@ void bnx2x_disable_sriov(struct bnx2x *bp)
         pci_disable_sriov(bp->pdev);
 }
 
-int bnx2x_vf_ndo_prep(struct bnx2x *bp, int vfidx, struct bnx2x_virtf **vf,
-                        struct pf_vf_bulletin_content **bulletin)
+static int bnx2x_vf_ndo_prep(struct bnx2x *bp, int vfidx,
+                             struct bnx2x_virtf **vf,
+                             struct pf_vf_bulletin_content **bulletin)
 {
         if (bp->state != BNX2X_STATE_OPEN) {
                 BNX2X_ERR("vf ndo called though PF is down\n");
@@ -3642,29 +3643,6 @@ alloc_mem_err:
         return -ENOMEM;
 }
 
-int bnx2x_open_epilog(struct bnx2x *bp)
-{
-        /* Enable sriov via delayed work. This must be done via delayed work
-         * because it causes the probe of the vf devices to be run, which invoke
-         * register_netdevice which must have rtnl lock taken. As we are holding
-         * the lock right now, that could only work if the probe would not take
-         * the lock. However, as the probe of the vf may be called from other
-         * contexts as well (such as passthrough to vm fails) it can't assume
-         * the lock is being held for it. Using delayed work here allows the
-         * probe code to simply take the lock (i.e. wait for it to be released
-         * if it is being held). We only want to do this if the number of VFs
-         * was set before PF driver was loaded.
-         */
-        if (IS_SRIOV(bp) && BNX2X_NR_VIRTFN(bp)) {
-                smp_mb__before_clear_bit();
-                set_bit(BNX2X_SP_RTNL_ENABLE_SRIOV, &bp->sp_rtnl_state);
-                smp_mb__after_clear_bit();
-                schedule_delayed_work(&bp->sp_rtnl_task, 0);
-        }
-
-        return 0;
-}
-
 void bnx2x_iov_channel_down(struct bnx2x *bp)
 {
         int vf_idx;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 059f0d460af2..1ff6a9366629 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -782,7 +782,6 @@ static inline int bnx2x_vf_headroom(struct bnx2x *bp)
 void bnx2x_pf_set_vfs_vlan(struct bnx2x *bp);
 int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs);
 void bnx2x_iov_channel_down(struct bnx2x *bp);
-int bnx2x_open_epilog(struct bnx2x *bp);
 
 #else /* CONFIG_BNX2X_SRIOV */
 
@@ -842,7 +841,6 @@ static inline int bnx2x_vf_pci_alloc(struct bnx2x *bp) {return 0; }
 static inline void bnx2x_pf_set_vfs_vlan(struct bnx2x *bp) {}
 static inline int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs) {return 0; }
 static inline void bnx2x_iov_channel_down(struct bnx2x *bp) {}
-static inline int bnx2x_open_epilog(struct bnx2x *bp) {return 0; }
 
 #endif /* CONFIG_BNX2X_SRIOV */
 #endif /* bnx2x_sriov.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 28757dfacf0d..9199adf32d33 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -60,6 +60,30 @@ void bnx2x_vfpf_finalize(struct bnx2x *bp, struct vfpf_first_tlv *first_tlv)
         mutex_unlock(&bp->vf2pf_mutex);
 }
 
+/* Finds a TLV by type in a TLV buffer; If found, returns pointer to the TLV */
+static void *bnx2x_search_tlv_list(struct bnx2x *bp, void *tlvs_list,
+                                   enum channel_tlvs req_tlv)
+{
+        struct channel_tlv *tlv = (struct channel_tlv *)tlvs_list;
+
+        do {
+                if (tlv->type == req_tlv)
+                        return tlv;
+
+                if (!tlv->length) {
+                        BNX2X_ERR("Found TLV with length 0\n");
+                        return NULL;
+                }
+
+                tlvs_list += tlv->length;
+                tlv = (struct channel_tlv *)tlvs_list;
+        } while (tlv->type != CHANNEL_TLV_LIST_END);
+
+        DP(BNX2X_MSG_IOV, "TLV list does not contain %d TLV\n", req_tlv);
+
+        return NULL;
+}
+
 /* list the types and lengths of the tlvs on the buffer */
 void bnx2x_dp_tlv_list(struct bnx2x *bp, void *tlvs_list)
 {
@@ -196,6 +220,7 @@ int bnx2x_vfpf_acquire(struct bnx2x *bp, u8 tx_count, u8 rx_count)
         int rc = 0, attempts = 0;
         struct vfpf_acquire_tlv *req = &bp->vf2pf_mbox->req.acquire;
         struct pfvf_acquire_resp_tlv *resp = &bp->vf2pf_mbox->resp.acquire_resp;
+        struct vfpf_port_phys_id_resp_tlv *phys_port_resp;
         u32 vf_id;
         bool resources_acquired = false;
 
@@ -219,8 +244,14 @@ int bnx2x_vfpf_acquire(struct bnx2x *bp, u8 tx_count, u8 rx_count)
         /* pf 2 vf bulletin board address */
         req->bulletin_addr = bp->pf2vf_bulletin_mapping;
 
+        /* Request physical port identifier */
+        bnx2x_add_tlv(bp, req, req->first_tlv.tl.length,
+                      CHANNEL_TLV_PHYS_PORT_ID, sizeof(struct channel_tlv));
+
         /* add list termination tlv */
-        bnx2x_add_tlv(bp, req, req->first_tlv.tl.length, CHANNEL_TLV_LIST_END,
+        bnx2x_add_tlv(bp, req,
+                      req->first_tlv.tl.length + sizeof(struct channel_tlv),
+                      CHANNEL_TLV_LIST_END,
                       sizeof(struct channel_list_end_tlv));
 
         /* output tlvs list */
@@ -287,6 +318,15 @@ int bnx2x_vfpf_acquire(struct bnx2x *bp, u8 tx_count, u8 rx_count)
                 }
         }
 
+        /* Retrieve physical port id (if possible) */
+        phys_port_resp = (struct vfpf_port_phys_id_resp_tlv *)
+                         bnx2x_search_tlv_list(bp, resp,
+                                               CHANNEL_TLV_PHYS_PORT_ID);
+        if (phys_port_resp) {
+                memcpy(bp->phys_port_id, phys_port_resp->id, ETH_ALEN);
+                bp->flags |= HAS_PHYS_PORT_ID;
+        }
+
         /* get HW info */
         bp->common.chip_id |= (bp->acquire_resp.pfdev_info.chip_num & 0xffff);
         bp->link_params.chip_id = bp->common.chip_id;
@@ -983,53 +1023,59 @@ static int bnx2x_copy32_vf_dmae(struct bnx2x *bp, u8 from_vf,
         return bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
 }
 
-static void bnx2x_vf_mbx_resp(struct bnx2x *bp, struct bnx2x_virtf *vf)
+static void bnx2x_vf_mbx_resp_single_tlv(struct bnx2x *bp,
+                                         struct bnx2x_virtf *vf)
 {
         struct bnx2x_vf_mbx *mbx = BP_VF_MBX(bp, vf->index);
-        u64 vf_addr;
-        dma_addr_t pf_addr;
         u16 length, type;
-        int rc;
-        struct pfvf_general_resp_tlv *resp = &mbx->msg->resp.general_resp;
 
         /* prepare response */
         type = mbx->first_tlv.tl.type;
         length = type == CHANNEL_TLV_ACQUIRE ?
                 sizeof(struct pfvf_acquire_resp_tlv) :
                 sizeof(struct pfvf_general_resp_tlv);
-        bnx2x_add_tlv(bp, resp, 0, type, length);
-        resp->hdr.status = bnx2x_pfvf_status_codes(vf->op_rc);
-        bnx2x_add_tlv(bp, resp, length, CHANNEL_TLV_LIST_END,
+        bnx2x_add_tlv(bp, &mbx->msg->resp, 0, type, length);
+        bnx2x_add_tlv(bp, &mbx->msg->resp, length, CHANNEL_TLV_LIST_END,
                       sizeof(struct channel_list_end_tlv));
+}
+
+static void bnx2x_vf_mbx_resp_send_msg(struct bnx2x *bp,
+                                       struct bnx2x_virtf *vf)
+{
+        struct bnx2x_vf_mbx *mbx = BP_VF_MBX(bp, vf->index);
+        struct pfvf_general_resp_tlv *resp = &mbx->msg->resp.general_resp;
+        dma_addr_t pf_addr;
+        u64 vf_addr;
+        int rc;
+
         bnx2x_dp_tlv_list(bp, resp);
         DP(BNX2X_MSG_IOV, "mailbox vf address hi 0x%x, lo 0x%x, offset 0x%x\n",
            mbx->vf_addr_hi, mbx->vf_addr_lo, mbx->first_tlv.resp_msg_offset);
 
+        resp->hdr.status = bnx2x_pfvf_status_codes(vf->op_rc);
+
         /* send response */
         vf_addr = HILO_U64(mbx->vf_addr_hi, mbx->vf_addr_lo) +
                   mbx->first_tlv.resp_msg_offset;
         pf_addr = mbx->msg_mapping +
                   offsetof(struct bnx2x_vf_mbx_msg, resp);
 
-        /* copy the response body, if there is one, before the header, as the vf
-         * is sensitive to the header being written
+        /* Copy the response buffer. The first u64 is written afterwards, as
+         * the vf is sensitive to the header being written
          */
-        if (resp->hdr.tl.length > sizeof(u64)) {
-                length = resp->hdr.tl.length - sizeof(u64);
-                vf_addr += sizeof(u64);
-                pf_addr += sizeof(u64);
-                rc = bnx2x_copy32_vf_dmae(bp, false, pf_addr, vf->abs_vfid,
-                                          U64_HI(vf_addr),
-                                          U64_LO(vf_addr),
-                                          length/4);
-                if (rc) {
-                        BNX2X_ERR("Failed to copy response body to VF %d\n",
-                                  vf->abs_vfid);
-                        goto mbx_error;
-                }
-                vf_addr -= sizeof(u64);
-                pf_addr -= sizeof(u64);
+        vf_addr += sizeof(u64);
+        pf_addr += sizeof(u64);
+        rc = bnx2x_copy32_vf_dmae(bp, false, pf_addr, vf->abs_vfid,
+                                  U64_HI(vf_addr),
+                                  U64_LO(vf_addr),
+                                  (sizeof(union pfvf_tlvs) - sizeof(u64))/4);
+        if (rc) {
+                BNX2X_ERR("Failed to copy response body to VF %d\n",
+                          vf->abs_vfid);
+                goto mbx_error;
         }
+        vf_addr -= sizeof(u64);
+        pf_addr -= sizeof(u64);
 
         /* ack the FW */
         storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
@@ -1060,6 +1106,36 @@ mbx_error:
         bnx2x_vf_release(bp, vf, false); /* non blocking */
 }
 
+static void bnx2x_vf_mbx_resp(struct bnx2x *bp,
+                                       struct bnx2x_virtf *vf)
+{
+        bnx2x_vf_mbx_resp_single_tlv(bp, vf);
+        bnx2x_vf_mbx_resp_send_msg(bp, vf);
+}
+
+static void bnx2x_vf_mbx_resp_phys_port(struct bnx2x *bp,
+                                        struct bnx2x_virtf *vf,
+                                        void *buffer,
+                                        u16 *offset)
+{
+        struct vfpf_port_phys_id_resp_tlv *port_id;
+
+        if (!(bp->flags & HAS_PHYS_PORT_ID))
+                return;
+
+        bnx2x_add_tlv(bp, buffer, *offset, CHANNEL_TLV_PHYS_PORT_ID,
+                      sizeof(struct vfpf_port_phys_id_resp_tlv));
+
+        port_id = (struct vfpf_port_phys_id_resp_tlv *)
+                  (((u8 *)buffer) + *offset);
+        memcpy(port_id->id, bp->phys_port_id, ETH_ALEN);
+
+        /* Offset should continue representing the offset to the tail
+         * of TLV data (outside this function scope)
+         */
+        *offset += sizeof(struct vfpf_port_phys_id_resp_tlv);
+}
+
 static void bnx2x_vf_mbx_acquire_resp(struct bnx2x *bp, struct bnx2x_virtf *vf,
                                       struct bnx2x_vf_mbx *mbx, int vfop_status)
 {
@@ -1067,6 +1143,7 @@ static void bnx2x_vf_mbx_acquire_resp(struct bnx2x *bp, struct bnx2x_virtf *vf,
         struct pfvf_acquire_resp_tlv *resp = &mbx->msg->resp.acquire_resp;
         struct pf_vf_resc *resc = &resp->resc;
         u8 status = bnx2x_pfvf_status_codes(vfop_status);
+        u16 length;
 
         memset(resp, 0, sizeof(*resp));
 
@@ -1140,9 +1217,24 @@ static void bnx2x_vf_mbx_acquire_resp(struct bnx2x *bp, struct bnx2x_virtf *vf,
                         resc->hw_sbs[i].sb_qid);
         DP_CONT(BNX2X_MSG_IOV, "]\n");
 
+        /* prepare response */
+        length = sizeof(struct pfvf_acquire_resp_tlv);
+        bnx2x_add_tlv(bp, &mbx->msg->resp, 0, CHANNEL_TLV_ACQUIRE, length);
+
+        /* Handle possible VF requests for physical port identifiers.
+         * 'length' should continue to indicate the offset of the first empty
+         * place in the buffer (i.e., where next TLV should be inserted)
+         */
+        if (bnx2x_search_tlv_list(bp, &mbx->msg->req,
+                                  CHANNEL_TLV_PHYS_PORT_ID))
+                bnx2x_vf_mbx_resp_phys_port(bp, vf, &mbx->msg->resp, &length);
+
+        bnx2x_add_tlv(bp, &mbx->msg->resp, length, CHANNEL_TLV_LIST_END,
+                      sizeof(struct channel_list_end_tlv));
+
         /* send the response */
         vf->op_rc = vfop_status;
-        bnx2x_vf_mbx_resp(bp, vf);
+        bnx2x_vf_mbx_resp_send_msg(bp, vf);
 }
 
 static void bnx2x_vf_mbx_acquire(struct bnx2x *bp, struct bnx2x_virtf *vf,
@@ -1874,6 +1966,9 @@ void bnx2x_vf_mbx(struct bnx2x *bp, struct vf_pf_event_data *vfpf_event)
         /* process the VF message header */
         mbx->first_tlv = mbx->msg->req.first_tlv;
 
+        /* Clean response buffer to refrain from falsely seeing chains */
+        memset(&mbx->msg->resp, 0, sizeof(union pfvf_tlvs));
+
         /* dispatch the request (will prepare the response) */
         bnx2x_vf_mbx_request(bp, vf, mbx);
         goto mbx_done;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.h
index 1179fe06d0c7..208568bc7a71 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.h
@@ -188,6 +188,12 @@ struct pfvf_acquire_resp_tlv {
         } resc;
 };
 
+struct vfpf_port_phys_id_resp_tlv {
+        struct channel_tlv tl;
+        u8 id[ETH_ALEN];
+        u8 padding[2];
+};
+
 #define VFPF_INIT_FLG_STATS_COALESCE    (1 << 0) /* when set the VFs queues
                                                   * stats will be coalesced on
                                                   * the leading RSS queue
@@ -398,6 +404,7 @@ enum channel_tlvs {
         CHANNEL_TLV_PF_SET_MAC,
         CHANNEL_TLV_PF_SET_VLAN,
         CHANNEL_TLV_UPDATE_RSS,
+        CHANNEL_TLV_PHYS_PORT_ID,
         CHANNEL_TLV_MAX
 };
 
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 99394bd49a13..f58a8b80302d 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -393,7 +393,7 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
 
                         csk->vlan_id = path_resp->vlan_id;
 
-                        memcpy(csk->ha, path_resp->mac_addr, 6);
+                        memcpy(csk->ha, path_resp->mac_addr, ETH_ALEN);
                         if (test_bit(SK_F_IPV6, &csk->flags))
                                 memcpy(&csk->src_ip[0], &path_resp->src.v6_addr,
                                        sizeof(struct in6_addr));
@@ -5572,7 +5572,7 @@ static struct cnic_dev *init_bnx2x_cnic(struct net_device *dev)
         if (cdev->max_fcoe_conn > BNX2X_FCOE_NUM_CONNECTIONS)
                 cdev->max_fcoe_conn = BNX2X_FCOE_NUM_CONNECTIONS;
 
-        memcpy(cdev->mac_addr, ethdev->iscsi_mac, 6);
+        memcpy(cdev->mac_addr, ethdev->iscsi_mac, ETH_ALEN);
 
         cp->cnic_ops = &cnic_bnx2x_ops;
         cp->start_hw = cnic_start_bnx2x_hw;
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 0658b43e148c..ebbfe25acaa6 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -353,8 +353,8 @@ struct cnic_ulp_ops {
         atomic_t ref_count;
 };
 
-extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
+int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
 
-extern int cnic_unregister_driver(int ulp_type);
+int cnic_unregister_driver(int ulp_type);
 
 #endif
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 12d961c4ebca..819d87c281bf 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -94,10 +94,10 @@ static inline void _tg3_flag_clear(enum TG3_FLAGS flag, unsigned long *bits)
 
 #define DRV_MODULE_NAME         "tg3"
 #define TG3_MAJ_NUM                     3
-#define TG3_MIN_NUM                     133
+#define TG3_MIN_NUM                     134
 #define DRV_MODULE_VERSION      \
         __stringify(TG3_MAJ_NUM) "." __stringify(TG3_MIN_NUM)
-#define DRV_MODULE_RELDATE      "Jul 29, 2013"
+#define DRV_MODULE_RELDATE      "Sep 16, 2013"
 
 #define RESET_KIND_SHUTDOWN     0
 #define RESET_KIND_INIT         1
@@ -337,6 +337,11 @@ static DEFINE_PCI_DEVICE_TABLE(tg3_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5762)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5725)},
         {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5727)},
+        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57764)},
+        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57767)},
+        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57787)},
+        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57782)},
+        {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57786)},
         {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9DXX)},
         {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9MXX)},
         {PCI_DEVICE(PCI_VENDOR_ID_ALTIMA, PCI_DEVICE_ID_ALTIMA_AC1000)},
@@ -1326,6 +1331,12 @@ static int tg3_phy_toggle_auxctl_smdsp(struct tg3 *tp, bool enable)
         return err;
 }
 
+static int tg3_phy_shdw_write(struct tg3 *tp, int reg, u32 val)
+{
+        return tg3_writephy(tp, MII_TG3_MISC_SHDW,
+                            reg | val | MII_TG3_MISC_SHDW_WREN);
+}
+
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
         u32 phy_control;
@@ -1364,7 +1375,7 @@ static int tg3_mdio_read(struct mii_bus *bp, int mii_id, int reg)
 
         spin_lock_bh(&tp->lock);
 
-        if (tg3_readphy(tp, reg, &val))
+        if (__tg3_readphy(tp, mii_id, reg, &val))
                 val = -EIO;
 
         spin_unlock_bh(&tp->lock);
@@ -1379,7 +1390,7 @@ static int tg3_mdio_write(struct mii_bus *bp, int mii_id, int reg, u16 val)
 
         spin_lock_bh(&tp->lock);
 
-        if (tg3_writephy(tp, reg, val))
+        if (__tg3_writephy(tp, mii_id, reg, val))
                 ret = -EIO;
 
         spin_unlock_bh(&tp->lock);
@@ -1397,7 +1408,7 @@ static void tg3_mdio_config_5785(struct tg3 *tp)
         u32 val;
         struct phy_device *phydev;
 
-        phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+        phydev = tp->mdio_bus->phy_map[tp->phy_addr];
         switch (phydev->drv->phy_id & phydev->drv->phy_id_mask) {
         case PHY_ID_BCM50610:
         case PHY_ID_BCM50610M:
@@ -1502,6 +1513,13 @@ static int tg3_mdio_init(struct tg3 *tp)
                                     TG3_CPMU_PHY_STRAP_IS_SERDES;
                 if (is_serdes)
                         tp->phy_addr += 7;
+        } else if (tg3_flag(tp, IS_SSB_CORE) && tg3_flag(tp, ROBOSWITCH)) {
+                int addr;
+
+                addr = ssb_gige_get_phyaddr(tp->pdev);
+                if (addr < 0)
+                        return addr;
+                tp->phy_addr = addr;
         } else
                 tp->phy_addr = TG3_PHY_MII_ADDR;
 
@@ -1522,7 +1540,7 @@ static int tg3_mdio_init(struct tg3 *tp)
         tp->mdio_bus->read     = &tg3_mdio_read;
         tp->mdio_bus->write    = &tg3_mdio_write;
         tp->mdio_bus->reset    = &tg3_mdio_reset;
-        tp->mdio_bus->phy_mask = ~(1 << TG3_PHY_MII_ADDR);
+        tp->mdio_bus->phy_mask = ~(1 << tp->phy_addr);
         tp->mdio_bus->irq      = &tp->mdio_irq[0];
 
         for (i = 0; i < PHY_MAX_ADDR; i++)
@@ -1543,7 +1561,7 @@ static int tg3_mdio_init(struct tg3 *tp)
                 return i;
         }
 
-        phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+        phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
         if (!phydev || !phydev->drv) {
                 dev_warn(&tp->pdev->dev, "No PHY devices\n");
@@ -1953,7 +1971,7 @@ static void tg3_setup_flow_control(struct tg3 *tp, u32 lcladv, u32 rmtadv)
         u32 old_tx_mode = tp->tx_mode;
 
         if (tg3_flag(tp, USE_PHYLIB))
-                autoneg = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR]->autoneg;
+                autoneg = tp->mdio_bus->phy_map[tp->phy_addr]->autoneg;
         else
                 autoneg = tp->link_config.autoneg;
 
@@ -1989,7 +2007,7 @@ static void tg3_adjust_link(struct net_device *dev)
         u8 oldflowctrl, linkmesg = 0;
         u32 mac_mode, lcl_adv, rmt_adv;
         struct tg3 *tp = netdev_priv(dev);
-        struct phy_device *phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+        struct phy_device *phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
         spin_lock_bh(&tp->lock);
 
@@ -2078,7 +2096,7 @@ static int tg3_phy_init(struct tg3 *tp)
         /* Bring the PHY back to a known state. */
         tg3_bmcr_reset(tp);
 
-        phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+        phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
         /* Attach the MAC to the PHY. */
         phydev = phy_connect(tp->dev, dev_name(&phydev->dev),
@@ -2105,7 +2123,7 @@ static int tg3_phy_init(struct tg3 *tp)
                                       SUPPORTED_Asym_Pause);
                 break;
         default:
-                phy_disconnect(tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR]);
+                phy_disconnect(tp->mdio_bus->phy_map[tp->phy_addr]);
                 return -EINVAL;
         }
 
@@ -2123,7 +2141,7 @@ static void tg3_phy_start(struct tg3 *tp)
         if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                 return;
 
-        phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+        phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
         if (tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER) {
                 tp->phy_flags &= ~TG3_PHYFLG_IS_LOW_POWER;
@@ -2143,13 +2161,13 @@ static void tg3_phy_stop(struct tg3 *tp)
         if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                 return;
 
-        phy_stop(tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR]);
+        phy_stop(tp->mdio_bus->phy_map[tp->phy_addr]);
 }
 
 static void tg3_phy_fini(struct tg3 *tp)
 {
         if (tp->phy_flags & TG3_PHYFLG_IS_CONNECTED) {
-                phy_disconnect(tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR]);
+                phy_disconnect(tp->mdio_bus->phy_map[tp->phy_addr]);
                 tp->phy_flags &= ~TG3_PHYFLG_IS_CONNECTED;
         }
 }
@@ -2218,25 +2236,21 @@ static void tg3_phy_toggle_apd(struct tg3 *tp, bool enable)
                 return;
         }
 
-        reg = MII_TG3_MISC_SHDW_WREN |
-              MII_TG3_MISC_SHDW_SCR5_SEL |
-              MII_TG3_MISC_SHDW_SCR5_LPED |
+        reg = MII_TG3_MISC_SHDW_SCR5_LPED |
               MII_TG3_MISC_SHDW_SCR5_DLPTLM |
               MII_TG3_MISC_SHDW_SCR5_SDTL |
               MII_TG3_MISC_SHDW_SCR5_C125OE;
         if (tg3_asic_rev(tp) != ASIC_REV_5784 || !enable)
                 reg |= MII_TG3_MISC_SHDW_SCR5_DLLAPD;
 
-        tg3_writephy(tp, MII_TG3_MISC_SHDW, reg);
+        tg3_phy_shdw_write(tp, MII_TG3_MISC_SHDW_SCR5_SEL, reg);
 
 
-        reg = MII_TG3_MISC_SHDW_WREN |
-              MII_TG3_MISC_SHDW_APD_SEL |
-              MII_TG3_MISC_SHDW_APD_WKTM_84MS;
+        reg = MII_TG3_MISC_SHDW_APD_WKTM_84MS;
         if (enable)
                 reg |= MII_TG3_MISC_SHDW_APD_ENABLE;
 
-        tg3_writephy(tp, MII_TG3_MISC_SHDW, reg);
+        tg3_phy_shdw_write(tp, MII_TG3_MISC_SHDW_APD_SEL, reg);
 }
 
 static void tg3_phy_toggle_automdix(struct tg3 *tp, bool enable)
@@ -4027,7 +4041,7 @@ static int tg3_power_down_prepare(struct tg3 *tp)
                         struct phy_device *phydev;
                         u32 phyid, advertising;
 
-                        phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                        phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
                         tp->phy_flags |= TG3_PHYFLG_IS_LOW_POWER;
 
@@ -9196,10 +9210,7 @@ static int tg3_halt(struct tg3 *tp, int kind, bool silent)
                 memset(tp->hw_stats, 0, sizeof(struct tg3_hw_stats));
         }
 
-        if (err)
-                return err;
-
-        return 0;
+        return err;
 }
 
 static int tg3_set_mac_addr(struct net_device *dev, void *p)
@@ -11035,7 +11046,18 @@ static int tg3_request_irq(struct tg3 *tp, int irq_num)
                 name = tp->dev->name;
         else {
                 name = &tnapi->irq_lbl[0];
-                snprintf(name, IFNAMSIZ, "%s-%d", tp->dev->name, irq_num);
+                if (tnapi->tx_buffers && tnapi->rx_rcb)
+                        snprintf(name, IFNAMSIZ,
+                                 "%s-txrx-%d", tp->dev->name, irq_num);
+                else if (tnapi->tx_buffers)
+                        snprintf(name, IFNAMSIZ,
+                                 "%s-tx-%d", tp->dev->name, irq_num);
+                else if (tnapi->rx_rcb)
+                        snprintf(name, IFNAMSIZ,
+                                 "%s-rx-%d", tp->dev->name, irq_num);
+                else
+                        snprintf(name, IFNAMSIZ,
+                                 "%s-%d", tp->dev->name, irq_num);
                 name[IFNAMSIZ-1] = 0;
         }
 
@@ -11907,7 +11929,7 @@ static int tg3_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 struct phy_device *phydev;
                 if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                         return -EAGAIN;
-                phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                phydev = tp->mdio_bus->phy_map[tp->phy_addr];
                 return phy_ethtool_gset(phydev, cmd);
         }
 
@@ -11974,7 +11996,7 @@ static int tg3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 struct phy_device *phydev;
                 if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                         return -EAGAIN;
-                phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                phydev = tp->mdio_bus->phy_map[tp->phy_addr];
                 return phy_ethtool_sset(phydev, cmd);
         }
 
@@ -12093,12 +12115,10 @@ static int tg3_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 
         device_set_wakeup_enable(dp, wol->wolopts & WAKE_MAGIC);
 
-        spin_lock_bh(&tp->lock);
         if (device_may_wakeup(dp))
                 tg3_flag_set(tp, WOL_ENABLE);
         else
                 tg3_flag_clear(tp, WOL_ENABLE);
-        spin_unlock_bh(&tp->lock);
 
         return 0;
 }
@@ -12131,7 +12151,7 @@ static int tg3_nway_reset(struct net_device *dev)
         if (tg3_flag(tp, USE_PHYLIB)) {
                 if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                         return -EAGAIN;
-                r = phy_start_aneg(tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR]);
+                r = phy_start_aneg(tp->mdio_bus->phy_map[tp->phy_addr]);
         } else {
                 u32 bmcr;
 
@@ -12247,7 +12267,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
                 u32 newadv;
                 struct phy_device *phydev;
 
-                phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                phydev = tp->mdio_bus->phy_map[tp->phy_addr];
 
                 if (!(phydev->supported & SUPPORTED_Pause) ||
                     (!(phydev->supported & SUPPORTED_Asym_Pause) &&
@@ -13194,8 +13214,8 @@ static int tg3_run_loopback(struct tg3 *tp, u32 pktsz, bool tso_loopback)
                 return -ENOMEM;
 
         tx_data = skb_put(skb, tx_len);
-        memcpy(tx_data, tp->dev->dev_addr, 6);
-        memset(tx_data + 6, 0x0, 8);
+        memcpy(tx_data, tp->dev->dev_addr, ETH_ALEN);
+        memset(tx_data + ETH_ALEN, 0x0, 8);
 
         tw32(MAC_RX_MTU_SIZE, tx_len + ETH_FCS_LEN);
 
@@ -13683,7 +13703,7 @@ static int tg3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 struct phy_device *phydev;
                 if (!(tp->phy_flags & TG3_PHYFLG_IS_CONNECTED))
                         return -EAGAIN;
-                phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                phydev = tp->mdio_bus->phy_map[tp->phy_addr];
                 return phy_mii_ioctl(phydev, ifr, cmd);
         }
 
@@ -14921,6 +14941,12 @@ static void tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                             tg3_chip_rev_id(tp) != CHIPREV_ID_5750_A1)
                                 tp->led_ctrl |= (LED_CTRL_MODE_PHY_1 |
                                                  LED_CTRL_MODE_PHY_2);
+
+                        if (tg3_flag(tp, 5717_PLUS) ||
+                            tg3_asic_rev(tp) == ASIC_REV_5762)
+                                tp->led_ctrl |= LED_CTRL_BLINK_RATE_OVERRIDE |
+                                                LED_CTRL_BLINK_RATE_MASK;
+
                         break;
 
                 case SHASTA_EXT_LED_MAC:
@@ -15759,9 +15785,12 @@ static void tg3_detect_asic_rev(struct tg3 *tp, u32 misc_ctrl_reg)
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5719 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5720 ||
+                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_57767 ||
+                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_57764 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5762 ||
                     tp->pdev->device == TG3PCI_DEVICE_TIGON3_5725 ||
-                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_5727)
+                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_5727 ||
+                    tp->pdev->device == TG3PCI_DEVICE_TIGON3_57787)
                         reg = TG3PCI_GEN2_PRODID_ASICREV;
                 else if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_57781 ||
                          tp->pdev->device == TG3PCI_DEVICE_TIGON3_57785 ||
@@ -16632,8 +16661,8 @@ static int tg3_get_macaddr_sparc(struct tg3 *tp)
         int len;
 
         addr = of_get_property(dp, "local-mac-address", &len);
-        if (addr && len == 6) {
-                memcpy(dev->dev_addr, addr, 6);
+        if (addr && len == ETH_ALEN) {
+                memcpy(dev->dev_addr, addr, ETH_ALEN);
                 return 0;
         }
         return -ENODEV;
@@ -16643,7 +16672,7 @@ static int tg3_get_default_macaddr_sparc(struct tg3 *tp)
 {
         struct net_device *dev = tp->dev;
 
-        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+        memcpy(dev->dev_addr, idprom->id_ethaddr, ETH_ALEN);
         return 0;
 }
 #endif
@@ -17052,10 +17081,6 @@ static int tg3_test_dma(struct tg3 *tp)
 
         tw32(TG3PCI_DMA_RW_CTRL, tp->dma_rwctrl);
 
-#if 0
-        /* Unneeded, already done by tg3_get_invariants.  */
-        tg3_switch_clocks(tp);
-#endif
 
         if (tg3_asic_rev(tp) != ASIC_REV_5700 &&
             tg3_asic_rev(tp) != ASIC_REV_5701)
@@ -17083,20 +17108,6 @@ static int tg3_test_dma(struct tg3 *tp)
                         break;
                 }
 
-#if 0
-                /* validate data reached card RAM correctly. */
-                for (i = 0; i < TEST_BUFFER_SIZE / sizeof(u32); i++) {
-                        u32 val;
-                        tg3_read_mem(tp, 0x2100 + (i*4), &val);
-                        if (le32_to_cpu(val) != p[i]) {
-                                dev_err(&tp->pdev->dev,
-                                        "%s: Buffer corrupted on device! "
-                                        "(%d != %d)\n", __func__, val, i);
-                                /* ret = -ENODEV here? */
-                        }
-                        p[i] = 0;
-                }
-#endif
                 /* Now read it back. */
                 ret = tg3_do_test_dma(tp, buf, buf_dma, TEST_BUFFER_SIZE, false);
                 if (ret) {
@@ -17362,8 +17373,10 @@ static int tg3_init_one(struct pci_dev *pdev,
                         tg3_flag_set(tp, FLUSH_POSTED_WRITES);
                 if (ssb_gige_one_dma_at_once(pdev))
                         tg3_flag_set(tp, ONE_DMA_AT_ONCE);
-                if (ssb_gige_have_roboswitch(pdev))
+                if (ssb_gige_have_roboswitch(pdev)) {
+                        tg3_flag_set(tp, USE_PHYLIB);
                         tg3_flag_set(tp, ROBOSWITCH);
+                }
                 if (ssb_gige_is_rgmii(pdev))
                         tg3_flag_set(tp, RGMII_MODE);
         }
@@ -17409,9 +17422,12 @@ static int tg3_init_one(struct pci_dev *pdev,
             tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 ||
             tp->pdev->device == TG3PCI_DEVICE_TIGON3_5719 ||
             tp->pdev->device == TG3PCI_DEVICE_TIGON3_5720 ||
+            tp->pdev->device == TG3PCI_DEVICE_TIGON3_57767 ||
+            tp->pdev->device == TG3PCI_DEVICE_TIGON3_57764 ||
             tp->pdev->device == TG3PCI_DEVICE_TIGON3_5762 ||
             tp->pdev->device == TG3PCI_DEVICE_TIGON3_5725 ||
-            tp->pdev->device == TG3PCI_DEVICE_TIGON3_5727) {
+            tp->pdev->device == TG3PCI_DEVICE_TIGON3_5727 ||
+            tp->pdev->device == TG3PCI_DEVICE_TIGON3_57787) {
                 tg3_flag_set(tp, ENABLE_APE);
                 tp->aperegs = pci_ioremap_bar(pdev, BAR_2);
                 if (!tp->aperegs) {
@@ -17628,7 +17644,7 @@ static int tg3_init_one(struct pci_dev *pdev,
 
         if (tp->phy_flags & TG3_PHYFLG_IS_CONNECTED) {
                 struct phy_device *phydev;
-                phydev = tp->mdio_bus->phy_map[TG3_PHY_MII_ADDR];
+                phydev = tp->mdio_bus->phy_map[tp->phy_addr];
                 netdev_info(dev,
                             "attached PHY driver [%s] (mii_bus:phy_addr=%s)\n",
                             phydev->drv->name, dev_name(&phydev->dev));
@@ -17685,7 +17701,6 @@ err_out_free_res:
 err_out_disable_pdev:
         if (pci_is_enabled(pdev))
                 pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return err;
 }
 
@@ -17717,7 +17732,6 @@ static void tg3_remove_one(struct pci_dev *pdev)
                 free_netdev(dev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 70257808aa37..5c3835aa1e1b 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -68,6 +68,9 @@
 #define  TG3PCI_DEVICE_TIGON3_5762       0x1687
 #define  TG3PCI_DEVICE_TIGON3_5725       0x1643
 #define  TG3PCI_DEVICE_TIGON3_5727       0x16f3
+#define  TG3PCI_DEVICE_TIGON3_57764      0x1642
+#define  TG3PCI_DEVICE_TIGON3_57767      0x1683
+#define  TG3PCI_DEVICE_TIGON3_57787      0x1641
 /* 0x04 --> 0x2c unused */
 #define TG3PCI_SUBVENDOR_ID_BROADCOM            PCI_VENDOR_ID_BROADCOM
 #define TG3PCI_SUBDEVICE_ID_BROADCOM_95700A6    0x1644
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index b78e69e0e52a..f276433d37ce 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3212,7 +3212,6 @@ bnad_init(struct bnad *bnad,
         bnad->bar0 = ioremap_nocache(bnad->mmio_start, bnad->mmio_len);
         if (!bnad->bar0) {
                 dev_err(&pdev->dev, "ioremap for bar0 failed\n");
-                pci_set_drvdata(pdev, NULL);
                 return -ENOMEM;
         }
         pr_info("bar0 mapped to %p, len %llu\n", bnad->bar0,
diff --git a/drivers/net/ethernet/brocade/bna/bnad.h b/drivers/net/ethernet/brocade/bna/bnad.h
index aefee77523f2..f7e033f8a00e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.h
+++ b/drivers/net/ethernet/brocade/bna/bnad.h
@@ -372,38 +372,37 @@ extern u32		bnad_rxqs_per_cq;
 /*
  * EXTERN PROTOTYPES
  */
-extern u32 *cna_get_firmware_buf(struct pci_dev *pdev);
+u32 *cna_get_firmware_buf(struct pci_dev *pdev);
 /* Netdev entry point prototypes */
-extern void bnad_set_rx_mode(struct net_device *netdev);
-extern struct net_device_stats *bnad_get_netdev_stats(
-                                struct net_device *netdev);
-extern int bnad_mac_addr_set_locked(struct bnad *bnad, u8 *mac_addr);
-extern int bnad_enable_default_bcast(struct bnad *bnad);
-extern void bnad_restore_vlans(struct bnad *bnad, u32 rx_id);
-extern void bnad_set_ethtool_ops(struct net_device *netdev);
-extern void bnad_cb_completion(void *arg, enum bfa_status status);
+void bnad_set_rx_mode(struct net_device *netdev);
+struct net_device_stats *bnad_get_netdev_stats(struct net_device *netdev);
+int bnad_mac_addr_set_locked(struct bnad *bnad, u8 *mac_addr);
+int bnad_enable_default_bcast(struct bnad *bnad);
+void bnad_restore_vlans(struct bnad *bnad, u32 rx_id);
+void bnad_set_ethtool_ops(struct net_device *netdev);
+void bnad_cb_completion(void *arg, enum bfa_status status);
 
 /* Configuration & setup */
-extern void bnad_tx_coalescing_timeo_set(struct bnad *bnad);
-extern void bnad_rx_coalescing_timeo_set(struct bnad *bnad);
+void bnad_tx_coalescing_timeo_set(struct bnad *bnad);
+void bnad_rx_coalescing_timeo_set(struct bnad *bnad);
 
-extern int bnad_setup_rx(struct bnad *bnad, u32 rx_id);
-extern int bnad_setup_tx(struct bnad *bnad, u32 tx_id);
-extern void bnad_destroy_tx(struct bnad *bnad, u32 tx_id);
-extern void bnad_destroy_rx(struct bnad *bnad, u32 rx_id);
+int bnad_setup_rx(struct bnad *bnad, u32 rx_id);
+int bnad_setup_tx(struct bnad *bnad, u32 tx_id);
+void bnad_destroy_tx(struct bnad *bnad, u32 tx_id);
+void bnad_destroy_rx(struct bnad *bnad, u32 rx_id);
 
 /* Timer start/stop protos */
-extern void bnad_dim_timer_start(struct bnad *bnad);
+void bnad_dim_timer_start(struct bnad *bnad);
 
 /* Statistics */
-extern void bnad_netdev_qstats_fill(struct bnad *bnad,
-                struct rtnl_link_stats64 *stats);
-extern void bnad_netdev_hwstats_fill(struct bnad *bnad,
-                struct rtnl_link_stats64 *stats);
+void bnad_netdev_qstats_fill(struct bnad *bnad,
+                             struct rtnl_link_stats64 *stats);
+void bnad_netdev_hwstats_fill(struct bnad *bnad,
+                              struct rtnl_link_stats64 *stats);
 
 /* Debugfs */
-void    bnad_debugfs_init(struct bnad *bnad);
-void    bnad_debugfs_uninit(struct bnad *bnad);
+void bnad_debugfs_init(struct bnad *bnad);
+void bnad_debugfs_uninit(struct bnad *bnad);
 
 /* MACROS */
 /* To set & get the stats counters */
diff --git a/drivers/net/ethernet/chelsio/cxgb/common.h b/drivers/net/ethernet/chelsio/cxgb/common.h
index 5ccbed1784d2..8abb46b39032 100644
--- a/drivers/net/ethernet/chelsio/cxgb/common.h
+++ b/drivers/net/ethernet/chelsio/cxgb/common.h
@@ -324,30 +324,30 @@ static inline unsigned int core_ticks_per_usec(const adapter_t *adap)
         return board_info(adap)->clock_core / 1000000;
 }
 
-extern int __t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp);
-extern int __t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
-extern int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
-extern int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *value);
-
-extern void t1_interrupts_enable(adapter_t *adapter);
-extern void t1_interrupts_disable(adapter_t *adapter);
-extern void t1_interrupts_clear(adapter_t *adapter);
-extern int t1_elmer0_ext_intr_handler(adapter_t *adapter);
-extern void t1_elmer0_ext_intr(adapter_t *adapter);
-extern int t1_slow_intr_handler(adapter_t *adapter);
-
-extern int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc);
-extern const struct board_info *t1_get_board_info(unsigned int board_id);
-extern const struct board_info *t1_get_board_info_from_ids(unsigned int devid,
+int __t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp);
+int __t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
+int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
+int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *value);
+
+void t1_interrupts_enable(adapter_t *adapter);
+void t1_interrupts_disable(adapter_t *adapter);
+void t1_interrupts_clear(adapter_t *adapter);
+int t1_elmer0_ext_intr_handler(adapter_t *adapter);
+void t1_elmer0_ext_intr(adapter_t *adapter);
+int t1_slow_intr_handler(adapter_t *adapter);
+
+int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc);
+const struct board_info *t1_get_board_info(unsigned int board_id);
+const struct board_info *t1_get_board_info_from_ids(unsigned int devid,
                                                     unsigned short ssid);
-extern int t1_seeprom_read(adapter_t *adapter, u32 addr, __le32 *data);
-extern int t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
+int t1_seeprom_read(adapter_t *adapter, u32 addr, __le32 *data);
+int t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
                      struct adapter_params *p);
-extern int t1_init_hw_modules(adapter_t *adapter);
-extern int t1_init_sw_modules(adapter_t *adapter, const struct board_info *bi);
-extern void t1_free_sw_modules(adapter_t *adapter);
-extern void t1_fatal_err(adapter_t *adapter);
-extern void t1_link_changed(adapter_t *adapter, int port_id);
-extern void t1_link_negotiated(adapter_t *adapter, int port_id, int link_stat,
+int t1_init_hw_modules(adapter_t *adapter);
+int t1_init_sw_modules(adapter_t *adapter, const struct board_info *bi);
+void t1_free_sw_modules(adapter_t *adapter);
+void t1_fatal_err(adapter_t *adapter);
+void t1_link_changed(adapter_t *adapter, int port_id);
+void t1_link_negotiated(adapter_t *adapter, int port_id, int link_stat,
                             int speed, int duplex, int pause);
 #endif /* _CXGB_COMMON_H_ */
diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
index d7048db9863d..1d021059f097 100644
--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
@@ -1168,7 +1168,6 @@ out_free_dev:
         pci_release_regions(pdev);
 out_disable_pdev:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return err;
 }
 
@@ -1347,7 +1346,6 @@ static void remove_one(struct pci_dev *pdev)
 
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         t1_sw_reset(pdev);
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb/pm3393.c b/drivers/net/ethernet/chelsio/cxgb/pm3393.c
index 40c7b93ababc..eb33a31b08a0 100644
--- a/drivers/net/ethernet/chelsio/cxgb/pm3393.c
+++ b/drivers/net/ethernet/chelsio/cxgb/pm3393.c
@@ -499,7 +499,7 @@ static const struct cmac_statistics *pm3393_update_statistics(struct cmac *mac,
 
 static int pm3393_macaddress_get(struct cmac *cmac, u8 mac_addr[6])
 {
-        memcpy(mac_addr, cmac->instance->mac_addr, 6);
+        memcpy(mac_addr, cmac->instance->mac_addr, ETH_ALEN);
         return 0;
 }
 
@@ -526,7 +526,7 @@ static int pm3393_macaddress_set(struct cmac *cmac, u8 ma[6])
          */
 
         /* Store local copy */
-        memcpy(cmac->instance->mac_addr, ma, 6);
+        memcpy(cmac->instance->mac_addr, ma, ETH_ALEN);
 
         lo  = ((u32) ma[1] << 8) | (u32) ma[0];
         mid = ((u32) ma[3] << 8) | (u32) ma[2];
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index b650951791dd..45d77334d7d9 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -3374,7 +3374,6 @@ out_release_regions:
         pci_release_regions(pdev);
 out_disable_device:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 out:
         return err;
 }
@@ -3415,7 +3414,6 @@ static void remove_one(struct pci_dev *pdev)
                 kfree(adapter);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb3/regs.h b/drivers/net/ethernet/chelsio/cxgb3/regs.h
index 6990f6c65221..81029b872bdd 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb3/regs.h
@@ -685,10 +685,6 @@
 #define V_BUSY(x) ((x) << S_BUSY)
 #define F_BUSY    V_BUSY(1U)
 
-#define S_BUSY    31
-#define V_BUSY(x) ((x) << S_BUSY)
-#define F_BUSY    V_BUSY(1U)
-
 #define A_MC7_EXT_MODE1 0x108
 
 #define A_MC7_EXT_MODE2 0x10c
@@ -749,14 +745,6 @@
 
 #define A_MC7_CAL 0x128
 
-#define S_BUSY    31
-#define V_BUSY(x) ((x) << S_BUSY)
-#define F_BUSY    V_BUSY(1U)
-
-#define S_BUSY    31
-#define V_BUSY(x) ((x) << S_BUSY)
-#define F_BUSY    V_BUSY(1U)
-
 #define S_CAL_FAULT    30
 #define V_CAL_FAULT(x) ((x) << S_CAL_FAULT)
 #define F_CAL_FAULT    V_CAL_FAULT(1U)
@@ -815,9 +803,6 @@
 #define V_OP(x) ((x) << S_OP)
 #define F_OP    V_OP(1U)
 
-#define F_OP    V_OP(1U)
-#define A_SF_OP 0x6dc
-
 #define A_MC7_BIST_ADDR_BEG 0x168
 
 #define A_MC7_BIST_ADDR_END 0x16c
@@ -830,8 +815,6 @@
 #define V_CONT(x) ((x) << S_CONT)
 #define F_CONT    V_CONT(1U)
 
-#define F_CONT    V_CONT(1U)
-
 #define A_MC7_INT_ENABLE 0x178
 
 #define S_AE    17
@@ -1017,8 +1000,6 @@
 #define V_NICMODE(x) ((x) << S_NICMODE)
 #define F_NICMODE    V_NICMODE(1U)
 
-#define F_NICMODE    V_NICMODE(1U)
-
 #define S_IPV6ENABLE    15
 #define V_IPV6ENABLE(x) ((x) << S_IPV6ENABLE)
 #define F_IPV6ENABLE    V_IPV6ENABLE(1U)
@@ -1562,27 +1543,15 @@
 #define A_ULPRX_STAG_ULIMIT 0x530
 
 #define A_ULPRX_RQ_LLIMIT 0x534
-#define A_ULPRX_RQ_LLIMIT 0x534
 
 #define A_ULPRX_RQ_ULIMIT 0x538
-#define A_ULPRX_RQ_ULIMIT 0x538
 
 #define A_ULPRX_PBL_LLIMIT 0x53c
 
 #define A_ULPRX_PBL_ULIMIT 0x540
-#define A_ULPRX_PBL_ULIMIT 0x540
 
 #define A_ULPRX_TDDP_TAGMASK 0x524
 
-#define A_ULPRX_RQ_LLIMIT 0x534
-#define A_ULPRX_RQ_LLIMIT 0x534
-
-#define A_ULPRX_RQ_ULIMIT 0x538
-#define A_ULPRX_RQ_ULIMIT 0x538
-
-#define A_ULPRX_PBL_ULIMIT 0x540
-#define A_ULPRX_PBL_ULIMIT 0x540
-
 #define A_ULPTX_CONFIG 0x580
 
 #define S_CFG_CQE_SOP_MASK    1
@@ -2053,8 +2022,6 @@
 #define V_TMMODE(x) ((x) << S_TMMODE)
 #define F_TMMODE    V_TMMODE(1U)
 
-#define F_TMMODE    V_TMMODE(1U)
-
 #define A_MC5_DB_ROUTING_TABLE_INDEX 0x70c
 
 #define A_MC5_DB_FILTER_TABLE 0x710
@@ -2454,8 +2421,6 @@
 #define V_TXACTENABLE(x) ((x) << S_TXACTENABLE)
 #define F_TXACTENABLE    V_TXACTENABLE(1U)
 
-#define A_XGM_SERDES_CTRL0 0x8e0
-
 #define S_RESET3    23
 #define V_RESET3(x) ((x) << S_RESET3)
 #define F_RESET3    V_RESET3(1U)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index dfd1e36f5753..ecd2fb3ef695 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -48,7 +48,6 @@
 #include <linux/vmalloc.h>
 #include <asm/io.h>
 #include "cxgb4_uld.h"
-#include "t4_hw.h"
 
 #define FW_VERSION_MAJOR 1
 #define FW_VERSION_MINOR 4
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c73cabdbd4c0..8b929eeecd2d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3983,6 +3983,7 @@ static int cxgb4_inet6addr_handler(struct notifier_block *this,
         struct net_device *event_dev;
         int ret = NOTIFY_DONE;
         struct bonding *bond = netdev_priv(ifa->idev->dev);
+        struct list_head *iter;
         struct slave *slave;
         struct pci_dev *first_pdev = NULL;
 
@@ -3995,7 +3996,7 @@ static int cxgb4_inet6addr_handler(struct notifier_block *this,
                  * in all of them only once.
                  */
                 read_lock(&bond->lock);
-                bond_for_each_slave(bond, slave) {
+                bond_for_each_slave(bond, slave, iter) {
                         if (!first_pdev) {
                                 ret = clip_add(slave->dev, ifa, event);
                                 /* If clip_add is success then only initialize
@@ -6074,7 +6075,6 @@ sriov:
         pci_disable_device(pdev);
  out_release_regions:
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
         return err;
 }
 
@@ -6122,7 +6122,6 @@ static void remove_one(struct pci_dev *pdev)
                 pci_disable_pcie_error_reporting(pdev);
                 pci_disable_device(pdev);
                 pci_release_regions(pdev);
-                pci_set_drvdata(pdev, NULL);
         } else
                 pci_release_regions(pdev);
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 40c22e7de15c..5f90ec5f7519 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2782,11 +2782,9 @@ err_unmap_bar:
 
 err_free_adapter:
         kfree(adapter);
-        pci_set_drvdata(pdev, NULL);
 
 err_release_regions:
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
         pci_clear_master(pdev);
 
 err_disable_device:
@@ -2851,7 +2849,6 @@ static void cxgb4vf_pci_remove(struct pci_dev *pdev)
                 }
                 iounmap(adapter->regs);
                 kfree(adapter);
-                pci_set_drvdata(pdev, NULL);
         }
 
         /*
@@ -2908,7 +2905,7 @@ static void cxgb4vf_pci_shutdown(struct pci_dev *pdev)
 #define CH_DEVICE(devid, idx) \
         { PCI_VENDOR_ID_CHELSIO, devid, PCI_ANY_ID, PCI_ANY_ID, 0, 0, idx }
 
-static struct pci_device_id cxgb4vf_pci_tbl[] = {
+static DEFINE_PCI_DEVICE_TABLE(cxgb4vf_pci_tbl) = {
         CH_DEVICE(0xb000, 0),   /* PE10K FPGA */
         CH_DEVICE(0x4800, 0),   /* T440-dbg */
         CH_DEVICE(0x4801, 0),   /* T420-cr */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index df296af20bd5..8475c4cda9e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -1396,8 +1396,9 @@ static inline void copy_frags(struct sk_buff *skb,
  *      Builds an sk_buff from the given packet gather list.  Returns the
  *      sk_buff or %NULL if sk_buff allocation failed.
  */
-struct sk_buff *t4vf_pktgl_to_skb(const struct pkt_gl *gl,
-                                  unsigned int skb_len, unsigned int pull_len)
+static struct sk_buff *t4vf_pktgl_to_skb(const struct pkt_gl *gl,
+                                         unsigned int skb_len,
+                                         unsigned int pull_len)
 {
         struct sk_buff *skb;
 
@@ -1443,7 +1444,7 @@ out:
  *      Releases the pages of a packet gather list.  We do not own the last
  *      page on the list and do not free it.
  */
-void t4vf_pktgl_free(const struct pkt_gl *gl)
+static void t4vf_pktgl_free(const struct pkt_gl *gl)
 {
         int frag;
 
@@ -1640,7 +1641,7 @@ static inline void rspq_next(struct sge_rspq *rspq)
  *      on this queue.  If the system is under memory shortage use a fairly
  *      long delay to help recovery.
  */
-int process_responses(struct sge_rspq *rspq, int budget)
+static int process_responses(struct sge_rspq *rspq, int budget)
 {
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
         int budget_left = budget;
@@ -1893,7 +1894,7 @@ static unsigned int process_intrq(struct adapter *adapter)
  * The MSI interrupt handler handles data events from SGE response queues as
  * well as error and other async events as they all use the same MSI vector.
  */
-irqreturn_t t4vf_intr_msi(int irq, void *cookie)
+static irqreturn_t t4vf_intr_msi(int irq, void *cookie)
 {
         struct adapter *adapter = cookie;
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 7b756cf9474a..ff78dfaec508 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2309,7 +2309,6 @@ err_out_release_regions:
 err_out_disable_device:
         pci_disable_device(pdev);
 err_out_free_netdev:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(netdev);
 
         return err;
@@ -2338,7 +2337,6 @@ static void enic_remove(struct pci_dev *pdev)
                 enic_iounmap(enic);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
                 free_netdev(netdev);
         }
 }
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index a7a941b1a655..7080ad6c4014 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1623,7 +1623,7 @@ dm9000_probe(struct platform_device *pdev)
 
         if (!is_valid_ether_addr(ndev->dev_addr) && pdata != NULL) {
                 mac_src = "platform data";
-                memcpy(ndev->dev_addr, pdata->dev_addr, 6);
+                memcpy(ndev->dev_addr, pdata->dev_addr, ETH_ALEN);
         }
 
         if (!is_valid_ether_addr(ndev->dev_addr)) {
diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
index eaab73cf27ca..38148b0e3a95 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -2110,7 +2110,6 @@ static void de_remove_one(struct pci_dev *pdev)
         iounmap(de->regs);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 263b92c00cbf..c05b66dfcc30 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -2328,7 +2328,7 @@ static void de4x5_pci_remove(struct pci_dev *pdev)
         pci_disable_device (pdev);
 }
 
-static struct pci_device_id de4x5_pci_tbl[] = {
+static DEFINE_PCI_DEVICE_TABLE(de4x5_pci_tbl) = {
         { PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_TULIP,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         { PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_TULIP_PLUS,
diff --git a/drivers/net/ethernet/dec/tulip/dmfe.c b/drivers/net/ethernet/dec/tulip/dmfe.c
index 83139307861c..5ad9e3e3c0b8 100644
--- a/drivers/net/ethernet/dec/tulip/dmfe.c
+++ b/drivers/net/ethernet/dec/tulip/dmfe.c
@@ -523,7 +523,6 @@ err_out_res:
 err_out_disable:
         pci_disable_device(pdev);
 err_out_free:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 
         return err;
@@ -548,8 +547,6 @@ static void dmfe_remove_one(struct pci_dev *pdev)
                                         db->buf_pool_ptr, db->buf_pool_dma_ptr);
                 pci_release_regions(pdev);
                 free_netdev(dev);       /* free board information */
-
-                pci_set_drvdata(pdev, NULL);
         }
 
         DMFE_DBUG(0, "dmfe_remove_one() exit", 0);
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 4e8cfa2ac803..add05f14b38b 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -1939,7 +1939,6 @@ static void tulip_remove_one(struct pci_dev *pdev)
         pci_iounmap(pdev, tp->base_addr);
         free_netdev (dev);
         pci_release_regions (pdev);
-        pci_set_drvdata (pdev, NULL);
 
         /* pci_power_off (pdev, -1); */
 }
diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c
index 93845afe1cea..a5397b130724 100644
--- a/drivers/net/ethernet/dec/tulip/uli526x.c
+++ b/drivers/net/ethernet/dec/tulip/uli526x.c
@@ -429,7 +429,6 @@ err_out_release:
 err_out_disable:
         pci_disable_device(pdev);
 err_out_free:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 
         return err;
@@ -450,7 +449,6 @@ static void uli526x_remove_one(struct pci_dev *pdev)
                                 db->buf_pool_ptr, db->buf_pool_dma_ptr);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
index c7b04ecf5b49..62fe512bb216 100644
--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
+++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
@@ -468,7 +468,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 err_out_cleardev:
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
 err_out_free_res:
         pci_release_regions(pdev);
@@ -1542,8 +1541,6 @@ static void w840_remove1(struct pci_dev *pdev)
                 pci_iounmap(pdev, np->base_addr);
                 free_netdev(dev);
         }
-
-        pci_set_drvdata(pdev, NULL);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/ethernet/dec/tulip/xircom_cb.c b/drivers/net/ethernet/dec/tulip/xircom_cb.c
index 9b84cb04fe5f..ab7ebac6fbea 100644
--- a/drivers/net/ethernet/dec/tulip/xircom_cb.c
+++ b/drivers/net/ethernet/dec/tulip/xircom_cb.c
@@ -289,7 +289,6 @@ out:
 err_unmap:
         pci_iounmap(pdev, private->ioaddr);
 reg_fail:
-        pci_set_drvdata(pdev, NULL);
         dma_free_coherent(d, 8192, private->tx_buffer, private->tx_dma_handle);
 tx_buf_fail:
         dma_free_coherent(d, 8192, private->rx_buffer, private->rx_dma_handle);
@@ -317,7 +316,6 @@ static void xircom_remove(struct pci_dev *pdev)
 
         unregister_netdev(dev);
         pci_iounmap(pdev, card->ioaddr);
-        pci_set_drvdata(pdev, NULL);
         dma_free_coherent(d, 8192, card->tx_buffer, card->tx_dma_handle);
         dma_free_coherent(d, 8192, card->rx_buffer, card->rx_dma_handle);
         free_netdev(dev);
diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index afa8e3af2c4d..4fb756d219f7 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -1746,7 +1746,6 @@ rio_remove1 (struct pci_dev *pdev)
                 pci_release_regions (pdev);
                 pci_disable_device (pdev);
         }
-        pci_set_drvdata (pdev, NULL);
 }
 
 static struct pci_driver rio_driver = {
diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c
index bf3bf6f22c99..113cd799a131 100644
--- a/drivers/net/ethernet/dlink/sundance.c
+++ b/drivers/net/ethernet/dlink/sundance.c
@@ -703,7 +703,6 @@ err_out_unmap_tx:
         dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE,
                 np->tx_ring, np->tx_ring_dma);
 err_out_cleardev:
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
 err_out_res:
         pci_release_regions(pdev);
@@ -1941,7 +1940,6 @@ static void sundance_remove1(struct pci_dev *pdev)
             pci_iounmap(pdev, np->base);
             pci_release_regions(pdev);
             free_netdev(dev);
-            pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index db020230bd0b..1bce77fdbd99 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -34,7 +34,7 @@
 #include "be_hw.h"
 #include "be_roce.h"
 
-#define DRV_VER                 "4.9.134.0u"
+#define DRV_VER                 "4.9.224.0u"
 #define DRV_NAME                "be2net"
 #define BE_NAME                 "Emulex BladeEngine2"
 #define BE3_NAME                "Emulex BladeEngine3"
@@ -89,7 +89,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 
 #define BE_NUM_VLANS_SUPPORTED  64
 #define BE_UMC_NUM_VLANS_SUPPORTED      15
-#define BE_MAX_EQD              96u
+#define BE_MAX_EQD              128u
 #define BE_MAX_TX_FRAG_COUNT    30
 
 #define EVNT_Q_LEN              1024
@@ -201,6 +201,17 @@ struct be_eq_obj {
         struct be_adapter *adapter;
 } ____cacheline_aligned_in_smp;
 
+struct be_aic_obj {             /* Adaptive interrupt coalescing (AIC) info */
+        bool enable;
+        u32 min_eqd;            /* in usecs */
+        u32 max_eqd;            /* in usecs */
+        u32 prev_eqd;           /* in usecs */
+        u32 et_eqd;             /* configured val when aic is off */
+        ulong jiffies;
+        u64 rx_pkts_prev;       /* Used to calculate RX pps */
+        u64 tx_reqs_prev;       /* Used to calculate TX pps */
+};
+
 struct be_mcc_obj {
         struct be_queue_info q;
         struct be_queue_info cq;
@@ -215,6 +226,7 @@ struct be_tx_stats {
         u64 tx_compl;
         ulong tx_jiffies;
         u32 tx_stops;
+        u32 tx_drv_drops;       /* pkts dropped by driver */
         struct u64_stats_sync sync;
         struct u64_stats_sync sync_compl;
 };
@@ -239,15 +251,12 @@ struct be_rx_page_info {
 struct be_rx_stats {
         u64 rx_bytes;
         u64 rx_pkts;
-        u64 rx_pkts_prev;
-        ulong rx_jiffies;
         u32 rx_drops_no_skbs;   /* skb allocation errors */
         u32 rx_drops_no_frags;  /* HW has no fetched frags */
         u32 rx_post_fail;       /* page post alloc failures */
         u32 rx_compl;
         u32 rx_mcast_pkts;
         u32 rx_compl_err;       /* completions with err set */
-        u32 rx_pps;             /* pkts per second */
         struct u64_stats_sync sync;
 };
 
@@ -316,6 +325,11 @@ struct be_drv_stats {
         u32 rx_input_fifo_overflow_drop;
         u32 pmem_fifo_overflow_drop;
         u32 jabber_events;
+        u32 rx_roce_bytes_lsd;
+        u32 rx_roce_bytes_msd;
+        u32 rx_roce_frames;
+        u32 roce_drops_payload_len;
+        u32 roce_drops_crc;
 };
 
 struct be_vf_cfg {
@@ -405,6 +419,7 @@ struct be_adapter {
         u32 big_page_size;      /* Compounded page size shared by rx wrbs */
 
         struct be_drv_stats drv_stats;
+        struct be_aic_obj aic_obj[MAX_EVT_QS];
         u16 vlans_added;
         u8 vlan_tag[VLAN_N_VID];
         u8 vlan_prio_bmap;      /* Available Priority BitMap */
@@ -472,8 +487,8 @@ struct be_adapter {
 
 #define be_physfn(adapter)              (!adapter->virtfn)
 #define sriov_enabled(adapter)          (adapter->num_vfs > 0)
-#define sriov_want(adapter)             (be_max_vfs(adapter) && num_vfs && \
-                                         be_physfn(adapter))
+#define sriov_want(adapter)             (be_physfn(adapter) &&  \
+                                         (num_vfs || pci_num_vf(adapter->pdev)))
 #define for_all_vfs(adapter, vf_cfg, i)                                 \
         for (i = 0, vf_cfg = &adapter->vf_cfg[i]; i < adapter->num_vfs; \
                 i++, vf_cfg++)
@@ -696,27 +711,27 @@ static inline int qnq_async_evt_rcvd(struct be_adapter *adapter)
         return adapter->flags & BE_FLAGS_QNQ_ASYNC_EVT_RCVD;
 }
 
-extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
-                u16 num_popped);
-extern void be_link_status_update(struct be_adapter *adapter, u8 link_status);
-extern void be_parse_stats(struct be_adapter *adapter);
-extern int be_load_fw(struct be_adapter *adapter, u8 *func);
-extern bool be_is_wol_supported(struct be_adapter *adapter);
-extern bool be_pause_supported(struct be_adapter *adapter);
-extern u32 be_get_fw_log_level(struct be_adapter *adapter);
+void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
+                  u16 num_popped);
+void be_link_status_update(struct be_adapter *adapter, u8 link_status);
+void be_parse_stats(struct be_adapter *adapter);
+int be_load_fw(struct be_adapter *adapter, u8 *func);
+bool be_is_wol_supported(struct be_adapter *adapter);
+bool be_pause_supported(struct be_adapter *adapter);
+u32 be_get_fw_log_level(struct be_adapter *adapter);
 int be_update_queues(struct be_adapter *adapter);
 int be_poll(struct napi_struct *napi, int budget);
 
 /*
  * internal function to initialize-cleanup roce device.
  */
-extern void be_roce_dev_add(struct be_adapter *);
-extern void be_roce_dev_remove(struct be_adapter *);
+void be_roce_dev_add(struct be_adapter *);
+void be_roce_dev_remove(struct be_adapter *);
 
 /*
  * internal function to open-close roce device during ifup-ifdown.
  */
-extern void be_roce_dev_open(struct be_adapter *);
-extern void be_roce_dev_close(struct be_adapter *);
+void be_roce_dev_open(struct be_adapter *);
+void be_roce_dev_close(struct be_adapter *);
 
 #endif                          /* BE_H */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index c08fd32bb8e5..2d554366b342 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1436,8 +1436,12 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
                 OPCODE_ETH_GET_STATISTICS, nonemb_cmd->size, wrb, nonemb_cmd);
 
         /* version 1 of the cmd is not supported only by BE2 */
-        if (!BE2_chip(adapter))
+        if (BE2_chip(adapter))
+                hdr->version = 0;
+        if (BE3_chip(adapter) || lancer_chip(adapter))
                 hdr->version = 1;
+        else
+                hdr->version = 2;
 
         be_mcc_notify(adapter);
         adapter->stats_cmd_sent = true;
@@ -1719,11 +1723,12 @@ err:
 /* set the EQ delay interval of an EQ to specified value
  * Uses async mcc
  */
-int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
+int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
+                      int num)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_modify_eq_delay *req;
-        int status = 0;
+        int status = 0, i;
 
         spin_lock_bh(&adapter->mcc_lock);
 
@@ -1737,13 +1742,15 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                 OPCODE_COMMON_MODIFY_EQ_DELAY, sizeof(*req), wrb, NULL);
 
-        req->num_eq = cpu_to_le32(1);
-        req->delay[0].eq_id = cpu_to_le32(eq_id);
-        req->delay[0].phase = 0;
-        req->delay[0].delay_multiplier = cpu_to_le32(eqd);
+        req->num_eq = cpu_to_le32(num);
+        for (i = 0; i < num; i++) {
+                req->set_eqd[i].eq_id = cpu_to_le32(set_eqd[i].eq_id);
+                req->set_eqd[i].phase = 0;
+                req->set_eqd[i].delay_multiplier =
+                                cpu_to_le32(set_eqd[i].delay_multiplier);
+        }
 
         be_mcc_notify(adapter);
-
 err:
         spin_unlock_bh(&adapter->mcc_lock);
         return status;
@@ -3520,7 +3527,7 @@ int be_cmd_enable_vf(struct be_adapter *adapter, u8 domain)
         struct be_cmd_enable_disable_vf *req;
         int status;
 
-        if (!lancer_chip(adapter))
+        if (BEx_chip(adapter))
                 return 0;
 
         spin_lock_bh(&adapter->mcc_lock);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 108ca8abf0af..88708372d5e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1057,14 +1057,16 @@ struct be_cmd_resp_get_flow_control {
 } __packed;
 
 /******************** Modify EQ Delay *******************/
+struct be_set_eqd {
+        u32 eq_id;
+        u32 phase;
+        u32 delay_multiplier;
+};
+
 struct be_cmd_req_modify_eq_delay {
         struct be_cmd_req_hdr hdr;
         u32 num_eq;
-        struct {
-                u32 eq_id;
-                u32 phase;
-                u32 delay_multiplier;
-        } delay[8];
+        struct be_set_eqd set_eqd[MAX_EVT_QS];
 } __packed;
 
 struct be_cmd_resp_modify_eq_delay {
@@ -1660,6 +1662,67 @@ struct be_erx_stats_v1 {
         u32 rsvd[4];
 };
 
+struct be_port_rxf_stats_v2 {
+        u32 rsvd0[10];
+        u32 roce_bytes_received_lsd;
+        u32 roce_bytes_received_msd;
+        u32 rsvd1[5];
+        u32 roce_frames_received;
+        u32 rx_crc_errors;
+        u32 rx_alignment_symbol_errors;
+        u32 rx_pause_frames;
+        u32 rx_priority_pause_frames;
+        u32 rx_control_frames;
+        u32 rx_in_range_errors;
+        u32 rx_out_range_errors;
+        u32 rx_frame_too_long;
+        u32 rx_address_filtered;
+        u32 rx_dropped_too_small;
+        u32 rx_dropped_too_short;
+        u32 rx_dropped_header_too_small;
+        u32 rx_dropped_tcp_length;
+        u32 rx_dropped_runt;
+        u32 rsvd2[10];
+        u32 rx_ip_checksum_errs;
+        u32 rx_tcp_checksum_errs;
+        u32 rx_udp_checksum_errs;
+        u32 rsvd3[7];
+        u32 rx_switched_unicast_packets;
+        u32 rx_switched_multicast_packets;
+        u32 rx_switched_broadcast_packets;
+        u32 rsvd4[3];
+        u32 tx_pauseframes;
+        u32 tx_priority_pauseframes;
+        u32 tx_controlframes;
+        u32 rsvd5[10];
+        u32 rxpp_fifo_overflow_drop;
+        u32 rx_input_fifo_overflow_drop;
+        u32 pmem_fifo_overflow_drop;
+        u32 jabber_events;
+        u32 rsvd6[3];
+        u32 rx_drops_payload_size;
+        u32 rx_drops_clipped_header;
+        u32 rx_drops_crc;
+        u32 roce_drops_payload_len;
+        u32 roce_drops_crc;
+        u32 rsvd7[19];
+};
+
+struct be_rxf_stats_v2 {
+        struct be_port_rxf_stats_v2 port[4];
+        u32 rsvd0[2];
+        u32 rx_drops_no_pbuf;
+        u32 rx_drops_no_txpb;
+        u32 rx_drops_no_erx_descr;
+        u32 rx_drops_no_tpre_descr;
+        u32 rsvd1[6];
+        u32 rx_drops_too_many_frags;
+        u32 rx_drops_invalid_ring;
+        u32 forwarded_packets;
+        u32 rx_drops_mtu;
+        u32 rsvd2[35];
+};
+
 struct be_hw_stats_v1 {
         struct be_rxf_stats_v1 rxf;
         u32 rsvd0[BE_TXP_SW_SZ];
@@ -1678,6 +1741,29 @@ struct be_cmd_resp_get_stats_v1 {
         struct be_hw_stats_v1 hw_stats;
 };
 
+struct be_erx_stats_v2 {
+        u32 rx_drops_no_fragments[136];     /* dwordS 0 to 135*/
+        u32 rsvd[3];
+};
+
+struct be_hw_stats_v2 {
+        struct be_rxf_stats_v2 rxf;
+        u32 rsvd0[BE_TXP_SW_SZ];
+        struct be_erx_stats_v2 erx;
+        struct be_pmem_stats pmem;
+        u32 rsvd1[18];
+};
+
+struct be_cmd_req_get_stats_v2 {
+        struct be_cmd_req_hdr hdr;
+        u8 rsvd[sizeof(struct be_hw_stats_v2)];
+};
+
+struct be_cmd_resp_get_stats_v2 {
+        struct be_cmd_resp_hdr hdr;
+        struct be_hw_stats_v2 hw_stats;
+};
+
 /************** get fat capabilites *******************/
 #define MAX_MODULES 27
 #define MAX_MODES 4
@@ -1865,137 +1951,120 @@ struct be_cmd_resp_get_iface_list {
         struct be_if_desc if_desc;
 };
 
-extern int be_pci_fnum_get(struct be_adapter *adapter);
-extern int be_fw_wait_ready(struct be_adapter *adapter);
-extern int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
-                                 bool permanent, u32 if_handle, u32 pmac_id);
-extern int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
-                        u32 if_id, u32 *pmac_id, u32 domain);
-extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id,
-                        int pmac_id, u32 domain);
-extern int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags,
-                            u32 en_flags, u32 *if_handle, u32 domain);
-extern int be_cmd_if_destroy(struct be_adapter *adapter, int if_handle,
-                        u32 domain);
-extern int be_cmd_eq_create(struct be_adapter *adapter, struct be_eq_obj *eqo);
-extern int be_cmd_cq_create(struct be_adapter *adapter,
-                        struct be_queue_info *cq, struct be_queue_info *eq,
-                        bool no_delay, int num_cqe_dma_coalesce);
-extern int be_cmd_mccq_create(struct be_adapter *adapter,
-                        struct be_queue_info *mccq,
-                        struct be_queue_info *cq);
-extern int be_cmd_txq_create(struct be_adapter *adapter,
-                        struct be_tx_obj *txo);
-extern int be_cmd_rxq_create(struct be_adapter *adapter,
-                        struct be_queue_info *rxq, u16 cq_id,
-                        u16 frag_size, u32 if_id, u32 rss, u8 *rss_id);
-extern int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
-                        int type);
-extern int be_cmd_rxq_destroy(struct be_adapter *adapter,
-                        struct be_queue_info *q);
-extern int be_cmd_link_status_query(struct be_adapter *adapter, u16 *link_speed,
-                                    u8 *link_status, u32 dom);
-extern int be_cmd_reset(struct be_adapter *adapter);
-extern int be_cmd_get_stats(struct be_adapter *adapter,
-                        struct be_dma_mem *nonemb_cmd);
-extern int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
-                        struct be_dma_mem *nonemb_cmd);
-extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
-                char *fw_on_flash);
-
-extern int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd);
-extern int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id,
-                        u16 *vtag_array, u32 num, bool untagged,
-                        bool promiscuous);
-extern int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
-extern int be_cmd_set_flow_control(struct be_adapter *adapter,
-                        u32 tx_fc, u32 rx_fc);
-extern int be_cmd_get_flow_control(struct be_adapter *adapter,
-                        u32 *tx_fc, u32 *rx_fc);
-extern int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
+int be_pci_fnum_get(struct be_adapter *adapter);
+int be_fw_wait_ready(struct be_adapter *adapter);
+int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
+                          bool permanent, u32 if_handle, u32 pmac_id);
+int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr, u32 if_id,
+                    u32 *pmac_id, u32 domain);
+int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, int pmac_id,
+                    u32 domain);
+int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
+                     u32 *if_handle, u32 domain);
+int be_cmd_if_destroy(struct be_adapter *adapter, int if_handle, u32 domain);
+int be_cmd_eq_create(struct be_adapter *adapter, struct be_eq_obj *eqo);
+int be_cmd_cq_create(struct be_adapter *adapter, struct be_queue_info *cq,
+                     struct be_queue_info *eq, bool no_delay,
+                     int num_cqe_dma_coalesce);
+int be_cmd_mccq_create(struct be_adapter *adapter, struct be_queue_info *mccq,
+                       struct be_queue_info *cq);
+int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo);
+int be_cmd_rxq_create(struct be_adapter *adapter, struct be_queue_info *rxq,
+                      u16 cq_id, u16 frag_size, u32 if_id, u32 rss, u8 *rss_id);
+int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
+                     int type);
+int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q);
+int be_cmd_link_status_query(struct be_adapter *adapter, u16 *link_speed,
+                             u8 *link_status, u32 dom);
+int be_cmd_reset(struct be_adapter *adapter);
+int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd);
+int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
+                               struct be_dma_mem *nonemb_cmd);
+int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
+                      char *fw_on_flash);
+int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
+int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
+                       u32 num, bool untagged, bool promiscuous);
+int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
+int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
+int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
+int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
                         u32 *function_mode, u32 *function_caps, u16 *asic_rev);
-extern int be_cmd_reset_function(struct be_adapter *adapter);
-extern int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
-                             u32 rss_hash_opts, u16 table_size);
-extern int be_process_mcc(struct be_adapter *adapter);
-extern int be_cmd_set_beacon_state(struct be_adapter *adapter,
-                        u8 port_num, u8 beacon, u8 status, u8 state);
-extern int be_cmd_get_beacon_state(struct be_adapter *adapter,
-                        u8 port_num, u32 *state);
-extern int be_cmd_write_flashrom(struct be_adapter *adapter,
-                        struct be_dma_mem *cmd, u32 flash_oper,
-                        u32 flash_opcode, u32 buf_size);
-extern int lancer_cmd_write_object(struct be_adapter *adapter,
-                                   struct be_dma_mem *cmd,
-                                   u32 data_size, u32 data_offset,
-                                   const char *obj_name,
-                                   u32 *data_written, u8 *change_status,
-                                   u8 *addn_status);
+int be_cmd_reset_function(struct be_adapter *adapter);
+int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
+                      u32 rss_hash_opts, u16 table_size);
+int be_process_mcc(struct be_adapter *adapter);
+int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon,
+                            u8 status, u8 state);
+int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num,
+                            u32 *state);
+int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
+                          u32 flash_oper, u32 flash_opcode, u32 buf_size);
+int lancer_cmd_write_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
+                            u32 data_size, u32 data_offset,
+                            const char *obj_name, u32 *data_written,
+                            u8 *change_status, u8 *addn_status);
 int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
-                u32 data_size, u32 data_offset, const char *obj_name,
-                u32 *data_read, u32 *eof, u8 *addn_status);
+                           u32 data_size, u32 data_offset, const char *obj_name,
+                           u32 *data_read, u32 *eof, u8 *addn_status);
 int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
-                                int offset);
-extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
-                                struct be_dma_mem *nonemb_cmd);
-extern int be_cmd_fw_init(struct be_adapter *adapter);
-extern int be_cmd_fw_clean(struct be_adapter *adapter);
-extern void be_async_mcc_enable(struct be_adapter *adapter);
-extern void be_async_mcc_disable(struct be_adapter *adapter);
-extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
-                                u32 loopback_type, u32 pkt_size,
-                                u32 num_pkts, u64 pattern);
-extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
-                        u32 byte_cnt, struct be_dma_mem *cmd);
-extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
-                                struct be_dma_mem *nonemb_cmd);
-extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
-                                u8 loopback_type, u8 enable);
-extern int be_cmd_get_phy_info(struct be_adapter *adapter);
-extern int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
-extern void be_detect_error(struct be_adapter *adapter);
-extern int be_cmd_get_die_temperature(struct be_adapter *adapter);
-extern int be_cmd_get_cntl_attributes(struct be_adapter *adapter);
-extern int be_cmd_req_native_mode(struct be_adapter *adapter);
-extern int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size);
-extern void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf);
-extern int be_cmd_get_fn_privileges(struct be_adapter *adapter,
-                                    u32 *privilege, u32 domain);
-extern int be_cmd_set_fn_privileges(struct be_adapter *adapter,
-                                    u32 privileges, u32 vf_num);
-extern int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
-                                    bool *pmac_id_active, u32 *pmac_id,
-                                    u8 domain);
-extern int be_cmd_get_active_mac(struct be_adapter *adapter, u32 pmac_id,
-                                 u8 *mac);
-extern int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac);
-extern int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array,
-                                                u8 mac_count, u32 domain);
-extern int be_cmd_set_mac(struct be_adapter *adapter, u8 *mac, int if_id,
-                          u32 dom);
-extern int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-                                 u32 domain, u16 intf_id, u16 hsw_mode);
-extern int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-                                 u32 domain, u16 intf_id, u8 *mode);
-extern int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter);
-extern int be_cmd_get_ext_fat_capabilites(struct be_adapter *adapter,
-                                          struct be_dma_mem *cmd);
-extern int be_cmd_set_ext_fat_capabilites(struct be_adapter *adapter,
-                                          struct be_dma_mem *cmd,
-                                          struct be_fat_conf_params *cfgs);
-extern int lancer_wait_ready(struct be_adapter *adapter);
-extern int lancer_physdev_ctrl(struct be_adapter *adapter, u32 mask);
-extern int lancer_initiate_dump(struct be_adapter *adapter);
-extern bool dump_present(struct be_adapter *adapter);
-extern int lancer_test_and_set_rdy_state(struct be_adapter *adapter);
-extern int be_cmd_query_port_name(struct be_adapter *adapter, u8 *port_name);
+                         int offset);
+int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
+                            struct be_dma_mem *nonemb_cmd);
+int be_cmd_fw_init(struct be_adapter *adapter);
+int be_cmd_fw_clean(struct be_adapter *adapter);
+void be_async_mcc_enable(struct be_adapter *adapter);
+void be_async_mcc_disable(struct be_adapter *adapter);
+int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
+                         u32 loopback_type, u32 pkt_size, u32 num_pkts,
+                         u64 pattern);
+int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern, u32 byte_cnt,
+                        struct be_dma_mem *cmd);
+int be_cmd_get_seeprom_data(struct be_adapter *adapter,
+                            struct be_dma_mem *nonemb_cmd);
+int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
+                        u8 loopback_type, u8 enable);
+int be_cmd_get_phy_info(struct be_adapter *adapter);
+int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
+void be_detect_error(struct be_adapter *adapter);
+int be_cmd_get_die_temperature(struct be_adapter *adapter);
+int be_cmd_get_cntl_attributes(struct be_adapter *adapter);
+int be_cmd_req_native_mode(struct be_adapter *adapter);
+int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size);
+void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf);
+int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege,
+                             u32 domain);
+int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 privileges,
+                             u32 vf_num);
+int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
+                             bool *pmac_id_active, u32 *pmac_id, u8 domain);
+int be_cmd_get_active_mac(struct be_adapter *adapter, u32 pmac_id, u8 *mac);
+int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac);
+int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array, u8 mac_count,
+                        u32 domain);
+int be_cmd_set_mac(struct be_adapter *adapter, u8 *mac, int if_id, u32 dom);
+int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid, u32 domain,
+                          u16 intf_id, u16 hsw_mode);
+int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid, u32 domain,
+                          u16 intf_id, u8 *mode);
+int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter);
+int be_cmd_get_ext_fat_capabilites(struct be_adapter *adapter,
+                                   struct be_dma_mem *cmd);
+int be_cmd_set_ext_fat_capabilites(struct be_adapter *adapter,
+                                   struct be_dma_mem *cmd,
+                                   struct be_fat_conf_params *cfgs);
+int lancer_wait_ready(struct be_adapter *adapter);
+int lancer_physdev_ctrl(struct be_adapter *adapter, u32 mask);
+int lancer_initiate_dump(struct be_adapter *adapter);
+bool dump_present(struct be_adapter *adapter);
+int lancer_test_and_set_rdy_state(struct be_adapter *adapter);
+int be_cmd_query_port_name(struct be_adapter *adapter, u8 *port_name);
 int be_cmd_get_func_config(struct be_adapter *adapter,
                            struct be_resources *res);
 int be_cmd_get_profile_config(struct be_adapter *adapter,
                               struct be_resources *res, u8 domain);
-extern int be_cmd_set_profile_config(struct be_adapter *adapter, u32 bps,
-                                     u8 domain);
-extern int be_cmd_get_if_id(struct be_adapter *adapter,
-                            struct be_vf_cfg *vf_cfg, int vf_num);
-extern int be_cmd_enable_vf(struct be_adapter *adapter, u8 domain);
-extern int be_cmd_intr_set(struct be_adapter *adapter, bool intr_enable);
+int be_cmd_set_profile_config(struct be_adapter *adapter, u32 bps, u8 domain);
+int be_cmd_get_if_id(struct be_adapter *adapter, struct be_vf_cfg *vf_cfg,
+                     int vf_num);
+int be_cmd_enable_vf(struct be_adapter *adapter, u8 domain);
+int be_cmd_intr_set(struct be_adapter *adapter, bool intr_enable);
diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
index b440a1fac77b..08330034d9ef 100644
--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
@@ -116,7 +116,12 @@ static const struct be_ethtool_stat et_stats[] = {
         {DRVSTAT_INFO(rx_drops_mtu)},
         /* Number of packets dropped due to random early drop function */
         {DRVSTAT_INFO(eth_red_drops)},
-        {DRVSTAT_INFO(be_on_die_temperature)}
+        {DRVSTAT_INFO(be_on_die_temperature)},
+        {DRVSTAT_INFO(rx_roce_bytes_lsd)},
+        {DRVSTAT_INFO(rx_roce_bytes_msd)},
+        {DRVSTAT_INFO(rx_roce_frames)},
+        {DRVSTAT_INFO(roce_drops_payload_len)},
+        {DRVSTAT_INFO(roce_drops_crc)}
 };
 #define ETHTOOL_STATS_NUM ARRAY_SIZE(et_stats)
 
@@ -155,7 +160,9 @@ static const struct be_ethtool_stat et_tx_stats[] = {
         /* Number of times the TX queue was stopped due to lack
          * of spaces in the TXQ.
          */
-        {DRVSTAT_TX_INFO(tx_stops)}
+        {DRVSTAT_TX_INFO(tx_stops)},
+        /* Pkts dropped in the driver's transmit path */
+        {DRVSTAT_TX_INFO(tx_drv_drops)}
 };
 #define ETHTOOL_TXSTATS_NUM (ARRAY_SIZE(et_tx_stats))
 
@@ -290,19 +297,19 @@ static int be_get_coalesce(struct net_device *netdev,
                            struct ethtool_coalesce *et)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        struct be_eq_obj *eqo = &adapter->eq_obj[0];
+        struct be_aic_obj *aic = &adapter->aic_obj[0];
 
 
-        et->rx_coalesce_usecs = eqo->cur_eqd;
-        et->rx_coalesce_usecs_high = eqo->max_eqd;
-        et->rx_coalesce_usecs_low = eqo->min_eqd;
+        et->rx_coalesce_usecs = aic->prev_eqd;
+        et->rx_coalesce_usecs_high = aic->max_eqd;
+        et->rx_coalesce_usecs_low = aic->min_eqd;
 
-        et->tx_coalesce_usecs = eqo->cur_eqd;
-        et->tx_coalesce_usecs_high = eqo->max_eqd;
-        et->tx_coalesce_usecs_low = eqo->min_eqd;
+        et->tx_coalesce_usecs = aic->prev_eqd;
+        et->tx_coalesce_usecs_high = aic->max_eqd;
+        et->tx_coalesce_usecs_low = aic->min_eqd;
 
-        et->use_adaptive_rx_coalesce = eqo->enable_aic;
-        et->use_adaptive_tx_coalesce = eqo->enable_aic;
+        et->use_adaptive_rx_coalesce = aic->enable;
+        et->use_adaptive_tx_coalesce = aic->enable;
 
         return 0;
 }
@@ -314,14 +321,17 @@ static int be_set_coalesce(struct net_device *netdev,
                            struct ethtool_coalesce *et)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
+        struct be_aic_obj *aic = &adapter->aic_obj[0];
         struct be_eq_obj *eqo;
         int i;
 
         for_all_evt_queues(adapter, eqo, i) {
-                eqo->enable_aic = et->use_adaptive_rx_coalesce;
-                eqo->max_eqd = min(et->rx_coalesce_usecs_high, BE_MAX_EQD);
-                eqo->min_eqd = min(et->rx_coalesce_usecs_low, eqo->max_eqd);
-                eqo->eqd = et->rx_coalesce_usecs;
+                aic->enable = et->use_adaptive_rx_coalesce;
+                aic->max_eqd = min(et->rx_coalesce_usecs_high, BE_MAX_EQD);
+                aic->min_eqd = min(et->rx_coalesce_usecs_low, aic->max_eqd);
+                aic->et_eqd = min(et->rx_coalesce_usecs, aic->max_eqd);
+                aic->et_eqd = max(aic->et_eqd, aic->min_eqd);
+                aic++;
         }
 
         return 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 2c38cc402119..393e3dc05a36 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -306,10 +306,14 @@ static void *hw_stats_from_cmd(struct be_adapter *adapter)
                 struct be_cmd_resp_get_stats_v0 *cmd = adapter->stats_cmd.va;
 
                 return &cmd->hw_stats;
-        } else  {
+        } else if (BE3_chip(adapter)) {
                 struct be_cmd_resp_get_stats_v1 *cmd = adapter->stats_cmd.va;
 
                 return &cmd->hw_stats;
+        } else {
+                struct be_cmd_resp_get_stats_v2 *cmd = adapter->stats_cmd.va;
+
+                return &cmd->hw_stats;
         }
 }
 
@@ -320,10 +324,14 @@ static void *be_erx_stats_from_cmd(struct be_adapter *adapter)
                 struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
 
                 return &hw_stats->erx;
-        } else {
+        } else if (BE3_chip(adapter)) {
                 struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
 
                 return &hw_stats->erx;
+        } else {
+                struct be_hw_stats_v2 *hw_stats = hw_stats_from_cmd(adapter);
+
+                return &hw_stats->erx;
         }
 }
 
@@ -422,6 +430,60 @@ static void populate_be_v1_stats(struct be_adapter *adapter)
         adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
 }
 
+static void populate_be_v2_stats(struct be_adapter *adapter)
+{
+        struct be_hw_stats_v2 *hw_stats = hw_stats_from_cmd(adapter);
+        struct be_pmem_stats *pmem_sts = &hw_stats->pmem;
+        struct be_rxf_stats_v2 *rxf_stats = &hw_stats->rxf;
+        struct be_port_rxf_stats_v2 *port_stats =
+                                        &rxf_stats->port[adapter->port_num];
+        struct be_drv_stats *drvs = &adapter->drv_stats;
+
+        be_dws_le_to_cpu(hw_stats, sizeof(*hw_stats));
+        drvs->pmem_fifo_overflow_drop = port_stats->pmem_fifo_overflow_drop;
+        drvs->rx_priority_pause_frames = port_stats->rx_priority_pause_frames;
+        drvs->rx_pause_frames = port_stats->rx_pause_frames;
+        drvs->rx_crc_errors = port_stats->rx_crc_errors;
+        drvs->rx_control_frames = port_stats->rx_control_frames;
+        drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
+        drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
+        drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
+        drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
+        drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
+        drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
+        drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
+        drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
+        drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
+        drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
+        drvs->rx_dropped_header_too_small =
+                port_stats->rx_dropped_header_too_small;
+        drvs->rx_input_fifo_overflow_drop =
+                port_stats->rx_input_fifo_overflow_drop;
+        drvs->rx_address_filtered = port_stats->rx_address_filtered;
+        drvs->rx_alignment_symbol_errors =
+                port_stats->rx_alignment_symbol_errors;
+        drvs->rxpp_fifo_overflow_drop = port_stats->rxpp_fifo_overflow_drop;
+        drvs->tx_pauseframes = port_stats->tx_pauseframes;
+        drvs->tx_controlframes = port_stats->tx_controlframes;
+        drvs->tx_priority_pauseframes = port_stats->tx_priority_pauseframes;
+        drvs->jabber_events = port_stats->jabber_events;
+        drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
+        drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
+        drvs->forwarded_packets = rxf_stats->forwarded_packets;
+        drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
+        drvs->rx_drops_no_tpre_descr = rxf_stats->rx_drops_no_tpre_descr;
+        drvs->rx_drops_too_many_frags = rxf_stats->rx_drops_too_many_frags;
+        adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
+        if (be_roce_supported(adapter))  {
+                drvs->rx_roce_bytes_lsd = port_stats->roce_bytes_received_lsd;
+                drvs->rx_roce_bytes_msd = port_stats->roce_bytes_received_msd;
+                drvs->rx_roce_frames = port_stats->roce_frames_received;
+                drvs->roce_drops_crc = port_stats->roce_drops_crc;
+                drvs->roce_drops_payload_len =
+                        port_stats->roce_drops_payload_len;
+        }
+}
+
 static void populate_lancer_stats(struct be_adapter *adapter)
 {
 
@@ -489,7 +551,7 @@ static void populate_erx_stats(struct be_adapter *adapter,
 
 void be_parse_stats(struct be_adapter *adapter)
 {
-        struct be_erx_stats_v1 *erx = be_erx_stats_from_cmd(adapter);
+        struct be_erx_stats_v2 *erx = be_erx_stats_from_cmd(adapter);
         struct be_rx_obj *rxo;
         int i;
         u32 erx_stat;
@@ -499,11 +561,13 @@ void be_parse_stats(struct be_adapter *adapter)
         } else {
                 if (BE2_chip(adapter))
                         populate_be_v0_stats(adapter);
-                else
-                        /* for BE3 and Skyhawk */
+                else if (BE3_chip(adapter))
+                        /* for BE3 */
                         populate_be_v1_stats(adapter);
+                else
+                        populate_be_v2_stats(adapter);
 
-                /* as erx_v1 is longer than v0, ok to use v1 for v0 access */
+                /* erx_v2 is longer than v0, v1. use v2 for v0, v1 access */
                 for_all_rx_queues(adapter, rxo, i) {
                         erx_stat = erx->rx_drops_no_fragments[rxo->q.id];
                         populate_erx_stats(adapter, rxo, erx_stat);
@@ -935,8 +999,10 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
         u32 start = txq->head;
 
         skb = be_xmit_workarounds(adapter, skb, &skip_hw_vlan);
-        if (!skb)
+        if (!skb) {
+                tx_stats(txo)->tx_drv_drops++;
                 return NETDEV_TX_OK;
+        }
 
         wrb_cnt = wrb_cnt_for_skb(adapter, skb, &dummy_wrb);
 
@@ -965,6 +1031,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
                 be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
         } else {
                 txq->head = start;
+                tx_stats(txo)->tx_drv_drops++;
                 dev_kfree_skb_any(skb);
         }
         return NETDEV_TX_OK;
@@ -1275,53 +1342,79 @@ static int be_set_vf_tx_rate(struct net_device *netdev,
         return status;
 }
 
-static void be_eqd_update(struct be_adapter *adapter, struct be_eq_obj *eqo)
+static void be_aic_update(struct be_aic_obj *aic, u64 rx_pkts, u64 tx_pkts,
+                          ulong now)
 {
-        struct be_rx_stats *stats = rx_stats(&adapter->rx_obj[eqo->idx]);
-        ulong now = jiffies;
-        ulong delta = now - stats->rx_jiffies;
-        u64 pkts;
-        unsigned int start, eqd;
+        aic->rx_pkts_prev = rx_pkts;
+        aic->tx_reqs_prev = tx_pkts;
+        aic->jiffies = now;
+}
 
-        if (!eqo->enable_aic) {
-                eqd = eqo->eqd;
-                goto modify_eqd;
-        }
+static void be_eqd_update(struct be_adapter *adapter)
+{
+        struct be_set_eqd set_eqd[MAX_EVT_QS];
+        int eqd, i, num = 0, start;
+        struct be_aic_obj *aic;
+        struct be_eq_obj *eqo;
+        struct be_rx_obj *rxo;
+        struct be_tx_obj *txo;
+        u64 rx_pkts, tx_pkts;
+        ulong now;
+        u32 pps, delta;
 
-        if (eqo->idx >= adapter->num_rx_qs)
-                return;
+        for_all_evt_queues(adapter, eqo, i) {
+                aic = &adapter->aic_obj[eqo->idx];
+                if (!aic->enable) {
+                        if (aic->jiffies)
+                                aic->jiffies = 0;
+                        eqd = aic->et_eqd;
+                        goto modify_eqd;
+                }
 
-        stats = rx_stats(&adapter->rx_obj[eqo->idx]);
+                rxo = &adapter->rx_obj[eqo->idx];
+                do {
+                        start = u64_stats_fetch_begin_bh(&rxo->stats.sync);
+                        rx_pkts = rxo->stats.rx_pkts;
+                } while (u64_stats_fetch_retry_bh(&rxo->stats.sync, start));
 
-        /* Wrapped around */
-        if (time_before(now, stats->rx_jiffies)) {
-                stats->rx_jiffies = now;
-                return;
-        }
+                txo = &adapter->tx_obj[eqo->idx];
+                do {
+                        start = u64_stats_fetch_begin_bh(&txo->stats.sync);
+                        tx_pkts = txo->stats.tx_reqs;
+                } while (u64_stats_fetch_retry_bh(&txo->stats.sync, start));
 
-        /* Update once a second */
-        if (delta < HZ)
-                return;
 
-        do {
-                start = u64_stats_fetch_begin_bh(&stats->sync);
-                pkts = stats->rx_pkts;
-        } while (u64_stats_fetch_retry_bh(&stats->sync, start));
-
-        stats->rx_pps = (unsigned long)(pkts - stats->rx_pkts_prev) / (delta / HZ);
-        stats->rx_pkts_prev = pkts;
-        stats->rx_jiffies = now;
-        eqd = (stats->rx_pps / 110000) << 3;
-        eqd = min(eqd, eqo->max_eqd);
-        eqd = max(eqd, eqo->min_eqd);
-        if (eqd < 10)
-                eqd = 0;
+                /* Skip, if wrapped around or first calculation */
+                now = jiffies;
+                if (!aic->jiffies || time_before(now, aic->jiffies) ||
+                    rx_pkts < aic->rx_pkts_prev ||
+                    tx_pkts < aic->tx_reqs_prev) {
+                        be_aic_update(aic, rx_pkts, tx_pkts, now);
+                        continue;
+                }
 
+                delta = jiffies_to_msecs(now - aic->jiffies);
+                pps = (((u32)(rx_pkts - aic->rx_pkts_prev) * 1000) / delta) +
+                        (((u32)(tx_pkts - aic->tx_reqs_prev) * 1000) / delta);
+                eqd = (pps / 15000) << 2;
+
+                if (eqd < 8)
+                        eqd = 0;
+                eqd = min_t(u32, eqd, aic->max_eqd);
+                eqd = max_t(u32, eqd, aic->min_eqd);
+
+                be_aic_update(aic, rx_pkts, tx_pkts, now);
 modify_eqd:
-        if (eqd != eqo->cur_eqd) {
-                be_cmd_modify_eqd(adapter, eqo->q.id, eqd);
-                eqo->cur_eqd = eqd;
+                if (eqd != aic->prev_eqd) {
+                        set_eqd[num].delay_multiplier = (eqd * 65)/100;
+                        set_eqd[num].eq_id = eqo->q.id;
+                        aic->prev_eqd = eqd;
+                        num++;
+                }
         }
+
+        if (num)
+                be_cmd_modify_eqd(adapter, set_eqd, num);
 }
 
 static void be_rx_stats_update(struct be_rx_obj *rxo,
@@ -1938,6 +2031,7 @@ static int be_evt_queues_create(struct be_adapter *adapter)
 {
         struct be_queue_info *eq;
         struct be_eq_obj *eqo;
+        struct be_aic_obj *aic;
         int i, rc;
 
         adapter->num_evt_qs = min_t(u16, num_irqs(adapter),
@@ -1946,11 +2040,12 @@ static int be_evt_queues_create(struct be_adapter *adapter)
         for_all_evt_queues(adapter, eqo, i) {
                 netif_napi_add(adapter->netdev, &eqo->napi, be_poll,
                                BE_NAPI_WEIGHT);
+                aic = &adapter->aic_obj[i];
                 eqo->adapter = adapter;
                 eqo->tx_budget = BE_TX_BUDGET;
                 eqo->idx = i;
-                eqo->max_eqd = BE_MAX_EQD;
-                eqo->enable_aic = true;
+                aic->max_eqd = BE_MAX_EQD;
+                aic->enable = true;
 
                 eq = &eqo->q;
                 rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
@@ -2937,7 +3032,8 @@ static int be_vf_setup(struct be_adapter *adapter)
                         goto err;
                 vf_cfg->def_vid = def_vlan;
 
-                be_cmd_enable_vf(adapter, vf + 1);
+                if (!old_vfs)
+                        be_cmd_enable_vf(adapter, vf + 1);
         }
 
         if (!old_vfs) {
@@ -2962,12 +3058,12 @@ static void BEx_get_resources(struct be_adapter *adapter,
         struct pci_dev *pdev = adapter->pdev;
         bool use_sriov = false;
 
-        if (BE3_chip(adapter) && be_physfn(adapter)) {
+        if (BE3_chip(adapter) && sriov_want(adapter)) {
                 int max_vfs;
 
                 max_vfs = pci_sriov_get_totalvfs(pdev);
                 res->max_vfs = max_vfs > 0 ? min(MAX_VFS, max_vfs) : 0;
-                use_sriov = res->max_vfs && num_vfs;
+                use_sriov = res->max_vfs;
         }
 
         if (be_physfn(adapter))
@@ -2983,8 +3079,9 @@ static void BEx_get_resources(struct be_adapter *adapter,
                 res->max_vlans = BE_NUM_VLANS_SUPPORTED;
         res->max_mcast_mac = BE_MAX_MC;
 
+        /* For BE3 1Gb ports, F/W does not properly support multiple TXQs */
         if (BE2_chip(adapter) || use_sriov || be_is_mc(adapter) ||
-            !be_physfn(adapter))
+            !be_physfn(adapter) || (adapter->port_num > 1))
                 res->max_tx_qs = 1;
         else
                 res->max_tx_qs = BE3_MAX_TX_QS;
@@ -3026,14 +3123,6 @@ static int be_get_resources(struct be_adapter *adapter)
                 adapter->res = res;
         }
 
-        /* For BE3 only check if FW suggests a different max-txqs value */
-        if (BE3_chip(adapter)) {
-                status = be_cmd_get_profile_config(adapter, &res, 0);
-                if (!status && res.max_tx_qs)
-                        adapter->res.max_tx_qs =
-                                min(adapter->res.max_tx_qs, res.max_tx_qs);
-        }
-
         /* For Lancer, SH etc read per-function resource limits from FW.
          * GET_FUNC_CONFIG returns per function guaranteed limits.
          * GET_PROFILE_CONFIG returns PCI-E related limits PF-pool limits
@@ -3258,7 +3347,7 @@ static int be_setup(struct be_adapter *adapter)
                 be_cmd_set_flow_control(adapter, adapter->tx_fc,
                                         adapter->rx_fc);
 
-        if (be_physfn(adapter) && num_vfs) {
+        if (sriov_want(adapter)) {
                 if (be_max_vfs(adapter))
                         be_vf_setup(adapter);
                 else
@@ -4077,9 +4166,11 @@ static int be_stats_init(struct be_adapter *adapter)
                 cmd->size = sizeof(struct lancer_cmd_req_pport_stats);
         else if (BE2_chip(adapter))
                 cmd->size = sizeof(struct be_cmd_req_get_stats_v0);
-        else
-                /* BE3 and Skyhawk */
+        else if (BE3_chip(adapter))
                 cmd->size = sizeof(struct be_cmd_req_get_stats_v1);
+        else
+                /* ALL non-BE ASICs */
+                cmd->size = sizeof(struct be_cmd_req_get_stats_v2);
 
         cmd->va = dma_zalloc_coherent(&adapter->pdev->dev, cmd->size, &cmd->dma,
                                       GFP_KERNEL);
@@ -4113,7 +4204,6 @@ static void be_remove(struct pci_dev *pdev)
 
         pci_disable_pcie_error_reporting(pdev);
 
-        pci_set_drvdata(pdev, NULL);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 
@@ -4262,7 +4352,6 @@ static void be_worker(struct work_struct *work)
         struct be_adapter *adapter =
                 container_of(work, struct be_adapter, work.work);
         struct be_rx_obj *rxo;
-        struct be_eq_obj *eqo;
         int i;
 
         /* when interrupts are not yet enabled, just reap any pending
@@ -4293,8 +4382,7 @@ static void be_worker(struct work_struct *work)
                 }
         }
 
-        for_all_evt_queues(adapter, eqo, i)
-                be_eqd_update(adapter, eqo);
+        be_eqd_update(adapter);
 
 reschedule:
         adapter->work_counter++;
@@ -4370,9 +4458,11 @@ static int be_probe(struct pci_dev *pdev, const struct pci_device_id *pdev_id)
                 }
         }
 
-        status = pci_enable_pcie_error_reporting(pdev);
-        if (status)
-                dev_info(&pdev->dev, "Could not use PCIe error reporting\n");
+        if (be_physfn(adapter)) {
+                status = pci_enable_pcie_error_reporting(pdev);
+                if (!status)
+                        dev_info(&pdev->dev, "PCIe error reporting enabled\n");
+        }
 
         status = be_ctrl_init(adapter);
         if (status)
@@ -4443,7 +4533,6 @@ ctrl_clean:
         be_ctrl_cleanup(adapter);
 free_netdev:
         free_netdev(netdev);
-        pci_set_drvdata(pdev, NULL);
 rel_reg:
         pci_release_regions(pdev);
 disable_dev:
diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index c706b7a9397e..4b22a9579f85 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -699,7 +699,6 @@ static void fealnx_remove_one(struct pci_dev *pdev)
                 pci_iounmap(pdev, np->mem);
                 free_netdev(dev);
                 pci_release_regions(pdev);
-                pci_set_drvdata(pdev, NULL);
         } else
                 printk(KERN_ERR "fealnx: remove for unknown device\n");
 }
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index 6b60582ce8cf..56f2f608a9f4 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -1083,7 +1083,7 @@ static int fs_enet_probe(struct platform_device *ofdev)
 
         mac_addr = of_get_mac_address(ofdev->dev.of_node);
         if (mac_addr)
-                memcpy(ndev->dev_addr, mac_addr, 6);
+                memcpy(ndev->dev_addr, mac_addr, ETH_ALEN);
 
         ret = fep->ops->allocate_bd(ndev);
         if (ret)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 9fbe4dda7a0e..d6d810cb97c7 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2918,7 +2918,7 @@ static int gfar_poll(struct napi_struct *napi, int budget)
         struct gfar_priv_rx_q *rx_queue = NULL;
         int work_done = 0, work_done_per_q = 0;
         int i, budget_per_q = 0;
-        int has_tx_work;
+        int has_tx_work = 0;
         unsigned long rstat_rxf;
         int num_act_queues;
 
@@ -2933,62 +2933,51 @@ static int gfar_poll(struct napi_struct *napi, int budget)
         if (num_act_queues)
                 budget_per_q = budget/num_act_queues;
 
-        while (1) {
-                has_tx_work = 0;
-                for_each_set_bit(i, &gfargrp->tx_bit_map, priv->num_tx_queues) {
-                        tx_queue = priv->tx_queue[i];
-                        /* run Tx cleanup to completion */
-                        if (tx_queue->tx_skbuff[tx_queue->skb_dirtytx]) {
-                                gfar_clean_tx_ring(tx_queue);
-                                has_tx_work = 1;
-                        }
+        for_each_set_bit(i, &gfargrp->tx_bit_map, priv->num_tx_queues) {
+                tx_queue = priv->tx_queue[i];
+                /* run Tx cleanup to completion */
+                if (tx_queue->tx_skbuff[tx_queue->skb_dirtytx]) {
+                        gfar_clean_tx_ring(tx_queue);
+                        has_tx_work = 1;
                 }
+        }
 
-                for_each_set_bit(i, &gfargrp->rx_bit_map, priv->num_rx_queues) {
-                        /* skip queue if not active */
-                        if (!(rstat_rxf & (RSTAT_CLEAR_RXF0 >> i)))
-                                continue;
-
-                        rx_queue = priv->rx_queue[i];
-                        work_done_per_q =
-                                gfar_clean_rx_ring(rx_queue, budget_per_q);
-                        work_done += work_done_per_q;
-
-                        /* finished processing this queue */
-                        if (work_done_per_q < budget_per_q) {
-                                /* clear active queue hw indication */
-                                gfar_write(&regs->rstat,
-                                           RSTAT_CLEAR_RXF0 >> i);
-                                rstat_rxf &= ~(RSTAT_CLEAR_RXF0 >> i);
-                                num_act_queues--;
-
-                                if (!num_act_queues)
-                                        break;
-                                /* recompute budget per Rx queue */
-                                budget_per_q =
-                                        (budget - work_done) / num_act_queues;
-                        }
-                }
+        for_each_set_bit(i, &gfargrp->rx_bit_map, priv->num_rx_queues) {
+                /* skip queue if not active */
+                if (!(rstat_rxf & (RSTAT_CLEAR_RXF0 >> i)))
+                        continue;
 
-                if (work_done >= budget)
-                        break;
+                rx_queue = priv->rx_queue[i];
+                work_done_per_q =
+                        gfar_clean_rx_ring(rx_queue, budget_per_q);
+                work_done += work_done_per_q;
+
+                /* finished processing this queue */
+                if (work_done_per_q < budget_per_q) {
+                        /* clear active queue hw indication */
+                        gfar_write(&regs->rstat,
+                                   RSTAT_CLEAR_RXF0 >> i);
+                        num_act_queues--;
+
+                        if (!num_act_queues)
+                                break;
+                }
+        }
 
-                if (!num_act_queues && !has_tx_work) {
+        if (!num_act_queues && !has_tx_work) {
 
-                        napi_complete(napi);
+                napi_complete(napi);
 
-                        /* Clear the halt bit in RSTAT */
-                        gfar_write(&regs->rstat, gfargrp->rstat);
+                /* Clear the halt bit in RSTAT */
+                gfar_write(&regs->rstat, gfargrp->rstat);
 
-                        gfar_write(&regs->imask, IMASK_DEFAULT);
+                gfar_write(&regs->imask, IMASK_DEFAULT);
 
-                        /* If we are coalescing interrupts, update the timer
-                         * Otherwise, clear it
-                         */
-                        gfar_configure_coalescing(priv, gfargrp->rx_bit_map,
-                                                  gfargrp->tx_bit_map);
-                        break;
-                }
+                /* If we are coalescing interrupts, update the timer
+                 * Otherwise, clear it
+                 */
+                gfar_configure_coalescing(priv, gfargrp->rx_bit_map,
+                                          gfargrp->tx_bit_map);
         }
 
         return work_done;
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 04112b98ff5d..114c58f9d8d2 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -1177,21 +1177,21 @@ static inline void gfar_read_filer(struct gfar_private *priv,
         *fpr = gfar_read(&regs->rqfpr);
 }
 
-extern void lock_rx_qs(struct gfar_private *priv);
-extern void lock_tx_qs(struct gfar_private *priv);
-extern void unlock_rx_qs(struct gfar_private *priv);
-extern void unlock_tx_qs(struct gfar_private *priv);
-extern irqreturn_t gfar_receive(int irq, void *dev_id);
-extern int startup_gfar(struct net_device *dev);
-extern void stop_gfar(struct net_device *dev);
-extern void gfar_halt(struct net_device *dev);
-extern void gfar_phy_test(struct mii_bus *bus, struct phy_device *phydev,
-                int enable, u32 regnum, u32 read);
-extern void gfar_configure_coalescing_all(struct gfar_private *priv);
+void lock_rx_qs(struct gfar_private *priv);
+void lock_tx_qs(struct gfar_private *priv);
+void unlock_rx_qs(struct gfar_private *priv);
+void unlock_tx_qs(struct gfar_private *priv);
+irqreturn_t gfar_receive(int irq, void *dev_id);
+int startup_gfar(struct net_device *dev);
+void stop_gfar(struct net_device *dev);
+void gfar_halt(struct net_device *dev);
+void gfar_phy_test(struct mii_bus *bus, struct phy_device *phydev, int enable,
+                   u32 regnum, u32 read);
+void gfar_configure_coalescing_all(struct gfar_private *priv);
 void gfar_init_sysfs(struct net_device *dev);
 int gfar_set_features(struct net_device *dev, netdev_features_t features);
-extern void gfar_check_rx_parser_mode(struct gfar_private *priv);
-extern void gfar_vlan_mode(struct net_device *dev, netdev_features_t features);
+void gfar_check_rx_parser_mode(struct gfar_private *priv);
+void gfar_vlan_mode(struct net_device *dev, netdev_features_t features);
 
 extern const struct ethtool_ops gfar_ethtool_ops;
 
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 5930c39672db..d58a3dfc95c2 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3899,7 +3899,7 @@ static int ucc_geth_probe(struct platform_device* ofdev)
 
         mac_addr = of_get_mac_address(np);
         if (mac_addr)
-                memcpy(dev->dev_addr, mac_addr, 6);
+                memcpy(dev->dev_addr, mac_addr, ETH_ALEN);
 
         ugeth->ug_info = ug_info;
         ugeth->dev = device;
diff --git a/drivers/net/ethernet/fujitsu/Kconfig b/drivers/net/ethernet/fujitsu/Kconfig
index 6231bc02b964..1085257385d2 100644
--- a/drivers/net/ethernet/fujitsu/Kconfig
+++ b/drivers/net/ethernet/fujitsu/Kconfig
@@ -5,7 +5,7 @@
 config NET_VENDOR_FUJITSU
         bool "Fujitsu devices"
         default y
-        depends on ISA || PCMCIA
+        depends on PCMCIA
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index 91227d03274e..37860096f744 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -1098,7 +1098,7 @@ static int hp100_open(struct net_device *dev)
         if (request_irq(dev->irq, hp100_interrupt,
                         lp->bus == HP100_BUS_PCI || lp->bus ==
                         HP100_BUS_EISA ? IRQF_SHARED : 0,
-                        "hp100", dev)) {
+                        dev->name, dev)) {
                 printk("hp100: %s: unable to get IRQ %d\n", dev->name, dev->irq);
                 return -EAGAIN;
         }
diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index e38816145395..a15877affc9b 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -711,7 +711,7 @@ static int init_i596_mem(struct net_device *dev)
         i596_add_cmd(dev, &lp->cf_cmd.cmd);
 
         DEB(DEB_INIT,printk(KERN_DEBUG "%s: queuing CmdSASetup\n", dev->name));
-        memcpy(lp->sa_cmd.eth_addr, dev->dev_addr, 6);
+        memcpy(lp->sa_cmd.eth_addr, dev->dev_addr, ETH_ALEN);
         lp->sa_cmd.cmd.command = CmdSASetup;
         i596_add_cmd(dev, &lp->sa_cmd.cmd);
 
@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit)
                         err = -ENODEV;
                         goto out;
                 }
-                memcpy(eth_addr, (void *) 0xfffc1f2c, 6);       /* YUCK! Get addr from NOVRAM */
+                memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN);        /* YUCK! Get addr from NOVRAM */
                 dev->base_addr = MVME_I596_BASE;
                 dev->irq = (unsigned) MVME16x_IRQ_I596;
                 goto found;
diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
index d653bac4cfc4..861fa15e1e81 100644
--- a/drivers/net/ethernet/i825xx/lib82596.c
+++ b/drivers/net/ethernet/i825xx/lib82596.c
@@ -607,7 +607,7 @@ static int init_i596_mem(struct net_device *dev)
         i596_add_cmd(dev, &dma->cf_cmd.cmd);
 
         DEB(DEB_INIT, printk(KERN_DEBUG "%s: queuing CmdSASetup\n", dev->name));
-        memcpy(dma->sa_cmd.eth_addr, dev->dev_addr, 6);
+        memcpy(dma->sa_cmd.eth_addr, dev->dev_addr, ETH_ALEN);
         dma->sa_cmd.cmd.command = SWAP16(CmdSASetup);
         DMA_WBACK(dev, &(dma->sa_cmd), sizeof(struct sa_cmd));
         i596_add_cmd(dev, &dma->sa_cmd.cmd);
@@ -1396,13 +1396,13 @@ static void set_multicast_list(struct net_device *dev)
                 netdev_for_each_mc_addr(ha, dev) {
                         if (!cnt--)
                                 break;
-                        memcpy(cp, ha->addr, 6);
+                        memcpy(cp, ha->addr, ETH_ALEN);
                         if (i596_debug > 1)
                                 DEB(DEB_MULTI,
                                     printk(KERN_DEBUG
                                            "%s: Adding address %pM\n",
                                            dev->name, cp));
-                        cp += 6;
+                        cp += ETH_ALEN;
                 }
                 DMA_WBACK_INV(dev, &dma->mc_cmd, sizeof(struct mc_cmd));
                 i596_add_cmd(dev, &cmd->cmd);
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 6b5c7222342c..ef21a2e10180 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2676,7 +2676,7 @@ static int emac_init_config(struct emac_instance *dev)
                        np->full_name);
                 return -ENXIO;
         }
-        memcpy(dev->ndev->dev_addr, p, 6);
+        memcpy(dev->ndev->dev_addr, p, ETH_ALEN);
 
         /* IAHT and GAHT filter parameterization */
         if (emac_has_feature(dev, EMAC_FTR_EMAC4SYNC)) {
diff --git a/drivers/net/ethernet/ibm/emac/debug.h b/drivers/net/ethernet/ibm/emac/debug.h
index 59a92d5870b5..9c45efe4c8fe 100644
--- a/drivers/net/ethernet/ibm/emac/debug.h
+++ b/drivers/net/ethernet/ibm/emac/debug.h
@@ -29,13 +29,13 @@
 struct emac_instance;
 struct mal_instance;
 
-extern void emac_dbg_register(struct emac_instance *dev);
-extern void emac_dbg_unregister(struct emac_instance *dev);
-extern void mal_dbg_register(struct mal_instance *mal);
-extern void mal_dbg_unregister(struct mal_instance *mal);
-extern int emac_init_debug(void) __init;
-extern void emac_fini_debug(void) __exit;
-extern void emac_dbg_dump_all(void);
+void emac_dbg_register(struct emac_instance *dev);
+void emac_dbg_unregister(struct emac_instance *dev);
+void mal_dbg_register(struct mal_instance *mal);
+void mal_dbg_unregister(struct mal_instance *mal);
+int emac_init_debug(void) __init;
+void emac_fini_debug(void) __exit;
+void emac_dbg_dump_all(void);
 
 # define DBG_LEVEL              1
 
diff --git a/drivers/net/ethernet/ibm/emac/rgmii.h b/drivers/net/ethernet/ibm/emac/rgmii.h
index 668bceeff4a2..d4f1374d1900 100644
--- a/drivers/net/ethernet/ibm/emac/rgmii.h
+++ b/drivers/net/ethernet/ibm/emac/rgmii.h
@@ -56,15 +56,15 @@ struct rgmii_instance {
 
 #ifdef CONFIG_IBM_EMAC_RGMII
 
-extern int rgmii_init(void);
-extern void rgmii_exit(void);
-extern int rgmii_attach(struct platform_device *ofdev, int input, int mode);
-extern void rgmii_detach(struct platform_device *ofdev, int input);
-extern void rgmii_get_mdio(struct platform_device *ofdev, int input);
-extern void rgmii_put_mdio(struct platform_device *ofdev, int input);
-extern void rgmii_set_speed(struct platform_device *ofdev, int input, int speed);
-extern int rgmii_get_regs_len(struct platform_device *ofdev);
-extern void *rgmii_dump_regs(struct platform_device *ofdev, void *buf);
+int rgmii_init(void);
+void rgmii_exit(void);
+int rgmii_attach(struct platform_device *ofdev, int input, int mode);
+void rgmii_detach(struct platform_device *ofdev, int input);
+void rgmii_get_mdio(struct platform_device *ofdev, int input);
+void rgmii_put_mdio(struct platform_device *ofdev, int input);
+void rgmii_set_speed(struct platform_device *ofdev, int input, int speed);
+int rgmii_get_regs_len(struct platform_device *ofdev);
+void *rgmii_dump_regs(struct platform_device *ofdev, void *buf);
 
 #else
 
diff --git a/drivers/net/ethernet/ibm/emac/tah.h b/drivers/net/ethernet/ibm/emac/tah.h
index 350b7096a041..4d5f336f07b3 100644
--- a/drivers/net/ethernet/ibm/emac/tah.h
+++ b/drivers/net/ethernet/ibm/emac/tah.h
@@ -72,13 +72,13 @@ struct tah_instance {
 
 #ifdef CONFIG_IBM_EMAC_TAH
 
-extern int tah_init(void);
-extern void tah_exit(void);
-extern int tah_attach(struct platform_device *ofdev, int channel);
-extern void tah_detach(struct platform_device *ofdev, int channel);
-extern void tah_reset(struct platform_device *ofdev);
-extern int tah_get_regs_len(struct platform_device *ofdev);
-extern void *tah_dump_regs(struct platform_device *ofdev, void *buf);
+int tah_init(void);
+void tah_exit(void);
+int tah_attach(struct platform_device *ofdev, int channel);
+void tah_detach(struct platform_device *ofdev, int channel);
+void tah_reset(struct platform_device *ofdev);
+int tah_get_regs_len(struct platform_device *ofdev);
+void *tah_dump_regs(struct platform_device *ofdev, void *buf);
 
 #else
 
diff --git a/drivers/net/ethernet/ibm/emac/zmii.h b/drivers/net/ethernet/ibm/emac/zmii.h
index 455bfb085493..0959c55b1459 100644
--- a/drivers/net/ethernet/ibm/emac/zmii.h
+++ b/drivers/net/ethernet/ibm/emac/zmii.h
@@ -53,15 +53,15 @@ struct zmii_instance {
 
 #ifdef CONFIG_IBM_EMAC_ZMII
 
-extern int zmii_init(void);
-extern void zmii_exit(void);
-extern int zmii_attach(struct platform_device *ofdev, int input, int *mode);
-extern void zmii_detach(struct platform_device *ofdev, int input);
-extern void zmii_get_mdio(struct platform_device *ofdev, int input);
-extern void zmii_put_mdio(struct platform_device *ofdev, int input);
-extern void zmii_set_speed(struct platform_device *ofdev, int input, int speed);
-extern int zmii_get_regs_len(struct platform_device *ocpdev);
-extern void *zmii_dump_regs(struct platform_device *ofdev, void *buf);
+int zmii_init(void);
+void zmii_exit(void);
+int zmii_attach(struct platform_device *ofdev, int input, int *mode);
+void zmii_detach(struct platform_device *ofdev, int input);
+void zmii_get_mdio(struct platform_device *ofdev, int input);
+void zmii_put_mdio(struct platform_device *ofdev, int input);
+void zmii_set_speed(struct platform_device *ofdev, int input, int speed);
+int zmii_get_regs_len(struct platform_device *ocpdev);
+void *zmii_dump_regs(struct platform_device *ofdev, void *buf);
 
 #else
 # define zmii_init()            0
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 5d41aee69d16..952d795230a4 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1185,7 +1185,7 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                 netdev_for_each_mc_addr(ha, netdev) {
                         /* add the multicast address to the filter table */
                         unsigned long mcast_addr = 0;
-                        memcpy(((char *)&mcast_addr)+2, ha->addr, 6);
+                        memcpy(((char *)&mcast_addr)+2, ha->addr, ETH_ALEN);
                         lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                    IbmVethMcastAddFilter,
                                                    mcast_addr);
@@ -1370,7 +1370,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
         netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
 
         adapter->mac_addr = 0;
-        memcpy(&adapter->mac_addr, mac_addr_p, 6);
+        memcpy(&adapter->mac_addr, mac_addr_p, ETH_ALEN);
 
         netdev->irq = dev->irq;
         netdev->netdev_ops = &ibmveth_netdev_ops;
diff --git a/drivers/net/ethernet/icplus/ipg.c b/drivers/net/ethernet/icplus/ipg.c
index bdf5023724e7..25045ae07171 100644
--- a/drivers/net/ethernet/icplus/ipg.c
+++ b/drivers/net/ethernet/icplus/ipg.c
@@ -2183,7 +2183,6 @@ static void ipg_remove(struct pci_dev *pdev)
 
         free_netdev(dev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static const struct net_device_ops ipg_netdev_ops = {
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index ada6e210279f..cbaba4442d4b 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -2985,7 +2985,6 @@ err_out_free_res:
 err_out_disable_pdev:
         pci_disable_device(pdev);
 err_out_free_dev:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(netdev);
         return err;
 }
@@ -3003,7 +3002,6 @@ static void e100_remove(struct pci_dev *pdev)
                 free_netdev(netdev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 26d9cd59ec75..58c147271a36 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -325,7 +325,7 @@ enum e1000_state_t {
 #undef pr_fmt
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
-extern struct net_device *e1000_get_hw_dev(struct e1000_hw *hw);
+struct net_device *e1000_get_hw_dev(struct e1000_hw *hw);
 #define e_dbg(format, arg...) \
         netdev_dbg(e1000_get_hw_dev(hw), format, ## arg)
 #define e_err(msglvl, format, arg...) \
@@ -346,20 +346,20 @@ extern struct net_device *e1000_get_hw_dev(struct e1000_hw *hw);
 extern char e1000_driver_name[];
 extern const char e1000_driver_version[];
 
-extern int e1000_up(struct e1000_adapter *adapter);
-extern void e1000_down(struct e1000_adapter *adapter);
-extern void e1000_reinit_locked(struct e1000_adapter *adapter);
-extern void e1000_reset(struct e1000_adapter *adapter);
-extern int e1000_set_spd_dplx(struct e1000_adapter *adapter, u32 spd, u8 dplx);
-extern int e1000_setup_all_rx_resources(struct e1000_adapter *adapter);
-extern int e1000_setup_all_tx_resources(struct e1000_adapter *adapter);
-extern void e1000_free_all_rx_resources(struct e1000_adapter *adapter);
-extern void e1000_free_all_tx_resources(struct e1000_adapter *adapter);
-extern void e1000_update_stats(struct e1000_adapter *adapter);
-extern bool e1000_has_link(struct e1000_adapter *adapter);
-extern void e1000_power_up_phy(struct e1000_adapter *);
-extern void e1000_set_ethtool_ops(struct net_device *netdev);
-extern void e1000_check_options(struct e1000_adapter *adapter);
-extern char *e1000_get_hw_dev_name(struct e1000_hw *hw);
+int e1000_up(struct e1000_adapter *adapter);
+void e1000_down(struct e1000_adapter *adapter);
+void e1000_reinit_locked(struct e1000_adapter *adapter);
+void e1000_reset(struct e1000_adapter *adapter);
+int e1000_set_spd_dplx(struct e1000_adapter *adapter, u32 spd, u8 dplx);
+int e1000_setup_all_rx_resources(struct e1000_adapter *adapter);
+int e1000_setup_all_tx_resources(struct e1000_adapter *adapter);
+void e1000_free_all_rx_resources(struct e1000_adapter *adapter);
+void e1000_free_all_tx_resources(struct e1000_adapter *adapter);
+void e1000_update_stats(struct e1000_adapter *adapter);
+bool e1000_has_link(struct e1000_adapter *adapter);
+void e1000_power_up_phy(struct e1000_adapter *);
+void e1000_set_ethtool_ops(struct net_device *netdev);
+void e1000_check_options(struct e1000_adapter *adapter);
+char *e1000_get_hw_dev_name(struct e1000_hw *hw);
 
 #endif /* _E1000_H_ */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index ad0edd11015d..0150f7fc893d 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -472,26 +472,25 @@ enum latency_range {
 extern char e1000e_driver_name[];
 extern const char e1000e_driver_version[];
 
-extern void e1000e_check_options(struct e1000_adapter *adapter);
-extern void e1000e_set_ethtool_ops(struct net_device *netdev);
-
-extern int e1000e_up(struct e1000_adapter *adapter);
-extern void e1000e_down(struct e1000_adapter *adapter);
-extern void e1000e_reinit_locked(struct e1000_adapter *adapter);
-extern void e1000e_reset(struct e1000_adapter *adapter);
-extern void e1000e_power_up_phy(struct e1000_adapter *adapter);
-extern int e1000e_setup_rx_resources(struct e1000_ring *ring);
-extern int e1000e_setup_tx_resources(struct e1000_ring *ring);
-extern void e1000e_free_rx_resources(struct e1000_ring *ring);
-extern void e1000e_free_tx_resources(struct e1000_ring *ring);
-extern struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
-                                                    struct rtnl_link_stats64
-                                                    *stats);
-extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
-extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
-extern void e1000e_get_hw_control(struct e1000_adapter *adapter);
-extern void e1000e_release_hw_control(struct e1000_adapter *adapter);
-extern void e1000e_write_itr(struct e1000_adapter *adapter, u32 itr);
+void e1000e_check_options(struct e1000_adapter *adapter);
+void e1000e_set_ethtool_ops(struct net_device *netdev);
+
+int e1000e_up(struct e1000_adapter *adapter);
+void e1000e_down(struct e1000_adapter *adapter);
+void e1000e_reinit_locked(struct e1000_adapter *adapter);
+void e1000e_reset(struct e1000_adapter *adapter);
+void e1000e_power_up_phy(struct e1000_adapter *adapter);
+int e1000e_setup_rx_resources(struct e1000_ring *ring);
+int e1000e_setup_tx_resources(struct e1000_ring *ring);
+void e1000e_free_rx_resources(struct e1000_ring *ring);
+void e1000e_free_tx_resources(struct e1000_ring *ring);
+struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
+                                             struct rtnl_link_stats64 *stats);
+void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
+void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+void e1000e_get_hw_control(struct e1000_adapter *adapter);
+void e1000e_release_hw_control(struct e1000_adapter *adapter);
+void e1000e_write_itr(struct e1000_adapter *adapter, u32 itr);
 
 extern unsigned int copybreak;
 
@@ -508,8 +507,8 @@ extern const struct e1000_info e1000_pch2_info;
 extern const struct e1000_info e1000_pch_lpt_info;
 extern const struct e1000_info e1000_es2_info;
 
-extern void e1000e_ptp_init(struct e1000_adapter *adapter);
-extern void e1000e_ptp_remove(struct e1000_adapter *adapter);
+void e1000e_ptp_init(struct e1000_adapter *adapter);
+void e1000e_ptp_remove(struct e1000_adapter *adapter);
 
 static inline s32 e1000_phy_hw_reset(struct e1000_hw *hw)
 {
@@ -536,7 +535,7 @@ static inline s32 e1e_wphy_locked(struct e1000_hw *hw, u32 offset, u16 data)
         return hw->phy.ops.write_reg_locked(hw, offset, data);
 }
 
-extern void e1000e_reload_nvm_generic(struct e1000_hw *hw);
+void e1000e_reload_nvm_generic(struct e1000_hw *hw);
 
 static inline s32 e1000e_read_mac_addr(struct e1000_hw *hw)
 {
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index b5252eb8a6c7..49572dcdba87 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -347,9 +347,9 @@ struct i40e_vsi {
         u32 rx_buf_failed;
         u32 rx_page_failed;
 
-        /* These are arrays of rings, allocated at run-time */
-        struct i40e_ring *rx_rings;
-        struct i40e_ring *tx_rings;
+        /* These are containers of ring pointers, allocated at run-time */
+        struct i40e_ring **rx_rings;
+        struct i40e_ring **tx_rings;
 
         u16 work_limit;
         /* high bit set means dynamic, use accessor routines to read/write.
@@ -366,7 +366,7 @@ struct i40e_vsi {
         u8  dtype;
 
         /* List of q_vectors allocated to this VSI */
-        struct i40e_q_vector *q_vectors;
+        struct i40e_q_vector **q_vectors;
         int num_q_vectors;
         int base_vector;
 
@@ -422,8 +422,9 @@ struct i40e_q_vector {
 
         u8 num_ringpairs;       /* total number of ring pairs in vector */
 
-        char name[IFNAMSIZ + 9];
         cpumask_t affinity_mask;
+        struct rcu_head rcu;    /* to avoid race with update stats on free */
+        char name[IFNAMSIZ + 9];
 } ____cacheline_internodealigned_in_smp;
 
 /* lan device */
@@ -544,6 +545,7 @@ static inline void i40e_dbg_init(void) {}
 static inline void i40e_dbg_exit(void) {}
 #endif /* CONFIG_DEBUG_FS*/
 void i40e_irq_dynamic_enable(struct i40e_vsi *vsi, int vector);
+void i40e_irq_dynamic_enable_icr0(struct i40e_pf *pf);
 int i40e_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd);
 void i40e_vlan_stripping_disable(struct i40e_vsi *vsi);
 int i40e_vsi_add_vlan(struct i40e_vsi *vsi, s16 vid);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 8dbd91f64b74..ef4cb1cf31f2 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -151,9 +151,7 @@ static ssize_t i40e_dbg_dump_write(struct file *filp,
                                    size_t count, loff_t *ppos)
 {
         struct i40e_pf *pf = filp->private_data;
-        char dump_request_buf[16];
         bool seid_found = false;
-        int bytes_not_copied;
         long seid = -1;
         int buflen = 0;
         int i, ret;
@@ -163,21 +161,12 @@ static ssize_t i40e_dbg_dump_write(struct file *filp,
         /* don't allow partial writes */
         if (*ppos != 0)
                 return 0;
-        if (count >= sizeof(dump_request_buf))
-                return -ENOSPC;
-
-        bytes_not_copied = copy_from_user(dump_request_buf, buffer, count);
-        if (bytes_not_copied < 0)
-                return bytes_not_copied;
-        if (bytes_not_copied > 0)
-                count -= bytes_not_copied;
-        dump_request_buf[count] = '\0';
 
         /* decode the SEID given to be dumped */
-        ret = kstrtol(dump_request_buf, 0, &seid);
-        if (ret < 0) {
-                dev_info(&pf->pdev->dev, "bad seid value '%s'\n",
-                         dump_request_buf);
+        ret = kstrtol_from_user(buffer, count, 0, &seid);
+
+        if (ret) {
+                dev_info(&pf->pdev->dev, "bad seid value\n");
         } else if (seid == 0) {
                 seid_found = true;
 
@@ -245,26 +234,33 @@ static ssize_t i40e_dbg_dump_write(struct file *filp,
                         memcpy(p, vsi, len);
                         p += len;
 
-                        len = (sizeof(struct i40e_q_vector)
-                                * vsi->num_q_vectors);
-                        memcpy(p, vsi->q_vectors, len);
-                        p += len;
-
-                        len = (sizeof(struct i40e_ring) * vsi->num_queue_pairs);
-                        memcpy(p, vsi->tx_rings, len);
-                        p += len;
-                        memcpy(p, vsi->rx_rings, len);
-                        p += len;
+                        if (vsi->num_q_vectors) {
+                                len = (sizeof(struct i40e_q_vector)
+                                        * vsi->num_q_vectors);
+                                memcpy(p, vsi->q_vectors, len);
+                                p += len;
+                        }
 
-                        for (i = 0; i < vsi->num_queue_pairs; i++) {
-                                len = sizeof(struct i40e_tx_buffer);
-                                memcpy(p, vsi->tx_rings[i].tx_bi, len);
+                        if (vsi->num_queue_pairs) {
+                                len = (sizeof(struct i40e_ring) *
+                                      vsi->num_queue_pairs);
+                                memcpy(p, vsi->tx_rings, len);
+                                p += len;
+                                memcpy(p, vsi->rx_rings, len);
                                 p += len;
                         }
-                        for (i = 0; i < vsi->num_queue_pairs; i++) {
+
+                        if (vsi->tx_rings[0]) {
+                                len = sizeof(struct i40e_tx_buffer);
+                                for (i = 0; i < vsi->num_queue_pairs; i++) {
+                                        memcpy(p, vsi->tx_rings[i]->tx_bi, len);
+                                        p += len;
+                                }
                                 len = sizeof(struct i40e_rx_buffer);
-                                memcpy(p, vsi->rx_rings[i].rx_bi, len);
-                                p += len;
+                                for (i = 0; i < vsi->num_queue_pairs; i++) {
+                                        memcpy(p, vsi->rx_rings[i]->rx_bi, len);
+                                        p += len;
+                                }
                         }
 
                         /* macvlan filter list */
@@ -484,100 +480,104 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                  "    tx_restart = %d, tx_busy = %d, rx_buf_failed = %d, rx_page_failed = %d\n",
                  vsi->tx_restart, vsi->tx_busy,
                  vsi->rx_buf_failed, vsi->rx_page_failed);
-        if (vsi->rx_rings) {
-                for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: desc = %p\n",
-                                 i, vsi->rx_rings[i].desc);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: dev = %p, netdev = %p, rx_bi = %p\n",
-                                 i, vsi->rx_rings[i].dev,
-                                 vsi->rx_rings[i].netdev,
-                                 vsi->rx_rings[i].rx_bi);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: state = %li, queue_index = %d, reg_idx = %d\n",
-                                 i, vsi->rx_rings[i].state,
-                                 vsi->rx_rings[i].queue_index,
-                                 vsi->rx_rings[i].reg_idx);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: rx_hdr_len = %d, rx_buf_len = %d, dtype = %d\n",
-                                 i, vsi->rx_rings[i].rx_hdr_len,
-                                 vsi->rx_rings[i].rx_buf_len,
-                                 vsi->rx_rings[i].dtype);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: hsplit = %d, next_to_use = %d, next_to_clean = %d, ring_active = %i\n",
-                                 i, vsi->rx_rings[i].hsplit,
-                                 vsi->rx_rings[i].next_to_use,
-                                 vsi->rx_rings[i].next_to_clean,
-                                 vsi->rx_rings[i].ring_active);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: rx_stats: packets = %lld, bytes = %lld, non_eop_descs = %lld\n",
-                                 i, vsi->rx_rings[i].rx_stats.packets,
-                                 vsi->rx_rings[i].rx_stats.bytes,
-                                 vsi->rx_rings[i].rx_stats.non_eop_descs);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: rx_stats: alloc_rx_page_failed = %lld, alloc_rx_buff_failed = %lld\n",
-                                 i,
-                                 vsi->rx_rings[i].rx_stats.alloc_rx_page_failed,
-                                vsi->rx_rings[i].rx_stats.alloc_rx_buff_failed);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: size = %i, dma = 0x%08lx\n",
-                                 i, vsi->rx_rings[i].size,
-                                 (long unsigned int)vsi->rx_rings[i].dma);
-                        dev_info(&pf->pdev->dev,
-                                 "    rx_rings[%i]: vsi = %p, q_vector = %p\n",
-                                 i, vsi->rx_rings[i].vsi,
-                                 vsi->rx_rings[i].q_vector);
-                }
+        rcu_read_lock();
+        for (i = 0; i < vsi->num_queue_pairs; i++) {
+                struct i40e_ring *rx_ring = ACCESS_ONCE(vsi->rx_rings[i]);
+                if (!rx_ring)
+                        continue;
+
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: desc = %p\n",
+                         i, rx_ring->desc);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: dev = %p, netdev = %p, rx_bi = %p\n",
+                         i, rx_ring->dev,
+                         rx_ring->netdev,
+                         rx_ring->rx_bi);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: state = %li, queue_index = %d, reg_idx = %d\n",
+                         i, rx_ring->state,
+                         rx_ring->queue_index,
+                         rx_ring->reg_idx);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: rx_hdr_len = %d, rx_buf_len = %d, dtype = %d\n",
+                         i, rx_ring->rx_hdr_len,
+                         rx_ring->rx_buf_len,
+                         rx_ring->dtype);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: hsplit = %d, next_to_use = %d, next_to_clean = %d, ring_active = %i\n",
+                         i, rx_ring->hsplit,
+                         rx_ring->next_to_use,
+                         rx_ring->next_to_clean,
+                         rx_ring->ring_active);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: rx_stats: packets = %lld, bytes = %lld, non_eop_descs = %lld\n",
+                         i, rx_ring->stats.packets,
+                         rx_ring->stats.bytes,
+                         rx_ring->rx_stats.non_eop_descs);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: rx_stats: alloc_rx_page_failed = %lld, alloc_rx_buff_failed = %lld\n",
+                         i,
+                         rx_ring->rx_stats.alloc_rx_page_failed,
+                        rx_ring->rx_stats.alloc_rx_buff_failed);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: size = %i, dma = 0x%08lx\n",
+                         i, rx_ring->size,
+                         (long unsigned int)rx_ring->dma);
+                dev_info(&pf->pdev->dev,
+                         "    rx_rings[%i]: vsi = %p, q_vector = %p\n",
+                         i, rx_ring->vsi,
+                         rx_ring->q_vector);
         }
-        if (vsi->tx_rings) {
-                for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: desc = %p\n",
-                                 i, vsi->tx_rings[i].desc);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: dev = %p, netdev = %p, tx_bi = %p\n",
-                                 i, vsi->tx_rings[i].dev,
-                                 vsi->tx_rings[i].netdev,
-                                 vsi->tx_rings[i].tx_bi);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: state = %li, queue_index = %d, reg_idx = %d\n",
-                                 i, vsi->tx_rings[i].state,
-                                 vsi->tx_rings[i].queue_index,
-                                 vsi->tx_rings[i].reg_idx);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: dtype = %d\n",
-                                 i, vsi->tx_rings[i].dtype);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: hsplit = %d, next_to_use = %d, next_to_clean = %d, ring_active = %i\n",
-                                 i, vsi->tx_rings[i].hsplit,
-                                 vsi->tx_rings[i].next_to_use,
-                                 vsi->tx_rings[i].next_to_clean,
-                                 vsi->tx_rings[i].ring_active);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: tx_stats: packets = %lld, bytes = %lld, restart_queue = %lld\n",
-                                 i, vsi->tx_rings[i].tx_stats.packets,
-                                 vsi->tx_rings[i].tx_stats.bytes,
-                                 vsi->tx_rings[i].tx_stats.restart_queue);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: tx_stats: tx_busy = %lld, completed = %lld, tx_done_old = %lld\n",
-                                 i,
-                                 vsi->tx_rings[i].tx_stats.tx_busy,
-                                 vsi->tx_rings[i].tx_stats.completed,
-                                 vsi->tx_rings[i].tx_stats.tx_done_old);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: size = %i, dma = 0x%08lx\n",
-                                 i, vsi->tx_rings[i].size,
-                                 (long unsigned int)vsi->tx_rings[i].dma);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: vsi = %p, q_vector = %p\n",
-                                 i, vsi->tx_rings[i].vsi,
-                                 vsi->tx_rings[i].q_vector);
-                        dev_info(&pf->pdev->dev,
-                                 "    tx_rings[%i]: DCB tc = %d\n",
-                                 i, vsi->tx_rings[i].dcb_tc);
-                }
+        for (i = 0; i < vsi->num_queue_pairs; i++) {
+                struct i40e_ring *tx_ring = ACCESS_ONCE(vsi->tx_rings[i]);
+                if (!tx_ring)
+                        continue;
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: desc = %p\n",
+                         i, tx_ring->desc);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: dev = %p, netdev = %p, tx_bi = %p\n",
+                         i, tx_ring->dev,
+                         tx_ring->netdev,
+                         tx_ring->tx_bi);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: state = %li, queue_index = %d, reg_idx = %d\n",
+                         i, tx_ring->state,
+                         tx_ring->queue_index,
+                         tx_ring->reg_idx);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: dtype = %d\n",
+                         i, tx_ring->dtype);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: hsplit = %d, next_to_use = %d, next_to_clean = %d, ring_active = %i\n",
+                         i, tx_ring->hsplit,
+                         tx_ring->next_to_use,
+                         tx_ring->next_to_clean,
+                         tx_ring->ring_active);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: tx_stats: packets = %lld, bytes = %lld, restart_queue = %lld\n",
+                         i, tx_ring->stats.packets,
+                         tx_ring->stats.bytes,
+                         tx_ring->tx_stats.restart_queue);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: tx_stats: tx_busy = %lld, tx_done_old = %lld\n",
+                         i,
+                         tx_ring->tx_stats.tx_busy,
+                         tx_ring->tx_stats.tx_done_old);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: size = %i, dma = 0x%08lx\n",
+                         i, tx_ring->size,
+                         (long unsigned int)tx_ring->dma);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: vsi = %p, q_vector = %p\n",
+                         i, tx_ring->vsi,
+                         tx_ring->q_vector);
+                dev_info(&pf->pdev->dev,
+                         "    tx_rings[%i]: DCB tc = %d\n",
+                         i, tx_ring->dcb_tc);
         }
+        rcu_read_unlock();
         dev_info(&pf->pdev->dev,
                  "    work_limit = %d, rx_itr_setting = %d (%s), tx_itr_setting = %d (%s)\n",
                  vsi->work_limit, vsi->rx_itr_setting,
@@ -587,15 +587,6 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
         dev_info(&pf->pdev->dev,
                  "    max_frame = %d, rx_hdr_len = %d, rx_buf_len = %d dtype = %d\n",
                  vsi->max_frame, vsi->rx_hdr_len, vsi->rx_buf_len, vsi->dtype);
-        if (vsi->q_vectors) {
-                for (i = 0; i < vsi->num_q_vectors; i++) {
-                        dev_info(&pf->pdev->dev,
-                                 "    q_vectors[%i]: base index = %ld\n",
-                                 i, ((long int)*vsi->q_vectors[i].rx.ring-
-                                        (long int)*vsi->q_vectors[0].rx.ring)/
-                                        sizeof(struct i40e_ring));
-                }
-        }
         dev_info(&pf->pdev->dev,
                  "    num_q_vectors = %i, base_vector = %i\n",
                  vsi->num_q_vectors, vsi->base_vector);
@@ -792,9 +783,9 @@ static void i40e_dbg_dump_desc(int cnt, int vsi_seid, int ring_id, int desc_n,
                 return;
         }
         if (is_rx_ring)
-                ring = vsi->rx_rings[ring_id];
+                ring = *vsi->rx_rings[ring_id];
         else
-                ring = vsi->tx_rings[ring_id];
+                ring = *vsi->tx_rings[ring_id];
         if (cnt == 2) {
                 dev_info(&pf->pdev->dev, "vsi = %02i %s ring = %02i\n",
                          vsi_seid, is_rx_ring ? "rx" : "tx", ring_id);
@@ -1028,11 +1019,11 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                                       size_t count, loff_t *ppos)
 {
         struct i40e_pf *pf = filp->private_data;
+        char *cmd_buf, *cmd_buf_tmp;
         int bytes_not_copied;
         struct i40e_vsi *vsi;
         u8 *print_buf_start;
         u8 *print_buf;
-        char *cmd_buf;
         int vsi_seid;
         int veb_seid;
         int cnt;
@@ -1051,6 +1042,12 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                 count -= bytes_not_copied;
         cmd_buf[count] = '\0';
 
+        cmd_buf_tmp = strchr(cmd_buf, '\n');
+        if (cmd_buf_tmp) {
+                *cmd_buf_tmp = '\0';
+                count = cmd_buf_tmp - cmd_buf + 1;
+        }
+
         print_buf_start = kzalloc(I40E_MAX_DEBUG_OUT_BUFFER, GFP_KERNEL);
         if (!print_buf_start)
                 goto command_write_done;
@@ -1157,9 +1154,9 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                 i40e_veb_release(pf->veb[i]);
 
         } else if (strncmp(cmd_buf, "add macaddr", 11) == 0) {
-                u8 ma[6];
-                int vlan = 0;
                 struct i40e_mac_filter *f;
+                int vlan = 0;
+                u8 ma[6];
                 int ret;
 
                 cnt = sscanf(&cmd_buf[11],
@@ -1195,8 +1192,8 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                                  ma, vlan, vsi_seid, f, ret);
 
         } else if (strncmp(cmd_buf, "del macaddr", 11) == 0) {
-                u8 ma[6];
                 int vlan = 0;
+                u8 ma[6];
                 int ret;
 
                 cnt = sscanf(&cmd_buf[11],
@@ -1232,9 +1229,9 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                                  ma, vlan, vsi_seid, ret);
 
         } else if (strncmp(cmd_buf, "add pvid", 8) == 0) {
-                int v;
-                u16 vid;
                 i40e_status ret;
+                u16 vid;
+                int v;
 
                 cnt = sscanf(&cmd_buf[8], "%i %u", &vsi_seid, &v);
                 if (cnt != 2) {
@@ -1545,10 +1542,10 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
         } else if ((strncmp(cmd_buf, "add fd_filter", 13) == 0) ||
                    (strncmp(cmd_buf, "rem fd_filter", 13) == 0)) {
                 struct i40e_fdir_data fd_data;
-                int ret;
                 u16 packet_len, i, j = 0;
                 char *asc_packet;
                 bool add = false;
+                int ret;
 
                 asc_packet = kzalloc(I40E_FDIR_MAX_RAW_PACKET_LOOKUP,
                                      GFP_KERNEL);
@@ -1636,9 +1633,9 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                         }
                 } else if (strncmp(&cmd_buf[5],
                            "get local", 9) == 0) {
+                        u16 llen, rlen;
                         int ret, i;
                         u8 *buff;
-                        u16 llen, rlen;
                         buff = kzalloc(I40E_LLDPDU_SIZE, GFP_KERNEL);
                         if (!buff)
                                 goto command_write_done;
@@ -1669,9 +1666,9 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                         kfree(buff);
                         buff = NULL;
                 } else if (strncmp(&cmd_buf[5], "get remote", 10) == 0) {
+                        u16 llen, rlen;
                         int ret, i;
                         u8 *buff;
-                        u16 llen, rlen;
                         buff = kzalloc(I40E_LLDPDU_SIZE, GFP_KERNEL);
                         if (!buff)
                                 goto command_write_done;
@@ -1747,11 +1744,13 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                         goto command_write_done;
                 }
 
-                /* Read at least 512 words */
-                if (buffer_len == 0)
-                        buffer_len = 512;
+                /* set the max length */
+                buffer_len = min_t(u16, buffer_len, I40E_MAX_AQ_BUF_SIZE/2);
 
                 bytes = 2 * buffer_len;
+
+                /* read at least 1k bytes, no more than 4kB */
+                bytes = clamp(bytes, (u16)1024, (u16)I40E_MAX_AQ_BUF_SIZE);
                 buff = kzalloc(bytes, GFP_KERNEL);
                 if (!buff)
                         goto command_write_done;
@@ -1903,6 +1902,7 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,
         struct i40e_pf *pf = filp->private_data;
         int bytes_not_copied;
         struct i40e_vsi *vsi;
+        char *buf_tmp;
         int vsi_seid;
         int i, cnt;
 
@@ -1921,6 +1921,12 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,
                 count -= bytes_not_copied;
         i40e_dbg_netdev_ops_buf[count] = '\0';
 
+        buf_tmp = strchr(i40e_dbg_netdev_ops_buf, '\n');
+        if (buf_tmp) {
+                *buf_tmp = '\0';
+                count = buf_tmp - i40e_dbg_netdev_ops_buf + 1;
+        }
+
         if (strncmp(i40e_dbg_netdev_ops_buf, "tx_timeout", 10) == 0) {
                 cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i", &vsi_seid);
                 if (cnt != 1) {
@@ -1996,7 +2002,7 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,
                         goto netdev_ops_write_done;
                 }
                 for (i = 0; i < vsi->num_q_vectors; i++)
-                        napi_schedule(&vsi->q_vectors[i].napi);
+                        napi_schedule(&vsi->q_vectors[i]->napi);
                 dev_info(&pf->pdev->dev, "napi called\n");
         } else {
                 dev_info(&pf->pdev->dev, "unknown command '%s'\n",
@@ -2024,21 +2030,35 @@ static const struct file_operations i40e_dbg_netdev_ops_fops = {
  **/
 void i40e_dbg_pf_init(struct i40e_pf *pf)
 {
-        struct dentry *pfile __attribute__((unused));
+        struct dentry *pfile;
         const char *name = pci_name(pf->pdev);
+        const struct device *dev = &pf->pdev->dev;
 
         pf->i40e_dbg_pf = debugfs_create_dir(name, i40e_dbg_root);
-        if (pf->i40e_dbg_pf) {
-                pfile = debugfs_create_file("command", 0600, pf->i40e_dbg_pf,
-                                            pf, &i40e_dbg_command_fops);
-                pfile = debugfs_create_file("dump", 0600, pf->i40e_dbg_pf, pf,
-                                            &i40e_dbg_dump_fops);
-                pfile = debugfs_create_file("netdev_ops", 0600, pf->i40e_dbg_pf,
-                                            pf, &i40e_dbg_netdev_ops_fops);
-        } else {
-                dev_info(&pf->pdev->dev,
-                         "debugfs entry for %s failed\n", name);
-        }
+        if (!pf->i40e_dbg_pf)
+                return;
+
+        pfile = debugfs_create_file("command", 0600, pf->i40e_dbg_pf, pf,
+                                    &i40e_dbg_command_fops);
+        if (!pfile)
+                goto create_failed;
+
+        pfile = debugfs_create_file("dump", 0600, pf->i40e_dbg_pf, pf,
+                                    &i40e_dbg_dump_fops);
+        if (!pfile)
+                goto create_failed;
+
+        pfile = debugfs_create_file("netdev_ops", 0600, pf->i40e_dbg_pf, pf,
+                                    &i40e_dbg_netdev_ops_fops);
+        if (!pfile)
+                goto create_failed;
+
+        return;
+
+create_failed:
+        dev_info(dev, "debugfs dir/file for %s failed\n", name);
+        debugfs_remove_recursive(pf->i40e_dbg_pf);
+        return;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 9a76b8cec76c..1b86138fa9e1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -399,8 +399,8 @@ static void i40e_get_ringparam(struct net_device *netdev,
         ring->tx_max_pending = I40E_MAX_NUM_DESCRIPTORS;
         ring->rx_mini_max_pending = 0;
         ring->rx_jumbo_max_pending = 0;
-        ring->rx_pending = vsi->rx_rings[0].count;
-        ring->tx_pending = vsi->tx_rings[0].count;
+        ring->rx_pending = vsi->rx_rings[0]->count;
+        ring->tx_pending = vsi->tx_rings[0]->count;
         ring->rx_mini_pending = 0;
         ring->rx_jumbo_pending = 0;
 }
@@ -429,8 +429,8 @@ static int i40e_set_ringparam(struct net_device *netdev,
         new_rx_count = ALIGN(new_rx_count, I40E_REQ_DESCRIPTOR_MULTIPLE);
 
         /* if nothing to do return success */
-        if ((new_tx_count == vsi->tx_rings[0].count) &&
-            (new_rx_count == vsi->rx_rings[0].count))
+        if ((new_tx_count == vsi->tx_rings[0]->count) &&
+            (new_rx_count == vsi->rx_rings[0]->count))
                 return 0;
 
         while (test_and_set_bit(__I40E_CONFIG_BUSY, &pf->state))
@@ -439,8 +439,8 @@ static int i40e_set_ringparam(struct net_device *netdev,
         if (!netif_running(vsi->netdev)) {
                 /* simple case - set for the next time the netdev is started */
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        vsi->tx_rings[i].count = new_tx_count;
-                        vsi->rx_rings[i].count = new_rx_count;
+                        vsi->tx_rings[i]->count = new_tx_count;
+                        vsi->rx_rings[i]->count = new_rx_count;
                 }
                 goto done;
         }
@@ -451,10 +451,10 @@ static int i40e_set_ringparam(struct net_device *netdev,
          */
 
         /* alloc updated Tx resources */
-        if (new_tx_count != vsi->tx_rings[0].count) {
+        if (new_tx_count != vsi->tx_rings[0]->count) {
                 netdev_info(netdev,
                             "Changing Tx descriptor count from %d to %d.\n",
-                            vsi->tx_rings[0].count, new_tx_count);
+                            vsi->tx_rings[0]->count, new_tx_count);
                 tx_rings = kcalloc(vsi->alloc_queue_pairs,
                                    sizeof(struct i40e_ring), GFP_KERNEL);
                 if (!tx_rings) {
@@ -464,7 +464,7 @@ static int i40e_set_ringparam(struct net_device *netdev,
 
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
                         /* clone ring and setup updated count */
-                        tx_rings[i] = vsi->tx_rings[i];
+                        tx_rings[i] = *vsi->tx_rings[i];
                         tx_rings[i].count = new_tx_count;
                         err = i40e_setup_tx_descriptors(&tx_rings[i]);
                         if (err) {
@@ -481,10 +481,10 @@ static int i40e_set_ringparam(struct net_device *netdev,
         }
 
         /* alloc updated Rx resources */
-        if (new_rx_count != vsi->rx_rings[0].count) {
+        if (new_rx_count != vsi->rx_rings[0]->count) {
                 netdev_info(netdev,
                             "Changing Rx descriptor count from %d to %d\n",
-                            vsi->rx_rings[0].count, new_rx_count);
+                            vsi->rx_rings[0]->count, new_rx_count);
                 rx_rings = kcalloc(vsi->alloc_queue_pairs,
                                    sizeof(struct i40e_ring), GFP_KERNEL);
                 if (!rx_rings) {
@@ -494,7 +494,7 @@ static int i40e_set_ringparam(struct net_device *netdev,
 
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
                         /* clone ring and setup updated count */
-                        rx_rings[i] = vsi->rx_rings[i];
+                        rx_rings[i] = *vsi->rx_rings[i];
                         rx_rings[i].count = new_rx_count;
                         err = i40e_setup_rx_descriptors(&rx_rings[i]);
                         if (err) {
@@ -517,8 +517,8 @@ static int i40e_set_ringparam(struct net_device *netdev,
 
         if (tx_rings) {
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        i40e_free_tx_resources(&vsi->tx_rings[i]);
-                        vsi->tx_rings[i] = tx_rings[i];
+                        i40e_free_tx_resources(vsi->tx_rings[i]);
+                        *vsi->tx_rings[i] = tx_rings[i];
                 }
                 kfree(tx_rings);
                 tx_rings = NULL;
@@ -526,8 +526,8 @@ static int i40e_set_ringparam(struct net_device *netdev,
 
         if (rx_rings) {
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        i40e_free_rx_resources(&vsi->rx_rings[i]);
-                        vsi->rx_rings[i] = rx_rings[i];
+                        i40e_free_rx_resources(vsi->rx_rings[i]);
+                        *vsi->rx_rings[i] = rx_rings[i];
                 }
                 kfree(rx_rings);
                 rx_rings = NULL;
@@ -579,6 +579,7 @@ static void i40e_get_ethtool_stats(struct net_device *netdev,
         char *p;
         int j;
         struct rtnl_link_stats64 *net_stats = i40e_get_vsi_stats_struct(vsi);
+        unsigned int start;
 
         i40e_update_stats(vsi);
 
@@ -587,14 +588,30 @@ static void i40e_get_ethtool_stats(struct net_device *netdev,
                 data[i++] = (i40e_gstrings_net_stats[j].sizeof_stat ==
                         sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
         }
-        for (j = 0; j < vsi->num_queue_pairs; j++) {
-                data[i++] = vsi->tx_rings[j].tx_stats.packets;
-                data[i++] = vsi->tx_rings[j].tx_stats.bytes;
-        }
-        for (j = 0; j < vsi->num_queue_pairs; j++) {
-                data[i++] = vsi->rx_rings[j].rx_stats.packets;
-                data[i++] = vsi->rx_rings[j].rx_stats.bytes;
+        rcu_read_lock();
+        for (j = 0; j < vsi->num_queue_pairs; j++, i += 4) {
+                struct i40e_ring *tx_ring = ACCESS_ONCE(vsi->tx_rings[j]);
+                struct i40e_ring *rx_ring;
+
+                if (!tx_ring)
+                        continue;
+
+                /* process Tx ring statistics */
+                do {
+                        start = u64_stats_fetch_begin_bh(&tx_ring->syncp);
+                        data[i] = tx_ring->stats.packets;
+                        data[i + 1] = tx_ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&tx_ring->syncp, start));
+
+                /* Rx ring is the 2nd half of the queue pair */
+                rx_ring = &tx_ring[1];
+                do {
+                        start = u64_stats_fetch_begin_bh(&rx_ring->syncp);
+                        data[i + 2] = rx_ring->stats.packets;
+                        data[i + 3] = rx_ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&rx_ring->syncp, start));
         }
+        rcu_read_unlock();
         if (vsi == pf->vsi[pf->lan_vsi]) {
                 for (j = 0; j < I40E_GLOBAL_STATS_LEN; j++) {
                         p = (char *)pf + i40e_gstrings_stats[j].stat_offset;
@@ -641,8 +658,6 @@ static void i40e_get_strings(struct net_device *netdev, u32 stringset,
                         p += ETH_GSTRING_LEN;
                         snprintf(p, ETH_GSTRING_LEN, "tx-%u.tx_bytes", i);
                         p += ETH_GSTRING_LEN;
-                }
-                for (i = 0; i < vsi->num_queue_pairs; i++) {
                         snprintf(p, ETH_GSTRING_LEN, "rx-%u.rx_packets", i);
                         p += ETH_GSTRING_LEN;
                         snprintf(p, ETH_GSTRING_LEN, "rx-%u.rx_bytes", i);
@@ -910,8 +925,8 @@ static int i40e_set_coalesce(struct net_device *netdev,
         }
 
         vector = vsi->base_vector;
-        q_vector = vsi->q_vectors;
-        for (i = 0; i < vsi->num_q_vectors; i++, vector++, q_vector++) {
+        for (i = 0; i < vsi->num_q_vectors; i++, vector++) {
+                q_vector = vsi->q_vectors[i];
                 q_vector->rx.itr = ITR_TO_REG(vsi->rx_itr_setting);
                 wr32(hw, I40E_PFINT_ITRN(0, vector - 1), q_vector->rx.itr);
                 q_vector->tx.itr = ITR_TO_REG(vsi->tx_itr_setting);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 221aa4795017..41a79df373d5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -36,7 +36,7 @@ static const char i40e_driver_string[] =
 
 #define DRV_VERSION_MAJOR 0
 #define DRV_VERSION_MINOR 3
-#define DRV_VERSION_BUILD 9
+#define DRV_VERSION_BUILD 11
 #define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \
              __stringify(DRV_VERSION_MINOR) "." \
              __stringify(DRV_VERSION_BUILD)    DRV_KERN
@@ -347,14 +347,53 @@ struct rtnl_link_stats64 *i40e_get_vsi_stats_struct(struct i40e_vsi *vsi)
  **/
 static struct rtnl_link_stats64 *i40e_get_netdev_stats_struct(
                                              struct net_device *netdev,
-                                             struct rtnl_link_stats64 *storage)
+                                             struct rtnl_link_stats64 *stats)
 {
         struct i40e_netdev_priv *np = netdev_priv(netdev);
         struct i40e_vsi *vsi = np->vsi;
+        struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
+        int i;
+
+        rcu_read_lock();
+        for (i = 0; i < vsi->num_queue_pairs; i++) {
+                struct i40e_ring *tx_ring, *rx_ring;
+                u64 bytes, packets;
+                unsigned int start;
+
+                tx_ring = ACCESS_ONCE(vsi->tx_rings[i]);
+                if (!tx_ring)
+                        continue;
 
-        *storage = *i40e_get_vsi_stats_struct(vsi);
+                do {
+                        start = u64_stats_fetch_begin_bh(&tx_ring->syncp);
+                        packets = tx_ring->stats.packets;
+                        bytes   = tx_ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&tx_ring->syncp, start));
+
+                stats->tx_packets += packets;
+                stats->tx_bytes   += bytes;
+                rx_ring = &tx_ring[1];
 
-        return storage;
+                do {
+                        start = u64_stats_fetch_begin_bh(&rx_ring->syncp);
+                        packets = rx_ring->stats.packets;
+                        bytes   = rx_ring->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&rx_ring->syncp, start));
+
+                stats->rx_packets += packets;
+                stats->rx_bytes   += bytes;
+        }
+        rcu_read_unlock();
+
+        /* following stats updated by ixgbe_watchdog_task() */
+        stats->multicast        = vsi_stats->multicast;
+        stats->tx_errors        = vsi_stats->tx_errors;
+        stats->tx_dropped       = vsi_stats->tx_dropped;
+        stats->rx_errors        = vsi_stats->rx_errors;
+        stats->rx_crc_errors    = vsi_stats->rx_crc_errors;
+        stats->rx_length_errors = vsi_stats->rx_length_errors;
+
+        return stats;
 }
 
 /**
@@ -376,10 +415,14 @@ void i40e_vsi_reset_stats(struct i40e_vsi *vsi)
         memset(&vsi->eth_stats_offsets, 0, sizeof(vsi->eth_stats_offsets));
         if (vsi->rx_rings)
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        memset(&vsi->rx_rings[i].rx_stats, 0 ,
-                               sizeof(vsi->rx_rings[i].rx_stats));
-                        memset(&vsi->tx_rings[i].tx_stats, 0,
-                               sizeof(vsi->tx_rings[i].tx_stats));
+                        memset(&vsi->rx_rings[i]->stats, 0 ,
+                               sizeof(vsi->rx_rings[i]->stats));
+                        memset(&vsi->rx_rings[i]->rx_stats, 0 ,
+                               sizeof(vsi->rx_rings[i]->rx_stats));
+                        memset(&vsi->tx_rings[i]->stats, 0 ,
+                               sizeof(vsi->tx_rings[i]->stats));
+                        memset(&vsi->tx_rings[i]->tx_stats, 0,
+                               sizeof(vsi->tx_rings[i]->tx_stats));
                 }
         vsi->stat_offsets_loaded = false;
 }
@@ -598,7 +641,7 @@ static void i40e_update_link_xoff_rx(struct i40e_pf *pf)
                         continue;
 
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        struct i40e_ring *ring = &vsi->tx_rings[i];
+                        struct i40e_ring *ring = vsi->tx_rings[i];
                         clear_bit(__I40E_HANG_CHECK_ARMED, &ring->state);
                 }
         }
@@ -652,7 +695,7 @@ static void i40e_update_prio_xoff_rx(struct i40e_pf *pf)
                         continue;
 
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        struct i40e_ring *ring = &vsi->tx_rings[i];
+                        struct i40e_ring *ring = vsi->tx_rings[i];
 
                         tc = ring->dcb_tc;
                         if (xoff[tc])
@@ -704,21 +747,38 @@ void i40e_update_stats(struct i40e_vsi *vsi)
         tx_restart = tx_busy = 0;
         rx_page = 0;
         rx_buf = 0;
+        rcu_read_lock();
         for (q = 0; q < vsi->num_queue_pairs; q++) {
                 struct i40e_ring *p;
+                u64 bytes, packets;
+                unsigned int start;
 
-                p = &vsi->rx_rings[q];
-                rx_b += p->rx_stats.bytes;
-                rx_p += p->rx_stats.packets;
-                rx_buf += p->rx_stats.alloc_rx_buff_failed;
-                rx_page += p->rx_stats.alloc_rx_page_failed;
+                /* locate Tx ring */
+                p = ACCESS_ONCE(vsi->tx_rings[q]);
 
-                p = &vsi->tx_rings[q];
-                tx_b += p->tx_stats.bytes;
-                tx_p += p->tx_stats.packets;
+                do {
+                        start = u64_stats_fetch_begin_bh(&p->syncp);
+                        packets = p->stats.packets;
+                        bytes = p->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&p->syncp, start));
+                tx_b += bytes;
+                tx_p += packets;
                 tx_restart += p->tx_stats.restart_queue;
                 tx_busy += p->tx_stats.tx_busy;
+
+                /* Rx queue is part of the same block as Tx queue */
+                p = &p[1];
+                do {
+                        start = u64_stats_fetch_begin_bh(&p->syncp);
+                        packets = p->stats.packets;
+                        bytes = p->stats.bytes;
+                } while (u64_stats_fetch_retry_bh(&p->syncp, start));
+                rx_b += bytes;
+                rx_p += packets;
+                rx_buf += p->rx_stats.alloc_rx_buff_failed;
+                rx_page += p->rx_stats.alloc_rx_page_failed;
         }
+        rcu_read_unlock();
         vsi->tx_restart = tx_restart;
         vsi->tx_busy = tx_busy;
         vsi->rx_page_failed = rx_page;
@@ -1988,7 +2048,7 @@ static int i40e_vsi_setup_tx_resources(struct i40e_vsi *vsi)
         int i, err = 0;
 
         for (i = 0; i < vsi->num_queue_pairs && !err; i++)
-                err = i40e_setup_tx_descriptors(&vsi->tx_rings[i]);
+                err = i40e_setup_tx_descriptors(vsi->tx_rings[i]);
 
         return err;
 }
@@ -2004,8 +2064,8 @@ static void i40e_vsi_free_tx_resources(struct i40e_vsi *vsi)
         int i;
 
         for (i = 0; i < vsi->num_queue_pairs; i++)
-                if (vsi->tx_rings[i].desc)
-                        i40e_free_tx_resources(&vsi->tx_rings[i]);
+                if (vsi->tx_rings[i]->desc)
+                        i40e_free_tx_resources(vsi->tx_rings[i]);
 }
 
 /**
@@ -2023,7 +2083,7 @@ static int i40e_vsi_setup_rx_resources(struct i40e_vsi *vsi)
         int i, err = 0;
 
         for (i = 0; i < vsi->num_queue_pairs && !err; i++)
-                err = i40e_setup_rx_descriptors(&vsi->rx_rings[i]);
+                err = i40e_setup_rx_descriptors(vsi->rx_rings[i]);
         return err;
 }
 
@@ -2038,8 +2098,8 @@ static void i40e_vsi_free_rx_resources(struct i40e_vsi *vsi)
         int i;
 
         for (i = 0; i < vsi->num_queue_pairs; i++)
-                if (vsi->rx_rings[i].desc)
-                        i40e_free_rx_resources(&vsi->rx_rings[i]);
+                if (vsi->rx_rings[i]->desc)
+                        i40e_free_rx_resources(vsi->rx_rings[i]);
 }
 
 /**
@@ -2114,8 +2174,8 @@ static int i40e_configure_tx_ring(struct i40e_ring *ring)
 
         /* Now associate this queue with this PCI function */
         qtx_ctl = I40E_QTX_CTL_PF_QUEUE;
-        qtx_ctl |= ((hw->hmc.hmc_fn_id << I40E_QTX_CTL_PF_INDX_SHIFT)
-                                                & I40E_QTX_CTL_PF_INDX_MASK);
+        qtx_ctl |= ((hw->pf_id << I40E_QTX_CTL_PF_INDX_SHIFT) &
+                    I40E_QTX_CTL_PF_INDX_MASK);
         wr32(hw, I40E_QTX_CTL(pf_q), qtx_ctl);
         i40e_flush(hw);
 
@@ -2223,8 +2283,8 @@ static int i40e_vsi_configure_tx(struct i40e_vsi *vsi)
         int err = 0;
         u16 i;
 
-        for (i = 0; (i < vsi->num_queue_pairs) && (!err); i++)
-                err = i40e_configure_tx_ring(&vsi->tx_rings[i]);
+        for (i = 0; (i < vsi->num_queue_pairs) && !err; i++)
+                err = i40e_configure_tx_ring(vsi->tx_rings[i]);
 
         return err;
 }
@@ -2274,7 +2334,7 @@ static int i40e_vsi_configure_rx(struct i40e_vsi *vsi)
 
         /* set up individual rings */
         for (i = 0; i < vsi->num_queue_pairs && !err; i++)
-                err = i40e_configure_rx_ring(&vsi->rx_rings[i]);
+                err = i40e_configure_rx_ring(vsi->rx_rings[i]);
 
         return err;
 }
@@ -2298,8 +2358,8 @@ static void i40e_vsi_config_dcb_rings(struct i40e_vsi *vsi)
                 qoffset = vsi->tc_config.tc_info[n].qoffset;
                 qcount = vsi->tc_config.tc_info[n].qcount;
                 for (i = qoffset; i < (qoffset + qcount); i++) {
-                        struct i40e_ring *rx_ring = &vsi->rx_rings[i];
-                        struct i40e_ring *tx_ring = &vsi->tx_rings[i];
+                        struct i40e_ring *rx_ring = vsi->rx_rings[i];
+                        struct i40e_ring *tx_ring = vsi->tx_rings[i];
                         rx_ring->dcb_tc = n;
                         tx_ring->dcb_tc = n;
                 }
@@ -2354,8 +2414,8 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi)
          */
         qp = vsi->base_queue;
         vector = vsi->base_vector;
-        q_vector = vsi->q_vectors;
-        for (i = 0; i < vsi->num_q_vectors; i++, q_vector++, vector++) {
+        for (i = 0; i < vsi->num_q_vectors; i++, vector++) {
+                q_vector = vsi->q_vectors[i];
                 q_vector->rx.itr = ITR_TO_REG(vsi->rx_itr_setting);
                 q_vector->rx.latency_range = I40E_LOW_LATENCY;
                 wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1),
@@ -2435,7 +2495,7 @@ static void i40e_enable_misc_int_causes(struct i40e_hw *hw)
  **/
 static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi)
 {
-        struct i40e_q_vector *q_vector = vsi->q_vectors;
+        struct i40e_q_vector *q_vector = vsi->q_vectors[0];
         struct i40e_pf *pf = vsi->back;
         struct i40e_hw *hw = &pf->hw;
         u32 val;
@@ -2472,7 +2532,7 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi)
  * i40e_irq_dynamic_enable_icr0 - Enable default interrupt generation for icr0
  * @pf: board private structure
  **/
-static void i40e_irq_dynamic_enable_icr0(struct i40e_pf *pf)
+void i40e_irq_dynamic_enable_icr0(struct i40e_pf *pf)
 {
         struct i40e_hw *hw = &pf->hw;
         u32 val;
@@ -2500,7 +2560,7 @@ void i40e_irq_dynamic_enable(struct i40e_vsi *vsi, int vector)
               I40E_PFINT_DYN_CTLN_CLEARPBA_MASK |
               (I40E_ITR_NONE << I40E_PFINT_DYN_CTLN_ITR_INDX_SHIFT);
         wr32(hw, I40E_PFINT_DYN_CTLN(vector - 1), val);
-        i40e_flush(hw);
+        /* skip the flush */
 }
 
 /**
@@ -2512,7 +2572,7 @@ static irqreturn_t i40e_msix_clean_rings(int irq, void *data)
 {
         struct i40e_q_vector *q_vector = data;
 
-        if (!q_vector->tx.ring[0] && !q_vector->rx.ring[0])
+        if (!q_vector->tx.ring && !q_vector->rx.ring)
                 return IRQ_HANDLED;
 
         napi_schedule(&q_vector->napi);
@@ -2529,7 +2589,7 @@ static irqreturn_t i40e_fdir_clean_rings(int irq, void *data)
 {
         struct i40e_q_vector *q_vector = data;
 
-        if (!q_vector->tx.ring[0] && !q_vector->rx.ring[0])
+        if (!q_vector->tx.ring && !q_vector->rx.ring)
                 return IRQ_HANDLED;
 
         pr_info("fdir ring cleaning needed\n");
@@ -2554,16 +2614,16 @@ static int i40e_vsi_request_irq_msix(struct i40e_vsi *vsi, char *basename)
         int vector, err;
 
         for (vector = 0; vector < q_vectors; vector++) {
-                struct i40e_q_vector *q_vector = &(vsi->q_vectors[vector]);
+                struct i40e_q_vector *q_vector = vsi->q_vectors[vector];
 
-                if (q_vector->tx.ring[0] && q_vector->rx.ring[0]) {
+                if (q_vector->tx.ring && q_vector->rx.ring) {
                         snprintf(q_vector->name, sizeof(q_vector->name) - 1,
                                  "%s-%s-%d", basename, "TxRx", rx_int_idx++);
                         tx_int_idx++;
-                } else if (q_vector->rx.ring[0]) {
+                } else if (q_vector->rx.ring) {
                         snprintf(q_vector->name, sizeof(q_vector->name) - 1,
                                  "%s-%s-%d", basename, "rx", rx_int_idx++);
-                } else if (q_vector->tx.ring[0]) {
+                } else if (q_vector->tx.ring) {
                         snprintf(q_vector->name, sizeof(q_vector->name) - 1,
                                  "%s-%s-%d", basename, "tx", tx_int_idx++);
                 } else {
@@ -2611,8 +2671,8 @@ static void i40e_vsi_disable_irq(struct i40e_vsi *vsi)
         int i;
 
         for (i = 0; i < vsi->num_queue_pairs; i++) {
-                wr32(hw, I40E_QINT_TQCTL(vsi->tx_rings[i].reg_idx), 0);
-                wr32(hw, I40E_QINT_RQCTL(vsi->rx_rings[i].reg_idx), 0);
+                wr32(hw, I40E_QINT_TQCTL(vsi->tx_rings[i]->reg_idx), 0);
+                wr32(hw, I40E_QINT_RQCTL(vsi->rx_rings[i]->reg_idx), 0);
         }
 
         if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
@@ -2649,6 +2709,7 @@ static int i40e_vsi_enable_irq(struct i40e_vsi *vsi)
                 i40e_irq_dynamic_enable_icr0(pf);
         }
 
+        i40e_flush(&pf->hw);
         return 0;
 }
 
@@ -2681,14 +2742,14 @@ static irqreturn_t i40e_intr(int irq, void *data)
 
         icr0 = rd32(hw, I40E_PFINT_ICR0);
 
-        /* if sharing a legacy IRQ, we might get called w/o an intr pending */
-        if ((icr0 & I40E_PFINT_ICR0_INTEVENT_MASK) == 0)
-                return IRQ_NONE;
-
         val = rd32(hw, I40E_PFINT_DYN_CTL0);
         val = val | I40E_PFINT_DYN_CTL0_CLEARPBA_MASK;
         wr32(hw, I40E_PFINT_DYN_CTL0, val);
 
+        /* if sharing a legacy IRQ, we might get called w/o an intr pending */
+        if ((icr0 & I40E_PFINT_ICR0_INTEVENT_MASK) == 0)
+                return IRQ_NONE;
+
         ena_mask = rd32(hw, I40E_PFINT_ICR0_ENA);
 
         /* only q0 is used in MSI/Legacy mode, and none are used in MSIX */
@@ -2702,10 +2763,9 @@ static irqreturn_t i40e_intr(int irq, void *data)
                 qval = rd32(hw, I40E_QINT_TQCTL(0));
                 qval &= ~I40E_QINT_TQCTL_CAUSE_ENA_MASK;
                 wr32(hw, I40E_QINT_TQCTL(0), qval);
-                i40e_flush(hw);
 
                 if (!test_bit(__I40E_DOWN, &pf->state))
-                        napi_schedule(&pf->vsi[pf->lan_vsi]->q_vectors[0].napi);
+                        napi_schedule(&pf->vsi[pf->lan_vsi]->q_vectors[0]->napi);
         }
 
         if (icr0 & I40E_PFINT_ICR0_ADMINQ_MASK) {
@@ -2764,7 +2824,6 @@ static irqreturn_t i40e_intr(int irq, void *data)
 
         /* re-enable interrupt causes */
         wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        i40e_flush(hw);
         if (!test_bit(__I40E_DOWN, &pf->state)) {
                 i40e_service_event_schedule(pf);
                 i40e_irq_dynamic_enable_icr0(pf);
@@ -2774,40 +2833,26 @@ static irqreturn_t i40e_intr(int irq, void *data)
 }
 
 /**
- * i40e_map_vector_to_rxq - Assigns the Rx queue to the vector
- * @vsi: the VSI being configured
- * @v_idx: vector index
- * @r_idx: rx queue index
- **/
-static void map_vector_to_rxq(struct i40e_vsi *vsi, int v_idx, int r_idx)
-{
-        struct i40e_q_vector *q_vector = &(vsi->q_vectors[v_idx]);
-        struct i40e_ring *rx_ring = &(vsi->rx_rings[r_idx]);
-
-        rx_ring->q_vector = q_vector;
-        q_vector->rx.ring[q_vector->rx.count] = rx_ring;
-        q_vector->rx.count++;
-        q_vector->rx.latency_range = I40E_LOW_LATENCY;
-        q_vector->vsi = vsi;
-}
-
-/**
- * i40e_map_vector_to_txq - Assigns the Tx queue to the vector
+ * i40e_map_vector_to_qp - Assigns the queue pair to the vector
  * @vsi: the VSI being configured
  * @v_idx: vector index
- * @t_idx: tx queue index
+ * @qp_idx: queue pair index
  **/
-static void map_vector_to_txq(struct i40e_vsi *vsi, int v_idx, int t_idx)
+static void map_vector_to_qp(struct i40e_vsi *vsi, int v_idx, int qp_idx)
 {
-        struct i40e_q_vector *q_vector = &(vsi->q_vectors[v_idx]);
-        struct i40e_ring *tx_ring = &(vsi->tx_rings[t_idx]);
+        struct i40e_q_vector *q_vector = vsi->q_vectors[v_idx];
+        struct i40e_ring *tx_ring = vsi->tx_rings[qp_idx];
+        struct i40e_ring *rx_ring = vsi->rx_rings[qp_idx];
 
         tx_ring->q_vector = q_vector;
-        q_vector->tx.ring[q_vector->tx.count] = tx_ring;
+        tx_ring->next = q_vector->tx.ring;
+        q_vector->tx.ring = tx_ring;
         q_vector->tx.count++;
-        q_vector->tx.latency_range = I40E_LOW_LATENCY;
-        q_vector->num_ringpairs++;
-        q_vector->vsi = vsi;
+
+        rx_ring->q_vector = q_vector;
+        rx_ring->next = q_vector->rx.ring;
+        q_vector->rx.ring = rx_ring;
+        q_vector->rx.count++;
 }
 
 /**
@@ -2823,7 +2868,7 @@ static void i40e_vsi_map_rings_to_vectors(struct i40e_vsi *vsi)
 {
         int qp_remaining = vsi->num_queue_pairs;
         int q_vectors = vsi->num_q_vectors;
-        int qp_per_vector;
+        int num_ringpairs;
         int v_start = 0;
         int qp_idx = 0;
 
@@ -2831,11 +2876,21 @@ static void i40e_vsi_map_rings_to_vectors(struct i40e_vsi *vsi)
          * group them so there are multiple queues per vector.
          */
         for (; v_start < q_vectors && qp_remaining; v_start++) {
-                qp_per_vector = DIV_ROUND_UP(qp_remaining, q_vectors - v_start);
-                for (; qp_per_vector;
-                     qp_per_vector--, qp_idx++, qp_remaining--) {
-                        map_vector_to_rxq(vsi, v_start, qp_idx);
-                        map_vector_to_txq(vsi, v_start, qp_idx);
+                struct i40e_q_vector *q_vector = vsi->q_vectors[v_start];
+
+                num_ringpairs = DIV_ROUND_UP(qp_remaining, q_vectors - v_start);
+
+                q_vector->num_ringpairs = num_ringpairs;
+
+                q_vector->rx.count = 0;
+                q_vector->tx.count = 0;
+                q_vector->rx.ring = NULL;
+                q_vector->tx.ring = NULL;
+
+                while (num_ringpairs--) {
+                        map_vector_to_qp(vsi, v_start, qp_idx);
+                        qp_idx++;
+                        qp_remaining--;
                 }
         }
 }
@@ -2887,7 +2942,7 @@ static void i40e_netpoll(struct net_device *netdev)
         pf->flags |= I40E_FLAG_IN_NETPOLL;
         if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
                 for (i = 0; i < vsi->num_q_vectors; i++)
-                        i40e_msix_clean_rings(0, &vsi->q_vectors[i]);
+                        i40e_msix_clean_rings(0, vsi->q_vectors[i]);
         } else {
                 i40e_intr(pf->pdev->irq, netdev);
         }
@@ -3073,14 +3128,14 @@ static void i40e_vsi_free_irq(struct i40e_vsi *vsi)
                         u16 vector = i + base;
 
                         /* free only the irqs that were actually requested */
-                        if (vsi->q_vectors[i].num_ringpairs == 0)
+                        if (vsi->q_vectors[i]->num_ringpairs == 0)
                                 continue;
 
                         /* clear the affinity_mask in the IRQ descriptor */
                         irq_set_affinity_hint(pf->msix_entries[vector].vector,
                                               NULL);
                         free_irq(pf->msix_entries[vector].vector,
-                                 &vsi->q_vectors[i]);
+                                 vsi->q_vectors[i]);
 
                         /* Tear down the interrupt queue link list
                          *
@@ -3164,6 +3219,39 @@ static void i40e_vsi_free_irq(struct i40e_vsi *vsi)
 }
 
 /**
+ * i40e_free_q_vector - Free memory allocated for specific interrupt vector
+ * @vsi: the VSI being configured
+ * @v_idx: Index of vector to be freed
+ *
+ * This function frees the memory allocated to the q_vector.  In addition if
+ * NAPI is enabled it will delete any references to the NAPI struct prior
+ * to freeing the q_vector.
+ **/
+static void i40e_free_q_vector(struct i40e_vsi *vsi, int v_idx)
+{
+        struct i40e_q_vector *q_vector = vsi->q_vectors[v_idx];
+        struct i40e_ring *ring;
+
+        if (!q_vector)
+                return;
+
+        /* disassociate q_vector from rings */
+        i40e_for_each_ring(ring, q_vector->tx)
+                ring->q_vector = NULL;
+
+        i40e_for_each_ring(ring, q_vector->rx)
+                ring->q_vector = NULL;
+
+        /* only VSI w/ an associated netdev is set up w/ NAPI */
+        if (vsi->netdev)
+                netif_napi_del(&q_vector->napi);
+
+        vsi->q_vectors[v_idx] = NULL;
+
+        kfree_rcu(q_vector, rcu);
+}
+
+/**
  * i40e_vsi_free_q_vectors - Free memory allocated for interrupt vectors
  * @vsi: the VSI being un-configured
  *
@@ -3174,24 +3262,8 @@ static void i40e_vsi_free_q_vectors(struct i40e_vsi *vsi)
 {
         int v_idx;
 
-        for (v_idx = 0; v_idx < vsi->num_q_vectors; v_idx++) {
-                struct i40e_q_vector *q_vector = &vsi->q_vectors[v_idx];
-                int r_idx;
-
-                if (!q_vector)
-                        continue;
-
-                /* disassociate q_vector from rings */
-                for (r_idx = 0; r_idx < q_vector->tx.count; r_idx++)
-                        q_vector->tx.ring[r_idx]->q_vector = NULL;
-                for (r_idx = 0; r_idx < q_vector->rx.count; r_idx++)
-                        q_vector->rx.ring[r_idx]->q_vector = NULL;
-
-                /* only VSI w/ an associated netdev is set up w/ NAPI */
-                if (vsi->netdev)
-                        netif_napi_del(&q_vector->napi);
-        }
-        kfree(vsi->q_vectors);
+        for (v_idx = 0; v_idx < vsi->num_q_vectors; v_idx++)
+                i40e_free_q_vector(vsi, v_idx);
 }
 
 /**
@@ -3241,7 +3313,7 @@ static void i40e_napi_enable_all(struct i40e_vsi *vsi)
                 return;
 
         for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_enable(&vsi->q_vectors[q_idx].napi);
+                napi_enable(&vsi->q_vectors[q_idx]->napi);
 }
 
 /**
@@ -3256,7 +3328,7 @@ static void i40e_napi_disable_all(struct i40e_vsi *vsi)
                 return;
 
         for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_disable(&vsi->q_vectors[q_idx].napi);
+                napi_disable(&vsi->q_vectors[q_idx]->napi);
 }
 
 /**
@@ -3703,8 +3775,11 @@ static int i40e_up_complete(struct i40e_vsi *vsi)
 
         if ((pf->hw.phy.link_info.link_info & I40E_AQ_LINK_UP) &&
             (vsi->netdev)) {
+                netdev_info(vsi->netdev, "NIC Link is Up\n");
                 netif_tx_start_all_queues(vsi->netdev);
                 netif_carrier_on(vsi->netdev);
+        } else if (vsi->netdev) {
+                netdev_info(vsi->netdev, "NIC Link is Down\n");
         }
         i40e_service_event_schedule(pf);
 
@@ -3772,8 +3847,8 @@ void i40e_down(struct i40e_vsi *vsi)
         i40e_napi_disable_all(vsi);
 
         for (i = 0; i < vsi->num_queue_pairs; i++) {
-                i40e_clean_tx_ring(&vsi->tx_rings[i]);
-                i40e_clean_rx_ring(&vsi->rx_rings[i]);
+                i40e_clean_tx_ring(vsi->tx_rings[i]);
+                i40e_clean_rx_ring(vsi->rx_rings[i]);
         }
 }
 
@@ -4153,8 +4228,9 @@ static void i40e_link_event(struct i40e_pf *pf)
         if (new_link == old_link)
                 return;
 
-        netdev_info(pf->vsi[pf->lan_vsi]->netdev,
-                    "NIC Link is %s\n", (new_link ? "Up" : "Down"));
+        if (!test_bit(__I40E_DOWN, &pf->vsi[pf->lan_vsi]->state))
+                netdev_info(pf->vsi[pf->lan_vsi]->netdev,
+                            "NIC Link is %s\n", (new_link ? "Up" : "Down"));
 
         /* Notify the base of the switch tree connected to
          * the link.  Floating VEBs are not notified.
@@ -4199,9 +4275,9 @@ static void i40e_check_hang_subtask(struct i40e_pf *pf)
                         continue;
 
                 for (i = 0; i < vsi->num_queue_pairs; i++) {
-                        set_check_for_tx_hang(&vsi->tx_rings[i]);
+                        set_check_for_tx_hang(vsi->tx_rings[i]);
                         if (test_bit(__I40E_HANG_CHECK_ARMED,
-                                     &vsi->tx_rings[i].state))
+                                     &vsi->tx_rings[i]->state))
                                 armed++;
                 }
 
@@ -4537,7 +4613,8 @@ static void i40e_fdir_setup(struct i40e_pf *pf)
         bool new_vsi = false;
         int err, i;
 
-        if (!(pf->flags & (I40E_FLAG_FDIR_ENABLED|I40E_FLAG_FDIR_ATR_ENABLED)))
+        if (!(pf->flags & (I40E_FLAG_FDIR_ENABLED |
+                           I40E_FLAG_FDIR_ATR_ENABLED)))
                 return;
 
         pf->atr_sample_rate = I40E_DEFAULT_ATR_SAMPLE_RATE;
@@ -4937,6 +5014,8 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
 {
         int ret = -ENODEV;
         struct i40e_vsi *vsi;
+        int sz_vectors;
+        int sz_rings;
         int vsi_idx;
         int i;
 
@@ -4962,14 +5041,14 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
                 vsi_idx = i;             /* Found one! */
         } else {
                 ret = -ENODEV;
-                goto err_alloc_vsi;  /* out of VSI slots! */
+                goto unlock_pf;  /* out of VSI slots! */
         }
         pf->next_vsi = ++i;
 
         vsi = kzalloc(sizeof(*vsi), GFP_KERNEL);
         if (!vsi) {
                 ret = -ENOMEM;
-                goto err_alloc_vsi;
+                goto unlock_pf;
         }
         vsi->type = type;
         vsi->back = pf;
@@ -4982,14 +5061,40 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         vsi->work_limit = I40E_DEFAULT_IRQ_WORK;
         INIT_LIST_HEAD(&vsi->mac_filter_list);
 
-        i40e_set_num_rings_in_vsi(vsi);
+        ret = i40e_set_num_rings_in_vsi(vsi);
+        if (ret)
+                goto err_rings;
+
+        /* allocate memory for ring pointers */
+        sz_rings = sizeof(struct i40e_ring *) * vsi->alloc_queue_pairs * 2;
+        vsi->tx_rings = kzalloc(sz_rings, GFP_KERNEL);
+        if (!vsi->tx_rings) {
+                ret = -ENOMEM;
+                goto err_rings;
+        }
+        vsi->rx_rings = &vsi->tx_rings[vsi->alloc_queue_pairs];
+
+        /* allocate memory for q_vector pointers */
+        sz_vectors = sizeof(struct i40e_q_vectors *) * vsi->num_q_vectors;
+        vsi->q_vectors = kzalloc(sz_vectors, GFP_KERNEL);
+        if (!vsi->q_vectors) {
+                ret = -ENOMEM;
+                goto err_vectors;
+        }
 
         /* Setup default MSIX irq handler for VSI */
         i40e_vsi_setup_irqhandler(vsi, i40e_msix_clean_rings);
 
         pf->vsi[vsi_idx] = vsi;
         ret = vsi_idx;
-err_alloc_vsi:
+        goto unlock_pf;
+
+err_vectors:
+        kfree(vsi->tx_rings);
+err_rings:
+        pf->next_vsi = i - 1;
+        kfree(vsi);
+unlock_pf:
         mutex_unlock(&pf->switch_mutex);
         return ret;
 }
@@ -5030,6 +5135,10 @@ static int i40e_vsi_clear(struct i40e_vsi *vsi)
         i40e_put_lump(pf->qp_pile, vsi->base_queue, vsi->idx);
         i40e_put_lump(pf->irq_pile, vsi->base_vector, vsi->idx);
 
+        /* free the ring and vector containers */
+        kfree(vsi->q_vectors);
+        kfree(vsi->tx_rings);
+
         pf->vsi[vsi->idx] = NULL;
         if (vsi->idx < pf->next_vsi)
                 pf->next_vsi = vsi->idx;
@@ -5043,34 +5152,40 @@ free_vsi:
 }
 
 /**
+ * i40e_vsi_clear_rings - Deallocates the Rx and Tx rings for the provided VSI
+ * @vsi: the VSI being cleaned
+ **/
+static s32 i40e_vsi_clear_rings(struct i40e_vsi *vsi)
+{
+        int i;
+
+        if (vsi->tx_rings[0])
+                for (i = 0; i < vsi->alloc_queue_pairs; i++) {
+                        kfree_rcu(vsi->tx_rings[i], rcu);
+                        vsi->tx_rings[i] = NULL;
+                        vsi->rx_rings[i] = NULL;
+                }
+
+        return 0;
+}
+
+/**
  * i40e_alloc_rings - Allocates the Rx and Tx rings for the provided VSI
  * @vsi: the VSI being configured
  **/
 static int i40e_alloc_rings(struct i40e_vsi *vsi)
 {
         struct i40e_pf *pf = vsi->back;
-        int ret = 0;
         int i;
 
-        vsi->rx_rings = kcalloc(vsi->alloc_queue_pairs,
-                                sizeof(struct i40e_ring), GFP_KERNEL);
-        if (!vsi->rx_rings) {
-                ret = -ENOMEM;
-                goto err_alloc_rings;
-        }
-
-        vsi->tx_rings = kcalloc(vsi->alloc_queue_pairs,
-                                sizeof(struct i40e_ring), GFP_KERNEL);
-        if (!vsi->tx_rings) {
-                ret = -ENOMEM;
-                kfree(vsi->rx_rings);
-                goto err_alloc_rings;
-        }
-
         /* Set basic values in the rings to be used later during open() */
         for (i = 0; i < vsi->alloc_queue_pairs; i++) {
-                struct i40e_ring *rx_ring = &vsi->rx_rings[i];
-                struct i40e_ring *tx_ring = &vsi->tx_rings[i];
+                struct i40e_ring *tx_ring;
+                struct i40e_ring *rx_ring;
+
+                tx_ring = kzalloc(sizeof(struct i40e_ring) * 2, GFP_KERNEL);
+                if (!tx_ring)
+                        goto err_out;
 
                 tx_ring->queue_index = i;
                 tx_ring->reg_idx = vsi->base_queue + i;
@@ -5081,7 +5196,9 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
                 tx_ring->count = vsi->num_desc;
                 tx_ring->size = 0;
                 tx_ring->dcb_tc = 0;
+                vsi->tx_rings[i] = tx_ring;
 
+                rx_ring = &tx_ring[1];
                 rx_ring->queue_index = i;
                 rx_ring->reg_idx = vsi->base_queue + i;
                 rx_ring->ring_active = false;
@@ -5095,24 +5212,14 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
                         set_ring_16byte_desc_enabled(rx_ring);
                 else
                         clear_ring_16byte_desc_enabled(rx_ring);
-        }
-
-err_alloc_rings:
-        return ret;
-}
-
-/**
- * i40e_vsi_clear_rings - Deallocates the Rx and Tx rings for the provided VSI
- * @vsi: the VSI being cleaned
- **/
-static int i40e_vsi_clear_rings(struct i40e_vsi *vsi)
-{
-        if (vsi) {
-                kfree(vsi->rx_rings);
-                kfree(vsi->tx_rings);
+                vsi->rx_rings[i] = rx_ring;
         }
 
         return 0;
+
+err_out:
+        i40e_vsi_clear_rings(vsi);
+        return -ENOMEM;
 }
 
 /**
@@ -5249,6 +5356,38 @@ static int i40e_init_msix(struct i40e_pf *pf)
 }
 
 /**
+ * i40e_alloc_q_vector - Allocate memory for a single interrupt vector
+ * @vsi: the VSI being configured
+ * @v_idx: index of the vector in the vsi struct
+ *
+ * We allocate one q_vector.  If allocation fails we return -ENOMEM.
+ **/
+static int i40e_alloc_q_vector(struct i40e_vsi *vsi, int v_idx)
+{
+        struct i40e_q_vector *q_vector;
+
+        /* allocate q_vector */
+        q_vector = kzalloc(sizeof(struct i40e_q_vector), GFP_KERNEL);
+        if (!q_vector)
+                return -ENOMEM;
+
+        q_vector->vsi = vsi;
+        q_vector->v_idx = v_idx;
+        cpumask_set_cpu(v_idx, &q_vector->affinity_mask);
+        if (vsi->netdev)
+                netif_napi_add(vsi->netdev, &q_vector->napi,
+                               i40e_napi_poll, vsi->work_limit);
+
+        q_vector->rx.latency_range = I40E_LOW_LATENCY;
+        q_vector->tx.latency_range = I40E_LOW_LATENCY;
+
+        /* tie q_vector and vsi together */
+        vsi->q_vectors[v_idx] = q_vector;
+
+        return 0;
+}
+
+/**
  * i40e_alloc_q_vectors - Allocate memory for interrupt vectors
  * @vsi: the VSI being configured
  *
@@ -5259,6 +5398,7 @@ static int i40e_alloc_q_vectors(struct i40e_vsi *vsi)
 {
         struct i40e_pf *pf = vsi->back;
         int v_idx, num_q_vectors;
+        int err;
 
         /* if not MSIX, give the one vector only to the LAN VSI */
         if (pf->flags & I40E_FLAG_MSIX_ENABLED)
@@ -5268,22 +5408,19 @@ static int i40e_alloc_q_vectors(struct i40e_vsi *vsi)
         else
                 return -EINVAL;
 
-        vsi->q_vectors = kcalloc(num_q_vectors,
-                                 sizeof(struct i40e_q_vector),
-                                 GFP_KERNEL);
-        if (!vsi->q_vectors)
-                return -ENOMEM;
-
         for (v_idx = 0; v_idx < num_q_vectors; v_idx++) {
-                vsi->q_vectors[v_idx].vsi = vsi;
-                vsi->q_vectors[v_idx].v_idx = v_idx;
-                cpumask_set_cpu(v_idx, &vsi->q_vectors[v_idx].affinity_mask);
-                if (vsi->netdev)
-                        netif_napi_add(vsi->netdev, &vsi->q_vectors[v_idx].napi,
-                                       i40e_napi_poll, vsi->work_limit);
+                err = i40e_alloc_q_vector(vsi, v_idx);
+                if (err)
+                        goto err_out;
         }
 
         return 0;
+
+err_out:
+        while (v_idx--)
+                i40e_free_q_vector(vsi, v_idx);
+
+        return err;
 }
 
 /**
@@ -5297,7 +5434,8 @@ static void i40e_init_interrupt_scheme(struct i40e_pf *pf)
         if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
                 err = i40e_init_msix(pf);
                 if (err) {
-                        pf->flags &= ~(I40E_FLAG_RSS_ENABLED       |
+                        pf->flags &= ~(I40E_FLAG_MSIX_ENABLED      |
+                                        I40E_FLAG_RSS_ENABLED      |
                                         I40E_FLAG_MQ_ENABLED       |
                                         I40E_FLAG_DCB_ENABLED      |
                                         I40E_FLAG_SRIOV_ENABLED    |
@@ -5312,14 +5450,17 @@ static void i40e_init_interrupt_scheme(struct i40e_pf *pf)
 
         if (!(pf->flags & I40E_FLAG_MSIX_ENABLED) &&
             (pf->flags & I40E_FLAG_MSI_ENABLED)) {
+                dev_info(&pf->pdev->dev, "MSIX not available, trying MSI\n");
                 err = pci_enable_msi(pf->pdev);
                 if (err) {
-                        dev_info(&pf->pdev->dev,
-                                 "MSI init failed (%d), trying legacy.\n", err);
+                        dev_info(&pf->pdev->dev, "MSI init failed - %d\n", err);
                         pf->flags &= ~I40E_FLAG_MSI_ENABLED;
                 }
         }
 
+        if (!(pf->flags & (I40E_FLAG_MSIX_ENABLED | I40E_FLAG_MSI_ENABLED)))
+                dev_info(&pf->pdev->dev, "MSIX and MSI not available, falling back to Legacy IRQ\n");
+
         /* track first vector for misc interrupts */
         err = i40e_get_lump(pf, pf->irq_pile, 1, I40E_PILE_VALID_BIT-1);
 }
@@ -5950,7 +6091,7 @@ static int i40e_vsi_setup_vectors(struct i40e_vsi *vsi)
         int ret = -ENOENT;
         struct i40e_pf *pf = vsi->back;
 
-        if (vsi->q_vectors) {
+        if (vsi->q_vectors[0]) {
                 dev_info(&pf->pdev->dev, "VSI %d has existing q_vectors\n",
                          vsi->seid);
                 return -EEXIST;
@@ -5972,8 +6113,9 @@ static int i40e_vsi_setup_vectors(struct i40e_vsi *vsi)
                 goto vector_setup_out;
         }
 
-        vsi->base_vector = i40e_get_lump(pf, pf->irq_pile,
-                                         vsi->num_q_vectors, vsi->idx);
+        if (vsi->num_q_vectors)
+                vsi->base_vector = i40e_get_lump(pf, pf->irq_pile,
+                                                 vsi->num_q_vectors, vsi->idx);
         if (vsi->base_vector < 0) {
                 dev_info(&pf->pdev->dev,
                          "failed to get q tracking for VSI %d, err=%d\n",
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 49d2cfa9b0cc..f1f03bc5c729 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -37,6 +37,7 @@ static inline __le64 build_ctob(u32 td_cmd, u32 td_offset, unsigned int size,
                            ((u64)td_tag  << I40E_TXD_QW1_L2TAG1_SHIFT));
 }
 
+#define I40E_TXD_CMD (I40E_TX_DESC_CMD_EOP | I40E_TX_DESC_CMD_RS)
 /**
  * i40e_program_fdir_filter - Program a Flow Director filter
  * @fdir_input: Packet data that will be filter parameters
@@ -50,6 +51,7 @@ int i40e_program_fdir_filter(struct i40e_fdir_data *fdir_data,
         struct i40e_tx_buffer *tx_buf;
         struct i40e_tx_desc *tx_desc;
         struct i40e_ring *tx_ring;
+        unsigned int fpt, dcc;
         struct i40e_vsi *vsi;
         struct device *dev;
         dma_addr_t dma;
@@ -64,93 +66,78 @@ int i40e_program_fdir_filter(struct i40e_fdir_data *fdir_data,
         if (!vsi)
                 return -ENOENT;
 
-        tx_ring = &vsi->tx_rings[0];
+        tx_ring = vsi->tx_rings[0];
         dev = tx_ring->dev;
 
         dma = dma_map_single(dev, fdir_data->raw_packet,
-                                I40E_FDIR_MAX_RAW_PACKET_LOOKUP, DMA_TO_DEVICE);
+                             I40E_FDIR_MAX_RAW_PACKET_LOOKUP, DMA_TO_DEVICE);
         if (dma_mapping_error(dev, dma))
                 goto dma_fail;
 
         /* grab the next descriptor */
-        fdir_desc = I40E_TX_FDIRDESC(tx_ring, tx_ring->next_to_use);
-        tx_buf = &tx_ring->tx_bi[tx_ring->next_to_use];
-        tx_ring->next_to_use++;
-        if (tx_ring->next_to_use == tx_ring->count)
-                tx_ring->next_to_use = 0;
+        i = tx_ring->next_to_use;
+        fdir_desc = I40E_TX_FDIRDESC(tx_ring, i);
+        tx_buf = &tx_ring->tx_bi[i];
+
+        tx_ring->next_to_use = (i + 1 < tx_ring->count) ? i + 1 : 0;
 
-        fdir_desc->qindex_flex_ptype_vsi = cpu_to_le32((fdir_data->q_index
-                                             << I40E_TXD_FLTR_QW0_QINDEX_SHIFT)
-                                             & I40E_TXD_FLTR_QW0_QINDEX_MASK);
+        fpt = (fdir_data->q_index << I40E_TXD_FLTR_QW0_QINDEX_SHIFT) &
+              I40E_TXD_FLTR_QW0_QINDEX_MASK;
 
-        fdir_desc->qindex_flex_ptype_vsi |= cpu_to_le32((fdir_data->flex_off
-                                            << I40E_TXD_FLTR_QW0_FLEXOFF_SHIFT)
-                                            & I40E_TXD_FLTR_QW0_FLEXOFF_MASK);
+        fpt |= (fdir_data->flex_off << I40E_TXD_FLTR_QW0_FLEXOFF_SHIFT) &
+               I40E_TXD_FLTR_QW0_FLEXOFF_MASK;
 
-        fdir_desc->qindex_flex_ptype_vsi |= cpu_to_le32((fdir_data->pctype
-                                             << I40E_TXD_FLTR_QW0_PCTYPE_SHIFT)
-                                             & I40E_TXD_FLTR_QW0_PCTYPE_MASK);
+        fpt |= (fdir_data->pctype << I40E_TXD_FLTR_QW0_PCTYPE_SHIFT) &
+               I40E_TXD_FLTR_QW0_PCTYPE_MASK;
 
         /* Use LAN VSI Id if not programmed by user */
         if (fdir_data->dest_vsi == 0)
-                fdir_desc->qindex_flex_ptype_vsi |=
-                                          cpu_to_le32((pf->vsi[pf->lan_vsi]->id)
-                                           << I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT);
+                fpt |= (pf->vsi[pf->lan_vsi]->id) <<
+                       I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT;
         else
-                fdir_desc->qindex_flex_ptype_vsi |=
-                                            cpu_to_le32((fdir_data->dest_vsi
-                                            << I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT)
-                                            & I40E_TXD_FLTR_QW0_DEST_VSI_MASK);
+                fpt |= ((u32)fdir_data->dest_vsi <<
+                        I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT) &
+                       I40E_TXD_FLTR_QW0_DEST_VSI_MASK;
 
-        fdir_desc->dtype_cmd_cntindex =
-                                    cpu_to_le32(I40E_TX_DESC_DTYPE_FILTER_PROG);
+        fdir_desc->qindex_flex_ptype_vsi = cpu_to_le32(fpt);
+
+        dcc = I40E_TX_DESC_DTYPE_FILTER_PROG;
 
         if (add)
-                fdir_desc->dtype_cmd_cntindex |= cpu_to_le32(
-                                       I40E_FILTER_PROGRAM_DESC_PCMD_ADD_UPDATE
-                                        << I40E_TXD_FLTR_QW1_PCMD_SHIFT);
+                dcc |= I40E_FILTER_PROGRAM_DESC_PCMD_ADD_UPDATE <<
+                       I40E_TXD_FLTR_QW1_PCMD_SHIFT;
         else
-                fdir_desc->dtype_cmd_cntindex |= cpu_to_le32(
-                                           I40E_FILTER_PROGRAM_DESC_PCMD_REMOVE
-                                           << I40E_TXD_FLTR_QW1_PCMD_SHIFT);
+                dcc |= I40E_FILTER_PROGRAM_DESC_PCMD_REMOVE <<
+                       I40E_TXD_FLTR_QW1_PCMD_SHIFT;
 
-        fdir_desc->dtype_cmd_cntindex |= cpu_to_le32((fdir_data->dest_ctl
-                                          << I40E_TXD_FLTR_QW1_DEST_SHIFT)
-                                          & I40E_TXD_FLTR_QW1_DEST_MASK);
+        dcc |= (fdir_data->dest_ctl << I40E_TXD_FLTR_QW1_DEST_SHIFT) &
+               I40E_TXD_FLTR_QW1_DEST_MASK;
 
-        fdir_desc->dtype_cmd_cntindex |= cpu_to_le32(
-                     (fdir_data->fd_status << I40E_TXD_FLTR_QW1_FD_STATUS_SHIFT)
-                      & I40E_TXD_FLTR_QW1_FD_STATUS_MASK);
+        dcc |= (fdir_data->fd_status << I40E_TXD_FLTR_QW1_FD_STATUS_SHIFT) &
+               I40E_TXD_FLTR_QW1_FD_STATUS_MASK;
 
         if (fdir_data->cnt_index != 0) {
-                fdir_desc->dtype_cmd_cntindex |=
-                                    cpu_to_le32(I40E_TXD_FLTR_QW1_CNT_ENA_MASK);
-                fdir_desc->dtype_cmd_cntindex |=
-                                            cpu_to_le32((fdir_data->cnt_index
-                                            << I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT)
-                                            & I40E_TXD_FLTR_QW1_CNTINDEX_MASK);
+                dcc |= I40E_TXD_FLTR_QW1_CNT_ENA_MASK;
+                dcc |= ((u32)fdir_data->cnt_index <<
+                        I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT) &
+                       I40E_TXD_FLTR_QW1_CNTINDEX_MASK;
         }
 
+        fdir_desc->dtype_cmd_cntindex = cpu_to_le32(dcc);
         fdir_desc->fd_id = cpu_to_le32(fdir_data->fd_id);
 
         /* Now program a dummy descriptor */
-        tx_desc = I40E_TX_DESC(tx_ring, tx_ring->next_to_use);
-        tx_buf = &tx_ring->tx_bi[tx_ring->next_to_use];
-        tx_ring->next_to_use++;
-        if (tx_ring->next_to_use == tx_ring->count)
-                tx_ring->next_to_use = 0;
+        i = tx_ring->next_to_use;
+        tx_desc = I40E_TX_DESC(tx_ring, i);
+
+        tx_ring->next_to_use = (i + 1 < tx_ring->count) ? i + 1 : 0;
 
         tx_desc->buffer_addr = cpu_to_le64(dma);
-        td_cmd = I40E_TX_DESC_CMD_EOP |
-                 I40E_TX_DESC_CMD_RS  |
-                 I40E_TX_DESC_CMD_DUMMY;
+        td_cmd = I40E_TXD_CMD | I40E_TX_DESC_CMD_DUMMY;
 
         tx_desc->cmd_type_offset_bsz =
                 build_ctob(td_cmd, 0, I40E_FDIR_MAX_RAW_PACKET_LOOKUP, 0);
 
-        /* Mark the data descriptor to be watched */
-        tx_buf->next_to_watch = tx_desc;
-
         /* Force memory writes to complete before letting h/w
          * know there are new descriptors to fetch.  (Only
          * applicable for weak-ordered memory model archs,
@@ -158,6 +145,9 @@ int i40e_program_fdir_filter(struct i40e_fdir_data *fdir_data,
          */
         wmb();
 
+        /* Mark the data descriptor to be watched */
+        tx_buf->next_to_watch = tx_desc;
+
         writel(tx_ring->next_to_use, tx_ring->tail);
         return 0;
 
@@ -188,27 +178,30 @@ static void i40e_fd_handle_status(struct i40e_ring *rx_ring, u32 qw, u8 prog_id)
 }
 
 /**
- * i40e_unmap_tx_resource - Release a Tx buffer
+ * i40e_unmap_and_free_tx_resource - Release a Tx buffer
  * @ring:      the ring that owns the buffer
  * @tx_buffer: the buffer to free
  **/
-static inline void i40e_unmap_tx_resource(struct i40e_ring *ring,
-                                          struct i40e_tx_buffer *tx_buffer)
+static void i40e_unmap_and_free_tx_resource(struct i40e_ring *ring,
+                                            struct i40e_tx_buffer *tx_buffer)
 {
-        if (tx_buffer->dma) {
-                if (tx_buffer->tx_flags & I40E_TX_FLAGS_MAPPED_AS_PAGE)
-                        dma_unmap_page(ring->dev,
-                                       tx_buffer->dma,
-                                       tx_buffer->length,
-                                       DMA_TO_DEVICE);
-                else
+        if (tx_buffer->skb) {
+                dev_kfree_skb_any(tx_buffer->skb);
+                if (dma_unmap_len(tx_buffer, len))
                         dma_unmap_single(ring->dev,
-                                         tx_buffer->dma,
-                                         tx_buffer->length,
+                                         dma_unmap_addr(tx_buffer, dma),
+                                         dma_unmap_len(tx_buffer, len),
                                          DMA_TO_DEVICE);
+        } else if (dma_unmap_len(tx_buffer, len)) {
+                dma_unmap_page(ring->dev,
+                               dma_unmap_addr(tx_buffer, dma),
+                               dma_unmap_len(tx_buffer, len),
+                               DMA_TO_DEVICE);
         }
-        tx_buffer->dma = 0;
-        tx_buffer->time_stamp = 0;
+        tx_buffer->next_to_watch = NULL;
+        tx_buffer->skb = NULL;
+        dma_unmap_len_set(tx_buffer, len, 0);
+        /* tx_buffer must be completely set up in the transmit path */
 }
 
 /**
@@ -217,7 +210,6 @@ static inline void i40e_unmap_tx_resource(struct i40e_ring *ring,
  **/
 void i40e_clean_tx_ring(struct i40e_ring *tx_ring)
 {
-        struct i40e_tx_buffer *tx_buffer;
         unsigned long bi_size;
         u16 i;
 
@@ -226,13 +218,8 @@ void i40e_clean_tx_ring(struct i40e_ring *tx_ring)
                 return;
 
         /* Free all the Tx ring sk_buffs */
-        for (i = 0; i < tx_ring->count; i++) {
-                tx_buffer = &tx_ring->tx_bi[i];
-                i40e_unmap_tx_resource(tx_ring, tx_buffer);
-                if (tx_buffer->skb)
-                        dev_kfree_skb_any(tx_buffer->skb);
-                tx_buffer->skb = NULL;
-        }
+        for (i = 0; i < tx_ring->count; i++)
+                i40e_unmap_and_free_tx_resource(tx_ring, &tx_ring->tx_bi[i]);
 
         bi_size = sizeof(struct i40e_tx_buffer) * tx_ring->count;
         memset(tx_ring->tx_bi, 0, bi_size);
@@ -242,6 +229,13 @@ void i40e_clean_tx_ring(struct i40e_ring *tx_ring)
 
         tx_ring->next_to_use = 0;
         tx_ring->next_to_clean = 0;
+
+        if (!tx_ring->netdev)
+                return;
+
+        /* cleanup Tx queue statistics */
+        netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev,
+                                                  tx_ring->queue_index));
 }
 
 /**
@@ -300,14 +294,14 @@ static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
          * run the check_tx_hang logic with a transmit completion
          * pending but without time to complete it yet.
          */
-        if ((tx_ring->tx_stats.tx_done_old == tx_ring->tx_stats.packets) &&
+        if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
             tx_pending) {
                 /* make sure it is true for two checks in a row */
                 ret = test_and_set_bit(__I40E_HANG_CHECK_ARMED,
                                        &tx_ring->state);
         } else {
                 /* update completed stats and disarm the hang check */
-                tx_ring->tx_stats.tx_done_old = tx_ring->tx_stats.packets;
+                tx_ring->tx_stats.tx_done_old = tx_ring->stats.packets;
                 clear_bit(__I40E_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
@@ -331,62 +325,88 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget)
 
         tx_buf = &tx_ring->tx_bi[i];
         tx_desc = I40E_TX_DESC(tx_ring, i);
+        i -= tx_ring->count;
 
-        for (; budget; budget--) {
-                struct i40e_tx_desc *eop_desc;
-
-                eop_desc = tx_buf->next_to_watch;
+        do {
+                struct i40e_tx_desc *eop_desc = tx_buf->next_to_watch;
 
                 /* if next_to_watch is not set then there is no work pending */
                 if (!eop_desc)
                         break;
 
+                /* prevent any other reads prior to eop_desc */
+                read_barrier_depends();
+
                 /* if the descriptor isn't done, no work yet to do */
                 if (!(eop_desc->cmd_type_offset_bsz &
                       cpu_to_le64(I40E_TX_DESC_DTYPE_DESC_DONE)))
                         break;
 
-                /* count the packet as being completed */
-                tx_ring->tx_stats.completed++;
+                /* clear next_to_watch to prevent false hangs */
                 tx_buf->next_to_watch = NULL;
-                tx_buf->time_stamp = 0;
-
-                /* set memory barrier before eop_desc is verified */
-                rmb();
 
-                do {
-                        i40e_unmap_tx_resource(tx_ring, tx_buf);
+                /* update the statistics for this packet */
+                total_bytes += tx_buf->bytecount;
+                total_packets += tx_buf->gso_segs;
 
-                        /* clear dtype status */
-                        tx_desc->cmd_type_offset_bsz &=
-                                ~cpu_to_le64(I40E_TXD_QW1_DTYPE_MASK);
+                /* free the skb */
+                dev_kfree_skb_any(tx_buf->skb);
 
-                        if (likely(tx_desc == eop_desc)) {
-                                eop_desc = NULL;
+                /* unmap skb header data */
+                dma_unmap_single(tx_ring->dev,
+                                 dma_unmap_addr(tx_buf, dma),
+                                 dma_unmap_len(tx_buf, len),
+                                 DMA_TO_DEVICE);
 
-                                dev_kfree_skb_any(tx_buf->skb);
-                                tx_buf->skb = NULL;
+                /* clear tx_buffer data */
+                tx_buf->skb = NULL;
+                dma_unmap_len_set(tx_buf, len, 0);
 
-                                total_bytes += tx_buf->bytecount;
-                                total_packets += tx_buf->gso_segs;
-                        }
+                /* unmap remaining buffers */
+                while (tx_desc != eop_desc) {
 
                         tx_buf++;
                         tx_desc++;
                         i++;
-                        if (unlikely(i == tx_ring->count)) {
-                                i = 0;
+                        if (unlikely(!i)) {
+                                i -= tx_ring->count;
                                 tx_buf = tx_ring->tx_bi;
                                 tx_desc = I40E_TX_DESC(tx_ring, 0);
                         }
-                } while (eop_desc);
-        }
 
+                        /* unmap any remaining paged data */
+                        if (dma_unmap_len(tx_buf, len)) {
+                                dma_unmap_page(tx_ring->dev,
+                                               dma_unmap_addr(tx_buf, dma),
+                                               dma_unmap_len(tx_buf, len),
+                                               DMA_TO_DEVICE);
+                                dma_unmap_len_set(tx_buf, len, 0);
+                        }
+                }
+
+                /* move us one more past the eop_desc for start of next pkt */
+                tx_buf++;
+                tx_desc++;
+                i++;
+                if (unlikely(!i)) {
+                        i -= tx_ring->count;
+                        tx_buf = tx_ring->tx_bi;
+                        tx_desc = I40E_TX_DESC(tx_ring, 0);
+                }
+
+                /* update budget accounting */
+                budget--;
+        } while (likely(budget));
+
+        i += tx_ring->count;
         tx_ring->next_to_clean = i;
-        tx_ring->tx_stats.bytes += total_bytes;
-        tx_ring->tx_stats.packets += total_packets;
+        u64_stats_update_begin(&tx_ring->syncp);
+        tx_ring->stats.bytes += total_bytes;
+        tx_ring->stats.packets += total_packets;
+        u64_stats_update_end(&tx_ring->syncp);
         tx_ring->q_vector->tx.total_bytes += total_bytes;
         tx_ring->q_vector->tx.total_packets += total_packets;
+
         if (check_for_tx_hang(tx_ring) && i40e_check_tx_hang(tx_ring)) {
                 /* schedule immediate reset if we believe we hung */
                 dev_info(tx_ring->dev, "Detected Tx Unit Hang\n"
@@ -414,6 +434,10 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget)
                 return true;
         }
 
+        netdev_tx_completed_queue(netdev_get_tx_queue(tx_ring->netdev,
+                                                      tx_ring->queue_index),
+                                  total_packets, total_bytes);
+
 #define TX_WAKE_THRESHOLD (DESC_NEEDED * 2)
         if (unlikely(total_packets && netif_carrier_ok(tx_ring->netdev) &&
                      (I40E_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
@@ -524,8 +548,6 @@ static void i40e_update_dynamic_itr(struct i40e_q_vector *q_vector)
         i40e_set_new_dynamic_itr(&q_vector->tx);
         if (old_itr != q_vector->tx.itr)
                 wr32(hw, reg_addr, q_vector->tx.itr);
-
-        i40e_flush(hw);
 }
 
 /**
@@ -1042,8 +1064,10 @@ next_desc:
         }
 
         rx_ring->next_to_clean = i;
-        rx_ring->rx_stats.packets += total_rx_packets;
-        rx_ring->rx_stats.bytes += total_rx_bytes;
+        u64_stats_update_begin(&rx_ring->syncp);
+        rx_ring->stats.packets += total_rx_packets;
+        rx_ring->stats.bytes += total_rx_bytes;
+        u64_stats_update_end(&rx_ring->syncp);
         rx_ring->q_vector->rx.total_packets += total_rx_packets;
         rx_ring->q_vector->rx.total_bytes += total_rx_bytes;
 
@@ -1067,27 +1091,28 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
         struct i40e_q_vector *q_vector =
                                container_of(napi, struct i40e_q_vector, napi);
         struct i40e_vsi *vsi = q_vector->vsi;
+        struct i40e_ring *ring;
         bool clean_complete = true;
         int budget_per_ring;
-        int i;
 
         if (test_bit(__I40E_DOWN, &vsi->state)) {
                 napi_complete(napi);
                 return 0;
         }
 
+        /* Since the actual Tx work is minimal, we can give the Tx a larger
+         * budget and be more aggressive about cleaning up the Tx descriptors.
+         */
+        i40e_for_each_ring(ring, q_vector->tx)
+                clean_complete &= i40e_clean_tx_irq(ring, vsi->work_limit);
+
         /* We attempt to distribute budget to each Rx queue fairly, but don't
          * allow the budget to go below 1 because that would exit polling early.
-         * Since the actual Tx work is minimal, we can give the Tx a larger
-         * budget and be more aggressive about cleaning up the Tx descriptors.
          */
         budget_per_ring = max(budget/q_vector->num_ringpairs, 1);
-        for (i = 0; i < q_vector->num_ringpairs; i++) {
-                clean_complete &= i40e_clean_tx_irq(q_vector->tx.ring[i],
-                                                    vsi->work_limit);
-                clean_complete &= i40e_clean_rx_irq(q_vector->rx.ring[i],
-                                                    budget_per_ring);
-        }
+
+        i40e_for_each_ring(ring, q_vector->rx)
+                clean_complete &= i40e_clean_rx_irq(ring, budget_per_ring);
 
         /* If work not completed, return budget and polling will return */
         if (!clean_complete)
@@ -1117,7 +1142,8 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
                         qval = rd32(hw, I40E_QINT_TQCTL(0));
                         qval |= I40E_QINT_TQCTL_CAUSE_ENA_MASK;
                         wr32(hw, I40E_QINT_TQCTL(0), qval);
-                        i40e_flush(hw);
+
+                        i40e_irq_dynamic_enable_icr0(vsi->back);
                 }
         }
 
@@ -1144,6 +1170,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         struct tcphdr *th;
         unsigned int hlen;
         u32 flex_ptype, dtype_cmd;
+        u16 i;
 
         /* make sure ATR is enabled */
         if (!(pf->flags & I40E_FLAG_FDIR_ATR_ENABLED))
@@ -1183,10 +1210,11 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         tx_ring->atr_count = 0;
 
         /* grab the next descriptor */
-        fdir_desc = I40E_TX_FDIRDESC(tx_ring, tx_ring->next_to_use);
-        tx_ring->next_to_use++;
-        if (tx_ring->next_to_use == tx_ring->count)
-                tx_ring->next_to_use = 0;
+        i = tx_ring->next_to_use;
+        fdir_desc = I40E_TX_FDIRDESC(tx_ring, i);
+
+        i++;
+        tx_ring->next_to_use = (i < tx_ring->count) ? i : 0;
 
         flex_ptype = (tx_ring->queue_index << I40E_TXD_FLTR_QW0_QINDEX_SHIFT) &
                       I40E_TXD_FLTR_QW0_QINDEX_MASK;
@@ -1216,7 +1244,6 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         fdir_desc->dtype_cmd_cntindex = cpu_to_le32(dtype_cmd);
 }
 
-#define I40E_TXD_CMD (I40E_TX_DESC_CMD_EOP | I40E_TX_DESC_CMD_RS)
 /**
  * i40e_tx_prepare_vlan_flags - prepare generic TX VLAN tagging flags for HW
  * @skb:     send buffer
@@ -1276,27 +1303,6 @@ static int i40e_tx_prepare_vlan_flags(struct sk_buff *skb,
 }
 
 /**
- * i40e_tx_csum - is checksum offload requested
- * @tx_ring:  ptr to the ring to send
- * @skb:      ptr to the skb we're sending
- * @tx_flags: the collected send information
- * @protocol: the send protocol
- *
- * Returns true if checksum offload is requested
- **/
-static bool i40e_tx_csum(struct i40e_ring *tx_ring, struct sk_buff *skb,
-                         u32 tx_flags, __be16 protocol)
-{
-        if ((skb->ip_summed != CHECKSUM_PARTIAL) &&
-            !(tx_flags & I40E_TX_FLAGS_TXSW)) {
-                if (!(tx_flags & I40E_TX_FLAGS_HW_VLAN))
-                        return false;
-        }
-
-        return skb->ip_summed == CHECKSUM_PARTIAL;
-}
-
-/**
  * i40e_tso - set up the tso context descriptor
  * @tx_ring:  ptr to the ring to send
  * @skb:      ptr to the skb we're sending
@@ -1482,15 +1488,16 @@ static void i40e_create_tx_ctx(struct i40e_ring *tx_ring,
                                const u32 cd_tunneling, const u32 cd_l2tag2)
 {
         struct i40e_tx_context_desc *context_desc;
+        int i = tx_ring->next_to_use;
 
         if (!cd_type_cmd_tso_mss && !cd_tunneling && !cd_l2tag2)
                 return;
 
         /* grab the next descriptor */
-        context_desc = I40E_TX_CTXTDESC(tx_ring, tx_ring->next_to_use);
-        tx_ring->next_to_use++;
-        if (tx_ring->next_to_use == tx_ring->count)
-                tx_ring->next_to_use = 0;
+        context_desc = I40E_TX_CTXTDESC(tx_ring, i);
+
+        i++;
+        tx_ring->next_to_use = (i < tx_ring->count) ? i : 0;
 
         /* cpu_to_le32 and assign to struct fields */
         context_desc->tunneling_params = cpu_to_le32(cd_tunneling);
@@ -1512,68 +1519,71 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
                         struct i40e_tx_buffer *first, u32 tx_flags,
                         const u8 hdr_len, u32 td_cmd, u32 td_offset)
 {
-        struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[0];
         unsigned int data_len = skb->data_len;
         unsigned int size = skb_headlen(skb);
-        struct device *dev = tx_ring->dev;
-        u32 paylen = skb->len - hdr_len;
-        u16 i = tx_ring->next_to_use;
+        struct skb_frag_struct *frag;
         struct i40e_tx_buffer *tx_bi;
         struct i40e_tx_desc *tx_desc;
-        u32 buf_offset = 0;
+        u16 i = tx_ring->next_to_use;
         u32 td_tag = 0;
         dma_addr_t dma;
         u16 gso_segs;
 
-        dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
-        if (dma_mapping_error(dev, dma))
-                goto dma_error;
-
         if (tx_flags & I40E_TX_FLAGS_HW_VLAN) {
                 td_cmd |= I40E_TX_DESC_CMD_IL2TAG1;
                 td_tag = (tx_flags & I40E_TX_FLAGS_VLAN_MASK) >>
                          I40E_TX_FLAGS_VLAN_SHIFT;
         }
 
+        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO))
+                gso_segs = skb_shinfo(skb)->gso_segs;
+        else
+                gso_segs = 1;
+
+        /* multiply data chunks by size of headers */
+        first->bytecount = skb->len - hdr_len + (gso_segs * hdr_len);
+        first->gso_segs = gso_segs;
+        first->skb = skb;
+        first->tx_flags = tx_flags;
+
+        dma = dma_map_single(tx_ring->dev, skb->data, size, DMA_TO_DEVICE);
+
         tx_desc = I40E_TX_DESC(tx_ring, i);
-        for (;;) {
-                while (size > I40E_MAX_DATA_PER_TXD) {
-                        tx_desc->buffer_addr = cpu_to_le64(dma + buf_offset);
+        tx_bi = first;
+
+        for (frag = &skb_shinfo(skb)->frags[0];; frag++) {
+                if (dma_mapping_error(tx_ring->dev, dma))
+                        goto dma_error;
+
+                /* record length, and DMA address */
+                dma_unmap_len_set(tx_bi, len, size);
+                dma_unmap_addr_set(tx_bi, dma, dma);
+
+                tx_desc->buffer_addr = cpu_to_le64(dma);
+
+                while (unlikely(size > I40E_MAX_DATA_PER_TXD)) {
                         tx_desc->cmd_type_offset_bsz =
                                 build_ctob(td_cmd, td_offset,
                                            I40E_MAX_DATA_PER_TXD, td_tag);
 
-                        buf_offset += I40E_MAX_DATA_PER_TXD;
-                        size -= I40E_MAX_DATA_PER_TXD;
-
                         tx_desc++;
                         i++;
                         if (i == tx_ring->count) {
                                 tx_desc = I40E_TX_DESC(tx_ring, 0);
                                 i = 0;
                         }
-                }
 
-                tx_bi = &tx_ring->tx_bi[i];
-                tx_bi->length = buf_offset + size;
-                tx_bi->tx_flags = tx_flags;
-                tx_bi->dma = dma;
+                        dma += I40E_MAX_DATA_PER_TXD;
+                        size -= I40E_MAX_DATA_PER_TXD;
 
-                tx_desc->buffer_addr = cpu_to_le64(dma + buf_offset);
-                tx_desc->cmd_type_offset_bsz = build_ctob(td_cmd, td_offset,
-                                                          size, td_tag);
+                        tx_desc->buffer_addr = cpu_to_le64(dma);
+                }
 
                 if (likely(!data_len))
                         break;
 
-                size = skb_frag_size(frag);
-                data_len -= size;
-                buf_offset = 0;
-                tx_flags |= I40E_TX_FLAGS_MAPPED_AS_PAGE;
-
-                dma = skb_frag_dma_map(dev, frag, 0, size, DMA_TO_DEVICE);
-                if (dma_mapping_error(dev, dma))
-                        goto dma_error;
+                tx_desc->cmd_type_offset_bsz = build_ctob(td_cmd, td_offset,
+                                                          size, td_tag);
 
                 tx_desc++;
                 i++;
@@ -1582,31 +1592,25 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
                         i = 0;
                 }
 
-                frag++;
-        }
-
-        tx_desc->cmd_type_offset_bsz |=
-                       cpu_to_le64((u64)I40E_TXD_CMD << I40E_TXD_QW1_CMD_SHIFT);
+                size = skb_frag_size(frag);
+                data_len -= size;
 
-        i++;
-        if (i == tx_ring->count)
-                i = 0;
+                dma = skb_frag_dma_map(tx_ring->dev, frag, 0, size,
+                                       DMA_TO_DEVICE);
 
-        tx_ring->next_to_use = i;
+                tx_bi = &tx_ring->tx_bi[i];
+        }
 
-        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO))
-                gso_segs = skb_shinfo(skb)->gso_segs;
-        else
-                gso_segs = 1;
+        tx_desc->cmd_type_offset_bsz =
+                build_ctob(td_cmd, td_offset, size, td_tag) |
+                cpu_to_le64((u64)I40E_TXD_CMD << I40E_TXD_QW1_CMD_SHIFT);
 
-        /* multiply data chunks by size of headers */
-        tx_bi->bytecount = paylen + (gso_segs * hdr_len);
-        tx_bi->gso_segs = gso_segs;
-        tx_bi->skb = skb;
+        netdev_tx_sent_queue(netdev_get_tx_queue(tx_ring->netdev,
+                                                 tx_ring->queue_index),
+                             first->bytecount);
 
-        /* set the timestamp and next to watch values */
+        /* set the timestamp */
         first->time_stamp = jiffies;
-        first->next_to_watch = tx_desc;
 
         /* Force memory writes to complete before letting h/w
          * know there are new descriptors to fetch.  (Only
@@ -1615,16 +1619,27 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
          */
         wmb();
 
+        /* set next_to_watch value indicating a packet is present */
+        first->next_to_watch = tx_desc;
+
+        i++;
+        if (i == tx_ring->count)
+                i = 0;
+
+        tx_ring->next_to_use = i;
+
+        /* notify HW of packet */
         writel(i, tx_ring->tail);
+
         return;
 
 dma_error:
-        dev_info(dev, "TX DMA map failed\n");
+        dev_info(tx_ring->dev, "TX DMA map failed\n");
 
         /* clear dma mappings for failed tx_bi map */
         for (;;) {
                 tx_bi = &tx_ring->tx_bi[i];
-                i40e_unmap_tx_resource(tx_ring, tx_bi);
+                i40e_unmap_and_free_tx_resource(tx_ring, tx_bi);
                 if (tx_bi == first)
                         break;
                 if (i == 0)
@@ -1632,8 +1647,6 @@ dma_error:
                 i--;
         }
 
-        dev_kfree_skb_any(skb);
-
         tx_ring->next_to_use = i;
 }
 
@@ -1758,16 +1771,16 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
 
         skb_tx_timestamp(skb);
 
+        /* always enable CRC insertion offload */
+        td_cmd |= I40E_TX_DESC_CMD_ICRC;
+
         /* Always offload the checksum, since it's in the data descriptor */
-        if (i40e_tx_csum(tx_ring, skb, tx_flags, protocol))
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 tx_flags |= I40E_TX_FLAGS_CSUM;
 
-        /* always enable offload insertion */
-        td_cmd |= I40E_TX_DESC_CMD_ICRC;
-
-        if (tx_flags & I40E_TX_FLAGS_CSUM)
                 i40e_tx_enable_csum(skb, tx_flags, &td_cmd, &td_offset,
                                     tx_ring, &cd_tunneling);
+        }
 
         i40e_create_tx_ctx(tx_ring, cd_type_cmd_tso_mss,
                            cd_tunneling, cd_l2tag2);
@@ -1801,7 +1814,7 @@ netdev_tx_t i40e_lan_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 {
         struct i40e_netdev_priv *np = netdev_priv(netdev);
         struct i40e_vsi *vsi = np->vsi;
-        struct i40e_ring *tx_ring = &vsi->tx_rings[skb->queue_mapping];
+        struct i40e_ring *tx_ring = vsi->tx_rings[skb->queue_mapping];
 
         /* hardware can't handle really short frames, hardware padding works
          * beyond this point
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index b1d7722d98a7..db55d9947f15 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -102,23 +102,20 @@
 #define I40E_TX_FLAGS_IPV6              (u32)(1 << 5)
 #define I40E_TX_FLAGS_FCCRC             (u32)(1 << 6)
 #define I40E_TX_FLAGS_FSO               (u32)(1 << 7)
-#define I40E_TX_FLAGS_TXSW              (u32)(1 << 8)
-#define I40E_TX_FLAGS_MAPPED_AS_PAGE    (u32)(1 << 9)
 #define I40E_TX_FLAGS_VLAN_MASK         0xffff0000
 #define I40E_TX_FLAGS_VLAN_PRIO_MASK    0xe0000000
 #define I40E_TX_FLAGS_VLAN_PRIO_SHIFT   29
 #define I40E_TX_FLAGS_VLAN_SHIFT        16
 
 struct i40e_tx_buffer {
-        struct sk_buff *skb;
-        dma_addr_t dma;
-        unsigned long time_stamp;
-        u16 length;
-        u32 tx_flags;
         struct i40e_tx_desc *next_to_watch;
+        unsigned long time_stamp;
+        struct sk_buff *skb;
         unsigned int bytecount;
-        u16 gso_segs;
-        u8 mapped_as_page;
+        unsigned short gso_segs;
+        DEFINE_DMA_UNMAP_ADDR(dma);
+        DEFINE_DMA_UNMAP_LEN(len);
+        u32 tx_flags;
 };
 
 struct i40e_rx_buffer {
@@ -129,18 +126,18 @@ struct i40e_rx_buffer {
         unsigned int page_offset;
 };
 
-struct i40e_tx_queue_stats {
+struct i40e_queue_stats {
         u64 packets;
         u64 bytes;
+};
+
+struct i40e_tx_queue_stats {
         u64 restart_queue;
         u64 tx_busy;
-        u64 completed;
         u64 tx_done_old;
 };
 
 struct i40e_rx_queue_stats {
-        u64 packets;
-        u64 bytes;
         u64 non_eop_descs;
         u64 alloc_rx_page_failed;
         u64 alloc_rx_buff_failed;
@@ -183,6 +180,7 @@ enum i40e_ring_state_t {
 
 /* struct that defines a descriptor ring, associated with a VSI */
 struct i40e_ring {
+        struct i40e_ring *next;         /* pointer to next ring in q_vector */
         void *desc;                     /* Descriptor ring memory */
         struct device *dev;             /* Used for DMA mapping */
         struct net_device *netdev;      /* netdev ring maps to */
@@ -219,6 +217,8 @@ struct i40e_ring {
         bool ring_active;               /* is ring online or not */
 
         /* stats structs */
+        struct i40e_queue_stats stats;
+        struct u64_stats_sync syncp;
         union {
                 struct i40e_tx_queue_stats tx_stats;
                 struct i40e_rx_queue_stats rx_stats;
@@ -229,6 +229,8 @@ struct i40e_ring {
 
         struct i40e_vsi *vsi;           /* Backreference to associated VSI */
         struct i40e_q_vector *q_vector; /* Backreference to associated vector */
+
+        struct rcu_head rcu;            /* to avoid race on free */
 } ____cacheline_internodealigned_in_smp;
 
 enum i40e_latency_range {
@@ -238,9 +240,8 @@ enum i40e_latency_range {
 };
 
 struct i40e_ring_container {
-#define I40E_MAX_RINGPAIR_PER_VECTOR 8
         /* array of pointers to rings */
-        struct i40e_ring *ring[I40E_MAX_RINGPAIR_PER_VECTOR];
+        struct i40e_ring *ring;
         unsigned int total_bytes;       /* total bytes processed this int */
         unsigned int total_packets;     /* total packets processed this int */
         u16 count;
@@ -248,6 +249,10 @@ struct i40e_ring_container {
         u16 itr;
 };
 
+/* iterator for handling rings in ring container */
+#define i40e_for_each_ring(pos, head) \
+        for (pos = (head).ring; pos != NULL; pos = pos->next)
+
 void i40e_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count);
 netdev_tx_t i40e_lan_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
 void i40e_clean_tx_ring(struct i40e_ring *tx_ring);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 8967e58e2408..07596982a477 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -251,7 +251,7 @@ static void i40e_config_irq_link_list(struct i40e_vf *vf, u16 vsi_idx,
                 reg_idx = I40E_VPINT_LNKLST0(vf->vf_id);
         else
                 reg_idx = I40E_VPINT_LNKLSTN(
-                            ((pf->hw.func_caps.num_msix_vectors_vf - 1)
+                                           (pf->hw.func_caps.num_msix_vectors_vf
                                               * vf->vf_id) + (vector_id - 1));
 
         if (vecmap->rxq_map == 0 && vecmap->txq_map == 0) {
@@ -383,7 +383,7 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_idx,
 
         /* associate this queue with the PCI VF function */
         qtx_ctl = I40E_QTX_CTL_VF_QUEUE;
-        qtx_ctl |= ((hw->hmc.hmc_fn_id << I40E_QTX_CTL_PF_INDX_SHIFT)
+        qtx_ctl |= ((hw->pf_id << I40E_QTX_CTL_PF_INDX_SHIFT)
                     & I40E_QTX_CTL_PF_INDX_MASK);
         qtx_ctl |= (((vf->vf_id + hw->func_caps.vf_base_id)
                      << I40E_QTX_CTL_VFVM_INDX_SHIFT)
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.h b/drivers/net/ethernet/intel/igb/e1000_82575.h
index 74a1506b4235..8c2437722aad 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.h
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.h
@@ -28,14 +28,14 @@
 #ifndef _E1000_82575_H_
 #define _E1000_82575_H_
 
-extern void igb_shutdown_serdes_link_82575(struct e1000_hw *hw);
-extern void igb_power_up_serdes_link_82575(struct e1000_hw *hw);
-extern void igb_power_down_phy_copper_82575(struct e1000_hw *hw);
-extern void igb_rx_fifo_flush_82575(struct e1000_hw *hw);
-extern s32 igb_read_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
-                                u8 dev_addr, u8 *data);
-extern s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
-                                 u8 dev_addr, u8 data);
+void igb_shutdown_serdes_link_82575(struct e1000_hw *hw);
+void igb_power_up_serdes_link_82575(struct e1000_hw *hw);
+void igb_power_down_phy_copper_82575(struct e1000_hw *hw);
+void igb_rx_fifo_flush_82575(struct e1000_hw *hw);
+s32 igb_read_i2c_byte(struct e1000_hw *hw, u8 byte_offset, u8 dev_addr,
+                      u8 *data);
+s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset, u8 dev_addr,
+                       u8 data);
 
 #define ID_LED_DEFAULT_82575_SERDES ((ID_LED_DEF1_DEF2 << 12) | \
                                      (ID_LED_DEF1_DEF2 <<  8) | \
diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
index 37a9c06a6c68..2e166b22d52b 100644
--- a/drivers/net/ethernet/intel/igb/e1000_hw.h
+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
@@ -562,11 +562,11 @@ struct e1000_hw {
         u8  revision_id;
 };
 
-extern struct net_device *igb_get_hw_dev(struct e1000_hw *hw);
+struct net_device *igb_get_hw_dev(struct e1000_hw *hw);
 #define hw_dbg(format, arg...) \
         netdev_dbg(igb_get_hw_dev(hw), format, ##arg)
 
 /* These functions must be implemented by drivers */
-s32  igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
-s32  igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
+s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
+s32 igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
 #endif /* _E1000_HW_H_ */
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.h b/drivers/net/ethernet/intel/igb/e1000_i210.h
index dde3c4b7ea99..2d913716573a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.h
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.h
@@ -28,26 +28,24 @@
 #ifndef _E1000_I210_H_
 #define _E1000_I210_H_
 
-extern s32 igb_update_flash_i210(struct e1000_hw *hw);
-extern s32 igb_update_nvm_checksum_i210(struct e1000_hw *hw);
-extern s32 igb_validate_nvm_checksum_i210(struct e1000_hw *hw);
-extern s32 igb_write_nvm_srwr_i210(struct e1000_hw *hw, u16 offset,
-                              u16 words, u16 *data);
-extern s32 igb_read_nvm_srrd_i210(struct e1000_hw *hw, u16 offset,
-                             u16 words, u16 *data);
-extern s32 igb_acquire_swfw_sync_i210(struct e1000_hw *hw, u16 mask);
-extern void igb_release_swfw_sync_i210(struct e1000_hw *hw, u16 mask);
-extern s32 igb_acquire_nvm_i210(struct e1000_hw *hw);
-extern void igb_release_nvm_i210(struct e1000_hw *hw);
-extern s32 igb_valid_led_default_i210(struct e1000_hw *hw, u16 *data);
-extern s32 igb_read_invm_version(struct e1000_hw *hw,
-                                 struct e1000_fw_version *invm_ver);
-extern s32 igb_read_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr,
-                              u16 *data);
-extern s32 igb_write_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr,
-                               u16 data);
-extern s32 igb_init_nvm_params_i210(struct e1000_hw *hw);
-extern bool igb_get_flash_presence_i210(struct e1000_hw *hw);
+s32 igb_update_flash_i210(struct e1000_hw *hw);
+s32 igb_update_nvm_checksum_i210(struct e1000_hw *hw);
+s32 igb_validate_nvm_checksum_i210(struct e1000_hw *hw);
+s32 igb_write_nvm_srwr_i210(struct e1000_hw *hw, u16 offset, u16 words,
+                            u16 *data);
+s32 igb_read_nvm_srrd_i210(struct e1000_hw *hw, u16 offset, u16 words,
+                           u16 *data);
+s32 igb_acquire_swfw_sync_i210(struct e1000_hw *hw, u16 mask);
+void igb_release_swfw_sync_i210(struct e1000_hw *hw, u16 mask);
+s32 igb_acquire_nvm_i210(struct e1000_hw *hw);
+void igb_release_nvm_i210(struct e1000_hw *hw);
+s32 igb_valid_led_default_i210(struct e1000_hw *hw, u16 *data);
+s32 igb_read_invm_version(struct e1000_hw *hw,
+                          struct e1000_fw_version *invm_ver);
+s32 igb_read_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 *data);
+s32 igb_write_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 data);
+s32 igb_init_nvm_params_i210(struct e1000_hw *hw);
+bool igb_get_flash_presence_i210(struct e1000_hw *hw);
 
 #define E1000_STM_OPCODE                0xDB00
 #define E1000_EEPROM_FLASH_SIZE_WORD    0x11
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.h b/drivers/net/ethernet/intel/igb/e1000_mac.h
index 5e13e83cc608..e4cbe8ef67b3 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.h
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.h
@@ -86,6 +86,6 @@ enum e1000_mng_mode {
 
 #define E1000_MNG_DHCP_COOKIE_STATUS_VLAN       0x2
 
-extern void e1000_init_function_pointers_82575(struct e1000_hw *hw);
+void e1000_init_function_pointers_82575(struct e1000_hw *hw);
 
 #endif
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index 6807b098edae..5e9ed89403aa 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -483,40 +483,38 @@ enum igb_boards {
 extern char igb_driver_name[];
 extern char igb_driver_version[];
 
-extern int igb_up(struct igb_adapter *);
-extern void igb_down(struct igb_adapter *);
-extern void igb_reinit_locked(struct igb_adapter *);
-extern void igb_reset(struct igb_adapter *);
-extern void igb_write_rss_indir_tbl(struct igb_adapter *);
-extern int igb_set_spd_dplx(struct igb_adapter *, u32, u8);
-extern int igb_setup_tx_resources(struct igb_ring *);
-extern int igb_setup_rx_resources(struct igb_ring *);
-extern void igb_free_tx_resources(struct igb_ring *);
-extern void igb_free_rx_resources(struct igb_ring *);
-extern void igb_configure_tx_ring(struct igb_adapter *, struct igb_ring *);
-extern void igb_configure_rx_ring(struct igb_adapter *, struct igb_ring *);
-extern void igb_setup_tctl(struct igb_adapter *);
-extern void igb_setup_rctl(struct igb_adapter *);
-extern netdev_tx_t igb_xmit_frame_ring(struct sk_buff *, struct igb_ring *);
-extern void igb_unmap_and_free_tx_resource(struct igb_ring *,
-                                           struct igb_tx_buffer *);
-extern void igb_alloc_rx_buffers(struct igb_ring *, u16);
-extern void igb_update_stats(struct igb_adapter *, struct rtnl_link_stats64 *);
-extern bool igb_has_link(struct igb_adapter *adapter);
-extern void igb_set_ethtool_ops(struct net_device *);
-extern void igb_power_up_link(struct igb_adapter *);
-extern void igb_set_fw_version(struct igb_adapter *);
-extern void igb_ptp_init(struct igb_adapter *adapter);
-extern void igb_ptp_stop(struct igb_adapter *adapter);
-extern void igb_ptp_reset(struct igb_adapter *adapter);
-extern void igb_ptp_tx_work(struct work_struct *work);
-extern void igb_ptp_rx_hang(struct igb_adapter *adapter);
-extern void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter);
-extern void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
-                                struct sk_buff *skb);
-extern void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector,
-                                unsigned char *va,
-                                struct sk_buff *skb);
+int igb_up(struct igb_adapter *);
+void igb_down(struct igb_adapter *);
+void igb_reinit_locked(struct igb_adapter *);
+void igb_reset(struct igb_adapter *);
+int igb_reinit_queues(struct igb_adapter *);
+void igb_write_rss_indir_tbl(struct igb_adapter *);
+int igb_set_spd_dplx(struct igb_adapter *, u32, u8);
+int igb_setup_tx_resources(struct igb_ring *);
+int igb_setup_rx_resources(struct igb_ring *);
+void igb_free_tx_resources(struct igb_ring *);
+void igb_free_rx_resources(struct igb_ring *);
+void igb_configure_tx_ring(struct igb_adapter *, struct igb_ring *);
+void igb_configure_rx_ring(struct igb_adapter *, struct igb_ring *);
+void igb_setup_tctl(struct igb_adapter *);
+void igb_setup_rctl(struct igb_adapter *);
+netdev_tx_t igb_xmit_frame_ring(struct sk_buff *, struct igb_ring *);
+void igb_unmap_and_free_tx_resource(struct igb_ring *, struct igb_tx_buffer *);
+void igb_alloc_rx_buffers(struct igb_ring *, u16);
+void igb_update_stats(struct igb_adapter *, struct rtnl_link_stats64 *);
+bool igb_has_link(struct igb_adapter *adapter);
+void igb_set_ethtool_ops(struct net_device *);
+void igb_power_up_link(struct igb_adapter *);
+void igb_set_fw_version(struct igb_adapter *);
+void igb_ptp_init(struct igb_adapter *adapter);
+void igb_ptp_stop(struct igb_adapter *adapter);
+void igb_ptp_reset(struct igb_adapter *adapter);
+void igb_ptp_tx_work(struct work_struct *work);
+void igb_ptp_rx_hang(struct igb_adapter *adapter);
+void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter);
+void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb);
+void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, unsigned char *va,
+                         struct sk_buff *skb);
 static inline void igb_ptp_rx_hwtstamp(struct igb_ring *rx_ring,
                                        union e1000_adv_rx_desc *rx_desc,
                                        struct sk_buff *skb)
@@ -531,11 +529,11 @@ static inline void igb_ptp_rx_hwtstamp(struct igb_ring *rx_ring,
         rx_ring->last_rx_timestamp = jiffies;
 }
 
-extern int igb_ptp_hwtstamp_ioctl(struct net_device *netdev,
-                                  struct ifreq *ifr, int cmd);
+int igb_ptp_hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr,
+                           int cmd);
 #ifdef CONFIG_IGB_HWMON
-extern void igb_sysfs_exit(struct igb_adapter *adapter);
-extern int igb_sysfs_init(struct igb_adapter *adapter);
+void igb_sysfs_exit(struct igb_adapter *adapter);
+int igb_sysfs_init(struct igb_adapter *adapter);
 #endif
 static inline s32 igb_reset_phy(struct e1000_hw *hw)
 {
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 151e00cad113..0ae3177416c7 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1659,7 +1659,8 @@ static int igb_setup_loopback_test(struct igb_adapter *adapter)
                 if ((hw->device_id == E1000_DEV_ID_DH89XXCC_SGMII) ||
                 (hw->device_id == E1000_DEV_ID_DH89XXCC_SERDES) ||
                 (hw->device_id == E1000_DEV_ID_DH89XXCC_BACKPLANE) ||
-                (hw->device_id == E1000_DEV_ID_DH89XXCC_SFP)) {
+                (hw->device_id == E1000_DEV_ID_DH89XXCC_SFP) ||
+                (hw->device_id == E1000_DEV_ID_I354_SGMII)) {
 
                         /* Enable DH89xxCC MPHY for near end loopback */
                         reg = rd32(E1000_MPHY_ADDR_CTL);
@@ -1725,7 +1726,8 @@ static void igb_loopback_cleanup(struct igb_adapter *adapter)
         if ((hw->device_id == E1000_DEV_ID_DH89XXCC_SGMII) ||
         (hw->device_id == E1000_DEV_ID_DH89XXCC_SERDES) ||
         (hw->device_id == E1000_DEV_ID_DH89XXCC_BACKPLANE) ||
-        (hw->device_id == E1000_DEV_ID_DH89XXCC_SFP)) {
+        (hw->device_id == E1000_DEV_ID_DH89XXCC_SFP) ||
+        (hw->device_id == E1000_DEV_ID_I354_SGMII)) {
                 u32 reg;
 
                 /* Disable near end loopback on DH89xxCC */
@@ -2877,6 +2879,88 @@ static int igb_set_rxfh_indir(struct net_device *netdev, const u32 *indir)
         return 0;
 }
 
+static unsigned int igb_max_channels(struct igb_adapter *adapter)
+{
+        struct e1000_hw *hw = &adapter->hw;
+        unsigned int max_combined = 0;
+
+        switch (hw->mac.type) {
+        case e1000_i211:
+                max_combined = IGB_MAX_RX_QUEUES_I211;
+                break;
+        case e1000_82575:
+        case e1000_i210:
+                max_combined = IGB_MAX_RX_QUEUES_82575;
+                break;
+        case e1000_i350:
+                if (!!adapter->vfs_allocated_count) {
+                        max_combined = 1;
+                        break;
+                }
+                /* fall through */
+        case e1000_82576:
+                if (!!adapter->vfs_allocated_count) {
+                        max_combined = 2;
+                        break;
+                }
+                /* fall through */
+        case e1000_82580:
+        case e1000_i354:
+        default:
+                max_combined = IGB_MAX_RX_QUEUES;
+                break;
+        }
+
+        return max_combined;
+}
+
+static void igb_get_channels(struct net_device *netdev,
+                             struct ethtool_channels *ch)
+{
+        struct igb_adapter *adapter = netdev_priv(netdev);
+
+        /* Report maximum channels */
+        ch->max_combined = igb_max_channels(adapter);
+
+        /* Report info for other vector */
+        if (adapter->msix_entries) {
+                ch->max_other = NON_Q_VECTORS;
+                ch->other_count = NON_Q_VECTORS;
+        }
+
+        ch->combined_count = adapter->rss_queues;
+}
+
+static int igb_set_channels(struct net_device *netdev,
+                            struct ethtool_channels *ch)
+{
+        struct igb_adapter *adapter = netdev_priv(netdev);
+        unsigned int count = ch->combined_count;
+
+        /* Verify they are not requesting separate vectors */
+        if (!count || ch->rx_count || ch->tx_count)
+                return -EINVAL;
+
+        /* Verify other_count is valid and has not been changed */
+        if (ch->other_count != NON_Q_VECTORS)
+                return -EINVAL;
+
+        /* Verify the number of channels doesn't exceed hw limits */
+        if (count > igb_max_channels(adapter))
+                return -EINVAL;
+
+        if (count != adapter->rss_queues) {
+                adapter->rss_queues = count;
+
+                /* Hardware has to reinitialize queues and interrupts to
+                 * match the new configuration.
+                 */
+                return igb_reinit_queues(adapter);
+        }
+
+        return 0;
+}
+
 static const struct ethtool_ops igb_ethtool_ops = {
         .get_settings           = igb_get_settings,
         .set_settings           = igb_set_settings,
@@ -2913,6 +2997,8 @@ static const struct ethtool_ops igb_ethtool_ops = {
         .get_rxfh_indir_size    = igb_get_rxfh_indir_size,
         .get_rxfh_indir         = igb_get_rxfh_indir,
         .set_rxfh_indir         = igb_set_rxfh_indir,
+        .get_channels           = igb_get_channels,
+        .set_channels           = igb_set_channels,
         .begin                  = igb_ethtool_begin,
         .complete               = igb_ethtool_complete,
 };
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 8cf44f2a8ccd..a505d3bad09a 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5708,7 +5708,7 @@ static void igb_vf_reset_msg(struct igb_adapter *adapter, u32 vf)
 
         /* reply to reset with ack and vf mac address */
         msgbuf[0] = E1000_VF_RESET | E1000_VT_MSGTYPE_ACK;
-        memcpy(addr, vf_mac, 6);
+        memcpy(addr, vf_mac, ETH_ALEN);
         igb_write_mbx(hw, msgbuf, 3, vf);
 }
 
@@ -7838,4 +7838,26 @@ s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                 return E1000_SUCCESS;
 
 }
+
+int igb_reinit_queues(struct igb_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct pci_dev *pdev = adapter->pdev;
+        int err = 0;
+
+        if (netif_running(netdev))
+                igb_close(netdev);
+
+        igb_clear_interrupt_scheme(adapter);
+
+        if (igb_init_interrupt_scheme(adapter, true)) {
+                dev_err(&pdev->dev, "Unable to allocate memory for queues\n");
+                return -ENOMEM;
+        }
+
+        if (netif_running(netdev))
+                err = igb_open(netdev);
+
+        return err;
+}
 /* igb_main.c */
diff --git a/drivers/net/ethernet/intel/igbvf/igbvf.h b/drivers/net/ethernet/intel/igbvf/igbvf.h
index a1463e3d14c0..7d6a25c8f889 100644
--- a/drivers/net/ethernet/intel/igbvf/igbvf.h
+++ b/drivers/net/ethernet/intel/igbvf/igbvf.h
@@ -312,17 +312,17 @@ enum igbvf_state_t {
 extern char igbvf_driver_name[];
 extern const char igbvf_driver_version[];
 
-extern void igbvf_check_options(struct igbvf_adapter *);
-extern void igbvf_set_ethtool_ops(struct net_device *);
-
-extern int igbvf_up(struct igbvf_adapter *);
-extern void igbvf_down(struct igbvf_adapter *);
-extern void igbvf_reinit_locked(struct igbvf_adapter *);
-extern int igbvf_setup_rx_resources(struct igbvf_adapter *, struct igbvf_ring *);
-extern int igbvf_setup_tx_resources(struct igbvf_adapter *, struct igbvf_ring *);
-extern void igbvf_free_rx_resources(struct igbvf_ring *);
-extern void igbvf_free_tx_resources(struct igbvf_ring *);
-extern void igbvf_update_stats(struct igbvf_adapter *);
+void igbvf_check_options(struct igbvf_adapter *);
+void igbvf_set_ethtool_ops(struct net_device *);
+
+int igbvf_up(struct igbvf_adapter *);
+void igbvf_down(struct igbvf_adapter *);
+void igbvf_reinit_locked(struct igbvf_adapter *);
+int igbvf_setup_rx_resources(struct igbvf_adapter *, struct igbvf_ring *);
+int igbvf_setup_tx_resources(struct igbvf_adapter *, struct igbvf_ring *);
+void igbvf_free_rx_resources(struct igbvf_ring *);
+void igbvf_free_tx_resources(struct igbvf_ring *);
+void igbvf_update_stats(struct igbvf_adapter *);
 
 extern unsigned int copybreak;
 
diff --git a/drivers/net/ethernet/intel/igbvf/vf.c b/drivers/net/ethernet/intel/igbvf/vf.c
index eea0e10ce12f..955ad8c2c534 100644
--- a/drivers/net/ethernet/intel/igbvf/vf.c
+++ b/drivers/net/ethernet/intel/igbvf/vf.c
@@ -154,7 +154,7 @@ static s32 e1000_reset_hw_vf(struct e1000_hw *hw)
                 ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
                 if (!ret_val) {
                         if (msgbuf[0] == (E1000_VF_RESET | E1000_VT_MSGTYPE_ACK))
-                                memcpy(hw->mac.perm_addr, addr, 6);
+                                memcpy(hw->mac.perm_addr, addr, ETH_ALEN);
                         else
                                 ret_val = -E1000_ERR_MAC_INIT;
                 }
@@ -314,7 +314,7 @@ static void e1000_rar_set_vf(struct e1000_hw *hw, u8 * addr, u32 index)
 
         memset(msgbuf, 0, 12);
         msgbuf[0] = E1000_VF_SET_MAC_ADDR;
-        memcpy(msg_addr, addr, 6);
+        memcpy(msg_addr, addr, ETH_ALEN);
         ret_val = mbx->ops.write_posted(hw, msgbuf, 3);
 
         if (!ret_val)
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb.h b/drivers/net/ethernet/intel/ixgb/ixgb.h
index 4d2ae97ff1b3..2224cc2edf13 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb.h
@@ -187,21 +187,21 @@ enum ixgb_state_t {
 };
 
 /* Exported from other modules */
-extern void ixgb_check_options(struct ixgb_adapter *adapter);
-extern void ixgb_set_ethtool_ops(struct net_device *netdev);
+void ixgb_check_options(struct ixgb_adapter *adapter);
+void ixgb_set_ethtool_ops(struct net_device *netdev);
 extern char ixgb_driver_name[];
 extern const char ixgb_driver_version[];
 
-extern void ixgb_set_speed_duplex(struct net_device *netdev);
+void ixgb_set_speed_duplex(struct net_device *netdev);
 
-extern int ixgb_up(struct ixgb_adapter *adapter);
-extern void ixgb_down(struct ixgb_adapter *adapter, bool kill_watchdog);
-extern void ixgb_reset(struct ixgb_adapter *adapter);
-extern int ixgb_setup_rx_resources(struct ixgb_adapter *adapter);
-extern int ixgb_setup_tx_resources(struct ixgb_adapter *adapter);
-extern void ixgb_free_rx_resources(struct ixgb_adapter *adapter);
-extern void ixgb_free_tx_resources(struct ixgb_adapter *adapter);
-extern void ixgb_update_stats(struct ixgb_adapter *adapter);
+int ixgb_up(struct ixgb_adapter *adapter);
+void ixgb_down(struct ixgb_adapter *adapter, bool kill_watchdog);
+void ixgb_reset(struct ixgb_adapter *adapter);
+int ixgb_setup_rx_resources(struct ixgb_adapter *adapter);
+int ixgb_setup_tx_resources(struct ixgb_adapter *adapter);
+void ixgb_free_rx_resources(struct ixgb_adapter *adapter);
+void ixgb_free_tx_resources(struct ixgb_adapter *adapter);
+void ixgb_update_stats(struct ixgb_adapter *adapter);
 
 
 #endif /* _IXGB_H_ */
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_hw.h b/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
index 2a99a35c33aa..0bd5d72e1af5 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
@@ -759,27 +759,20 @@ struct ixgb_hw_stats {
 };
 
 /* Function Prototypes */
-extern bool ixgb_adapter_stop(struct ixgb_hw *hw);
-extern bool ixgb_init_hw(struct ixgb_hw *hw);
-extern bool ixgb_adapter_start(struct ixgb_hw *hw);
-extern void ixgb_check_for_link(struct ixgb_hw *hw);
-extern bool ixgb_check_for_bad_link(struct ixgb_hw *hw);
-
-extern void ixgb_rar_set(struct ixgb_hw *hw,
-                                u8 *addr,
-                                u32 index);
+bool ixgb_adapter_stop(struct ixgb_hw *hw);
+bool ixgb_init_hw(struct ixgb_hw *hw);
+bool ixgb_adapter_start(struct ixgb_hw *hw);
+void ixgb_check_for_link(struct ixgb_hw *hw);
+bool ixgb_check_for_bad_link(struct ixgb_hw *hw);
 
+void ixgb_rar_set(struct ixgb_hw *hw, u8 *addr, u32 index);
 
 /* Filters (multicast, vlan, receive) */
-extern void ixgb_mc_addr_list_update(struct ixgb_hw *hw,
-                                   u8 *mc_addr_list,
-                                   u32 mc_addr_count,
-                                   u32 pad);
+void ixgb_mc_addr_list_update(struct ixgb_hw *hw, u8 *mc_addr_list,
+                              u32 mc_addr_count, u32 pad);
 
 /* Vfta functions */
-extern void ixgb_write_vfta(struct ixgb_hw *hw,
-                                 u32 offset,
-                                 u32 value);
+void ixgb_write_vfta(struct ixgb_hw *hw, u32 offset, u32 value);
 
 /* Access functions to eeprom data */
 void ixgb_get_ee_mac_addr(struct ixgb_hw *hw, u8 *mac_addr);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 0ac6b11c6e4e..dc1588ee264a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -55,7 +55,7 @@
 #include <net/busy_poll.h>
 
 #ifdef CONFIG_NET_RX_BUSY_POLL
-#define LL_EXTENDED_STATS
+#define BP_EXTENDED_STATS
 #endif
 /* common prefix used by pr_<> macros */
 #undef pr_fmt
@@ -187,11 +187,11 @@ struct ixgbe_rx_buffer {
 struct ixgbe_queue_stats {
         u64 packets;
         u64 bytes;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
         u64 yields;
         u64 misses;
         u64 cleaned;
-#endif  /* LL_EXTENDED_STATS */
+#endif  /* BP_EXTENDED_STATS */
 };
 
 struct ixgbe_tx_queue_stats {
@@ -399,7 +399,7 @@ static inline bool ixgbe_qv_lock_napi(struct ixgbe_q_vector *q_vector)
                 WARN_ON(q_vector->state & IXGBE_QV_STATE_NAPI);
                 q_vector->state |= IXGBE_QV_STATE_NAPI_YIELD;
                 rc = false;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                 q_vector->tx.ring->stats.yields++;
 #endif
         } else
@@ -432,7 +432,7 @@ static inline bool ixgbe_qv_lock_poll(struct ixgbe_q_vector *q_vector)
         if ((q_vector->state & IXGBE_QV_LOCKED)) {
                 q_vector->state |= IXGBE_QV_STATE_POLL_YIELD;
                 rc = false;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                 q_vector->rx.ring->stats.yields++;
 #endif
         } else
@@ -457,7 +457,7 @@ static inline bool ixgbe_qv_unlock_poll(struct ixgbe_q_vector *q_vector)
 }
 
 /* true if a socket is polling, even if it did not get the lock */
-static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
+static inline bool ixgbe_qv_busy_polling(struct ixgbe_q_vector *q_vector)
 {
         WARN_ON(!(q_vector->state & IXGBE_QV_LOCKED));
         return q_vector->state & IXGBE_QV_USER_PEND;
@@ -487,7 +487,7 @@ static inline bool ixgbe_qv_unlock_poll(struct ixgbe_q_vector *q_vector)
         return false;
 }
 
-static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
+static inline bool ixgbe_qv_busy_polling(struct ixgbe_q_vector *q_vector)
 {
         return false;
 }
@@ -786,93 +786,89 @@ extern const char ixgbe_driver_version[];
 extern char ixgbe_default_device_descr[];
 #endif /* IXGBE_FCOE */
 
-extern void ixgbe_up(struct ixgbe_adapter *adapter);
-extern void ixgbe_down(struct ixgbe_adapter *adapter);
-extern void ixgbe_reinit_locked(struct ixgbe_adapter *adapter);
-extern void ixgbe_reset(struct ixgbe_adapter *adapter);
-extern void ixgbe_set_ethtool_ops(struct net_device *netdev);
-extern int ixgbe_setup_rx_resources(struct ixgbe_ring *);
-extern int ixgbe_setup_tx_resources(struct ixgbe_ring *);
-extern void ixgbe_free_rx_resources(struct ixgbe_ring *);
-extern void ixgbe_free_tx_resources(struct ixgbe_ring *);
-extern void ixgbe_configure_rx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
-extern void ixgbe_configure_tx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
-extern void ixgbe_disable_rx_queue(struct ixgbe_adapter *adapter,
-                                   struct ixgbe_ring *);
-extern void ixgbe_update_stats(struct ixgbe_adapter *adapter);
-extern int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter);
-extern int ixgbe_wol_supported(struct ixgbe_adapter *adapter, u16 device_id,
+void ixgbe_up(struct ixgbe_adapter *adapter);
+void ixgbe_down(struct ixgbe_adapter *adapter);
+void ixgbe_reinit_locked(struct ixgbe_adapter *adapter);
+void ixgbe_reset(struct ixgbe_adapter *adapter);
+void ixgbe_set_ethtool_ops(struct net_device *netdev);
+int ixgbe_setup_rx_resources(struct ixgbe_ring *);
+int ixgbe_setup_tx_resources(struct ixgbe_ring *);
+void ixgbe_free_rx_resources(struct ixgbe_ring *);
+void ixgbe_free_tx_resources(struct ixgbe_ring *);
+void ixgbe_configure_rx_ring(struct ixgbe_adapter *, struct ixgbe_ring *);
+void ixgbe_configure_tx_ring(struct ixgbe_adapter *, struct ixgbe_ring *);
+void ixgbe_disable_rx_queue(struct ixgbe_adapter *adapter, struct ixgbe_ring *);
+void ixgbe_update_stats(struct ixgbe_adapter *adapter);
+int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter);
+int ixgbe_wol_supported(struct ixgbe_adapter *adapter, u16 device_id,
                                u16 subdevice_id);
-extern void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter);
-extern netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *,
-                                         struct ixgbe_adapter *,
-                                         struct ixgbe_ring *);
-extern void ixgbe_unmap_and_free_tx_resource(struct ixgbe_ring *,
-                                             struct ixgbe_tx_buffer *);
-extern void ixgbe_alloc_rx_buffers(struct ixgbe_ring *, u16);
-extern void ixgbe_write_eitr(struct ixgbe_q_vector *);
-extern int ixgbe_poll(struct napi_struct *napi, int budget);
-extern int ethtool_ioctl(struct ifreq *ifr);
-extern s32 ixgbe_reinit_fdir_tables_82599(struct ixgbe_hw *hw);
-extern s32 ixgbe_init_fdir_signature_82599(struct ixgbe_hw *hw, u32 fdirctrl);
-extern s32 ixgbe_init_fdir_perfect_82599(struct ixgbe_hw *hw, u32 fdirctrl);
-extern s32 ixgbe_fdir_add_signature_filter_82599(struct ixgbe_hw *hw,
-                                                 union ixgbe_atr_hash_dword input,
-                                                 union ixgbe_atr_hash_dword common,
-                                                 u8 queue);
-extern s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw,
-                                           union ixgbe_atr_input *input_mask);
-extern s32 ixgbe_fdir_write_perfect_filter_82599(struct ixgbe_hw *hw,
-                                                 union ixgbe_atr_input *input,
-                                                 u16 soft_id, u8 queue);
-extern s32 ixgbe_fdir_erase_perfect_filter_82599(struct ixgbe_hw *hw,
-                                                 union ixgbe_atr_input *input,
-                                                 u16 soft_id);
-extern void ixgbe_atr_compute_perfect_hash_82599(union ixgbe_atr_input *input,
-                                                 union ixgbe_atr_input *mask);
-extern bool ixgbe_verify_lesm_fw_enabled_82599(struct ixgbe_hw *hw);
-extern void ixgbe_set_rx_mode(struct net_device *netdev);
+void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter);
+netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *, struct ixgbe_adapter *,
+                                  struct ixgbe_ring *);
+void ixgbe_unmap_and_free_tx_resource(struct ixgbe_ring *,
+                                      struct ixgbe_tx_buffer *);
+void ixgbe_alloc_rx_buffers(struct ixgbe_ring *, u16);
+void ixgbe_write_eitr(struct ixgbe_q_vector *);
+int ixgbe_poll(struct napi_struct *napi, int budget);
+int ethtool_ioctl(struct ifreq *ifr);
+s32 ixgbe_reinit_fdir_tables_82599(struct ixgbe_hw *hw);
+s32 ixgbe_init_fdir_signature_82599(struct ixgbe_hw *hw, u32 fdirctrl);
+s32 ixgbe_init_fdir_perfect_82599(struct ixgbe_hw *hw, u32 fdirctrl);
+s32 ixgbe_fdir_add_signature_filter_82599(struct ixgbe_hw *hw,
+                                          union ixgbe_atr_hash_dword input,
+                                          union ixgbe_atr_hash_dword common,
+                                          u8 queue);
+s32 ixgbe_fdir_set_input_mask_82599(struct ixgbe_hw *hw,
+                                    union ixgbe_atr_input *input_mask);
+s32 ixgbe_fdir_write_perfect_filter_82599(struct ixgbe_hw *hw,
+                                          union ixgbe_atr_input *input,
+                                          u16 soft_id, u8 queue);
+s32 ixgbe_fdir_erase_perfect_filter_82599(struct ixgbe_hw *hw,
+                                          union ixgbe_atr_input *input,
+                                          u16 soft_id);
+void ixgbe_atr_compute_perfect_hash_82599(union ixgbe_atr_input *input,
+                                          union ixgbe_atr_input *mask);
+bool ixgbe_verify_lesm_fw_enabled_82599(struct ixgbe_hw *hw);
+void ixgbe_set_rx_mode(struct net_device *netdev);
 #ifdef CONFIG_IXGBE_DCB
-extern void ixgbe_set_rx_drop_en(struct ixgbe_adapter *adapter);
+void ixgbe_set_rx_drop_en(struct ixgbe_adapter *adapter);
 #endif
-extern int ixgbe_setup_tc(struct net_device *dev, u8 tc);
-extern void ixgbe_tx_ctxtdesc(struct ixgbe_ring *, u32, u32, u32, u32);
-extern void ixgbe_do_reset(struct net_device *netdev);
+int ixgbe_setup_tc(struct net_device *dev, u8 tc);
+void ixgbe_tx_ctxtdesc(struct ixgbe_ring *, u32, u32, u32, u32);
+void ixgbe_do_reset(struct net_device *netdev);
 #ifdef CONFIG_IXGBE_HWMON
-extern void ixgbe_sysfs_exit(struct ixgbe_adapter *adapter);
-extern int ixgbe_sysfs_init(struct ixgbe_adapter *adapter);
+void ixgbe_sysfs_exit(struct ixgbe_adapter *adapter);
+int ixgbe_sysfs_init(struct ixgbe_adapter *adapter);
 #endif /* CONFIG_IXGBE_HWMON */
 #ifdef IXGBE_FCOE
-extern void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter);
-extern int ixgbe_fso(struct ixgbe_ring *tx_ring,
-                     struct ixgbe_tx_buffer *first,
-                     u8 *hdr_len);
-extern int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
-                          union ixgbe_adv_rx_desc *rx_desc,
-                          struct sk_buff *skb);
-extern int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
-                              struct scatterlist *sgl, unsigned int sgc);
-extern int ixgbe_fcoe_ddp_target(struct net_device *netdev, u16 xid,
-                                 struct scatterlist *sgl, unsigned int sgc);
-extern int ixgbe_fcoe_ddp_put(struct net_device *netdev, u16 xid);
-extern int ixgbe_setup_fcoe_ddp_resources(struct ixgbe_adapter *adapter);
-extern void ixgbe_free_fcoe_ddp_resources(struct ixgbe_adapter *adapter);
-extern int ixgbe_fcoe_enable(struct net_device *netdev);
-extern int ixgbe_fcoe_disable(struct net_device *netdev);
+void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter);
+int ixgbe_fso(struct ixgbe_ring *tx_ring, struct ixgbe_tx_buffer *first,
+              u8 *hdr_len);
+int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
+                   union ixgbe_adv_rx_desc *rx_desc, struct sk_buff *skb);
+int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
+                       struct scatterlist *sgl, unsigned int sgc);
+int ixgbe_fcoe_ddp_target(struct net_device *netdev, u16 xid,
+                          struct scatterlist *sgl, unsigned int sgc);
+int ixgbe_fcoe_ddp_put(struct net_device *netdev, u16 xid);
+int ixgbe_setup_fcoe_ddp_resources(struct ixgbe_adapter *adapter);
+void ixgbe_free_fcoe_ddp_resources(struct ixgbe_adapter *adapter);
+int ixgbe_fcoe_enable(struct net_device *netdev);
+int ixgbe_fcoe_disable(struct net_device *netdev);
 #ifdef CONFIG_IXGBE_DCB
-extern u8 ixgbe_fcoe_getapp(struct ixgbe_adapter *adapter);
-extern u8 ixgbe_fcoe_setapp(struct ixgbe_adapter *adapter, u8 up);
+u8 ixgbe_fcoe_getapp(struct ixgbe_adapter *adapter);
+u8 ixgbe_fcoe_setapp(struct ixgbe_adapter *adapter, u8 up);
 #endif /* CONFIG_IXGBE_DCB */
-extern int ixgbe_fcoe_get_wwn(struct net_device *netdev, u64 *wwn, int type);
-extern int ixgbe_fcoe_get_hbainfo(struct net_device *netdev,
-                                  struct netdev_fcoe_hbainfo *info);
-extern u8 ixgbe_fcoe_get_tc(struct ixgbe_adapter *adapter);
+int ixgbe_fcoe_get_wwn(struct net_device *netdev, u64 *wwn, int type);
+int ixgbe_fcoe_get_hbainfo(struct net_device *netdev,
+                           struct netdev_fcoe_hbainfo *info);
+u8 ixgbe_fcoe_get_tc(struct ixgbe_adapter *adapter);
 #endif /* IXGBE_FCOE */
 #ifdef CONFIG_DEBUG_FS
-extern void ixgbe_dbg_adapter_init(struct ixgbe_adapter *adapter);
-extern void ixgbe_dbg_adapter_exit(struct ixgbe_adapter *adapter);
-extern void ixgbe_dbg_init(void);
-extern void ixgbe_dbg_exit(void);
+void ixgbe_dbg_adapter_init(struct ixgbe_adapter *adapter);
+void ixgbe_dbg_adapter_exit(struct ixgbe_adapter *adapter);
+void ixgbe_dbg_init(void);
+void ixgbe_dbg_exit(void);
 #else
 static inline void ixgbe_dbg_adapter_init(struct ixgbe_adapter *adapter) {}
 static inline void ixgbe_dbg_adapter_exit(struct ixgbe_adapter *adapter) {}
@@ -884,12 +880,12 @@ static inline struct netdev_queue *txring_txq(const struct ixgbe_ring *ring)
         return netdev_get_tx_queue(ring->netdev, ring->queue_index);
 }
 
-extern void ixgbe_ptp_init(struct ixgbe_adapter *adapter);
-extern void ixgbe_ptp_stop(struct ixgbe_adapter *adapter);
-extern void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter);
-extern void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter);
-extern void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
-                                    struct sk_buff *skb);
+void ixgbe_ptp_init(struct ixgbe_adapter *adapter);
+void ixgbe_ptp_stop(struct ixgbe_adapter *adapter);
+void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter);
+void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter);
+void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
+                             struct sk_buff *skb);
 static inline void ixgbe_ptp_rx_hwtstamp(struct ixgbe_ring *rx_ring,
                                          union ixgbe_adv_rx_desc *rx_desc,
                                          struct sk_buff *skb)
@@ -906,11 +902,11 @@ static inline void ixgbe_ptp_rx_hwtstamp(struct ixgbe_ring *rx_ring,
         rx_ring->last_rx_timestamp = jiffies;
 }
 
-extern int ixgbe_ptp_hwtstamp_ioctl(struct ixgbe_adapter *adapter,
-                                    struct ifreq *ifr, int cmd);
-extern void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter);
-extern void ixgbe_ptp_reset(struct ixgbe_adapter *adapter);
-extern void ixgbe_ptp_check_pps_event(struct ixgbe_adapter *adapter, u32 eicr);
+int ixgbe_ptp_hwtstamp_ioctl(struct ixgbe_adapter *adapter, struct ifreq *ifr,
+                             int cmd);
+void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter);
+void ixgbe_ptp_reset(struct ixgbe_adapter *adapter);
+void ixgbe_ptp_check_pps_event(struct ixgbe_adapter *adapter, u32 eicr);
 #ifdef CONFIG_PCI_IOV
 void ixgbe_sriov_reinit(struct ixgbe_adapter *adapter);
 #endif
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index e8649abf97c0..90aac31b3551 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -442,7 +442,7 @@ static void ixgbe_set_msglevel(struct net_device *netdev, u32 data)
 
 static int ixgbe_get_regs_len(struct net_device *netdev)
 {
-#define IXGBE_REGS_LEN  1129
+#define IXGBE_REGS_LEN  1139
         return IXGBE_REGS_LEN * sizeof(u32);
 }
 
@@ -602,22 +602,53 @@ static void ixgbe_get_regs(struct net_device *netdev,
         regs_buff[828] = IXGBE_READ_REG(hw, IXGBE_FHFT(0));
 
         /* DCB */
-        regs_buff[829] = IXGBE_READ_REG(hw, IXGBE_RMCS);
-        regs_buff[830] = IXGBE_READ_REG(hw, IXGBE_DPMCS);
-        regs_buff[831] = IXGBE_READ_REG(hw, IXGBE_PDPMCS);
-        regs_buff[832] = IXGBE_READ_REG(hw, IXGBE_RUPPBMR);
-        for (i = 0; i < 8; i++)
-                regs_buff[833 + i] = IXGBE_READ_REG(hw, IXGBE_RT2CR(i));
-        for (i = 0; i < 8; i++)
-                regs_buff[841 + i] = IXGBE_READ_REG(hw, IXGBE_RT2SR(i));
-        for (i = 0; i < 8; i++)
-                regs_buff[849 + i] = IXGBE_READ_REG(hw, IXGBE_TDTQ2TCCR(i));
-        for (i = 0; i < 8; i++)
-                regs_buff[857 + i] = IXGBE_READ_REG(hw, IXGBE_TDTQ2TCSR(i));
+        regs_buff[829] = IXGBE_READ_REG(hw, IXGBE_RMCS);   /* same as FCCFG  */
+        regs_buff[831] = IXGBE_READ_REG(hw, IXGBE_PDPMCS); /* same as RTTPCS */
+
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
+                regs_buff[830] = IXGBE_READ_REG(hw, IXGBE_DPMCS);
+                regs_buff[832] = IXGBE_READ_REG(hw, IXGBE_RUPPBMR);
+                for (i = 0; i < 8; i++)
+                        regs_buff[833 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RT2CR(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[841 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RT2SR(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[849 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_TDTQ2TCCR(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[857 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_TDTQ2TCSR(i));
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                regs_buff[830] = IXGBE_READ_REG(hw, IXGBE_RTTDCS);
+                regs_buff[832] = IXGBE_READ_REG(hw, IXGBE_RTRPCS);
+                for (i = 0; i < 8; i++)
+                        regs_buff[833 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RTRPT4C(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[841 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RTRPT4S(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[849 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RTTDT2C(i));
+                for (i = 0; i < 8; i++)
+                        regs_buff[857 + i] =
+                                IXGBE_READ_REG(hw, IXGBE_RTTDT2S(i));
+                break;
+        default:
+                break;
+        }
+
         for (i = 0; i < 8; i++)
-                regs_buff[865 + i] = IXGBE_READ_REG(hw, IXGBE_TDPT2TCCR(i));
+                regs_buff[865 + i] =
+                IXGBE_READ_REG(hw, IXGBE_TDPT2TCCR(i)); /* same as RTTPT2C */
         for (i = 0; i < 8; i++)
-                regs_buff[873 + i] = IXGBE_READ_REG(hw, IXGBE_TDPT2TCSR(i));
+                regs_buff[873 + i] =
+                IXGBE_READ_REG(hw, IXGBE_TDPT2TCSR(i)); /* same as RTTPT2S */
 
         /* Statistics */
         regs_buff[881] = IXGBE_GET_STAT(adapter, crcerrs);
@@ -757,6 +788,20 @@ static void ixgbe_get_regs(struct net_device *netdev,
 
         /* 82599 X540 specific registers  */
         regs_buff[1128] = IXGBE_READ_REG(hw, IXGBE_MFLCN);
+
+        /* 82599 X540 specific DCB registers  */
+        regs_buff[1129] = IXGBE_READ_REG(hw, IXGBE_RTRUP2TC);
+        regs_buff[1130] = IXGBE_READ_REG(hw, IXGBE_RTTUP2TC);
+        for (i = 0; i < 4; i++)
+                regs_buff[1131 + i] = IXGBE_READ_REG(hw, IXGBE_TXLLQ(i));
+        regs_buff[1135] = IXGBE_READ_REG(hw, IXGBE_RTTBCNRM);
+                                        /* same as RTTQCNRM */
+        regs_buff[1136] = IXGBE_READ_REG(hw, IXGBE_RTTBCNRD);
+                                        /* same as RTTQCNRR */
+
+        /* X540 specific DCB registers  */
+        regs_buff[1137] = IXGBE_READ_REG(hw, IXGBE_RTTQCNCR);
+        regs_buff[1138] = IXGBE_READ_REG(hw, IXGBE_RTTQCNTG);
 }
 
 static int ixgbe_get_eeprom_len(struct net_device *netdev)
@@ -1072,7 +1117,7 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                         data[i] = 0;
                         data[i+1] = 0;
                         i += 2;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                         data[i] = 0;
                         data[i+1] = 0;
                         data[i+2] = 0;
@@ -1087,7 +1132,7 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                         data[i+1] = ring->stats.bytes;
                 } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
                 i += 2;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                 data[i] = ring->stats.yields;
                 data[i+1] = ring->stats.misses;
                 data[i+2] = ring->stats.cleaned;
@@ -1100,7 +1145,7 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                         data[i] = 0;
                         data[i+1] = 0;
                         i += 2;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                         data[i] = 0;
                         data[i+1] = 0;
                         data[i+2] = 0;
@@ -1115,7 +1160,7 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
                         data[i+1] = ring->stats.bytes;
                 } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
                 i += 2;
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                 data[i] = ring->stats.yields;
                 data[i+1] = ring->stats.misses;
                 data[i+2] = ring->stats.cleaned;
@@ -1157,28 +1202,28 @@ static void ixgbe_get_strings(struct net_device *netdev, u32 stringset,
                         p += ETH_GSTRING_LEN;
                         sprintf(p, "tx_queue_%u_bytes", i);
                         p += ETH_GSTRING_LEN;
-#ifdef LL_EXTENDED_STATS
-                        sprintf(p, "tx_queue_%u_ll_napi_yield", i);
+#ifdef BP_EXTENDED_STATS
+                        sprintf(p, "tx_queue_%u_bp_napi_yield", i);
                         p += ETH_GSTRING_LEN;
-                        sprintf(p, "tx_queue_%u_ll_misses", i);
+                        sprintf(p, "tx_queue_%u_bp_misses", i);
                         p += ETH_GSTRING_LEN;
-                        sprintf(p, "tx_queue_%u_ll_cleaned", i);
+                        sprintf(p, "tx_queue_%u_bp_cleaned", i);
                         p += ETH_GSTRING_LEN;
-#endif /* LL_EXTENDED_STATS */
+#endif /* BP_EXTENDED_STATS */
                 }
                 for (i = 0; i < IXGBE_NUM_RX_QUEUES; i++) {
                         sprintf(p, "rx_queue_%u_packets", i);
                         p += ETH_GSTRING_LEN;
                         sprintf(p, "rx_queue_%u_bytes", i);
                         p += ETH_GSTRING_LEN;
-#ifdef LL_EXTENDED_STATS
-                        sprintf(p, "rx_queue_%u_ll_poll_yield", i);
+#ifdef BP_EXTENDED_STATS
+                        sprintf(p, "rx_queue_%u_bp_poll_yield", i);
                         p += ETH_GSTRING_LEN;
-                        sprintf(p, "rx_queue_%u_ll_misses", i);
+                        sprintf(p, "rx_queue_%u_bp_misses", i);
                         p += ETH_GSTRING_LEN;
-                        sprintf(p, "rx_queue_%u_ll_cleaned", i);
+                        sprintf(p, "rx_queue_%u_bp_cleaned", i);
                         p += ETH_GSTRING_LEN;
-#endif /* LL_EXTENDED_STATS */
+#endif /* BP_EXTENDED_STATS */
                 }
                 for (i = 0; i < IXGBE_MAX_PACKET_BUFFERS; i++) {
                         sprintf(p, "tx_pb_%u_pxon", i);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0ade0cd5ef53..43b777aad288 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1585,7 +1585,7 @@ static void ixgbe_rx_skb(struct ixgbe_q_vector *q_vector,
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
 
-        if (ixgbe_qv_ll_polling(q_vector))
+        if (ixgbe_qv_busy_polling(q_vector))
                 netif_receive_skb(skb);
         else if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL))
                 napi_gro_receive(&q_vector->napi, skb);
@@ -2097,7 +2097,7 @@ static int ixgbe_low_latency_recv(struct napi_struct *napi)
 
         ixgbe_for_each_ring(ring, q_vector->rx) {
                 found = ixgbe_clean_rx_irq(q_vector, ring, 4);
-#ifdef LL_EXTENDED_STATS
+#ifdef BP_EXTENDED_STATS
                 if (found)
                         ring->stats.cleaned += found;
                 else
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index 24af12e3719e..aae900a256da 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -57,28 +57,28 @@
 #define IXGBE_SFF_QSFP_DEVICE_TECH      0x93
 
 /* Bitmasks */
-#define IXGBE_SFF_DA_PASSIVE_CABLE           0x4
-#define IXGBE_SFF_DA_ACTIVE_CABLE            0x8
-#define IXGBE_SFF_DA_SPEC_ACTIVE_LIMITING    0x4
-#define IXGBE_SFF_1GBASESX_CAPABLE           0x1
-#define IXGBE_SFF_1GBASELX_CAPABLE           0x2
-#define IXGBE_SFF_1GBASET_CAPABLE            0x8
-#define IXGBE_SFF_10GBASESR_CAPABLE          0x10
-#define IXGBE_SFF_10GBASELR_CAPABLE          0x20
-#define IXGBE_SFF_SOFT_RS_SELECT_MASK   0x8
-#define IXGBE_SFF_SOFT_RS_SELECT_10G    0x8
-#define IXGBE_SFF_SOFT_RS_SELECT_1G     0x0
-#define IXGBE_SFF_ADDRESSING_MODE            0x4
-#define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE       0x1
-#define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE      0x8
+#define IXGBE_SFF_DA_PASSIVE_CABLE              0x4
+#define IXGBE_SFF_DA_ACTIVE_CABLE               0x8
+#define IXGBE_SFF_DA_SPEC_ACTIVE_LIMITING       0x4
+#define IXGBE_SFF_1GBASESX_CAPABLE              0x1
+#define IXGBE_SFF_1GBASELX_CAPABLE              0x2
+#define IXGBE_SFF_1GBASET_CAPABLE               0x8
+#define IXGBE_SFF_10GBASESR_CAPABLE             0x10
+#define IXGBE_SFF_10GBASELR_CAPABLE             0x20
+#define IXGBE_SFF_SOFT_RS_SELECT_MASK           0x8
+#define IXGBE_SFF_SOFT_RS_SELECT_10G            0x8
+#define IXGBE_SFF_SOFT_RS_SELECT_1G             0x0
+#define IXGBE_SFF_ADDRESSING_MODE               0x4
+#define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE          0x1
+#define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE         0x8
 #define IXGBE_SFF_QSFP_CONNECTOR_NOT_SEPARABLE  0x23
 #define IXGBE_SFF_QSFP_TRANSMITER_850NM_VCSEL   0x0
-#define IXGBE_I2C_EEPROM_READ_MASK           0x100
-#define IXGBE_I2C_EEPROM_STATUS_MASK         0x3
-#define IXGBE_I2C_EEPROM_STATUS_NO_OPERATION 0x0
-#define IXGBE_I2C_EEPROM_STATUS_PASS         0x1
-#define IXGBE_I2C_EEPROM_STATUS_FAIL         0x2
-#define IXGBE_I2C_EEPROM_STATUS_IN_PROGRESS  0x3
+#define IXGBE_I2C_EEPROM_READ_MASK              0x100
+#define IXGBE_I2C_EEPROM_STATUS_MASK            0x3
+#define IXGBE_I2C_EEPROM_STATUS_NO_OPERATION    0x0
+#define IXGBE_I2C_EEPROM_STATUS_PASS            0x1
+#define IXGBE_I2C_EEPROM_STATUS_FAIL            0x2
+#define IXGBE_I2C_EEPROM_STATUS_IN_PROGRESS     0x3
 
 /* Flow control defines */
 #define IXGBE_TAF_SYM_PAUSE                  0x400
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 276d7b135332..1fe7cb0142e1 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -558,7 +558,7 @@ static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
         struct ixgbe_hw *hw = &adapter->hw;
         int rar_entry = hw->mac.num_rar_entries - (vf + 1);
 
-        memcpy(adapter->vfinfo[vf].vf_mac_addresses, mac_addr, 6);
+        memcpy(adapter->vfinfo[vf].vf_mac_addresses, mac_addr, ETH_ALEN);
         hw->mac.ops.set_rar(hw, rar_entry, mac_addr, vf, IXGBE_RAH_AV);
 
         return 0;
@@ -621,16 +621,13 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
 
 int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask)
 {
-        unsigned char vf_mac_addr[6];
         struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         unsigned int vfn = (event_mask & 0x3f);
 
         bool enable = ((event_mask & 0x10000000U) != 0);
 
-        if (enable) {
-                eth_zero_addr(vf_mac_addr);
-                memcpy(adapter->vfinfo[vfn].vf_mac_addresses, vf_mac_addr, 6);
-        }
+        if (enable)
+                eth_zero_addr(adapter->vfinfo[vfn].vf_mac_addresses);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 10775cb9b6d8..7c19e969576f 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -561,6 +561,10 @@ struct ixgbe_thermal_sensor_data {
 #define IXGBE_RTTDQSEL    0x04904
 #define IXGBE_RTTDT1C     0x04908
 #define IXGBE_RTTDT1S     0x0490C
+#define IXGBE_RTTQCNCR    0x08B00
+#define IXGBE_RTTQCNTG    0x04A90
+#define IXGBE_RTTBCNRD    0x0498C
+#define IXGBE_RTTQCNRR    0x0498C
 #define IXGBE_RTTDTECC    0x04990
 #define IXGBE_RTTDTECC_NO_BCN   0x00000100
 #define IXGBE_RTTBCNRC    0x04984
@@ -570,6 +574,7 @@ struct ixgbe_thermal_sensor_data {
 #define IXGBE_RTTBCNRC_RF_INT_MASK      \
         (IXGBE_RTTBCNRC_RF_DEC_MASK << IXGBE_RTTBCNRC_RF_INT_SHIFT)
 #define IXGBE_RTTBCNRM    0x04980
+#define IXGBE_RTTQCNRM    0x04980
 
 /* FCoE DMA Context Registers */
 #define IXGBE_FCPTRL    0x02410 /* FC User Desc. PTR Low */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
index 389324f5929a..24b80a6cfca4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
@@ -32,12 +32,12 @@
 #include "ixgbe.h"
 #include "ixgbe_phy.h"
 
-#define IXGBE_X540_MAX_TX_QUEUES 128
-#define IXGBE_X540_MAX_RX_QUEUES 128
-#define IXGBE_X540_RAR_ENTRIES   128
-#define IXGBE_X540_MC_TBL_SIZE   128
-#define IXGBE_X540_VFT_TBL_SIZE  128
-#define IXGBE_X540_RX_PB_SIZE    384
+#define IXGBE_X540_MAX_TX_QUEUES        128
+#define IXGBE_X540_MAX_RX_QUEUES        128
+#define IXGBE_X540_RAR_ENTRIES          128
+#define IXGBE_X540_MC_TBL_SIZE          128
+#define IXGBE_X540_VFT_TBL_SIZE         128
+#define IXGBE_X540_RX_PB_SIZE           384
 
 static s32 ixgbe_update_flash_X540(struct ixgbe_hw *hw);
 static s32 ixgbe_poll_flash_update_done_X540(struct ixgbe_hw *hw);
diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index c9d0c12d6f04..84329b0d567a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -140,58 +140,10 @@ static void ixgbevf_set_msglevel(struct net_device *netdev, u32 data)
 
 #define IXGBE_GET_STAT(_A_, _R_) (_A_->stats._R_)
 
-static char *ixgbevf_reg_names[] = {
-        "IXGBE_VFCTRL",
-        "IXGBE_VFSTATUS",
-        "IXGBE_VFLINKS",
-        "IXGBE_VFRXMEMWRAP",
-        "IXGBE_VFFRTIMER",
-        "IXGBE_VTEICR",
-        "IXGBE_VTEICS",
-        "IXGBE_VTEIMS",
-        "IXGBE_VTEIMC",
-        "IXGBE_VTEIAC",
-        "IXGBE_VTEIAM",
-        "IXGBE_VTEITR",
-        "IXGBE_VTIVAR",
-        "IXGBE_VTIVAR_MISC",
-        "IXGBE_VFRDBAL0",
-        "IXGBE_VFRDBAL1",
-        "IXGBE_VFRDBAH0",
-        "IXGBE_VFRDBAH1",
-        "IXGBE_VFRDLEN0",
-        "IXGBE_VFRDLEN1",
-        "IXGBE_VFRDH0",
-        "IXGBE_VFRDH1",
-        "IXGBE_VFRDT0",
-        "IXGBE_VFRDT1",
-        "IXGBE_VFRXDCTL0",
-        "IXGBE_VFRXDCTL1",
-        "IXGBE_VFSRRCTL0",
-        "IXGBE_VFSRRCTL1",
-        "IXGBE_VFPSRTYPE",
-        "IXGBE_VFTDBAL0",
-        "IXGBE_VFTDBAL1",
-        "IXGBE_VFTDBAH0",
-        "IXGBE_VFTDBAH1",
-        "IXGBE_VFTDLEN0",
-        "IXGBE_VFTDLEN1",
-        "IXGBE_VFTDH0",
-        "IXGBE_VFTDH1",
-        "IXGBE_VFTDT0",
-        "IXGBE_VFTDT1",
-        "IXGBE_VFTXDCTL0",
-        "IXGBE_VFTXDCTL1",
-        "IXGBE_VFTDWBAL0",
-        "IXGBE_VFTDWBAL1",
-        "IXGBE_VFTDWBAH0",
-        "IXGBE_VFTDWBAH1"
-};
-
-
 static int ixgbevf_get_regs_len(struct net_device *netdev)
 {
-        return (ARRAY_SIZE(ixgbevf_reg_names)) * sizeof(u32);
+#define IXGBE_REGS_LEN 45
+        return IXGBE_REGS_LEN * sizeof(u32);
 }
 
 static void ixgbevf_get_regs(struct net_device *netdev,
@@ -264,9 +216,6 @@ static void ixgbevf_get_regs(struct net_device *netdev,
                 regs_buff[41 + i] = IXGBE_READ_REG(hw, IXGBE_VFTDWBAL(i));
         for (i = 0; i < 2; i++)
                 regs_buff[43 + i] = IXGBE_READ_REG(hw, IXGBE_VFTDWBAH(i));
-
-        for (i = 0; i < ARRAY_SIZE(ixgbevf_reg_names); i++)
-                hw_dbg(hw, "%s\t%8.8x\n", ixgbevf_reg_names[i], regs_buff[i]);
 }
 
 static void ixgbevf_get_drvinfo(struct net_device *netdev,
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
index fff0d9867529..64a2b912e73c 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
@@ -281,27 +281,23 @@ extern const struct ixgbe_mbx_operations ixgbevf_mbx_ops;
 extern const char ixgbevf_driver_name[];
 extern const char ixgbevf_driver_version[];
 
-extern void ixgbevf_up(struct ixgbevf_adapter *adapter);
-extern void ixgbevf_down(struct ixgbevf_adapter *adapter);
-extern void ixgbevf_reinit_locked(struct ixgbevf_adapter *adapter);
-extern void ixgbevf_reset(struct ixgbevf_adapter *adapter);
-extern void ixgbevf_set_ethtool_ops(struct net_device *netdev);
-extern int ixgbevf_setup_rx_resources(struct ixgbevf_adapter *,
-                                      struct ixgbevf_ring *);
-extern int ixgbevf_setup_tx_resources(struct ixgbevf_adapter *,
-                                      struct ixgbevf_ring *);
-extern void ixgbevf_free_rx_resources(struct ixgbevf_adapter *,
-                                      struct ixgbevf_ring *);
-extern void ixgbevf_free_tx_resources(struct ixgbevf_adapter *,
-                                      struct ixgbevf_ring *);
-extern void ixgbevf_update_stats(struct ixgbevf_adapter *adapter);
-extern int ethtool_ioctl(struct ifreq *ifr);
-
-extern void ixgbe_napi_add_all(struct ixgbevf_adapter *adapter);
-extern void ixgbe_napi_del_all(struct ixgbevf_adapter *adapter);
+void ixgbevf_up(struct ixgbevf_adapter *adapter);
+void ixgbevf_down(struct ixgbevf_adapter *adapter);
+void ixgbevf_reinit_locked(struct ixgbevf_adapter *adapter);
+void ixgbevf_reset(struct ixgbevf_adapter *adapter);
+void ixgbevf_set_ethtool_ops(struct net_device *netdev);
+int ixgbevf_setup_rx_resources(struct ixgbevf_adapter *, struct ixgbevf_ring *);
+int ixgbevf_setup_tx_resources(struct ixgbevf_adapter *, struct ixgbevf_ring *);
+void ixgbevf_free_rx_resources(struct ixgbevf_adapter *, struct ixgbevf_ring *);
+void ixgbevf_free_tx_resources(struct ixgbevf_adapter *, struct ixgbevf_ring *);
+void ixgbevf_update_stats(struct ixgbevf_adapter *adapter);
+int ethtool_ioctl(struct ifreq *ifr);
+
+void ixgbe_napi_add_all(struct ixgbevf_adapter *adapter);
+void ixgbe_napi_del_all(struct ixgbevf_adapter *adapter);
 
 #ifdef DEBUG
-extern char *ixgbevf_get_hw_dev_name(struct ixgbe_hw *hw);
+char *ixgbevf_get_hw_dev_name(struct ixgbe_hw *hw);
 #define hw_dbg(hw, format, arg...) \
         printk(KERN_DEBUG "%s: " format, ixgbevf_get_hw_dev_name(hw), ##arg)
 #else
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 59a62bbfb371..ce27d62f9c8e 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -756,37 +756,12 @@ static void ixgbevf_set_itr(struct ixgbevf_q_vector *q_vector)
 static irqreturn_t ixgbevf_msix_other(int irq, void *data)
 {
         struct ixgbevf_adapter *adapter = data;
-        struct pci_dev *pdev = adapter->pdev;
         struct ixgbe_hw *hw = &adapter->hw;
-        u32 msg;
-        bool got_ack = false;
 
         hw->mac.get_link_status = 1;
-        if (!hw->mbx.ops.check_for_ack(hw))
-                got_ack = true;
-
-        if (!hw->mbx.ops.check_for_msg(hw)) {
-                hw->mbx.ops.read(hw, &msg, 1);
-
-                if ((msg & IXGBE_MBVFICR_VFREQ_MASK) == IXGBE_PF_CONTROL_MSG) {
-                        mod_timer(&adapter->watchdog_timer,
-                                  round_jiffies(jiffies + 1));
-                        adapter->link_up = false;
-                }
 
-                if (msg & IXGBE_VT_MSGTYPE_NACK)
-                        dev_info(&pdev->dev,
-                                 "Last Request of type %2.2x to PF Nacked\n",
-                                 msg & 0xFF);
-                hw->mbx.v2p_mailbox |= IXGBE_VFMAILBOX_PFSTS;
-        }
-
-        /* checking for the ack clears the PFACK bit.  Place
-         * it back in the v2p_mailbox cache so that anyone
-         * polling for an ack will not miss it
-         */
-        if (got_ack)
-                hw->mbx.v2p_mailbox |= IXGBE_VFMAILBOX_PFACK;
+        if (!test_bit(__IXGBEVF_DOWN, &adapter->state))
+                mod_timer(&adapter->watchdog_timer, jiffies);
 
         IXGBE_WRITE_REG(hw, IXGBE_VTEIMS, adapter->eims_other);
 
@@ -1327,27 +1302,51 @@ static void ixgbevf_configure(struct ixgbevf_adapter *adapter)
         }
 }
 
-#define IXGBE_MAX_RX_DESC_POLL 10
-static inline void ixgbevf_rx_desc_queue_enable(struct ixgbevf_adapter *adapter,
-                                                int rxr)
+#define IXGBEVF_MAX_RX_DESC_POLL 10
+static void ixgbevf_rx_desc_queue_enable(struct ixgbevf_adapter *adapter,
+                                         int rxr)
 {
         struct ixgbe_hw *hw = &adapter->hw;
+        int wait_loop = IXGBEVF_MAX_RX_DESC_POLL;
+        u32 rxdctl;
         int j = adapter->rx_ring[rxr].reg_idx;
-        int k;
 
-        for (k = 0; k < IXGBE_MAX_RX_DESC_POLL; k++) {
-                if (IXGBE_READ_REG(hw, IXGBE_VFRXDCTL(j)) & IXGBE_RXDCTL_ENABLE)
-                        break;
-                else
-                        msleep(1);
-        }
-        if (k >= IXGBE_MAX_RX_DESC_POLL) {
-                hw_dbg(hw, "RXDCTL.ENABLE on Rx queue %d "
-                       "not set within the polling period\n", rxr);
-        }
+        do {
+                usleep_range(1000, 2000);
+                rxdctl = IXGBE_READ_REG(hw, IXGBE_VFRXDCTL(j));
+        } while (--wait_loop && !(rxdctl & IXGBE_RXDCTL_ENABLE));
+
+        if (!wait_loop)
+                hw_dbg(hw, "RXDCTL.ENABLE queue %d not set while polling\n",
+                       rxr);
+
+        ixgbevf_release_rx_desc(&adapter->hw, &adapter->rx_ring[rxr],
+                                (adapter->rx_ring[rxr].count - 1));
+}
+
+static void ixgbevf_disable_rx_queue(struct ixgbevf_adapter *adapter,
+                                     struct ixgbevf_ring *ring)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        int wait_loop = IXGBEVF_MAX_RX_DESC_POLL;
+        u32 rxdctl;
+        u8 reg_idx = ring->reg_idx;
 
-        ixgbevf_release_rx_desc(hw, &adapter->rx_ring[rxr],
-                                adapter->rx_ring[rxr].count - 1);
+        rxdctl = IXGBE_READ_REG(hw, IXGBE_VFRXDCTL(reg_idx));
+        rxdctl &= ~IXGBE_RXDCTL_ENABLE;
+
+        /* write value back with RXDCTL.ENABLE bit cleared */
+        IXGBE_WRITE_REG(hw, IXGBE_VFRXDCTL(reg_idx), rxdctl);
+
+        /* the hardware may take up to 100us to really disable the rx queue */
+        do {
+                udelay(10);
+                rxdctl = IXGBE_READ_REG(hw, IXGBE_VFRXDCTL(reg_idx));
+        } while (--wait_loop && (rxdctl & IXGBE_RXDCTL_ENABLE));
+
+        if (!wait_loop)
+                hw_dbg(hw, "RXDCTL.ENABLE queue %d not cleared while polling\n",
+                       reg_idx);
 }
 
 static void ixgbevf_save_reset_stats(struct ixgbevf_adapter *adapter)
@@ -1545,8 +1544,6 @@ void ixgbevf_up(struct ixgbevf_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
 
-        ixgbevf_negotiate_api(adapter);
-
         ixgbevf_reset_queues(adapter);
 
         ixgbevf_configure(adapter);
@@ -1679,7 +1676,10 @@ void ixgbevf_down(struct ixgbevf_adapter *adapter)
 
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBEVF_DOWN, &adapter->state);
-        /* disable receives */
+
+        /* disable all enabled rx queues */
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                ixgbevf_disable_rx_queue(adapter, &adapter->rx_ring[i]);
 
         netif_tx_disable(netdev);
 
@@ -1733,10 +1733,12 @@ void ixgbevf_reset(struct ixgbevf_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         struct net_device *netdev = adapter->netdev;
 
-        if (hw->mac.ops.reset_hw(hw))
+        if (hw->mac.ops.reset_hw(hw)) {
                 hw_dbg(hw, "PF still resetting\n");
-        else
+        } else {
                 hw->mac.ops.init_hw(hw);
+                ixgbevf_negotiate_api(adapter);
+        }
 
         if (is_valid_ether_addr(adapter->hw.mac.addr)) {
                 memcpy(netdev->dev_addr, adapter->hw.mac.addr,
@@ -2072,6 +2074,9 @@ static int ixgbevf_sw_init(struct ixgbevf_adapter *adapter)
         hw->mac.max_tx_queues = 2;
         hw->mac.max_rx_queues = 2;
 
+        /* lock to protect mailbox accesses */
+        spin_lock_init(&adapter->mbx_lock);
+
         err = hw->mac.ops.reset_hw(hw);
         if (err) {
                 dev_info(&pdev->dev,
@@ -2082,6 +2087,7 @@ static int ixgbevf_sw_init(struct ixgbevf_adapter *adapter)
                         pr_err("init_shared_code failed: %d\n", err);
                         goto out;
                 }
+                ixgbevf_negotiate_api(adapter);
                 err = hw->mac.ops.get_mac_addr(hw, hw->mac.addr);
                 if (err)
                         dev_info(&pdev->dev, "Error reading MAC address\n");
@@ -2097,9 +2103,6 @@ static int ixgbevf_sw_init(struct ixgbevf_adapter *adapter)
                 memcpy(hw->mac.addr, netdev->dev_addr, netdev->addr_len);
         }
 
-        /* lock to protect mailbox accesses */
-        spin_lock_init(&adapter->mbx_lock);
-
         /* Enable dynamic interrupt throttling rates */
         adapter->rx_itr_setting = 1;
         adapter->tx_itr_setting = 1;
@@ -2620,8 +2623,6 @@ static int ixgbevf_open(struct net_device *netdev)
                 }
         }
 
-        ixgbevf_negotiate_api(adapter);
-
         /* setup queue reg_idx and Rx queue count */
         err = ixgbevf_setup_queues(adapter);
         if (err)
@@ -3216,6 +3217,8 @@ static int ixgbevf_resume(struct pci_dev *pdev)
         }
         pci_set_master(pdev);
 
+        ixgbevf_reset(adapter);
+
         rtnl_lock();
         err = ixgbevf_init_interrupt_scheme(adapter);
         rtnl_unlock();
@@ -3224,8 +3227,6 @@ static int ixgbevf_resume(struct pci_dev *pdev)
                 return err;
         }
 
-        ixgbevf_reset(adapter);
-
         if (netif_running(netdev)) {
                 err = ixgbevf_open(netdev);
                 if (err)
diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.c b/drivers/net/ethernet/intel/ixgbevf/vf.c
index 387b52635bc0..4d44d64ae387 100644
--- a/drivers/net/ethernet/intel/ixgbevf/vf.c
+++ b/drivers/net/ethernet/intel/ixgbevf/vf.c
@@ -242,7 +242,7 @@ static s32 ixgbevf_set_uc_addr_vf(struct ixgbe_hw *hw, u32 index, u8 *addr)
         msgbuf[0] |= index << IXGBE_VT_MSGINFO_SHIFT;
         msgbuf[0] |= IXGBE_VF_SET_MACVLAN;
         if (addr)
-                memcpy(msg_addr, addr, 6);
+                memcpy(msg_addr, addr, ETH_ALEN);
         ret_val = mbx->ops.write_posted(hw, msgbuf, 3);
 
         if (!ret_val)
@@ -275,7 +275,7 @@ static s32 ixgbevf_set_rar_vf(struct ixgbe_hw *hw, u32 index, u8 *addr,
 
         memset(msgbuf, 0, sizeof(msgbuf));
         msgbuf[0] = IXGBE_VF_SET_MAC_ADDR;
-        memcpy(msg_addr, addr, 6);
+        memcpy(msg_addr, addr, ETH_ALEN);
         ret_val = mbx->ops.write_posted(hw, msgbuf, 3);
 
         if (!ret_val)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 23de82a9da82..f5685c0d0579 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -309,7 +309,7 @@ static void
 jme_load_macaddr(struct net_device *netdev)
 {
         struct jme_adapter *jme = netdev_priv(netdev);
-        unsigned char macaddr[6];
+        unsigned char macaddr[ETH_ALEN];
         u32 val;
 
         spin_lock_bh(&jme->macaddr_lock);
@@ -321,7 +321,7 @@ jme_load_macaddr(struct net_device *netdev)
         val = jread32(jme, JME_RXUMA_HI);
         macaddr[4] = (val >>  0) & 0xFF;
         macaddr[5] = (val >>  8) & 0xFF;
-        memcpy(netdev->dev_addr, macaddr, 6);
+        memcpy(netdev->dev_addr, macaddr, ETH_ALEN);
         spin_unlock_bh(&jme->macaddr_lock);
 }
 
@@ -3192,7 +3192,6 @@ jme_init_one(struct pci_dev *pdev,
 err_out_unmap:
         iounmap(jme->regs);
 err_out_free_netdev:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(netdev);
 err_out_release_regions:
         pci_release_regions(pdev);
@@ -3210,7 +3209,6 @@ jme_remove_one(struct pci_dev *pdev)
 
         unregister_netdev(netdev);
         iounmap(jme->regs);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(netdev);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index a36fa80968eb..4a5e3b0f712e 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -1110,7 +1110,7 @@ static int korina_probe(struct platform_device *pdev)
         lp = netdev_priv(dev);
 
         bif->dev = dev;
-        memcpy(dev->dev_addr, bif->mac, 6);
+        memcpy(dev->dev_addr, bif->mac, ETH_ALEN);
 
         lp->rx_irq = platform_get_irq_byname(pdev, "korina_rx");
         lp->tx_irq = platform_get_irq_byname(pdev, "korina_tx");
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 2c210ec35d59..4cfae6c9a63f 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2513,7 +2513,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
 
         mac_addr = of_get_mac_address(pnp);
         if (mac_addr)
-                memcpy(ppd.mac_addr, mac_addr, 6);
+                memcpy(ppd.mac_addr, mac_addr, ETH_ALEN);
 
         mv643xx_eth_property(pnp, "tx-queue-size", ppd.tx_queue_size);
         mv643xx_eth_property(pnp, "tx-sram-addr", ppd.tx_sram_addr);
@@ -2696,7 +2696,7 @@ static void set_params(struct mv643xx_eth_private *mp,
         struct net_device *dev = mp->dev;
 
         if (is_valid_ether_addr(pd->mac_addr))
-                memcpy(dev->dev_addr, pd->mac_addr, 6);
+                memcpy(dev->dev_addr, pd->mac_addr, ETH_ALEN);
         else
                 uc_addr_get(mp, dev->dev_addr);
 
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index ecc7f7b696b8..597846193869 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4046,7 +4046,6 @@ err_out_free_regions:
         pci_release_regions(pdev);
 err_out_disable_pdev:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 err_out:
         return err;
 }
@@ -4090,7 +4089,6 @@ static void skge_remove(struct pci_dev *pdev)
 
         iounmap(hw->regs);
         kfree(hw);
-        pci_set_drvdata(pdev, NULL);
 }
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index e09a8c6f8536..a7df981d2123 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5081,7 +5081,6 @@ err_out_free_regions:
 err_out_disable:
         pci_disable_device(pdev);
 err_out:
-        pci_set_drvdata(pdev, NULL);
         return err;
 }
 
@@ -5124,8 +5123,6 @@ static void sky2_remove(struct pci_dev *pdev)
 
         iounmap(hw->regs);
         kfree(hw);
-
-        pci_set_drvdata(pdev, NULL);
 }
 
 static int sky2_suspend(struct device *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index ea20182c6969..735765c21c95 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2253,7 +2253,6 @@ EXPORT_SYMBOL_GPL(mlx4_set_vf_mac);
 int mlx4_set_vf_vlan(struct mlx4_dev *dev, int port, int vf, u16 vlan, u8 qos)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
-        struct mlx4_vport_oper_state *vf_oper;
         struct mlx4_vport_state *vf_admin;
         int slave;
 
@@ -2269,7 +2268,6 @@ int mlx4_set_vf_vlan(struct mlx4_dev *dev, int port, int vf, u16 vlan, u8 qos)
                 return -EINVAL;
 
         vf_admin = &priv->mfunc.master.vf_admin[slave].vport[port];
-        vf_oper = &priv->mfunc.master.vf_oper[slave].vport[port];
 
         if ((0 == vlan) && (0 == qos))
                 vf_admin->default_vlan = MLX4_VGT;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index fa37b7a61213..85d91665d400 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1733,7 +1733,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
 
         /* Unregister Mac address for the port */
         mlx4_en_put_qp(priv);
-        if (!(mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN))
+        if (!(mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_REASSIGN_MAC_EN))
                 mdev->mac_removed[priv->port] = 1;
 
         /* Free RX Rings */
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 0d63daa2f422..c151e7a6710a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -652,7 +652,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                  QUERY_DEV_CAP_RSVD_LKEY_OFFSET);
         MLX4_GET(field, outbox, QUERY_DEV_CAP_FW_REASSIGN_MAC);
         if (field & 1<<6)
-                dev_cap->flags2 |= MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN;
+                dev_cap->flags2 |= MLX4_DEV_CAP_FLAG2_REASSIGN_MAC_EN;
         MLX4_GET(dev_cap->max_icm_sz, outbox,
                  QUERY_DEV_CAP_MAX_ICM_SZ_OFFSET);
         if (dev_cap->flags & MLX4_DEV_CAP_FLAG_COUNTERS)
@@ -1713,7 +1713,6 @@ void mlx4_opreq_action(struct work_struct *work)
         u32 *outbox;
         u32 modifier;
         u16 token;
-        u16 type_m;
         u16 type;
         int err;
         u32 num_qps;
@@ -1746,7 +1745,6 @@ void mlx4_opreq_action(struct work_struct *work)
                 MLX4_GET(modifier, outbox, GET_OP_REQ_MODIFIER_OFFSET);
                 MLX4_GET(token, outbox, GET_OP_REQ_TOKEN_OFFSET);
                 MLX4_GET(type, outbox, GET_OP_REQ_TYPE_OFFSET);
-                type_m = type >> 12;
                 type &= 0xfff;
 
                 switch (type) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 60c9f4f103fc..179d26709c94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -42,6 +42,7 @@
 #include <linux/io-mapping.h>
 #include <linux/delay.h>
 #include <linux/netdevice.h>
+#include <linux/kmod.h>
 
 #include <linux/mlx4/device.h>
 #include <linux/mlx4/doorbell.h>
@@ -650,6 +651,27 @@ err_mem:
         return err;
 }
 
+static void mlx4_request_modules(struct mlx4_dev *dev)
+{
+        int port;
+        int has_ib_port = false;
+        int has_eth_port = false;
+#define EN_DRV_NAME     "mlx4_en"
+#define IB_DRV_NAME     "mlx4_ib"
+
+        for (port = 1; port <= dev->caps.num_ports; port++) {
+                if (dev->caps.port_type[port] == MLX4_PORT_TYPE_IB)
+                        has_ib_port = true;
+                else if (dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH)
+                        has_eth_port = true;
+        }
+
+        if (has_ib_port)
+                request_module_nowait(IB_DRV_NAME);
+        if (has_eth_port)
+                request_module_nowait(EN_DRV_NAME);
+}
+
 /*
  * Change the port configuration of the device.
  * Every user of this function must hold the port mutex.
@@ -681,6 +703,11 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
                 }
                 mlx4_set_port_mask(dev);
                 err = mlx4_register_device(dev);
+                if (err) {
+                        mlx4_err(dev, "Failed to register device\n");
+                        goto out;
+                }
+                mlx4_request_modules(dev);
         }
 
 out:
@@ -2305,6 +2332,8 @@ slave_start:
         if (err)
                 goto err_port;
 
+        mlx4_request_modules(dev);
+
         mlx4_sense_init(dev);
         mlx4_start_sense(dev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 55f6245efb6c..70f0213d68c4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -645,7 +645,7 @@ static const u8 __promisc_mode[] = {
 int mlx4_map_sw_to_hw_steering_mode(struct mlx4_dev *dev,
                                     enum mlx4_net_trans_promisc_mode flow_type)
 {
-        if (flow_type >= MLX4_FS_MODE_NUM || flow_type < 0) {
+        if (flow_type >= MLX4_FS_MODE_NUM) {
                 mlx4_err(dev, "Invalid flow type. type = %d\n", flow_type);
                 return -EINVAL;
         }
@@ -681,7 +681,7 @@ const u16 __sw_id_hw[] = {
 int mlx4_map_sw_to_hw_steering_id(struct mlx4_dev *dev,
                                   enum mlx4_net_trans_rule_id id)
 {
-        if (id >= MLX4_NET_TRANS_RULE_NUM || id < 0) {
+        if (id >= MLX4_NET_TRANS_RULE_NUM) {
                 mlx4_err(dev, "Invalid network rule id. id = %d\n", id);
                 return -EINVAL;
         }
@@ -706,7 +706,7 @@ static const int __rule_hw_sz[] = {
 int mlx4_hw_rule_sz(struct mlx4_dev *dev,
                enum mlx4_net_trans_rule_id id)
 {
-        if (id >= MLX4_NET_TRANS_RULE_NUM || id < 0) {
+        if (id >= MLX4_NET_TRANS_RULE_NUM) {
                 mlx4_err(dev, "Invalid network rule id. id = %d\n", id);
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c
index 79fd269e2c54..9e08e35ce351 100644
--- a/drivers/net/ethernet/mellanox/mlx4/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/srq.h>
 #include <linux/export.h>
 #include <linux/gfp.h>
 
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 075f4e21d33d..c83d16dc7cd5 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1248,7 +1248,7 @@ static void ks_set_mac(struct ks_net *ks, u8 *data)
         w = ((u & 0xFF) << 8) | ((u >> 8) & 0xFF);
         ks_wrreg16(ks, KS_MARL, w);
 
-        memcpy(ks->mac_addr, data, 6);
+        memcpy(ks->mac_addr, data, ETH_ALEN);
 
         if (ks->enabled)
                 ks_start_rx(ks);
@@ -1651,7 +1651,7 @@ static int ks8851_probe(struct platform_device *pdev)
         }
         netdev_info(netdev, "Mac address is: %pM\n", ks->mac_addr);
 
-        memcpy(netdev->dev_addr, ks->mac_addr, 6);
+        memcpy(netdev->dev_addr, ks->mac_addr, ETH_ALEN);
 
         ks_set_mac(ks, netdev->dev_addr);
 
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index 8ebc352bcbe6..ddd252a3da9c 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -7150,8 +7150,6 @@ static void pcidev_exit(struct pci_dev *pdev)
         struct platform_info *info = pci_get_drvdata(pdev);
         struct dev_info *hw_priv = &info->dev_info;
 
-        pci_set_drvdata(pdev, NULL);
-
         release_mem_region(pci_resource_start(pdev, 0),
                 pci_resource_len(pdev, 0));
         for (i = 0; i < hw_priv->hw.dev_count; i++) {
@@ -7227,7 +7225,7 @@ static int pcidev_suspend(struct pci_dev *pdev, pm_message_t state)
 
 static char pcidev_name[] = "ksz884xp";
 
-static struct pci_device_id pcidev_table[] = {
+static DEFINE_PCI_DEVICE_TABLE(pcidev_table) = {
         { PCI_VENDOR_ID_MICREL_KS, 0x8841,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         { PCI_VENDOR_ID_MICREL_KS, 0x8842,
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index ea54d95e5b9f..cbd013379252 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -26,7 +26,6 @@
 #include <linux/of_irq.h>
 #include <linux/crc32.h>
 #include <linux/crc32c.h>
-#include <linux/dma-mapping.h>
 
 #include "moxart_ether.h"
 
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index 149355b52ad0..68026f7e8ba3 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -934,7 +934,7 @@ static inline void myri10ge_ss_init_lock(struct myri10ge_slice_state *ss)
 
 static inline bool myri10ge_ss_lock_napi(struct myri10ge_slice_state *ss)
 {
-        int rc = true;
+        bool rc = true;
         spin_lock(&ss->lock);
         if ((ss->state & SLICE_LOCKED)) {
                 WARN_ON((ss->state & SLICE_STATE_NAPI));
@@ -957,7 +957,7 @@ static inline void myri10ge_ss_unlock_napi(struct myri10ge_slice_state *ss)
 
 static inline bool myri10ge_ss_lock_poll(struct myri10ge_slice_state *ss)
 {
-        int rc = true;
+        bool rc = true;
         spin_lock_bh(&ss->lock);
         if ((ss->state & SLICE_LOCKED)) {
                 ss->state |= SLICE_STATE_POLL_YIELD;
@@ -3164,7 +3164,7 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
 
         /* Walk the multicast list, and add each address */
         netdev_for_each_mc_addr(ha, dev) {
-                memcpy(data, &ha->addr, 6);
+                memcpy(data, &ha->addr, ETH_ALEN);
                 cmd.data0 = ntohl(data[0]);
                 cmd.data1 = ntohl(data[1]);
                 err = myri10ge_send_cmd(mgp, MXGEFW_JOIN_MULTICAST_GROUP,
@@ -3207,7 +3207,7 @@ static int myri10ge_set_mac_address(struct net_device *dev, void *addr)
         }
 
         /* change the dev structure */
-        memcpy(dev->dev_addr, sa->sa_data, 6);
+        memcpy(dev->dev_addr, sa->sa_data, ETH_ALEN);
         return 0;
 }
 
@@ -4208,7 +4208,6 @@ static void myri10ge_remove(struct pci_dev *pdev)
         set_fw_name(mgp, NULL, false);
         free_netdev(netdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 #define PCI_DEVICE_ID_MYRICOM_MYRI10GE_Z8E      0x0008
diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index 7a5e295588b0..64ec2a437f46 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -970,7 +970,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 
  err_ioremap:
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
 
  err_pci_request_regions:
         free_netdev(dev);
@@ -3220,7 +3219,6 @@ static void natsemi_remove1(struct pci_dev *pdev)
         pci_release_regions (pdev);
         iounmap(ioaddr);
         free_netdev (dev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
index 51b00941302c..9eeddbd0b2c7 100644
--- a/drivers/net/ethernet/neterion/s2io.c
+++ b/drivers/net/ethernet/neterion/s2io.c
@@ -8185,7 +8185,6 @@ mem_alloc_failed:
         free_shared_mem(sp);
         pci_disable_device(pdev);
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 
         return ret;
@@ -8221,7 +8220,6 @@ static void s2io_rem_nic(struct pci_dev *pdev)
         iounmap(sp->bar0);
         iounmap(sp->bar1);
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
         pci_disable_device(pdev);
 }
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index 5a20eaf903dd..8614eeb7de81 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -4739,7 +4739,6 @@ _exit6:
 _exit5:
         vxge_device_unregister(hldev);
 _exit4:
-        pci_set_drvdata(pdev, NULL);
         vxge_hw_device_terminate(hldev);
         pci_disable_sriov(pdev);
 _exit3:
@@ -4782,7 +4781,6 @@ static void vxge_remove(struct pci_dev *pdev)
                 vxge_free_mac_add_list(&vdev->vpaths[i]);
 
         vxge_device_unregister(hldev);
-        pci_set_drvdata(pdev, NULL);
         /* Do not call pci_disable_sriov here, as it will break child devices */
         vxge_hw_device_terminate(hldev);
         iounmap(vdev->bar0);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
index 6797b1075874..2a9003071d51 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe.h
@@ -653,38 +653,38 @@ struct pch_gbe_adapter {
 extern const char pch_driver_version[];
 
 /* pch_gbe_main.c */
-extern int pch_gbe_up(struct pch_gbe_adapter *adapter);
-extern void pch_gbe_down(struct pch_gbe_adapter *adapter);
-extern void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter);
-extern void pch_gbe_reset(struct pch_gbe_adapter *adapter);
-extern int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
-                                       struct pch_gbe_tx_ring *txdr);
-extern int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
-                                       struct pch_gbe_rx_ring *rxdr);
-extern void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
-                                       struct pch_gbe_tx_ring *tx_ring);
-extern void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
-                                       struct pch_gbe_rx_ring *rx_ring);
-extern void pch_gbe_update_stats(struct pch_gbe_adapter *adapter);
-extern u32 pch_ch_control_read(struct pci_dev *pdev);
-extern void pch_ch_control_write(struct pci_dev *pdev, u32 val);
-extern u32 pch_ch_event_read(struct pci_dev *pdev);
-extern void pch_ch_event_write(struct pci_dev *pdev, u32 val);
-extern u32 pch_src_uuid_lo_read(struct pci_dev *pdev);
-extern u32 pch_src_uuid_hi_read(struct pci_dev *pdev);
-extern u64 pch_rx_snap_read(struct pci_dev *pdev);
-extern u64 pch_tx_snap_read(struct pci_dev *pdev);
-extern int pch_set_station_address(u8 *addr, struct pci_dev *pdev);
+int pch_gbe_up(struct pch_gbe_adapter *adapter);
+void pch_gbe_down(struct pch_gbe_adapter *adapter);
+void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter);
+void pch_gbe_reset(struct pch_gbe_adapter *adapter);
+int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
+                               struct pch_gbe_tx_ring *txdr);
+int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
+                               struct pch_gbe_rx_ring *rxdr);
+void pch_gbe_free_tx_resources(struct pch_gbe_adapter *adapter,
+                               struct pch_gbe_tx_ring *tx_ring);
+void pch_gbe_free_rx_resources(struct pch_gbe_adapter *adapter,
+                               struct pch_gbe_rx_ring *rx_ring);
+void pch_gbe_update_stats(struct pch_gbe_adapter *adapter);
+u32 pch_ch_control_read(struct pci_dev *pdev);
+void pch_ch_control_write(struct pci_dev *pdev, u32 val);
+u32 pch_ch_event_read(struct pci_dev *pdev);
+void pch_ch_event_write(struct pci_dev *pdev, u32 val);
+u32 pch_src_uuid_lo_read(struct pci_dev *pdev);
+u32 pch_src_uuid_hi_read(struct pci_dev *pdev);
+u64 pch_rx_snap_read(struct pci_dev *pdev);
+u64 pch_tx_snap_read(struct pci_dev *pdev);
+int pch_set_station_address(u8 *addr, struct pci_dev *pdev);
 
 /* pch_gbe_param.c */
-extern void pch_gbe_check_options(struct pch_gbe_adapter *adapter);
+void pch_gbe_check_options(struct pch_gbe_adapter *adapter);
 
 /* pch_gbe_ethtool.c */
-extern void pch_gbe_set_ethtool_ops(struct net_device *netdev);
+void pch_gbe_set_ethtool_ops(struct net_device *netdev);
 
 /* pch_gbe_mac.c */
-extern s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw);
-extern s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw);
-extern u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw,
-                                  u32 addr, u32 dir, u32 reg, u16 data);
+s32 pch_gbe_mac_force_mac_fc(struct pch_gbe_hw *hw);
+s32 pch_gbe_mac_read_mac_addr(struct pch_gbe_hw *hw);
+u16 pch_gbe_mac_ctrl_miim(struct pch_gbe_hw *hw, u32 addr, u32 dir, u32 reg,
+                          u16 data);
 #endif /* _PCH_GBE_H_ */
diff --git a/drivers/net/ethernet/packetengines/hamachi.c b/drivers/net/ethernet/packetengines/hamachi.c
index cac33e5f9bc2..b6bdeb3c1971 100644
--- a/drivers/net/ethernet/packetengines/hamachi.c
+++ b/drivers/net/ethernet/packetengines/hamachi.c
@@ -1910,7 +1910,6 @@ static void hamachi_remove_one(struct pci_dev *pdev)
                 iounmap(hmp->base);
                 free_netdev(dev);
                 pci_release_regions(pdev);
-                pci_set_drvdata(pdev, NULL);
         }
 }
 
diff --git a/drivers/net/ethernet/packetengines/yellowfin.c b/drivers/net/ethernet/packetengines/yellowfin.c
index d28593b1fc3e..07a890eb72ad 100644
--- a/drivers/net/ethernet/packetengines/yellowfin.c
+++ b/drivers/net/ethernet/packetengines/yellowfin.c
@@ -513,7 +513,6 @@ err_out_unmap_rx:
 err_out_unmap_tx:
         pci_free_consistent(pdev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma);
 err_out_cleardev:
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
 err_out_free_res:
         pci_release_regions(pdev);
@@ -1392,7 +1391,6 @@ static void yellowfin_remove_one(struct pci_dev *pdev)
         pci_release_regions (pdev);
 
         free_netdev (dev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 5b65356e7568..dbaa49e58b0c 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1870,7 +1870,6 @@ static void pasemi_mac_remove(struct pci_dev *pdev)
         pasemi_dma_free_chan(&mac->tx->chan);
         pasemi_dma_free_chan(&mac->rx->chan);
 
-        pci_set_drvdata(pdev, NULL);
         free_netdev(netdev);
 }
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
index 32675e16021e..9adcdbb49476 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
@@ -53,8 +53,8 @@
 
 #define _NETXEN_NIC_LINUX_MAJOR 4
 #define _NETXEN_NIC_LINUX_MINOR 0
-#define _NETXEN_NIC_LINUX_SUBVERSION 81
-#define NETXEN_NIC_LINUX_VERSIONID  "4.0.81"
+#define _NETXEN_NIC_LINUX_SUBVERSION 82
+#define NETXEN_NIC_LINUX_VERSIONID  "4.0.82"
 
 #define NETXEN_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
@@ -1883,9 +1883,8 @@ static inline u32 netxen_tx_avail(struct nx_host_tx_ring *tx_ring)
 
 int netxen_get_flash_mac_addr(struct netxen_adapter *adapter, u64 *mac);
 int netxen_p3_get_mac_addr(struct netxen_adapter *adapter, u64 *mac);
-extern void netxen_change_ringparam(struct netxen_adapter *adapter);
-extern int netxen_rom_fast_read(struct netxen_adapter *adapter, int addr,
-                                int *valp);
+void netxen_change_ringparam(struct netxen_adapter *adapter);
+int netxen_rom_fast_read(struct netxen_adapter *adapter, int addr, int *valp);
 
 extern const struct ethtool_ops netxen_nic_ethtool_ops;
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hdr.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hdr.h
index 32c790659f9c..0c64c82b9acf 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hdr.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hdr.h
@@ -958,6 +958,7 @@ enum {
 #define NETXEN_PEG_HALT_STATUS2         (NETXEN_CAM_RAM(0xac))
 #define NX_CRB_DEV_REF_COUNT            (NETXEN_CAM_RAM(0x138))
 #define NX_CRB_DEV_STATE                (NETXEN_CAM_RAM(0x140))
+#define NETXEN_ULA_KEY                  (NETXEN_CAM_RAM(0x178))
 
 /* MiniDIMM related macros */
 #define NETXEN_DIMM_CAPABILITY          (NETXEN_CAM_RAM(0x258))
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
index 8375cbde9969..67efe754367d 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
@@ -648,7 +648,7 @@ nx_p3_sre_macaddr_change(struct netxen_adapter *adapter, u8 *addr, unsigned op)
 
         mac_req = (nx_mac_req_t *)&req.words[0];
         mac_req->op = op;
-        memcpy(mac_req->mac_addr, addr, 6);
+        memcpy(mac_req->mac_addr, addr, ETH_ALEN);
 
         return netxen_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
 }
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index cbd75f97ffb3..3bec8cfebf99 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1415,6 +1415,32 @@ netxen_setup_netdev(struct netxen_adapter *adapter,
         return 0;
 }
 
+#define NETXEN_ULA_ADAPTER_KEY          (0xdaddad01)
+#define NETXEN_NON_ULA_ADAPTER_KEY      (0xdaddad00)
+
+static void netxen_read_ula_info(struct netxen_adapter *adapter)
+{
+        u32 temp;
+
+        /* Print ULA info only once for an adapter */
+        if (adapter->portnum != 0)
+                return;
+
+        temp = NXRD32(adapter, NETXEN_ULA_KEY);
+        switch (temp) {
+        case NETXEN_ULA_ADAPTER_KEY:
+                dev_info(&adapter->pdev->dev, "ULA adapter");
+                break;
+        case NETXEN_NON_ULA_ADAPTER_KEY:
+                dev_info(&adapter->pdev->dev, "non ULA adapter");
+                break;
+        default:
+                break;
+        }
+
+        return;
+}
+
 #ifdef CONFIG_PCIEAER
 static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)
 {
@@ -1561,6 +1587,8 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_disable_msi;
         }
 
+        netxen_read_ula_info(adapter);
+
         err = netxen_setup_netdev(adapter, netdev);
         if (err)
                 goto err_out_disable_msi;
@@ -1602,7 +1630,6 @@ err_out_free_res:
         pci_release_regions(pdev);
 
 err_out_disable_pdev:
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
         return err;
 }
@@ -1661,7 +1688,6 @@ static void netxen_nic_remove(struct pci_dev *pdev)
 
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         free_netdev(netdev);
 }
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 91a8fcd6c246..0758b9435358 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3916,7 +3916,6 @@ err_out_free_regions:
         pci_release_regions(pdev);
 err_out_disable_pdev:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 err_out:
         return err;
 }
@@ -3939,7 +3938,6 @@ static void ql3xxx_remove(struct pci_dev *pdev)
 
         iounmap(qdev->mem_map_registers);
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(ndev);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 81bf83604c4f..0c2405dbc970 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -38,8 +38,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 50
-#define QLCNIC_LINUX_VERSIONID  "5.3.50"
+#define _QLCNIC_LINUX_SUBVERSION 51
+#define QLCNIC_LINUX_VERSIONID  "5.3.51"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
@@ -961,8 +961,6 @@ struct qlcnic_ipaddr {
 #define __QLCNIC_SRIOV_CAPABLE          11
 #define __QLCNIC_MBX_POLL_ENABLE        12
 #define __QLCNIC_DIAG_MODE              13
-#define __QLCNIC_DCB_STATE              14
-#define __QLCNIC_DCB_IN_AEN             15
 
 #define QLCNIC_INTERRUPT_TEST           1
 #define QLCNIC_LOOPBACK_TEST            2
@@ -1199,6 +1197,7 @@ struct qlcnic_npar_info {
         u8      promisc_mode;
         u8      offload_flags;
         u8      pci_func;
+        u8      mac[ETH_ALEN];
 };
 
 struct qlcnic_eswitch {
@@ -2115,98 +2114,4 @@ static inline bool qlcnic_sriov_vf_check(struct qlcnic_adapter *adapter)
 
         return status;
 }
-
-static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->get_hw_capability)
-                return dcb->ops->get_hw_capability(adapter);
-
-        return 0;
-}
-
-static inline void qlcnic_dcb_free(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->free)
-                dcb->ops->free(adapter);
-}
-
-static inline int qlcnic_dcb_attach(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->attach)
-                return dcb->ops->attach(adapter);
-
-        return 0;
-}
-
-static inline int
-qlcnic_dcb_query_hw_capability(struct qlcnic_adapter *adapter, char *buf)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->query_hw_capability)
-                return dcb->ops->query_hw_capability(adapter, buf);
-
-        return 0;
-}
-
-static inline void qlcnic_dcb_get_info(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->get_info)
-                dcb->ops->get_info(adapter);
-}
-
-static inline int
-qlcnic_dcb_query_cee_param(struct qlcnic_adapter *adapter, char *buf, u8 type)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->query_cee_param)
-                return dcb->ops->query_cee_param(adapter, buf, type);
-
-        return 0;
-}
-
-static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->get_cee_cfg)
-                return dcb->ops->get_cee_cfg(adapter);
-
-        return 0;
-}
-
-static inline void
-qlcnic_dcb_register_aen(struct qlcnic_adapter *adapter, u8 flag)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->register_aen)
-                dcb->ops->register_aen(adapter, flag);
-}
-
-static inline void qlcnic_dcb_handle_aen(struct qlcnic_adapter *adapter,
-                                         void *msg)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->handle_aen)
-                dcb->ops->handle_aen(adapter, msg);
-}
-
-static inline void qlcnic_dcb_init_dcbnl_ops(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (dcb && dcb->ops->init_dcbnl_ops)
-                dcb->ops->init_dcbnl_ops(adapter);
-}
 #endif                          /* __QLCNIC_H_ */
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 3ca00e05f23d..a126bdf27952 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -902,7 +902,7 @@ void __qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter)
                          QLCNIC_MBX_RSP(event[0]));
                 break;
         case QLCNIC_MBX_DCBX_CONFIG_CHANGE_EVENT:
-                qlcnic_dcb_handle_aen(adapter, (void *)&event[1]);
+                qlcnic_dcb_aen_handler(adapter->dcb, (void *)&event[1]);
                 break;
         default:
                 dev_dbg(&adapter->pdev->dev, "Unsupported AEN:0x%x.\n",
@@ -2321,19 +2321,7 @@ int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *adapter,
                         i++;
                         memcpy(pci_info->mac + sizeof(u32), &cmd.rsp.arg[i], 2);
                         i = i + 3;
-                        if (ahw->op_mode == QLCNIC_MGMT_FUNC)
-                                dev_info(dev, "id = %d active = %d type = %d\n"
-                                         "\tport = %d min bw = %d max bw = %d\n"
-                                         "\tmac_addr =  %pM\n", pci_info->id,
-                                         pci_info->active, pci_info->type,
-                                         pci_info->default_port,
-                                         pci_info->tx_min_bw,
-                                         pci_info->tx_max_bw, pci_info->mac);
                 }
-                if (ahw->op_mode == QLCNIC_MGMT_FUNC)
-                        dev_info(dev, "Max functions = %d, active functions = %d\n",
-                                 ahw->max_pci_func, ahw->act_pci_func);
-
         } else {
                 dev_err(dev, "Failed to get PCI Info, error = %d\n", err);
                 err = -EIO;
@@ -3279,12 +3267,12 @@ int qlcnic_83xx_reg_test(struct qlcnic_adapter *adapter)
         return 0;
 }
 
-int qlcnic_83xx_get_regs_len(struct qlcnic_adapter *adapter)
+inline int qlcnic_83xx_get_regs_len(struct qlcnic_adapter *adapter)
 {
         return (ARRAY_SIZE(qlcnic_83xx_ext_reg_tbl) *
-                sizeof(adapter->ahw->ext_reg_tbl)) +
-                (ARRAY_SIZE(qlcnic_83xx_reg_tbl) +
-                sizeof(adapter->ahw->reg_tbl));
+                sizeof(*adapter->ahw->ext_reg_tbl)) +
+                (ARRAY_SIZE(qlcnic_83xx_reg_tbl) *
+                sizeof(*adapter->ahw->reg_tbl));
 }
 
 int qlcnic_83xx_get_registers(struct qlcnic_adapter *adapter, u32 *regs_buff)
@@ -3381,10 +3369,21 @@ void qlcnic_83xx_get_pauseparam(struct qlcnic_adapter *adapter,
         }
         config = ahw->port_config;
         if (config & QLC_83XX_CFG_STD_PAUSE) {
-                if (config & QLC_83XX_CFG_STD_TX_PAUSE)
+                switch (MSW(config)) {
+                case QLC_83XX_TX_PAUSE:
                         pause->tx_pause = 1;
-                if (config & QLC_83XX_CFG_STD_RX_PAUSE)
+                        break;
+                case QLC_83XX_RX_PAUSE:
                         pause->rx_pause = 1;
+                        break;
+                case QLC_83XX_TX_RX_PAUSE:
+                default:
+                        /* Backward compatibility for existing
+                         * flash definitions
+                         */
+                        pause->tx_pause = 1;
+                        pause->rx_pause = 1;
+                }
         }
 
         if (QLC_83XX_AUTONEG(config))
@@ -3427,7 +3426,8 @@ int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *adapter,
                 ahw->port_config &= ~QLC_83XX_CFG_STD_RX_PAUSE;
                 ahw->port_config |= QLC_83XX_CFG_STD_TX_PAUSE;
         } else if (!pause->rx_pause && !pause->tx_pause) {
-                ahw->port_config &= ~QLC_83XX_CFG_STD_TX_RX_PAUSE;
+                ahw->port_config &= ~(QLC_83XX_CFG_STD_TX_RX_PAUSE |
+                                      QLC_83XX_CFG_STD_PAUSE);
         }
         status = qlcnic_83xx_set_port_config(adapter);
         if (status) {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 533e150503af..9f4e4c4ab521 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -363,6 +363,9 @@ enum qlcnic_83xx_states {
 #define QLC_83XX_LINK_EEE(data)         ((data) & BIT_13)
 #define QLC_83XX_DCBX(data)                     (((data) >> 28) & 7)
 #define QLC_83XX_AUTONEG(data)                  ((data) & BIT_15)
+#define QLC_83XX_TX_PAUSE                       0x10
+#define QLC_83XX_RX_PAUSE                       0x20
+#define QLC_83XX_TX_RX_PAUSE                    0x30
 #define QLC_83XX_CFG_STD_PAUSE                  (1 << 5)
 #define QLC_83XX_CFG_STD_TX_PAUSE               (1 << 20)
 #define QLC_83XX_CFG_STD_RX_PAUSE               (2 << 20)
@@ -626,7 +629,7 @@ int qlcnic_83xx_config_vnic_opmode(struct qlcnic_adapter *);
 int qlcnic_83xx_get_vnic_vport_info(struct qlcnic_adapter *,
                                     struct qlcnic_info *, u8);
 int qlcnic_83xx_get_vnic_pf_info(struct qlcnic_adapter *, struct qlcnic_info *);
-int qlcnic_83xx_enable_port_eswitch(struct qlcnic_adapter *, int);
+int qlcnic_83xx_set_port_eswitch_status(struct qlcnic_adapter *, int, int *);
 
 void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *);
 void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index f09e787af0b2..e2cd48417041 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -636,7 +636,7 @@ int qlcnic_83xx_idc_reattach_driver(struct qlcnic_adapter *adapter)
         if (adapter->portnum == 0)
                 qlcnic_set_drv_version(adapter);
 
-        qlcnic_dcb_get_info(adapter);
+        qlcnic_dcb_get_info(adapter->dcb);
         qlcnic_83xx_idc_attach_driver(adapter);
 
         return 0;
@@ -818,6 +818,7 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         struct qlcnic_mailbox *mbx = ahw->mailbox;
         int ret = 0;
+        u32 owner;
         u32 val;
 
         /* Perform NIC configuration based ready state entry actions */
@@ -846,6 +847,10 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                         clear_bit(QLC_83XX_MBX_READY, &mbx->status);
                         set_bit(__QLCNIC_RESETTING, &adapter->state);
                         qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
+                }  else {
+                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                        if (ahw->pci_func == owner)
+                                qlcnic_dump_fw(adapter);
                 }
                 return -EIO;
         }
@@ -1058,6 +1063,12 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
         adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
         qlcnic_83xx_periodic_tasks(adapter);
 
+        /* Do not reschedule if firmaware is in hanged state and auto
+         * recovery is disabled
+         */
+        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
+                return;
+
         /* Re-schedule the function */
         if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                 qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -2163,6 +2174,7 @@ static int qlcnic_83xx_get_fw_info(struct qlcnic_adapter *adapter)
 int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
 {
         struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct qlcnic_dcb *dcb;
         int err = 0;
 
         ahw->msix_supported = !!qlcnic_use_msi_x;
@@ -2220,8 +2232,10 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         if (err)
                 goto disable_mbx_intr;
 
-        if (adapter->dcb && qlcnic_dcb_attach(adapter))
-                qlcnic_clear_dcb_ops(adapter);
+        dcb = adapter->dcb;
+
+        if (dcb && qlcnic_dcb_attach(dcb))
+                qlcnic_clear_dcb_ops(dcb);
 
         /* Periodically monitor device status */
         qlcnic_83xx_idc_poll_dev_state(&adapter->fw_work.work);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index 0248a4c2f5dd..734d28602ac3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -94,13 +94,29 @@ qlcnic_83xx_config_vnic_buff_descriptors(struct qlcnic_adapter *adapter)
  **/
 static int qlcnic_83xx_init_mgmt_vnic(struct qlcnic_adapter *adapter)
 {
-        int err = -EIO;
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct device *dev = &adapter->pdev->dev;
+        struct qlcnic_npar_info *npar;
+        int i, err = -EIO;
 
         qlcnic_83xx_get_minidump_template(adapter);
+
         if (!(adapter->flags & QLCNIC_ADAPTER_INITIALIZED)) {
                 if (qlcnic_init_pci_info(adapter))
                         return err;
 
+                npar = adapter->npars;
+
+                for (i = 0; i < ahw->act_pci_func; i++, npar++) {
+                        dev_info(dev, "id:%d active:%d type:%d port:%d min_bw:%d max_bw:%d mac_addr:%pM\n",
+                                 npar->pci_func, npar->active, npar->type,
+                                 npar->phy_port, npar->min_bw, npar->max_bw,
+                                 npar->mac);
+                }
+
+                dev_info(dev, "Max functions = %d, active functions = %d\n",
+                         ahw->max_pci_func, ahw->act_pci_func);
+
                 if (qlcnic_83xx_set_vnic_opmode(adapter))
                         return err;
 
@@ -115,12 +131,12 @@ static int qlcnic_83xx_init_mgmt_vnic(struct qlcnic_adapter *adapter)
                 return err;
 
         qlcnic_83xx_config_vnic_buff_descriptors(adapter);
-        adapter->ahw->msix_supported = !!qlcnic_use_msi_x;
+        ahw->msix_supported = qlcnic_use_msi_x ? 1 : 0;
         adapter->flags |= QLCNIC_ADAPTER_INITIALIZED;
         qlcnic_83xx_enable_vnic_mode(adapter, 1);
 
-        dev_info(&adapter->pdev->dev, "HAL Version: %d, Management function\n",
-                 adapter->ahw->fw_hal_version);
+        dev_info(dev, "HAL Version: %d, Management function\n",
+                 ahw->fw_hal_version);
 
         return 0;
 }
@@ -240,8 +256,8 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
         return 0;
 }
 
-static int qlcnic_83xx_get_eswitch_port_info(struct qlcnic_adapter *adapter,
-                                             int func, int *port_id)
+int qlcnic_83xx_set_port_eswitch_status(struct qlcnic_adapter *adapter,
+                                        int func, int *port_id)
 {
         struct qlcnic_info nic_info;
         int err = 0;
@@ -257,23 +273,8 @@ static int qlcnic_83xx_get_eswitch_port_info(struct qlcnic_adapter *adapter,
         else
                 err = -EIO;
 
-        return err;
-}
-
-int qlcnic_83xx_enable_port_eswitch(struct qlcnic_adapter *adapter, int func)
-{
-        int id, err = 0;
-
-        err = qlcnic_83xx_get_eswitch_port_info(adapter, func, &id);
-        if (err)
-                return err;
-
-        if (!(adapter->eswitch[id].flags & QLCNIC_SWITCH_ENABLE)) {
-                if (!qlcnic_enable_eswitch(adapter, id, 1))
-                        adapter->eswitch[id].flags |= QLCNIC_SWITCH_ENABLE;
-                else
-                        err = -EIO;
-        }
+        if (!err)
+                adapter->eswitch[*port_id].flags |= QLCNIC_SWITCH_ENABLE;
 
         return err;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index d62d5ce432ec..86bca7c14f99 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -57,22 +57,22 @@ static const struct dcbnl_rtnl_ops qlcnic_dcbnl_ops;
 static void qlcnic_dcb_aen_work(struct work_struct *);
 static void qlcnic_dcb_data_cee_param_map(struct qlcnic_adapter *);
 
-static inline void __qlcnic_init_dcbnl_ops(struct qlcnic_adapter *);
-static void __qlcnic_dcb_free(struct qlcnic_adapter *);
-static int __qlcnic_dcb_attach(struct qlcnic_adapter *);
-static int __qlcnic_dcb_query_hw_capability(struct qlcnic_adapter *, char *);
-static void __qlcnic_dcb_get_info(struct qlcnic_adapter *);
-
-static int qlcnic_82xx_dcb_get_hw_capability(struct qlcnic_adapter *);
-static int qlcnic_82xx_dcb_query_cee_param(struct qlcnic_adapter *, char *, u8);
-static int qlcnic_82xx_dcb_get_cee_cfg(struct qlcnic_adapter *);
-static void qlcnic_82xx_dcb_handle_aen(struct qlcnic_adapter *, void *);
-
-static int qlcnic_83xx_dcb_get_hw_capability(struct qlcnic_adapter *);
-static int qlcnic_83xx_dcb_query_cee_param(struct qlcnic_adapter *, char *, u8);
-static int qlcnic_83xx_dcb_get_cee_cfg(struct qlcnic_adapter *);
-static int qlcnic_83xx_dcb_register_aen(struct qlcnic_adapter *, bool);
-static void qlcnic_83xx_dcb_handle_aen(struct qlcnic_adapter *, void *);
+static inline void __qlcnic_init_dcbnl_ops(struct qlcnic_dcb *);
+static void __qlcnic_dcb_free(struct qlcnic_dcb *);
+static int __qlcnic_dcb_attach(struct qlcnic_dcb *);
+static int __qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *, char *);
+static void __qlcnic_dcb_get_info(struct qlcnic_dcb *);
+
+static int qlcnic_82xx_dcb_get_hw_capability(struct qlcnic_dcb *);
+static int qlcnic_82xx_dcb_query_cee_param(struct qlcnic_dcb *, char *, u8);
+static int qlcnic_82xx_dcb_get_cee_cfg(struct qlcnic_dcb *);
+static void qlcnic_82xx_dcb_aen_handler(struct qlcnic_dcb *, void *);
+
+static int qlcnic_83xx_dcb_get_hw_capability(struct qlcnic_dcb *);
+static int qlcnic_83xx_dcb_query_cee_param(struct qlcnic_dcb *, char *, u8);
+static int qlcnic_83xx_dcb_get_cee_cfg(struct qlcnic_dcb *);
+static int qlcnic_83xx_dcb_register_aen(struct qlcnic_dcb *, bool);
+static void qlcnic_83xx_dcb_aen_handler(struct qlcnic_dcb *, void *);
 
 struct qlcnic_dcb_capability {
         bool    tsa_capability;
@@ -180,7 +180,7 @@ static struct qlcnic_dcb_ops qlcnic_83xx_dcb_ops = {
         .query_cee_param        = qlcnic_83xx_dcb_query_cee_param,
         .get_cee_cfg            = qlcnic_83xx_dcb_get_cee_cfg,
         .register_aen           = qlcnic_83xx_dcb_register_aen,
-        .handle_aen             = qlcnic_83xx_dcb_handle_aen,
+        .aen_handler            = qlcnic_83xx_dcb_aen_handler,
 };
 
 static struct qlcnic_dcb_ops qlcnic_82xx_dcb_ops = {
@@ -193,7 +193,7 @@ static struct qlcnic_dcb_ops qlcnic_82xx_dcb_ops = {
         .get_hw_capability      = qlcnic_82xx_dcb_get_hw_capability,
         .query_cee_param        = qlcnic_82xx_dcb_query_cee_param,
         .get_cee_cfg            = qlcnic_82xx_dcb_get_cee_cfg,
-        .handle_aen             = qlcnic_82xx_dcb_handle_aen,
+        .aen_handler            = qlcnic_82xx_dcb_aen_handler,
 };
 
 static u8 qlcnic_dcb_get_num_app(struct qlcnic_adapter *adapter, u32 val)
@@ -242,10 +242,10 @@ static int qlcnic_dcb_prio_count(u8 up_tc_map)
         return j;
 }
 
-static inline void __qlcnic_init_dcbnl_ops(struct qlcnic_adapter *adapter)
+static inline void __qlcnic_init_dcbnl_ops(struct qlcnic_dcb *dcb)
 {
-        if (test_bit(__QLCNIC_DCB_STATE, &adapter->state))
-                adapter->netdev->dcbnl_ops = &qlcnic_dcbnl_ops;
+        if (test_bit(QLCNIC_DCB_STATE, &dcb->state))
+                dcb->adapter->netdev->dcbnl_ops = &qlcnic_dcbnl_ops;
 }
 
 static void qlcnic_set_dcb_ops(struct qlcnic_adapter *adapter)
@@ -256,7 +256,7 @@ static void qlcnic_set_dcb_ops(struct qlcnic_adapter *adapter)
                 adapter->dcb->ops = &qlcnic_83xx_dcb_ops;
 }
 
-int __qlcnic_register_dcb(struct qlcnic_adapter *adapter)
+int qlcnic_register_dcb(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_dcb *dcb;
 
@@ -267,20 +267,22 @@ int __qlcnic_register_dcb(struct qlcnic_adapter *adapter)
         adapter->dcb = dcb;
         dcb->adapter = adapter;
         qlcnic_set_dcb_ops(adapter);
+        dcb->state = 0;
 
         return 0;
 }
 
-static void __qlcnic_dcb_free(struct qlcnic_adapter *adapter)
+static void __qlcnic_dcb_free(struct qlcnic_dcb *dcb)
 {
-        struct qlcnic_dcb *dcb = adapter->dcb;
+        struct qlcnic_adapter *adapter;
 
         if (!dcb)
                 return;
 
-        qlcnic_dcb_register_aen(adapter, 0);
+        adapter = dcb->adapter;
+        qlcnic_dcb_register_aen(dcb, 0);
 
-        while (test_bit(__QLCNIC_DCB_IN_AEN, &adapter->state))
+        while (test_bit(QLCNIC_DCB_AEN_MODE, &dcb->state))
                 usleep_range(10000, 11000);
 
         cancel_delayed_work_sync(&dcb->aen_work);
@@ -298,23 +300,22 @@ static void __qlcnic_dcb_free(struct qlcnic_adapter *adapter)
         adapter->dcb = NULL;
 }
 
-static void __qlcnic_dcb_get_info(struct qlcnic_adapter *adapter)
+static void __qlcnic_dcb_get_info(struct qlcnic_dcb *dcb)
 {
-        qlcnic_dcb_get_hw_capability(adapter);
-        qlcnic_dcb_get_cee_cfg(adapter);
-        qlcnic_dcb_register_aen(adapter, 1);
+        qlcnic_dcb_get_hw_capability(dcb);
+        qlcnic_dcb_get_cee_cfg(dcb);
+        qlcnic_dcb_register_aen(dcb, 1);
 }
 
-static int __qlcnic_dcb_attach(struct qlcnic_adapter *adapter)
+static int __qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
 {
-        struct qlcnic_dcb *dcb = adapter->dcb;
         int err = 0;
 
         INIT_DELAYED_WORK(&dcb->aen_work, qlcnic_dcb_aen_work);
 
         dcb->wq = create_singlethread_workqueue("qlcnic-dcb");
         if (!dcb->wq) {
-                dev_err(&adapter->pdev->dev,
+                dev_err(&dcb->adapter->pdev->dev,
                         "DCB workqueue allocation failed. DCB will be disabled\n");
                 return -1;
         }
@@ -331,7 +332,7 @@ static int __qlcnic_dcb_attach(struct qlcnic_adapter *adapter)
                 goto out_free_cfg;
         }
 
-        qlcnic_dcb_get_info(adapter);
+        qlcnic_dcb_get_info(dcb);
 
         return 0;
 out_free_cfg:
@@ -345,9 +346,9 @@ out_free_wq:
         return err;
 }
 
-static int __qlcnic_dcb_query_hw_capability(struct qlcnic_adapter *adapter,
-                                            char *buf)
+static int __qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf)
 {
+        struct qlcnic_adapter *adapter = dcb->adapter;
         struct qlcnic_cmd_args cmd;
         u32 mbx_out;
         int err;
@@ -371,15 +372,15 @@ static int __qlcnic_dcb_query_hw_capability(struct qlcnic_adapter *adapter,
         return err;
 }
 
-static int __qlcnic_dcb_get_capability(struct qlcnic_adapter *adapter, u32 *val)
+static int __qlcnic_dcb_get_capability(struct qlcnic_dcb *dcb, u32 *val)
 {
-        struct qlcnic_dcb_capability *cap = &adapter->dcb->cfg->capability;
+        struct qlcnic_dcb_capability *cap = &dcb->cfg->capability;
         u32 mbx_out;
         int err;
 
         memset(cap, 0, sizeof(struct qlcnic_dcb_capability));
 
-        err = qlcnic_dcb_query_hw_capability(adapter, (char *)val);
+        err = qlcnic_dcb_query_hw_capability(dcb, (char *)val);
         if (err)
                 return err;
 
@@ -397,21 +398,21 @@ static int __qlcnic_dcb_get_capability(struct qlcnic_adapter *adapter, u32 *val)
         if (cap->max_num_tc > QLC_DCB_MAX_TC ||
             cap->max_ets_tc > cap->max_num_tc ||
             cap->max_pfc_tc > cap->max_num_tc) {
-                dev_err(&adapter->pdev->dev, "Invalid DCB configuration\n");
+                dev_err(&dcb->adapter->pdev->dev, "Invalid DCB configuration\n");
                 return -EINVAL;
         }
 
         return err;
 }
 
-static int qlcnic_82xx_dcb_get_hw_capability(struct qlcnic_adapter *adapter)
+static int qlcnic_82xx_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
 {
-        struct qlcnic_dcb_cfg *cfg = adapter->dcb->cfg;
+        struct qlcnic_dcb_cfg *cfg = dcb->cfg;
         struct qlcnic_dcb_capability *cap;
         u32 mbx_out;
         int err;
 
-        err = __qlcnic_dcb_get_capability(adapter, &mbx_out);
+        err = __qlcnic_dcb_get_capability(dcb, &mbx_out);
         if (err)
                 return err;
 
@@ -419,15 +420,16 @@ static int qlcnic_82xx_dcb_get_hw_capability(struct qlcnic_adapter *adapter)
         cap->dcb_capability = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_LLD_MANAGED;
 
         if (cap->dcb_capability && cap->tsa_capability && cap->ets_capability)
-                set_bit(__QLCNIC_DCB_STATE, &adapter->state);
+                set_bit(QLCNIC_DCB_STATE, &dcb->state);
 
         return err;
 }
 
-static int qlcnic_82xx_dcb_query_cee_param(struct qlcnic_adapter *adapter,
+static int qlcnic_82xx_dcb_query_cee_param(struct qlcnic_dcb *dcb,
                                            char *buf, u8 type)
 {
         u16 size = sizeof(struct qlcnic_82xx_dcb_param_mbx_le);
+        struct qlcnic_adapter *adapter = dcb->adapter;
         struct qlcnic_82xx_dcb_param_mbx_le *prsp_le;
         struct device *dev = &adapter->pdev->dev;
         dma_addr_t cardrsp_phys_addr;
@@ -447,8 +449,7 @@ static int qlcnic_82xx_dcb_query_cee_param(struct qlcnic_adapter *adapter,
                 return -EINVAL;
         }
 
-        addr = dma_alloc_coherent(&adapter->pdev->dev, size, &cardrsp_phys_addr,
-                                  GFP_KERNEL);
+        addr = dma_alloc_coherent(dev, size, &cardrsp_phys_addr, GFP_KERNEL);
         if (addr == NULL)
                 return -ENOMEM;
 
@@ -488,72 +489,67 @@ out:
         qlcnic_free_mbx_args(&cmd);
 
 out_free_rsp:
-        dma_free_coherent(&adapter->pdev->dev, size, addr, cardrsp_phys_addr);
+        dma_free_coherent(dev, size, addr, cardrsp_phys_addr);
 
         return err;
 }
 
-static int qlcnic_82xx_dcb_get_cee_cfg(struct qlcnic_adapter *adapter)
+static int qlcnic_82xx_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
 {
         struct qlcnic_dcb_mbx_params *mbx;
         int err;
 
-        mbx = adapter->dcb->param;
+        mbx = dcb->param;
         if (!mbx)
                 return 0;
 
-        err = qlcnic_dcb_query_cee_param(adapter, (char *)&mbx->type[0],
+        err = qlcnic_dcb_query_cee_param(dcb, (char *)&mbx->type[0],
                                          QLC_DCB_LOCAL_PARAM_FWID);
         if (err)
                 return err;
 
-        err = qlcnic_dcb_query_cee_param(adapter, (char *)&mbx->type[1],
+        err = qlcnic_dcb_query_cee_param(dcb, (char *)&mbx->type[1],
                                          QLC_DCB_OPER_PARAM_FWID);
         if (err)
                 return err;
 
-        err = qlcnic_dcb_query_cee_param(adapter, (char *)&mbx->type[2],
+        err = qlcnic_dcb_query_cee_param(dcb, (char *)&mbx->type[2],
                                          QLC_DCB_PEER_PARAM_FWID);
         if (err)
                 return err;
 
         mbx->prio_tc_map = QLC_82XX_DCB_PRIO_TC_MAP;
 
-        qlcnic_dcb_data_cee_param_map(adapter);
+        qlcnic_dcb_data_cee_param_map(dcb->adapter);
 
         return err;
 }
 
 static void qlcnic_dcb_aen_work(struct work_struct *work)
 {
-        struct qlcnic_adapter *adapter;
         struct qlcnic_dcb *dcb;
 
         dcb = container_of(work, struct qlcnic_dcb, aen_work.work);
-        adapter = dcb->adapter;
 
-        qlcnic_dcb_get_cee_cfg(adapter);
-        clear_bit(__QLCNIC_DCB_IN_AEN, &adapter->state);
+        qlcnic_dcb_get_cee_cfg(dcb);
+        clear_bit(QLCNIC_DCB_AEN_MODE, &dcb->state);
 }
 
-static void qlcnic_82xx_dcb_handle_aen(struct qlcnic_adapter *adapter,
-                                       void *data)
+static void qlcnic_82xx_dcb_aen_handler(struct qlcnic_dcb *dcb, void *data)
 {
-        struct qlcnic_dcb *dcb = adapter->dcb;
-
-        if (test_and_set_bit(__QLCNIC_DCB_IN_AEN, &adapter->state))
+        if (test_and_set_bit(QLCNIC_DCB_AEN_MODE, &dcb->state))
                 return;
 
         queue_delayed_work(dcb->wq, &dcb->aen_work, 0);
 }
 
-static int qlcnic_83xx_dcb_get_hw_capability(struct qlcnic_adapter *adapter)
+static int qlcnic_83xx_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
 {
-        struct qlcnic_dcb_capability *cap = &adapter->dcb->cfg->capability;
+        struct qlcnic_dcb_capability *cap = &dcb->cfg->capability;
         u32 mbx_out;
         int err;
 
-        err = __qlcnic_dcb_get_capability(adapter, &mbx_out);
+        err = __qlcnic_dcb_get_capability(dcb, &mbx_out);
         if (err)
                 return err;
 
@@ -565,14 +561,15 @@ static int qlcnic_83xx_dcb_get_hw_capability(struct qlcnic_adapter *adapter)
                 cap->dcb_capability |= DCB_CAP_DCBX_LLD_MANAGED;
 
         if (cap->dcb_capability && cap->tsa_capability && cap->ets_capability)
-                set_bit(__QLCNIC_DCB_STATE, &adapter->state);
+                set_bit(QLCNIC_DCB_STATE, &dcb->state);
 
         return err;
 }
 
-static int qlcnic_83xx_dcb_query_cee_param(struct qlcnic_adapter *adapter,
+static int qlcnic_83xx_dcb_query_cee_param(struct qlcnic_dcb *dcb,
                                            char *buf, u8 idx)
 {
+        struct qlcnic_adapter *adapter = dcb->adapter;
         struct qlcnic_dcb_mbx_params mbx_out;
         int err, i, j, k, max_app, size;
         struct qlcnic_dcb_param *each;
@@ -632,24 +629,23 @@ out:
         return err;
 }
 
-static int qlcnic_83xx_dcb_get_cee_cfg(struct qlcnic_adapter *adapter)
+static int qlcnic_83xx_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
 {
-        struct qlcnic_dcb *dcb = adapter->dcb;
         int err;
 
-        err = qlcnic_dcb_query_cee_param(adapter, (char *)dcb->param, 0);
+        err = qlcnic_dcb_query_cee_param(dcb, (char *)dcb->param, 0);
         if (err)
                 return err;
 
-        qlcnic_dcb_data_cee_param_map(adapter);
+        qlcnic_dcb_data_cee_param_map(dcb->adapter);
 
         return err;
 }
 
-static int qlcnic_83xx_dcb_register_aen(struct qlcnic_adapter *adapter,
-                                        bool flag)
+static int qlcnic_83xx_dcb_register_aen(struct qlcnic_dcb *dcb, bool flag)
 {
         u8 val = (flag ? QLCNIC_CMD_INIT_NIC_FUNC : QLCNIC_CMD_STOP_NIC_FUNC);
+        struct qlcnic_adapter *adapter = dcb->adapter;
         struct qlcnic_cmd_args cmd;
         int err;
 
@@ -669,19 +665,17 @@ static int qlcnic_83xx_dcb_register_aen(struct qlcnic_adapter *adapter,
         return err;
 }
 
-static void qlcnic_83xx_dcb_handle_aen(struct qlcnic_adapter *adapter,
-                                       void *data)
+static void qlcnic_83xx_dcb_aen_handler(struct qlcnic_dcb *dcb, void *data)
 {
-        struct qlcnic_dcb *dcb = adapter->dcb;
         u32 *val = data;
 
-        if (test_and_set_bit(__QLCNIC_DCB_IN_AEN, &adapter->state))
+        if (test_and_set_bit(QLCNIC_DCB_AEN_MODE, &dcb->state))
                 return;
 
         if (*val & BIT_8)
-                set_bit(__QLCNIC_DCB_STATE, &adapter->state);
+                set_bit(QLCNIC_DCB_STATE, &dcb->state);
         else
-                clear_bit(__QLCNIC_DCB_STATE, &adapter->state);
+                clear_bit(QLCNIC_DCB_STATE, &dcb->state);
 
         queue_delayed_work(dcb->wq, &dcb->aen_work, 0);
 }
@@ -814,12 +808,12 @@ static u8 qlcnic_dcb_get_state(struct net_device *netdev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
 
-        return test_bit(__QLCNIC_DCB_STATE, &adapter->state);
+        return test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state);
 }
 
 static void qlcnic_dcb_get_perm_hw_addr(struct net_device *netdev, u8 *addr)
 {
-        memcpy(addr, netdev->dev_addr, netdev->addr_len);
+        memcpy(addr, netdev->perm_addr, netdev->addr_len);
 }
 
 static void
@@ -834,7 +828,7 @@ qlcnic_dcb_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, u8 *prio,
         type = &adapter->dcb->cfg->type[QLC_DCB_OPER_IDX];
         *prio = *pgid = *bw_per = *up_tc_map = 0;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state) ||
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state) ||
             !type->tc_param_valid)
                 return;
 
@@ -870,7 +864,7 @@ static void qlcnic_dcb_get_pg_bwg_cfg_tx(struct net_device *netdev, int pgid,
         *bw_pct = 0;
         type = &adapter->dcb->cfg->type[QLC_DCB_OPER_IDX];
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state) ||
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state) ||
             !type->tc_param_valid)
                 return;
 
@@ -896,7 +890,7 @@ static void qlcnic_dcb_get_pfc_cfg(struct net_device *netdev, int prio,
         *setting = 0;
         type = &adapter->dcb->cfg->type[QLC_DCB_OPER_IDX];
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state) ||
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state) ||
             !type->pfc_mode_enable)
                 return;
 
@@ -915,7 +909,7 @@ static u8 qlcnic_dcb_get_capability(struct net_device *netdev, int capid,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         switch (capid) {
@@ -944,7 +938,7 @@ static int qlcnic_dcb_get_num_tcs(struct net_device *netdev, int attr, u8 *num)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_dcb_cfg *cfg = adapter->dcb->cfg;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return -EINVAL;
 
         switch (attr) {
@@ -967,7 +961,7 @@ static u8 qlcnic_dcb_get_app(struct net_device *netdev, u8 idtype, u16 id)
                                 .protocol = id,
                              };
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         return dcb_getapp(netdev, &app);
@@ -978,7 +972,7 @@ static u8 qlcnic_dcb_get_pfc_state(struct net_device *netdev)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_dcb *dcb = adapter->dcb;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &dcb->state))
                 return 0;
 
         return dcb->cfg->type[QLC_DCB_OPER_IDX].pfc_mode_enable;
@@ -989,7 +983,7 @@ static u8 qlcnic_dcb_get_dcbx(struct net_device *netdev)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_dcb_cfg *cfg = adapter->dcb->cfg;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         return cfg->capability.dcb_capability;
@@ -1000,7 +994,7 @@ static u8 qlcnic_dcb_get_feat_cfg(struct net_device *netdev, int fid, u8 *flag)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_dcb_cee *type;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 1;
 
         type = &adapter->dcb->cfg->type[QLC_DCB_OPER_IDX];
@@ -1055,7 +1049,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,
 
         *app_count = 0;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         peer = &adapter->dcb->cfg->type[QLC_DCB_PEER_IDX];
@@ -1076,7 +1070,7 @@ static int qlcnic_dcb_peer_app_table(struct net_device *netdev,
         struct qlcnic_dcb_app *app;
         int i, j;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         peer = &adapter->dcb->cfg->type[QLC_DCB_PEER_IDX];
@@ -1101,7 +1095,7 @@ static int qlcnic_dcb_cee_peer_get_pg(struct net_device *netdev,
         struct qlcnic_dcb_cee *peer;
         u8 i, j, k, map;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         peer = &adapter->dcb->cfg->type[QLC_DCB_PEER_IDX];
@@ -1136,7 +1130,7 @@ static int qlcnic_dcb_cee_peer_get_pfc(struct net_device *netdev,
 
         pfc->pfc_en = 0;
 
-        if (!test_bit(__QLCNIC_DCB_STATE, &adapter->state))
+        if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
                 return 0;
 
         peer = &cfg->type[QLC_DCB_PEER_IDX];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
index b87ce9fb503e..c04ae0cdc108 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
@@ -8,26 +8,29 @@
 #ifndef __QLCNIC_DCBX_H
 #define __QLCNIC_DCBX_H
 
-void qlcnic_clear_dcb_ops(struct qlcnic_adapter *);
+#define QLCNIC_DCB_STATE        0
+#define QLCNIC_DCB_AEN_MODE     1
 
 #ifdef CONFIG_QLCNIC_DCB
-int __qlcnic_register_dcb(struct qlcnic_adapter *);
+int qlcnic_register_dcb(struct qlcnic_adapter *);
 #else
-static inline int __qlcnic_register_dcb(struct qlcnic_adapter *adapter)
+static inline int qlcnic_register_dcb(struct qlcnic_adapter *adapter)
 { return 0; }
 #endif
 
+struct qlcnic_dcb;
+
 struct qlcnic_dcb_ops {
-        void (*init_dcbnl_ops) (struct qlcnic_adapter *);
-        void (*free) (struct qlcnic_adapter *);
-        int (*attach) (struct qlcnic_adapter *);
-        int (*query_hw_capability) (struct qlcnic_adapter *, char *);
-        int (*get_hw_capability) (struct qlcnic_adapter *);
-        void (*get_info) (struct qlcnic_adapter *);
-        int (*query_cee_param) (struct qlcnic_adapter *, char *, u8);
-        int (*get_cee_cfg) (struct qlcnic_adapter *);
-        int (*register_aen) (struct qlcnic_adapter *, bool);
-        void (*handle_aen) (struct qlcnic_adapter *, void *);
+        int (*query_hw_capability) (struct qlcnic_dcb *, char *);
+        int (*get_hw_capability) (struct qlcnic_dcb *);
+        int (*query_cee_param) (struct qlcnic_dcb *, char *, u8);
+        void (*init_dcbnl_ops) (struct qlcnic_dcb *);
+        int (*register_aen) (struct qlcnic_dcb *, bool);
+        void (*aen_handler) (struct qlcnic_dcb *, void *);
+        int (*get_cee_cfg) (struct qlcnic_dcb *);
+        void (*get_info) (struct qlcnic_dcb *);
+        int (*attach) (struct qlcnic_dcb *);
+        void (*free) (struct qlcnic_dcb *);
 };
 
 struct qlcnic_dcb {
@@ -37,5 +40,85 @@ struct qlcnic_dcb {
         struct workqueue_struct         *wq;
         struct qlcnic_dcb_ops           *ops;
         struct qlcnic_dcb_cfg           *cfg;
+        unsigned long                   state;
 };
+
+static inline void qlcnic_clear_dcb_ops(struct qlcnic_dcb *dcb)
+{
+        kfree(dcb);
+        dcb = NULL;
+}
+
+static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->get_hw_capability)
+                return dcb->ops->get_hw_capability(dcb);
+
+        return 0;
+}
+
+static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->free)
+                dcb->ops->free(dcb);
+}
+
+static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->attach)
+                return dcb->ops->attach(dcb);
+
+        return 0;
+}
+
+static inline int
+qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf)
+{
+        if (dcb && dcb->ops->query_hw_capability)
+                return dcb->ops->query_hw_capability(dcb, buf);
+
+        return 0;
+}
+
+static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->get_info)
+                dcb->ops->get_info(dcb);
+}
+
+static inline int
+qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type)
+{
+        if (dcb && dcb->ops->query_cee_param)
+                return dcb->ops->query_cee_param(dcb, buf, type);
+
+        return 0;
+}
+
+static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->get_cee_cfg)
+                return dcb->ops->get_cee_cfg(dcb);
+
+        return 0;
+}
+
+static inline void
+qlcnic_dcb_register_aen(struct qlcnic_dcb *dcb, u8 flag)
+{
+        if (dcb && dcb->ops->register_aen)
+                dcb->ops->register_aen(dcb, flag);
+}
+
+static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg)
+{
+        if (dcb && dcb->ops->aen_handler)
+                dcb->ops->aen_handler(dcb, msg);
+}
+
+static inline void qlcnic_dcb_init_dcbnl_ops(struct qlcnic_dcb *dcb)
+{
+        if (dcb && dcb->ops->init_dcbnl_ops)
+                dcb->ops->init_dcbnl_ops(dcb);
+}
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index ff83a9fcd4c5..b2a8805997ca 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -187,8 +187,8 @@ static int qlcnic_dev_statistics_len(struct qlcnic_adapter *adapter)
                 return -1;
 }
 
-#define QLCNIC_RING_REGS_COUNT  20
-#define QLCNIC_RING_REGS_LEN    (QLCNIC_RING_REGS_COUNT * sizeof(u32))
+#define QLCNIC_TX_INTR_NOT_CONFIGURED   0X78563412
+
 #define QLCNIC_MAX_EEPROM_LEN   1024
 
 static const u32 diag_registers[] = {
@@ -219,7 +219,15 @@ static const u32 ext_diag_registers[] = {
 };
 
 #define QLCNIC_MGMT_API_VERSION 2
-#define QLCNIC_ETHTOOL_REGS_VER 3
+#define QLCNIC_ETHTOOL_REGS_VER 4
+
+static inline int qlcnic_get_ring_regs_len(struct qlcnic_adapter *adapter)
+{
+        int ring_regs_cnt = (adapter->max_drv_tx_rings * 5) +
+                            (adapter->max_rds_rings * 2) +
+                            (adapter->max_sds_rings * 3) + 5;
+        return ring_regs_cnt * sizeof(u32);
+}
 
 static int qlcnic_get_regs_len(struct net_device *dev)
 {
@@ -231,7 +239,9 @@ static int qlcnic_get_regs_len(struct net_device *dev)
         else
                 len = sizeof(ext_diag_registers) + sizeof(diag_registers);
 
-        return QLCNIC_RING_REGS_LEN + len + QLCNIC_DEV_INFO_SIZE + 1;
+        len += ((QLCNIC_DEV_INFO_SIZE + 2) * sizeof(u32));
+        len += qlcnic_get_ring_regs_len(adapter);
+        return len;
 }
 
 static int qlcnic_get_eeprom_len(struct net_device *dev)
@@ -493,6 +503,8 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         struct qlcnic_recv_context *recv_ctx = adapter->recv_ctx;
         struct qlcnic_host_sds_ring *sds_ring;
+        struct qlcnic_host_rds_ring *rds_rings;
+        struct qlcnic_host_tx_ring *tx_ring;
         u32 *regs_buff = p;
         int ring, i = 0;
 
@@ -512,21 +524,35 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
         if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
                 return;
 
-        regs_buff[i++] = 0xFFEFCDAB; /* Marker btw regs and ring count*/
-
-        regs_buff[i++] = 1; /* No. of tx ring */
-        regs_buff[i++] = le32_to_cpu(*(adapter->tx_ring->hw_consumer));
-        regs_buff[i++] = readl(adapter->tx_ring->crb_cmd_producer);
-
-        regs_buff[i++] = 2; /* No. of rx ring */
-        regs_buff[i++] = readl(recv_ctx->rds_rings[0].crb_rcv_producer);
-        regs_buff[i++] = readl(recv_ctx->rds_rings[1].crb_rcv_producer);
+        /* Marker btw regs and TX ring count */
+        regs_buff[i++] = 0xFFEFCDAB;
+
+        regs_buff[i++] = adapter->max_drv_tx_rings; /* No. of TX ring */
+        for (ring = 0; ring < adapter->max_drv_tx_rings; ring++) {
+                tx_ring = &adapter->tx_ring[ring];
+                regs_buff[i++] = le32_to_cpu(*(tx_ring->hw_consumer));
+                regs_buff[i++] = tx_ring->sw_consumer;
+                regs_buff[i++] = readl(tx_ring->crb_cmd_producer);
+                regs_buff[i++] = tx_ring->producer;
+                if (tx_ring->crb_intr_mask)
+                        regs_buff[i++] = readl(tx_ring->crb_intr_mask);
+                else
+                        regs_buff[i++] = QLCNIC_TX_INTR_NOT_CONFIGURED;
+        }
 
-        regs_buff[i++] = adapter->max_sds_rings;
+        regs_buff[i++] = adapter->max_rds_rings; /* No. of RX ring */
+        for (ring = 0; ring < adapter->max_rds_rings; ring++) {
+                rds_rings = &recv_ctx->rds_rings[ring];
+                regs_buff[i++] = readl(rds_rings->crb_rcv_producer);
+                regs_buff[i++] = rds_rings->producer;
+        }
 
+        regs_buff[i++] = adapter->max_sds_rings; /* No. of SDS ring */
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &(recv_ctx->sds_rings[ring]);
                 regs_buff[i++] = readl(sds_ring->crb_sts_consumer);
+                regs_buff[i++] = sds_ring->consumer;
+                regs_buff[i++] = readl(sds_ring->crb_intr_mask);
         }
 }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index f8adc7b01f1f..73e72eb83bdf 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -445,7 +445,7 @@ int qlcnic_82xx_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
 
         mac_req = (struct qlcnic_mac_req *)&req.words[0];
         mac_req->op = op;
-        memcpy(mac_req->mac_addr, addr, 6);
+        memcpy(mac_req->mac_addr, addr, ETH_ALEN);
 
         vlan_req = (struct qlcnic_vlan_req *)&req.words[1];
         vlan_req->vlan_id = cpu_to_le16(vlan_id);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 11b4bb83b930..897627dd1d04 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -1011,7 +1011,7 @@ static void qlcnic_handle_fw_message(int desc_cnt, int index,
                 }
                 break;
         case QLCNIC_C2H_OPCODE_GET_DCB_AEN:
-                qlcnic_dcb_handle_aen(adapter, (void *)&msg);
+                qlcnic_dcb_aen_handler(adapter->dcb, (void *)&msg);
                 break;
         default:
                 break;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 9e61eb867452..dcf4a4e7ce23 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -819,7 +819,7 @@ static bool qlcnic_port_eswitch_cfg_capability(struct qlcnic_adapter *adapter)
 int qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_pci_info *pci_info;
-        int i, ret = 0, j = 0;
+        int i, id = 0, ret = 0, j = 0;
         u16 act_pci_func;
         u8 pfn;
 
@@ -860,7 +860,8 @@ int qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
                         continue;
 
                 if (qlcnic_port_eswitch_cfg_capability(adapter)) {
-                        if (!qlcnic_83xx_enable_port_eswitch(adapter, pfn))
+                        if (!qlcnic_83xx_set_port_eswitch_status(adapter, pfn,
+                                                                 &id))
                                 adapter->npars[j].eswitch_status = true;
                         else
                                 continue;
@@ -875,15 +876,16 @@ int qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
                 adapter->npars[j].min_bw = pci_info[i].tx_min_bw;
                 adapter->npars[j].max_bw = pci_info[i].tx_max_bw;
 
+                memcpy(&adapter->npars[j].mac, &pci_info[i].mac, ETH_ALEN);
                 j++;
         }
 
-        if (qlcnic_82xx_check(adapter)) {
+        /* Update eSwitch status for adapters without per port eSwitch
+         * configuration capability
+         */
+        if (!qlcnic_port_eswitch_cfg_capability(adapter)) {
                 for (i = 0; i < QLCNIC_NIU_MAX_XG_PORTS; i++)
                         adapter->eswitch[i].flags |= QLCNIC_SWITCH_ENABLE;
-        } else if (!qlcnic_port_eswitch_cfg_capability(adapter)) {
-                for (i = 0; i < QLCNIC_NIU_MAX_XG_PORTS; i++)
-                        qlcnic_enable_eswitch(adapter, i, 1);
         }
 
         kfree(pci_info);
@@ -2069,7 +2071,7 @@ qlcnic_setup_netdev(struct qlcnic_adapter *adapter, struct net_device *netdev,
                 return err;
         }
 
-        qlcnic_dcb_init_dcbnl_ops(adapter);
+        qlcnic_dcb_init_dcbnl_ops(adapter->dcb);
 
         return 0;
 }
@@ -2164,17 +2166,6 @@ void qlcnic_set_drv_version(struct qlcnic_adapter *adapter)
                 qlcnic_fw_cmd_set_drv_version(adapter, fw_cmd);
 }
 
-static int qlcnic_register_dcb(struct qlcnic_adapter *adapter)
-{
-        return __qlcnic_register_dcb(adapter);
-}
-
-void qlcnic_clear_dcb_ops(struct qlcnic_adapter *adapter)
-{
-        kfree(adapter->dcb);
-        adapter->dcb = NULL;
-}
-
 static int
 qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2183,6 +2174,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct qlcnic_hardware_context *ahw;
         int err, pci_using_dac = -1;
         char board_name[QLCNIC_MAX_BOARD_NAME_LEN + 19]; /* MAC + ": " + name */
+        struct qlcnic_dcb *dcb;
 
         if (pdev->is_virtfn)
                 return -ENODEV;
@@ -2303,8 +2295,10 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
                 adapter->flags |= QLCNIC_NEED_FLR;
 
-                if (adapter->dcb && qlcnic_dcb_attach(adapter))
-                        qlcnic_clear_dcb_ops(adapter);
+                dcb = adapter->dcb;
+
+                if (dcb && qlcnic_dcb_attach(dcb))
+                        qlcnic_clear_dcb_ops(dcb);
 
         } else if (qlcnic_83xx_check(adapter)) {
                 adapter->max_drv_tx_rings = 1;
@@ -2412,7 +2406,6 @@ err_out_free_res:
         pci_release_regions(pdev);
 
 err_out_disable_pdev:
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
         return err;
 
@@ -2449,7 +2442,7 @@ static void qlcnic_remove(struct pci_dev *pdev)
         qlcnic_cancel_idc_work(adapter);
         ahw = adapter->ahw;
 
-        qlcnic_dcb_free(adapter);
+        qlcnic_dcb_free(adapter->dcb);
 
         unregister_netdev(netdev);
         qlcnic_sriov_cleanup(adapter);
@@ -2488,7 +2481,6 @@ static void qlcnic_remove(struct pci_dev *pdev)
         pci_disable_pcie_error_reporting(pdev);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         if (adapter->qlcnic_wq) {
                 destroy_workqueue(adapter->qlcnic_wq);
@@ -3327,7 +3319,7 @@ qlcnic_attach_work(struct work_struct *work)
                 return;
         }
 attach:
-        qlcnic_dcb_get_info(adapter);
+        qlcnic_dcb_get_info(adapter->dcb);
 
         if (netif_running(netdev)) {
                 if (qlcnic_up(adapter, netdev))
@@ -3352,6 +3344,8 @@ done:
 static int
 qlcnic_check_health(struct qlcnic_adapter *adapter)
 {
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct qlcnic_fw_dump *fw_dump = &ahw->fw_dump;
         u32 state = 0, heartbeat;
         u32 peg_status;
         int err = 0;
@@ -3376,7 +3370,7 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
                 if (adapter->need_fw_reset)
                         goto detach;
 
-                if (adapter->ahw->reset_context && qlcnic_auto_fw_reset)
+                if (ahw->reset_context && qlcnic_auto_fw_reset)
                         qlcnic_reset_hw_context(adapter);
 
                 return 0;
@@ -3419,6 +3413,9 @@ detach:
 
                 qlcnic_schedule_work(adapter, qlcnic_detach_work, 0);
                 QLCDB(adapter, DRV, "fw recovery scheduled.\n");
+        } else if (!qlcnic_auto_fw_reset && fw_dump->enable &&
+                   adapter->flags & QLCNIC_FW_RESET_OWNER) {
+                qlcnic_dump_fw(adapter);
         }
 
         return 1;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index 15513608d480..7763962e2ec4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1187,41 +1187,38 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
                 }
 
                 if (ops_index == ops_cnt) {
-                        dev_info(&adapter->pdev->dev,
-                                 "Invalid entry type %d, exiting dump\n",
+                        dev_info(dev, "Skipping unknown entry opcode %d\n",
                                  entry->hdr.type);
-                        goto error;
+                        entry->hdr.flags |= QLCNIC_DUMP_SKIP;
+                        entry_offset += entry->hdr.offset;
+                        continue;
                 }
 
                 /* Collect dump for this entry */
                 dump = fw_dump_ops[ops_index].handler(adapter, entry, buffer);
-                if (!qlcnic_valid_dump_entry(&adapter->pdev->dev, entry, dump))
+                if (!qlcnic_valid_dump_entry(dev, entry, dump)) {
                         entry->hdr.flags |= QLCNIC_DUMP_SKIP;
+                        entry_offset += entry->hdr.offset;
+                        continue;
+                }
+
                 buf_offset += entry->hdr.cap_size;
                 entry_offset += entry->hdr.offset;
                 buffer = fw_dump->data + buf_offset;
         }
-        if (dump_size != buf_offset) {
-                dev_info(&adapter->pdev->dev,
-                         "Captured(%d) and expected size(%d) do not match\n",
-                         buf_offset, dump_size);
-                goto error;
-        } else {
-                fw_dump->clr = 1;
-                snprintf(mesg, sizeof(mesg), "FW_DUMP=%s",
-                         adapter->netdev->name);
-                dev_info(&adapter->pdev->dev, "%s: Dump data, %d bytes captured\n",
-                         adapter->netdev->name, fw_dump->size);
-                /* Send a udev event to notify availability of FW dump */
-                kobject_uevent_env(&adapter->pdev->dev.kobj, KOBJ_CHANGE, msg);
-                return 0;
-        }
-error:
+
+        fw_dump->clr = 1;
+        snprintf(mesg, sizeof(mesg), "FW_DUMP=%s", adapter->netdev->name);
+        dev_info(dev, "%s: Dump data %d bytes captured, template header size %d bytes\n",
+                 adapter->netdev->name, fw_dump->size, tmpl_hdr->size);
+        /* Send a udev event to notify availability of FW dump */
+        kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, msg);
+
         if (fw_dump->use_pex_dma)
                 dma_free_coherent(dev, QLC_PEX_DMA_READ_SIZE,
                                   fw_dump->dma_buffer, fw_dump->phys_addr);
-        vfree(fw_dump->data);
-        return -EINVAL;
+
+        return 0;
 }
 
 void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 392b9bd12b4f..8b96e29df30f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -500,6 +500,7 @@ static int qlcnic_sriov_vf_init_driver(struct qlcnic_adapter *adapter)
 static int qlcnic_sriov_setup_vf(struct qlcnic_adapter *adapter,
                                  int pci_using_dac)
 {
+        struct qlcnic_dcb *dcb;
         int err;
 
         INIT_LIST_HEAD(&adapter->vf_mc_list);
@@ -533,8 +534,10 @@ static int qlcnic_sriov_setup_vf(struct qlcnic_adapter *adapter,
         if (err)
                 goto err_out_send_channel_term;
 
-        if (adapter->dcb && qlcnic_dcb_attach(adapter))
-                qlcnic_clear_dcb_ops(adapter);
+        dcb = adapter->dcb;
+
+        if (dcb && qlcnic_dcb_attach(dcb))
+                qlcnic_clear_dcb_ops(dcb);
 
         err = qlcnic_setup_netdev(adapter, adapter->netdev, pci_using_dac);
         if (err)
@@ -1577,7 +1580,7 @@ static int qlcnic_sriov_vf_reinit_driver(struct qlcnic_adapter *adapter)
         if (err)
                 goto err_out_term_channel;
 
-        qlcnic_dcb_get_info(adapter);
+        qlcnic_dcb_get_info(adapter->dcb);
 
         return 0;
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 899433778466..0c9c4e895595 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -18,7 +18,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "v1.00.00.32"
+#define DRV_VERSION     "1.00.00.33"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
@@ -2206,14 +2206,14 @@ extern char qlge_driver_name[];
 extern const char qlge_driver_version[];
 extern const struct ethtool_ops qlge_ethtool_ops;
 
-extern int ql_sem_spinlock(struct ql_adapter *qdev, u32 sem_mask);
-extern void ql_sem_unlock(struct ql_adapter *qdev, u32 sem_mask);
-extern int ql_read_xgmac_reg(struct ql_adapter *qdev, u32 reg, u32 *data);
-extern int ql_get_mac_addr_reg(struct ql_adapter *qdev, u32 type, u16 index,
-                               u32 *value);
-extern int ql_get_routing_reg(struct ql_adapter *qdev, u32 index, u32 *value);
-extern int ql_write_cfg(struct ql_adapter *qdev, void *ptr, int size, u32 bit,
-                        u16 q_id);
+int ql_sem_spinlock(struct ql_adapter *qdev, u32 sem_mask);
+void ql_sem_unlock(struct ql_adapter *qdev, u32 sem_mask);
+int ql_read_xgmac_reg(struct ql_adapter *qdev, u32 reg, u32 *data);
+int ql_get_mac_addr_reg(struct ql_adapter *qdev, u32 type, u16 index,
+                        u32 *value);
+int ql_get_routing_reg(struct ql_adapter *qdev, u32 index, u32 *value);
+int ql_write_cfg(struct ql_adapter *qdev, void *ptr, int size, u32 bit,
+                 u16 q_id);
 void ql_queue_fw_error(struct ql_adapter *qdev);
 void ql_mpi_work(struct work_struct *work);
 void ql_mpi_reset_work(struct work_struct *work);
@@ -2233,10 +2233,9 @@ int ql_unpause_mpi_risc(struct ql_adapter *qdev);
 int ql_pause_mpi_risc(struct ql_adapter *qdev);
 int ql_hard_reset_mpi_risc(struct ql_adapter *qdev);
 int ql_soft_reset_mpi_risc(struct ql_adapter *qdev);
-int ql_dump_risc_ram_area(struct ql_adapter *qdev, void *buf,
-                u32 ram_addr, int word_count);
-int ql_core_dump(struct ql_adapter *qdev,
-                struct ql_mpi_coredump *mpi_coredump);
+int ql_dump_risc_ram_area(struct ql_adapter *qdev, void *buf, u32 ram_addr,
+                          int word_count);
+int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump);
 int ql_mb_about_fw(struct ql_adapter *qdev);
 int ql_mb_wol_set_magic(struct ql_adapter *qdev, u32 enable_wol);
 int ql_mb_wol_mode(struct ql_adapter *qdev, u32 wol);
@@ -2249,8 +2248,7 @@ int ql_mb_get_port_cfg(struct ql_adapter *qdev);
 int ql_mb_set_port_cfg(struct ql_adapter *qdev);
 int ql_wait_fifo_empty(struct ql_adapter *qdev);
 void ql_get_dump(struct ql_adapter *qdev, void *buff);
-void ql_gen_reg_dump(struct ql_adapter *qdev,
-                        struct ql_reg_dump *mpi_coredump);
+void ql_gen_reg_dump(struct ql_adapter *qdev, struct ql_reg_dump *mpi_coredump);
 netdev_tx_t ql_lb_send(struct sk_buff *skb, struct net_device *ndev);
 void ql_check_lb_frame(struct ql_adapter *, struct sk_buff *);
 int ql_own_firmware(struct ql_adapter *qdev);
@@ -2264,9 +2262,9 @@ int ql_clean_lb_rx_ring(struct rx_ring *rx_ring, int budget);
 /* #define QL_OB_DUMP */
 
 #ifdef QL_REG_DUMP
-extern void ql_dump_xgmac_control_regs(struct ql_adapter *qdev);
-extern void ql_dump_routing_entries(struct ql_adapter *qdev);
-extern void ql_dump_regs(struct ql_adapter *qdev);
+void ql_dump_xgmac_control_regs(struct ql_adapter *qdev);
+void ql_dump_routing_entries(struct ql_adapter *qdev);
+void ql_dump_regs(struct ql_adapter *qdev);
 #define QL_DUMP_REGS(qdev) ql_dump_regs(qdev)
 #define QL_DUMP_ROUTE(qdev) ql_dump_routing_entries(qdev)
 #define QL_DUMP_XGMAC_CONTROL_REGS(qdev) ql_dump_xgmac_control_regs(qdev)
@@ -2277,26 +2275,26 @@ extern void ql_dump_regs(struct ql_adapter *qdev);
 #endif
 
 #ifdef QL_STAT_DUMP
-extern void ql_dump_stat(struct ql_adapter *qdev);
+void ql_dump_stat(struct ql_adapter *qdev);
 #define QL_DUMP_STAT(qdev) ql_dump_stat(qdev)
 #else
 #define QL_DUMP_STAT(qdev)
 #endif
 
 #ifdef QL_DEV_DUMP
-extern void ql_dump_qdev(struct ql_adapter *qdev);
+void ql_dump_qdev(struct ql_adapter *qdev);
 #define QL_DUMP_QDEV(qdev) ql_dump_qdev(qdev)
 #else
 #define QL_DUMP_QDEV(qdev)
 #endif
 
 #ifdef QL_CB_DUMP
-extern void ql_dump_wqicb(struct wqicb *wqicb);
-extern void ql_dump_tx_ring(struct tx_ring *tx_ring);
-extern void ql_dump_ricb(struct ricb *ricb);
-extern void ql_dump_cqicb(struct cqicb *cqicb);
-extern void ql_dump_rx_ring(struct rx_ring *rx_ring);
-extern void ql_dump_hw_cb(struct ql_adapter *qdev, int size, u32 bit, u16 q_id);
+void ql_dump_wqicb(struct wqicb *wqicb);
+void ql_dump_tx_ring(struct tx_ring *tx_ring);
+void ql_dump_ricb(struct ricb *ricb);
+void ql_dump_cqicb(struct cqicb *cqicb);
+void ql_dump_rx_ring(struct rx_ring *rx_ring);
+void ql_dump_hw_cb(struct ql_adapter *qdev, int size, u32 bit, u16 q_id);
 #define QL_DUMP_RICB(ricb) ql_dump_ricb(ricb)
 #define QL_DUMP_WQICB(wqicb) ql_dump_wqicb(wqicb)
 #define QL_DUMP_TX_RING(tx_ring) ql_dump_tx_ring(tx_ring)
@@ -2314,9 +2312,9 @@ extern void ql_dump_hw_cb(struct ql_adapter *qdev, int size, u32 bit, u16 q_id);
 #endif
 
 #ifdef QL_OB_DUMP
-extern void ql_dump_tx_desc(struct tx_buf_desc *tbd);
-extern void ql_dump_ob_mac_iocb(struct ob_mac_iocb_req *ob_mac_iocb);
-extern void ql_dump_ob_mac_rsp(struct ob_mac_iocb_rsp *ob_mac_rsp);
+void ql_dump_tx_desc(struct tx_buf_desc *tbd);
+void ql_dump_ob_mac_iocb(struct ob_mac_iocb_req *ob_mac_iocb);
+void ql_dump_ob_mac_rsp(struct ob_mac_iocb_rsp *ob_mac_rsp);
 #define QL_DUMP_OB_MAC_IOCB(ob_mac_iocb) ql_dump_ob_mac_iocb(ob_mac_iocb)
 #define QL_DUMP_OB_MAC_RSP(ob_mac_rsp) ql_dump_ob_mac_rsp(ob_mac_rsp)
 #else
@@ -2325,14 +2323,14 @@ extern void ql_dump_ob_mac_rsp(struct ob_mac_iocb_rsp *ob_mac_rsp);
 #endif
 
 #ifdef QL_IB_DUMP
-extern void ql_dump_ib_mac_rsp(struct ib_mac_iocb_rsp *ib_mac_rsp);
+void ql_dump_ib_mac_rsp(struct ib_mac_iocb_rsp *ib_mac_rsp);
 #define QL_DUMP_IB_MAC_RSP(ib_mac_rsp) ql_dump_ib_mac_rsp(ib_mac_rsp)
 #else
 #define QL_DUMP_IB_MAC_RSP(ib_mac_rsp)
 #endif
 
 #ifdef  QL_ALL_DUMP
-extern void ql_dump_all(struct ql_adapter *qdev);
+void ql_dump_all(struct ql_adapter *qdev);
 #define QL_DUMP_ALL(qdev) ql_dump_all(qdev)
 #else
 #define QL_DUMP_ALL(qdev)
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 2553cf4503b9..a245dc18d769 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -96,8 +96,10 @@ static DEFINE_PCI_DEVICE_TABLE(qlge_pci_tbl) = {
 
 MODULE_DEVICE_TABLE(pci, qlge_pci_tbl);
 
-static int ql_wol(struct ql_adapter *qdev);
-static void qlge_set_multicast_list(struct net_device *ndev);
+static int ql_wol(struct ql_adapter *);
+static void qlge_set_multicast_list(struct net_device *);
+static int ql_adapter_down(struct ql_adapter *);
+static int ql_adapter_up(struct ql_adapter *);
 
 /* This hardware semaphore causes exclusive access to
  * resources shared between the NIC driver, MPI firmware,
@@ -1464,6 +1466,29 @@ static void ql_categorize_rx_err(struct ql_adapter *qdev, u8 rx_err,
         }
 }
 
+/**
+ * ql_update_mac_hdr_len - helper routine to update the mac header length
+ * based on vlan tags if present
+ */
+static void ql_update_mac_hdr_len(struct ql_adapter *qdev,
+                                  struct ib_mac_iocb_rsp *ib_mac_rsp,
+                                  void *page, size_t *len)
+{
+        u16 *tags;
+
+        if (qdev->ndev->features & NETIF_F_HW_VLAN_CTAG_RX)
+                return;
+        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) {
+                tags = (u16 *)page;
+                /* Look for stacked vlan tags in ethertype field */
+                if (tags[6] == ETH_P_8021Q &&
+                    tags[8] == ETH_P_8021Q)
+                        *len += 2 * VLAN_HLEN;
+                else
+                        *len += VLAN_HLEN;
+        }
+}
+
 /* Process an inbound completion from an rx ring. */
 static void ql_process_mac_rx_gro_page(struct ql_adapter *qdev,
                                         struct rx_ring *rx_ring,
@@ -1523,6 +1548,7 @@ static void ql_process_mac_rx_page(struct ql_adapter *qdev,
         void *addr;
         struct bq_desc *lbq_desc = ql_get_curr_lchunk(qdev, rx_ring);
         struct napi_struct *napi = &rx_ring->napi;
+        size_t hlen = ETH_HLEN;
 
         skb = netdev_alloc_skb(ndev, length);
         if (!skb) {
@@ -1540,25 +1566,28 @@ static void ql_process_mac_rx_page(struct ql_adapter *qdev,
                 goto err_out;
         }
 
+        /* Update the MAC header length*/
+        ql_update_mac_hdr_len(qdev, ib_mac_rsp, addr, &hlen);
+
         /* The max framesize filter on this chip is set higher than
          * MTU since FCoE uses 2k frames.
          */
-        if (skb->len > ndev->mtu + ETH_HLEN) {
+        if (skb->len > ndev->mtu + hlen) {
                 netif_err(qdev, drv, qdev->ndev,
                           "Segment too small, dropping.\n");
                 rx_ring->rx_dropped++;
                 goto err_out;
         }
-        memcpy(skb_put(skb, ETH_HLEN), addr, ETH_HLEN);
+        memcpy(skb_put(skb, hlen), addr, hlen);
         netif_printk(qdev, rx_status, KERN_DEBUG, qdev->ndev,
                      "%d bytes of headers and data in large. Chain page to new skb and pull tail.\n",
                      length);
         skb_fill_page_desc(skb, 0, lbq_desc->p.pg_chunk.page,
-                                lbq_desc->p.pg_chunk.offset+ETH_HLEN,
-                                length-ETH_HLEN);
-        skb->len += length-ETH_HLEN;
-        skb->data_len += length-ETH_HLEN;
-        skb->truesize += length-ETH_HLEN;
+                                lbq_desc->p.pg_chunk.offset + hlen,
+                                length - hlen);
+        skb->len += length - hlen;
+        skb->data_len += length - hlen;
+        skb->truesize += length - hlen;
 
         rx_ring->rx_packets++;
         rx_ring->rx_bytes += skb->len;
@@ -1576,7 +1605,7 @@ static void ql_process_mac_rx_page(struct ql_adapter *qdev,
                                 (ib_mac_rsp->flags3 & IB_MAC_IOCB_RSP_V4)) {
                         /* Unfragmented ipv4 UDP frame. */
                         struct iphdr *iph =
-                                (struct iphdr *) ((u8 *)addr + ETH_HLEN);
+                                (struct iphdr *)((u8 *)addr + hlen);
                         if (!(iph->frag_off &
                                 htons(IP_MF|IP_OFFSET))) {
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1726,7 +1755,8 @@ static struct sk_buff *ql_build_rx_skb(struct ql_adapter *qdev,
         struct bq_desc *sbq_desc;
         struct sk_buff *skb = NULL;
         u32 length = le32_to_cpu(ib_mac_rsp->data_len);
-       u32 hdr_len = le32_to_cpu(ib_mac_rsp->hdr_len);
+        u32 hdr_len = le32_to_cpu(ib_mac_rsp->hdr_len);
+        size_t hlen = ETH_HLEN;
 
         /*
          * Handle the header buffer if present.
@@ -1853,9 +1883,10 @@ static struct sk_buff *ql_build_rx_skb(struct ql_adapter *qdev,
                         skb->data_len += length;
                         skb->truesize += length;
                         length -= length;
-                        __pskb_pull_tail(skb,
-                                (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) ?
-                                VLAN_ETH_HLEN : ETH_HLEN);
+                        ql_update_mac_hdr_len(qdev, ib_mac_rsp,
+                                              lbq_desc->p.pg_chunk.va,
+                                              &hlen);
+                        __pskb_pull_tail(skb, hlen);
                 }
         } else {
                 /*
@@ -1910,8 +1941,9 @@ static struct sk_buff *ql_build_rx_skb(struct ql_adapter *qdev,
                         length -= size;
                         i++;
                 }
-                __pskb_pull_tail(skb, (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) ?
-                                VLAN_ETH_HLEN : ETH_HLEN);
+                ql_update_mac_hdr_len(qdev, ib_mac_rsp, lbq_desc->p.pg_chunk.va,
+                                      &hlen);
+                __pskb_pull_tail(skb, hlen);
         }
         return skb;
 }
@@ -2003,7 +2035,7 @@ static void ql_process_mac_split_rx_intr(struct ql_adapter *qdev,
         rx_ring->rx_packets++;
         rx_ring->rx_bytes += skb->len;
         skb_record_rx_queue(skb, rx_ring->cq_id);
-        if ((ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) && (vlan_id != 0))
+        if (vlan_id != 0xffff)
                 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_id);
         if (skb->ip_summed == CHECKSUM_UNNECESSARY)
                 napi_gro_receive(&rx_ring->napi, skb);
@@ -2017,7 +2049,8 @@ static unsigned long ql_process_mac_rx_intr(struct ql_adapter *qdev,
                                         struct ib_mac_iocb_rsp *ib_mac_rsp)
 {
         u32 length = le32_to_cpu(ib_mac_rsp->data_len);
-        u16 vlan_id = (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) ?
+        u16 vlan_id = ((ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_V) &&
+                        (qdev->ndev->features & NETIF_F_HW_VLAN_CTAG_RX)) ?
                         ((le16_to_cpu(ib_mac_rsp->vlan_id) &
                         IB_MAC_IOCB_RSP_VLAN_MASK)) : 0xffff;
 
@@ -2310,9 +2343,39 @@ static void qlge_vlan_mode(struct net_device *ndev, netdev_features_t features)
         }
 }
 
+/**
+ * qlge_update_hw_vlan_features - helper routine to reinitialize the adapter
+ * based on the features to enable/disable hardware vlan accel
+ */
+static int qlge_update_hw_vlan_features(struct net_device *ndev,
+                                        netdev_features_t features)
+{
+        struct ql_adapter *qdev = netdev_priv(ndev);
+        int status = 0;
+
+        status = ql_adapter_down(qdev);
+        if (status) {
+                netif_err(qdev, link, qdev->ndev,
+                          "Failed to bring down the adapter\n");
+                return status;
+        }
+
+        /* update the features with resent change */
+        ndev->features = features;
+
+        status = ql_adapter_up(qdev);
+        if (status) {
+                netif_err(qdev, link, qdev->ndev,
+                          "Failed to bring up the adapter\n");
+                return status;
+        }
+        return status;
+}
+
 static netdev_features_t qlge_fix_features(struct net_device *ndev,
         netdev_features_t features)
 {
+        int err;
         /*
          * Since there is no support for separate rx/tx vlan accel
          * enable/disable make sure tx flag is always in same state as rx.
@@ -2322,6 +2385,11 @@ static netdev_features_t qlge_fix_features(struct net_device *ndev,
         else
                 features &= ~NETIF_F_HW_VLAN_CTAG_TX;
 
+        /* Update the behavior of vlan accel in the adapter */
+        err = qlge_update_hw_vlan_features(ndev, features);
+        if (err)
+                return err;
+
         return features;
 }
 
@@ -3704,8 +3772,12 @@ static int ql_adapter_initialize(struct ql_adapter *qdev)
         ql_write32(qdev, SYS, mask | value);
 
         /* Set the default queue, and VLAN behavior. */
-        value = NIC_RCV_CFG_DFQ | NIC_RCV_CFG_RV;
-        mask = NIC_RCV_CFG_DFQ_MASK | (NIC_RCV_CFG_RV << 16);
+        value = NIC_RCV_CFG_DFQ;
+        mask = NIC_RCV_CFG_DFQ_MASK;
+        if (qdev->ndev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+                value |= NIC_RCV_CFG_RV;
+                mask |= (NIC_RCV_CFG_RV << 16);
+        }
         ql_write32(qdev, NIC_RCV_CFG, (mask | value));
 
         /* Set the MPI interrupt to enabled. */
@@ -4505,7 +4577,6 @@ static void ql_release_all(struct pci_dev *pdev)
                 iounmap(qdev->doorbell_area);
         vfree(qdev->mpi_coredump);
         pci_release_regions(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static int ql_init_device(struct pci_dev *pdev, struct net_device *ndev,
@@ -4692,11 +4763,15 @@ static int qlge_probe(struct pci_dev *pdev,
 
         qdev = netdev_priv(ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
-        ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO_ECN |
-                NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_RXCSUM;
-        ndev->features = ndev->hw_features |
-                NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER;
+        ndev->hw_features = NETIF_F_SG |
+                            NETIF_F_IP_CSUM |
+                            NETIF_F_TSO |
+                            NETIF_F_TSO_ECN |
+                            NETIF_F_HW_VLAN_CTAG_TX |
+                            NETIF_F_HW_VLAN_CTAG_RX |
+                            NETIF_F_HW_VLAN_CTAG_FILTER |
+                            NETIF_F_RXCSUM;
+        ndev->features = ndev->hw_features;
         ndev->vlan_features = ndev->hw_features;
 
         if (test_bit(QL_DMA64, &qdev->flags))
diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c
index e9dc84943cfc..1e49ec5b2232 100644
--- a/drivers/net/ethernet/rdc/r6040.c
+++ b/drivers/net/ethernet/rdc/r6040.c
@@ -1231,7 +1231,6 @@ err_out_mdio:
         mdiobus_free(lp->mii_bus);
 err_out_unmap:
         netif_napi_del(&lp->napi);
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ioaddr);
 err_out_free_res:
         pci_release_regions(pdev);
@@ -1257,7 +1256,6 @@ static void r6040_remove_one(struct pci_dev *pdev)
         pci_release_regions(pdev);
         free_netdev(dev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index d2e591955bdd..f2a2128165dd 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -2052,7 +2052,6 @@ static void cp_remove_one (struct pci_dev *pdev)
         pci_release_regions(pdev);
         pci_clear_mwi(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
 }
 
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index 3ccedeb8aba0..50a92104dd0a 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -727,7 +727,6 @@ static void __rtl8139_cleanup_dev (struct net_device *dev)
         pci_release_regions (pdev);
 
         free_netdev(dev);
-        pci_set_drvdata (pdev, NULL);
 }
 
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 3397cee89777..799387570766 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6811,7 +6811,6 @@ static void rtl_remove_one(struct pci_dev *pdev)
 
         rtl_disable_msi(pdev, tp);
         rtl8169_release_board(pdev, dev, tp->mmio_addr);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static const struct net_device_ops rtl_netdev_ops = {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index b57c278d3b46..7258366f7e0b 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -872,7 +872,7 @@ static void update_mac_address(struct net_device *ndev)
 static void read_mac_address(struct net_device *ndev, unsigned char *mac)
 {
         if (mac[0] || mac[1] || mac[2] || mac[3] || mac[4] || mac[5]) {
-                memcpy(ndev->dev_addr, mac, 6);
+                memcpy(ndev->dev_addr, mac, ETH_ALEN);
         } else {
                 ndev->dev_addr[0] = (sh_eth_read(ndev, MAHR) >> 24);
                 ndev->dev_addr[1] = (sh_eth_read(ndev, MAHR) >> 16) & 0xFF;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 21f9ad6392e9..676c3c057bfb 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -285,6 +285,181 @@ static int efx_ef10_free_vis(struct efx_nic *efx)
         return rc;
 }
 
+#ifdef EFX_USE_PIO
+
+static void efx_ef10_free_piobufs(struct efx_nic *efx)
+{
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_FREE_PIOBUF_IN_LEN);
+        unsigned int i;
+        int rc;
+
+        BUILD_BUG_ON(MC_CMD_FREE_PIOBUF_OUT_LEN != 0);
+
+        for (i = 0; i < nic_data->n_piobufs; i++) {
+                MCDI_SET_DWORD(inbuf, FREE_PIOBUF_IN_PIOBUF_HANDLE,
+                               nic_data->piobuf_handle[i]);
+                rc = efx_mcdi_rpc(efx, MC_CMD_FREE_PIOBUF, inbuf, sizeof(inbuf),
+                                  NULL, 0, NULL);
+                WARN_ON(rc);
+        }
+
+        nic_data->n_piobufs = 0;
+}
+
+static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
+{
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        MCDI_DECLARE_BUF(outbuf, MC_CMD_ALLOC_PIOBUF_OUT_LEN);
+        unsigned int i;
+        size_t outlen;
+        int rc = 0;
+
+        BUILD_BUG_ON(MC_CMD_ALLOC_PIOBUF_IN_LEN != 0);
+
+        for (i = 0; i < n; i++) {
+                rc = efx_mcdi_rpc(efx, MC_CMD_ALLOC_PIOBUF, NULL, 0,
+                                  outbuf, sizeof(outbuf), &outlen);
+                if (rc)
+                        break;
+                if (outlen < MC_CMD_ALLOC_PIOBUF_OUT_LEN) {
+                        rc = -EIO;
+                        break;
+                }
+                nic_data->piobuf_handle[i] =
+                        MCDI_DWORD(outbuf, ALLOC_PIOBUF_OUT_PIOBUF_HANDLE);
+                netif_dbg(efx, probe, efx->net_dev,
+                          "allocated PIO buffer %u handle %x\n", i,
+                          nic_data->piobuf_handle[i]);
+        }
+
+        nic_data->n_piobufs = i;
+        if (rc)
+                efx_ef10_free_piobufs(efx);
+        return rc;
+}
+
+static int efx_ef10_link_piobufs(struct efx_nic *efx)
+{
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        MCDI_DECLARE_BUF(inbuf,
+                         max(MC_CMD_LINK_PIOBUF_IN_LEN,
+                             MC_CMD_UNLINK_PIOBUF_IN_LEN));
+        struct efx_channel *channel;
+        struct efx_tx_queue *tx_queue;
+        unsigned int offset, index;
+        int rc;
+
+        BUILD_BUG_ON(MC_CMD_LINK_PIOBUF_OUT_LEN != 0);
+        BUILD_BUG_ON(MC_CMD_UNLINK_PIOBUF_OUT_LEN != 0);
+
+        /* Link a buffer to each VI in the write-combining mapping */
+        for (index = 0; index < nic_data->n_piobufs; ++index) {
+                MCDI_SET_DWORD(inbuf, LINK_PIOBUF_IN_PIOBUF_HANDLE,
+                               nic_data->piobuf_handle[index]);
+                MCDI_SET_DWORD(inbuf, LINK_PIOBUF_IN_TXQ_INSTANCE,
+                               nic_data->pio_write_vi_base + index);
+                rc = efx_mcdi_rpc(efx, MC_CMD_LINK_PIOBUF,
+                                  inbuf, MC_CMD_LINK_PIOBUF_IN_LEN,
+                                  NULL, 0, NULL);
+                if (rc) {
+                        netif_err(efx, drv, efx->net_dev,
+                                  "failed to link VI %u to PIO buffer %u (%d)\n",
+                                  nic_data->pio_write_vi_base + index, index,
+                                  rc);
+                        goto fail;
+                }
+                netif_dbg(efx, probe, efx->net_dev,
+                          "linked VI %u to PIO buffer %u\n",
+                          nic_data->pio_write_vi_base + index, index);
+        }
+
+        /* Link a buffer to each TX queue */
+        efx_for_each_channel(channel, efx) {
+                efx_for_each_channel_tx_queue(tx_queue, channel) {
+                        /* We assign the PIO buffers to queues in
+                         * reverse order to allow for the following
+                         * special case.
+                         */
+                        offset = ((efx->tx_channel_offset + efx->n_tx_channels -
+                                   tx_queue->channel->channel - 1) *
+                                  efx_piobuf_size);
+                        index = offset / ER_DZ_TX_PIOBUF_SIZE;
+                        offset = offset % ER_DZ_TX_PIOBUF_SIZE;
+
+                        /* When the host page size is 4K, the first
+                         * host page in the WC mapping may be within
+                         * the same VI page as the last TX queue.  We
+                         * can only link one buffer to each VI.
+                         */
+                        if (tx_queue->queue == nic_data->pio_write_vi_base) {
+                                BUG_ON(index != 0);
+                                rc = 0;
+                        } else {
+                                MCDI_SET_DWORD(inbuf,
+                                               LINK_PIOBUF_IN_PIOBUF_HANDLE,
+                                               nic_data->piobuf_handle[index]);
+                                MCDI_SET_DWORD(inbuf,
+                                               LINK_PIOBUF_IN_TXQ_INSTANCE,
+                                               tx_queue->queue);
+                                rc = efx_mcdi_rpc(efx, MC_CMD_LINK_PIOBUF,
+                                                  inbuf, MC_CMD_LINK_PIOBUF_IN_LEN,
+                                                  NULL, 0, NULL);
+                        }
+
+                        if (rc) {
+                                /* This is non-fatal; the TX path just
+                                 * won't use PIO for this queue
+                                 */
+                                netif_err(efx, drv, efx->net_dev,
+                                          "failed to link VI %u to PIO buffer %u (%d)\n",
+                                          tx_queue->queue, index, rc);
+                                tx_queue->piobuf = NULL;
+                        } else {
+                                tx_queue->piobuf =
+                                        nic_data->pio_write_base +
+                                        index * EFX_VI_PAGE_SIZE + offset;
+                                tx_queue->piobuf_offset = offset;
+                                netif_dbg(efx, probe, efx->net_dev,
+                                          "linked VI %u to PIO buffer %u offset %x addr %p\n",
+                                          tx_queue->queue, index,
+                                          tx_queue->piobuf_offset,
+                                          tx_queue->piobuf);
+                        }
+                }
+        }
+
+        return 0;
+
+fail:
+        while (index--) {
+                MCDI_SET_DWORD(inbuf, UNLINK_PIOBUF_IN_TXQ_INSTANCE,
+                               nic_data->pio_write_vi_base + index);
+                efx_mcdi_rpc(efx, MC_CMD_UNLINK_PIOBUF,
+                             inbuf, MC_CMD_UNLINK_PIOBUF_IN_LEN,
+                             NULL, 0, NULL);
+        }
+        return rc;
+}
+
+#else /* !EFX_USE_PIO */
+
+static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
+{
+        return n == 0 ? 0 : -ENOBUFS;
+}
+
+static int efx_ef10_link_piobufs(struct efx_nic *efx)
+{
+        return 0;
+}
+
+static void efx_ef10_free_piobufs(struct efx_nic *efx)
+{
+}
+
+#endif /* EFX_USE_PIO */
+
 static void efx_ef10_remove(struct efx_nic *efx)
 {
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -295,9 +470,15 @@ static void efx_ef10_remove(struct efx_nic *efx)
         /* This needs to be after efx_ptp_remove_channel() with no filters */
         efx_ef10_rx_free_indir_table(efx);
 
+        if (nic_data->wc_membase)
+                iounmap(nic_data->wc_membase);
+
         rc = efx_ef10_free_vis(efx);
         WARN_ON(rc != 0);
 
+        if (!nic_data->must_restore_piobufs)
+                efx_ef10_free_piobufs(efx);
+
         efx_mcdi_fini(efx);
         efx_nic_free_buffer(efx, &nic_data->mcdi_buf);
         kfree(nic_data);
@@ -330,12 +511,126 @@ static int efx_ef10_alloc_vis(struct efx_nic *efx,
         return 0;
 }
 
+/* Note that the failure path of this function does not free
+ * resources, as this will be done by efx_ef10_remove().
+ */
 static int efx_ef10_dimension_resources(struct efx_nic *efx)
 {
-        unsigned int n_vis =
-                max(efx->n_channels, efx->n_tx_channels * EFX_TXQ_TYPES);
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        unsigned int uc_mem_map_size, wc_mem_map_size;
+        unsigned int min_vis, pio_write_vi_base, max_vis;
+        void __iomem *membase;
+        int rc;
+
+        min_vis = max(efx->n_channels, efx->n_tx_channels * EFX_TXQ_TYPES);
+
+#ifdef EFX_USE_PIO
+        /* Try to allocate PIO buffers if wanted and if the full
+         * number of PIO buffers would be sufficient to allocate one
+         * copy-buffer per TX channel.  Failure is non-fatal, as there
+         * are only a small number of PIO buffers shared between all
+         * functions of the controller.
+         */
+        if (efx_piobuf_size != 0 &&
+            ER_DZ_TX_PIOBUF_SIZE / efx_piobuf_size * EF10_TX_PIOBUF_COUNT >=
+            efx->n_tx_channels) {
+                unsigned int n_piobufs =
+                        DIV_ROUND_UP(efx->n_tx_channels,
+                                     ER_DZ_TX_PIOBUF_SIZE / efx_piobuf_size);
+
+                rc = efx_ef10_alloc_piobufs(efx, n_piobufs);
+                if (rc)
+                        netif_err(efx, probe, efx->net_dev,
+                                  "failed to allocate PIO buffers (%d)\n", rc);
+                else
+                        netif_dbg(efx, probe, efx->net_dev,
+                                  "allocated %u PIO buffers\n", n_piobufs);
+        }
+#else
+        nic_data->n_piobufs = 0;
+#endif
 
-        return efx_ef10_alloc_vis(efx, n_vis, n_vis);
+        /* PIO buffers should be mapped with write-combining enabled,
+         * and we want to make single UC and WC mappings rather than
+         * several of each (in fact that's the only option if host
+         * page size is >4K).  So we may allocate some extra VIs just
+         * for writing PIO buffers through.
+         */
+        uc_mem_map_size = PAGE_ALIGN((min_vis - 1) * EFX_VI_PAGE_SIZE +
+                                     ER_DZ_TX_PIOBUF);
+        if (nic_data->n_piobufs) {
+                pio_write_vi_base = uc_mem_map_size / EFX_VI_PAGE_SIZE;
+                wc_mem_map_size = (PAGE_ALIGN((pio_write_vi_base +
+                                               nic_data->n_piobufs) *
+                                              EFX_VI_PAGE_SIZE) -
+                                   uc_mem_map_size);
+                max_vis = pio_write_vi_base + nic_data->n_piobufs;
+        } else {
+                pio_write_vi_base = 0;
+                wc_mem_map_size = 0;
+                max_vis = min_vis;
+        }
+
+        /* In case the last attached driver failed to free VIs, do it now */
+        rc = efx_ef10_free_vis(efx);
+        if (rc != 0)
+                return rc;
+
+        rc = efx_ef10_alloc_vis(efx, min_vis, max_vis);
+        if (rc != 0)
+                return rc;
+
+        /* If we didn't get enough VIs to map all the PIO buffers, free the
+         * PIO buffers
+         */
+        if (nic_data->n_piobufs &&
+            nic_data->n_allocated_vis <
+            pio_write_vi_base + nic_data->n_piobufs) {
+                netif_dbg(efx, probe, efx->net_dev,
+                          "%u VIs are not sufficient to map %u PIO buffers\n",
+                          nic_data->n_allocated_vis, nic_data->n_piobufs);
+                efx_ef10_free_piobufs(efx);
+        }
+
+        /* Shrink the original UC mapping of the memory BAR */
+        membase = ioremap_nocache(efx->membase_phys, uc_mem_map_size);
+        if (!membase) {
+                netif_err(efx, probe, efx->net_dev,
+                          "could not shrink memory BAR to %x\n",
+                          uc_mem_map_size);
+                return -ENOMEM;
+        }
+        iounmap(efx->membase);
+        efx->membase = membase;
+
+        /* Set up the WC mapping if needed */
+        if (wc_mem_map_size) {
+                nic_data->wc_membase = ioremap_wc(efx->membase_phys +
+                                                  uc_mem_map_size,
+                                                  wc_mem_map_size);
+                if (!nic_data->wc_membase) {
+                        netif_err(efx, probe, efx->net_dev,
+                                  "could not allocate WC mapping of size %x\n",
+                                  wc_mem_map_size);
+                        return -ENOMEM;
+                }
+                nic_data->pio_write_vi_base = pio_write_vi_base;
+                nic_data->pio_write_base =
+                        nic_data->wc_membase +
+                        (pio_write_vi_base * EFX_VI_PAGE_SIZE + ER_DZ_TX_PIOBUF -
+                         uc_mem_map_size);
+
+                rc = efx_ef10_link_piobufs(efx);
+                if (rc)
+                        efx_ef10_free_piobufs(efx);
+        }
+
+        netif_dbg(efx, probe, efx->net_dev,
+                  "memory BAR at %pa (virtual %p+%x UC, %p+%x WC)\n",
+                  &efx->membase_phys, efx->membase, uc_mem_map_size,
+                  nic_data->wc_membase, wc_mem_map_size);
+
+        return 0;
 }
 
 static int efx_ef10_init_nic(struct efx_nic *efx)
@@ -359,6 +654,21 @@ static int efx_ef10_init_nic(struct efx_nic *efx)
                 nic_data->must_realloc_vis = false;
         }
 
+        if (nic_data->must_restore_piobufs && nic_data->n_piobufs) {
+                rc = efx_ef10_alloc_piobufs(efx, nic_data->n_piobufs);
+                if (rc == 0) {
+                        rc = efx_ef10_link_piobufs(efx);
+                        if (rc)
+                                efx_ef10_free_piobufs(efx);
+                }
+
+                /* Log an error on failure, but this is non-fatal */
+                if (rc)
+                        netif_err(efx, drv, efx->net_dev,
+                                  "failed to restore PIO buffers (%d)\n", rc);
+                nic_data->must_restore_piobufs = false;
+        }
+
         efx_ef10_rx_push_indir_table(efx);
         return 0;
 }
@@ -759,6 +1069,7 @@ static int efx_ef10_mcdi_poll_reboot(struct efx_nic *efx)
         /* All our allocations have been reset */
         nic_data->must_realloc_vis = true;
         nic_data->must_restore_filters = true;
+        nic_data->must_restore_piobufs = true;
         nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
 
         /* The datapath firmware might have been changed */
@@ -2180,7 +2491,7 @@ out_unlock:
         return rc;
 }
 
-void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
+static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
 {
         /* no need to do anything here on EF10 */
 }
diff --git a/drivers/net/ethernet/sfc/ef10_regs.h b/drivers/net/ethernet/sfc/ef10_regs.h
index b3f4e3755fd9..207ac9a1e3de 100644
--- a/drivers/net/ethernet/sfc/ef10_regs.h
+++ b/drivers/net/ethernet/sfc/ef10_regs.h
@@ -315,6 +315,7 @@
 #define ESF_DZ_TX_PIO_TYPE_WIDTH 1
 #define ESF_DZ_TX_PIO_OPT_LBN 60
 #define ESF_DZ_TX_PIO_OPT_WIDTH 3
+#define ESE_DZ_TX_OPTION_DESC_PIO 1
 #define ESF_DZ_TX_PIO_CONT_LBN 59
 #define ESF_DZ_TX_PIO_CONT_WIDTH 1
 #define ESF_DZ_TX_PIO_BYTE_CNT_LBN 32
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 34d00f5771fe..b8235ee5d7d7 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -18,37 +18,36 @@
 #define EFX_MEM_BAR 2
 
 /* TX */
-extern int efx_probe_tx_queue(struct efx_tx_queue *tx_queue);
-extern void efx_remove_tx_queue(struct efx_tx_queue *tx_queue);
-extern void efx_init_tx_queue(struct efx_tx_queue *tx_queue);
-extern void efx_init_tx_queue_core_txq(struct efx_tx_queue *tx_queue);
-extern void efx_fini_tx_queue(struct efx_tx_queue *tx_queue);
-extern netdev_tx_t
-efx_hard_start_xmit(struct sk_buff *skb, struct net_device *net_dev);
-extern netdev_tx_t
-efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
-extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
-extern int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
-extern unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
+int efx_probe_tx_queue(struct efx_tx_queue *tx_queue);
+void efx_remove_tx_queue(struct efx_tx_queue *tx_queue);
+void efx_init_tx_queue(struct efx_tx_queue *tx_queue);
+void efx_init_tx_queue_core_txq(struct efx_tx_queue *tx_queue);
+void efx_fini_tx_queue(struct efx_tx_queue *tx_queue);
+netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb,
+                                struct net_device *net_dev);
+netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
+void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
+int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
+unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
+extern unsigned int efx_piobuf_size;
 
 /* RX */
-extern void efx_rx_config_page_split(struct efx_nic *efx);
-extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
-extern void efx_remove_rx_queue(struct efx_rx_queue *rx_queue);
-extern void efx_init_rx_queue(struct efx_rx_queue *rx_queue);
-extern void efx_fini_rx_queue(struct efx_rx_queue *rx_queue);
-extern void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue);
-extern void efx_rx_slow_fill(unsigned long context);
-extern void __efx_rx_packet(struct efx_channel *channel);
-extern void efx_rx_packet(struct efx_rx_queue *rx_queue,
-                          unsigned int index, unsigned int n_frags,
-                          unsigned int len, u16 flags);
+void efx_rx_config_page_split(struct efx_nic *efx);
+int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
+void efx_remove_rx_queue(struct efx_rx_queue *rx_queue);
+void efx_init_rx_queue(struct efx_rx_queue *rx_queue);
+void efx_fini_rx_queue(struct efx_rx_queue *rx_queue);
+void efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue);
+void efx_rx_slow_fill(unsigned long context);
+void __efx_rx_packet(struct efx_channel *channel);
+void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+                   unsigned int n_frags, unsigned int len, u16 flags);
 static inline void efx_rx_flush_packet(struct efx_channel *channel)
 {
         if (channel->rx_pkt_n_frags)
                 __efx_rx_packet(channel);
 }
-extern void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
+void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
 
 #define EFX_MAX_DMAQ_SIZE 4096UL
 #define EFX_DEFAULT_DMAQ_SIZE 1024UL
@@ -162,9 +161,9 @@ static inline s32 efx_filter_get_rx_ids(struct efx_nic *efx,
         return efx->type->filter_get_rx_ids(efx, priority, buf, size);
 }
 #ifdef CONFIG_RFS_ACCEL
-extern int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
-                          u16 rxq_index, u32 flow_id);
-extern bool __efx_filter_rfs_expire(struct efx_nic *efx, unsigned quota);
+int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
+                   u16 rxq_index, u32 flow_id);
+bool __efx_filter_rfs_expire(struct efx_nic *efx, unsigned quota);
 static inline void efx_filter_rfs_expire(struct efx_channel *channel)
 {
         if (channel->rfs_filters_added >= 60 &&
@@ -176,50 +175,48 @@ static inline void efx_filter_rfs_expire(struct efx_channel *channel)
 static inline void efx_filter_rfs_expire(struct efx_channel *channel) {}
 #define efx_filter_rfs_enabled() 0
 #endif
-extern bool efx_filter_is_mc_recipient(const struct efx_filter_spec *spec);
+bool efx_filter_is_mc_recipient(const struct efx_filter_spec *spec);
 
 /* Channels */
-extern int efx_channel_dummy_op_int(struct efx_channel *channel);
-extern void efx_channel_dummy_op_void(struct efx_channel *channel);
-extern int
-efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries);
+int efx_channel_dummy_op_int(struct efx_channel *channel);
+void efx_channel_dummy_op_void(struct efx_channel *channel);
+int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries);
 
 /* Ports */
-extern int efx_reconfigure_port(struct efx_nic *efx);
-extern int __efx_reconfigure_port(struct efx_nic *efx);
+int efx_reconfigure_port(struct efx_nic *efx);
+int __efx_reconfigure_port(struct efx_nic *efx);
 
 /* Ethtool support */
 extern const struct ethtool_ops efx_ethtool_ops;
 
 /* Reset handling */
-extern int efx_reset(struct efx_nic *efx, enum reset_type method);
-extern void efx_reset_down(struct efx_nic *efx, enum reset_type method);
-extern int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok);
-extern int efx_try_recovery(struct efx_nic *efx);
+int efx_reset(struct efx_nic *efx, enum reset_type method);
+void efx_reset_down(struct efx_nic *efx, enum reset_type method);
+int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok);
+int efx_try_recovery(struct efx_nic *efx);
 
 /* Global */
-extern void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
-extern int efx_init_irq_moderation(struct efx_nic *efx, unsigned int tx_usecs,
-                                   unsigned int rx_usecs, bool rx_adaptive,
-                                   bool rx_may_override_tx);
-extern void efx_get_irq_moderation(struct efx_nic *efx, unsigned int *tx_usecs,
-                                   unsigned int *rx_usecs, bool *rx_adaptive);
+void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
+int efx_init_irq_moderation(struct efx_nic *efx, unsigned int tx_usecs,
+                            unsigned int rx_usecs, bool rx_adaptive,
+                            bool rx_may_override_tx);
+void efx_get_irq_moderation(struct efx_nic *efx, unsigned int *tx_usecs,
+                            unsigned int *rx_usecs, bool *rx_adaptive);
 
 /* Dummy PHY ops for PHY drivers */
-extern int efx_port_dummy_op_int(struct efx_nic *efx);
-extern void efx_port_dummy_op_void(struct efx_nic *efx);
-
+int efx_port_dummy_op_int(struct efx_nic *efx);
+void efx_port_dummy_op_void(struct efx_nic *efx);
 
 /* MTD */
 #ifdef CONFIG_SFC_MTD
-extern int efx_mtd_add(struct efx_nic *efx, struct efx_mtd_partition *parts,
-                       size_t n_parts, size_t sizeof_part);
+int efx_mtd_add(struct efx_nic *efx, struct efx_mtd_partition *parts,
+                size_t n_parts, size_t sizeof_part);
 static inline int efx_mtd_probe(struct efx_nic *efx)
 {
         return efx->type->mtd_probe(efx);
 }
-extern void efx_mtd_rename(struct efx_nic *efx);
-extern void efx_mtd_remove(struct efx_nic *efx);
+void efx_mtd_rename(struct efx_nic *efx);
+void efx_mtd_remove(struct efx_nic *efx);
 #else
 static inline int efx_mtd_probe(struct efx_nic *efx) { return 0; }
 static inline void efx_mtd_rename(struct efx_nic *efx) {}
@@ -241,9 +238,9 @@ static inline void efx_schedule_channel_irq(struct efx_channel *channel)
         efx_schedule_channel(channel);
 }
 
-extern void efx_link_status_changed(struct efx_nic *efx);
-extern void efx_link_set_advertising(struct efx_nic *efx, u32);
-extern void efx_link_set_wanted_fc(struct efx_nic *efx, u8);
+void efx_link_status_changed(struct efx_nic *efx);
+void efx_link_set_advertising(struct efx_nic *efx, u32);
+void efx_link_set_wanted_fc(struct efx_nic *efx, u8);
 
 static inline void efx_device_detach_sync(struct efx_nic *efx)
 {
diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
index 5b471cf5c323..1f529fa2edb1 100644
--- a/drivers/net/ethernet/sfc/ethtool.c
+++ b/drivers/net/ethernet/sfc/ethtool.c
@@ -70,6 +70,7 @@ static const struct efx_sw_stat_desc efx_sw_stat_desc[] = {
         EFX_ETHTOOL_UINT_TXQ_STAT(tso_long_headers),
         EFX_ETHTOOL_UINT_TXQ_STAT(tso_packets),
         EFX_ETHTOOL_UINT_TXQ_STAT(pushes),
+        EFX_ETHTOOL_UINT_TXQ_STAT(pio_packets),
         EFX_ETHTOOL_ATOMIC_NIC_ERROR_STAT(rx_reset),
         EFX_ETHTOOL_UINT_CHANNEL_STAT(rx_tobe_disc),
         EFX_ETHTOOL_UINT_CHANNEL_STAT(rx_ip_hdr_chksum_err),
@@ -1035,8 +1036,8 @@ static int efx_ethtool_set_rxfh_indir(struct net_device *net_dev,
         return 0;
 }
 
-int efx_ethtool_get_ts_info(struct net_device *net_dev,
-                            struct ethtool_ts_info *ts_info)
+static int efx_ethtool_get_ts_info(struct net_device *net_dev,
+                                   struct ethtool_ts_info *ts_info)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
 
diff --git a/drivers/net/ethernet/sfc/io.h b/drivers/net/ethernet/sfc/io.h
index 96ce507d8602..4d3f119b67b3 100644
--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,6 +66,11 @@
 #define EFX_USE_QWORD_IO 1
 #endif
 
+/* PIO is a win only if write-combining is possible */
+#ifdef ARCH_HAS_IOREMAP_WC
+#define EFX_USE_PIO 1
+#endif
+
 #ifdef EFX_USE_QWORD_IO
 static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
                                   unsigned int reg)
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index c34d0d4e10ee..656a3277c2b2 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -108,38 +108,35 @@ static inline struct efx_mcdi_mon *efx_mcdi_mon(struct efx_nic *efx)
 }
 #endif
 
-extern int efx_mcdi_init(struct efx_nic *efx);
-extern void efx_mcdi_fini(struct efx_nic *efx);
+int efx_mcdi_init(struct efx_nic *efx);
+void efx_mcdi_fini(struct efx_nic *efx);
 
-extern int efx_mcdi_rpc(struct efx_nic *efx, unsigned cmd,
-                        const efx_dword_t *inbuf, size_t inlen,
+int efx_mcdi_rpc(struct efx_nic *efx, unsigned cmd, const efx_dword_t *inbuf,
+                 size_t inlen, efx_dword_t *outbuf, size_t outlen,
+                 size_t *outlen_actual);
+
+int efx_mcdi_rpc_start(struct efx_nic *efx, unsigned cmd,
+                       const efx_dword_t *inbuf, size_t inlen);
+int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                         efx_dword_t *outbuf, size_t outlen,
                         size_t *outlen_actual);
 
-extern int efx_mcdi_rpc_start(struct efx_nic *efx, unsigned cmd,
-                              const efx_dword_t *inbuf, size_t inlen);
-extern int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
-                               efx_dword_t *outbuf, size_t outlen,
-                               size_t *outlen_actual);
-
 typedef void efx_mcdi_async_completer(struct efx_nic *efx,
                                       unsigned long cookie, int rc,
                                       efx_dword_t *outbuf,
                                       size_t outlen_actual);
-extern int efx_mcdi_rpc_async(struct efx_nic *efx, unsigned int cmd,
-                              const efx_dword_t *inbuf, size_t inlen,
-                              size_t outlen,
-                              efx_mcdi_async_completer *complete,
-                              unsigned long cookie);
+int efx_mcdi_rpc_async(struct efx_nic *efx, unsigned int cmd,
+                       const efx_dword_t *inbuf, size_t inlen, size_t outlen,
+                       efx_mcdi_async_completer *complete,
+                       unsigned long cookie);
 
-extern int efx_mcdi_poll_reboot(struct efx_nic *efx);
-extern void efx_mcdi_mode_poll(struct efx_nic *efx);
-extern void efx_mcdi_mode_event(struct efx_nic *efx);
-extern void efx_mcdi_flush_async(struct efx_nic *efx);
+int efx_mcdi_poll_reboot(struct efx_nic *efx);
+void efx_mcdi_mode_poll(struct efx_nic *efx);
+void efx_mcdi_mode_event(struct efx_nic *efx);
+void efx_mcdi_flush_async(struct efx_nic *efx);
 
-extern void efx_mcdi_process_event(struct efx_channel *channel,
-                                   efx_qword_t *event);
-extern void efx_mcdi_sensor_event(struct efx_nic *efx, efx_qword_t *ev);
+void efx_mcdi_process_event(struct efx_channel *channel, efx_qword_t *event);
+void efx_mcdi_sensor_event(struct efx_nic *efx, efx_qword_t *ev);
 
 /* We expect that 16- and 32-bit fields in MCDI requests and responses
  * are appropriately aligned, but 64-bit fields are only
@@ -275,55 +272,54 @@ extern void efx_mcdi_sensor_event(struct efx_nic *efx, efx_qword_t *ev);
 #define MCDI_EVENT_FIELD(_ev, _field)                   \
         EFX_QWORD_FIELD(_ev, MCDI_EVENT_ ## _field)
 
-extern void efx_mcdi_print_fwver(struct efx_nic *efx, char *buf, size_t len);
-extern int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
-                                  u16 *fw_subtype_list, u32 *capabilities);
-extern int efx_mcdi_log_ctrl(struct efx_nic *efx, bool evq, bool uart,
-                             u32 dest_evq);
-extern int efx_mcdi_nvram_types(struct efx_nic *efx, u32 *nvram_types_out);
-extern int efx_mcdi_nvram_info(struct efx_nic *efx, unsigned int type,
-                               size_t *size_out, size_t *erase_size_out,
-                               bool *protected_out);
-extern int efx_mcdi_nvram_test_all(struct efx_nic *efx);
-extern int efx_mcdi_handle_assertion(struct efx_nic *efx);
-extern void efx_mcdi_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
-extern int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx,
-                                         const u8 *mac, int *id_out);
-extern int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out);
-extern int efx_mcdi_wol_filter_remove(struct efx_nic *efx, int id);
-extern int efx_mcdi_wol_filter_reset(struct efx_nic *efx);
-extern int efx_mcdi_flush_rxqs(struct efx_nic *efx);
-extern int efx_mcdi_port_probe(struct efx_nic *efx);
-extern void efx_mcdi_port_remove(struct efx_nic *efx);
-extern int efx_mcdi_port_reconfigure(struct efx_nic *efx);
-extern int efx_mcdi_port_get_number(struct efx_nic *efx);
-extern u32 efx_mcdi_phy_get_caps(struct efx_nic *efx);
-extern void efx_mcdi_process_link_change(struct efx_nic *efx, efx_qword_t *ev);
-extern int efx_mcdi_set_mac(struct efx_nic *efx);
+void efx_mcdi_print_fwver(struct efx_nic *efx, char *buf, size_t len);
+int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+                           u16 *fw_subtype_list, u32 *capabilities);
+int efx_mcdi_log_ctrl(struct efx_nic *efx, bool evq, bool uart, u32 dest_evq);
+int efx_mcdi_nvram_types(struct efx_nic *efx, u32 *nvram_types_out);
+int efx_mcdi_nvram_info(struct efx_nic *efx, unsigned int type,
+                        size_t *size_out, size_t *erase_size_out,
+                        bool *protected_out);
+int efx_mcdi_nvram_test_all(struct efx_nic *efx);
+int efx_mcdi_handle_assertion(struct efx_nic *efx);
+void efx_mcdi_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
+int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx, const u8 *mac,
+                                  int *id_out);
+int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out);
+int efx_mcdi_wol_filter_remove(struct efx_nic *efx, int id);
+int efx_mcdi_wol_filter_reset(struct efx_nic *efx);
+int efx_mcdi_flush_rxqs(struct efx_nic *efx);
+int efx_mcdi_port_probe(struct efx_nic *efx);
+void efx_mcdi_port_remove(struct efx_nic *efx);
+int efx_mcdi_port_reconfigure(struct efx_nic *efx);
+int efx_mcdi_port_get_number(struct efx_nic *efx);
+u32 efx_mcdi_phy_get_caps(struct efx_nic *efx);
+void efx_mcdi_process_link_change(struct efx_nic *efx, efx_qword_t *ev);
+int efx_mcdi_set_mac(struct efx_nic *efx);
 #define EFX_MC_STATS_GENERATION_INVALID ((__force __le64)(-1))
-extern void efx_mcdi_mac_start_stats(struct efx_nic *efx);
-extern void efx_mcdi_mac_stop_stats(struct efx_nic *efx);
-extern bool efx_mcdi_mac_check_fault(struct efx_nic *efx);
-extern enum reset_type efx_mcdi_map_reset_reason(enum reset_type reason);
-extern int efx_mcdi_reset(struct efx_nic *efx, enum reset_type method);
-extern int efx_mcdi_set_workaround(struct efx_nic *efx, u32 type, bool enabled);
+void efx_mcdi_mac_start_stats(struct efx_nic *efx);
+void efx_mcdi_mac_stop_stats(struct efx_nic *efx);
+bool efx_mcdi_mac_check_fault(struct efx_nic *efx);
+enum reset_type efx_mcdi_map_reset_reason(enum reset_type reason);
+int efx_mcdi_reset(struct efx_nic *efx, enum reset_type method);
+int efx_mcdi_set_workaround(struct efx_nic *efx, u32 type, bool enabled);
 
 #ifdef CONFIG_SFC_MCDI_MON
-extern int efx_mcdi_mon_probe(struct efx_nic *efx);
-extern void efx_mcdi_mon_remove(struct efx_nic *efx);
+int efx_mcdi_mon_probe(struct efx_nic *efx);
+void efx_mcdi_mon_remove(struct efx_nic *efx);
 #else
 static inline int efx_mcdi_mon_probe(struct efx_nic *efx) { return 0; }
 static inline void efx_mcdi_mon_remove(struct efx_nic *efx) {}
 #endif
 
 #ifdef CONFIG_SFC_MTD
-extern int efx_mcdi_mtd_read(struct mtd_info *mtd, loff_t start,
-                             size_t len, size_t *retlen, u8 *buffer);
-extern int efx_mcdi_mtd_erase(struct mtd_info *mtd, loff_t start, size_t len);
-extern int efx_mcdi_mtd_write(struct mtd_info *mtd, loff_t start,
-                              size_t len, size_t *retlen, const u8 *buffer);
-extern int efx_mcdi_mtd_sync(struct mtd_info *mtd);
-extern void efx_mcdi_mtd_rename(struct efx_mtd_partition *part);
+int efx_mcdi_mtd_read(struct mtd_info *mtd, loff_t start, size_t len,
+                      size_t *retlen, u8 *buffer);
+int efx_mcdi_mtd_erase(struct mtd_info *mtd, loff_t start, size_t len);
+int efx_mcdi_mtd_write(struct mtd_info *mtd, loff_t start, size_t len,
+                       size_t *retlen, const u8 *buffer);
+int efx_mcdi_mtd_sync(struct mtd_info *mtd);
+void efx_mcdi_mtd_rename(struct efx_mtd_partition *part);
 #endif
 
 #endif /* EFX_MCDI_H */
diff --git a/drivers/net/ethernet/sfc/mdio_10g.h b/drivers/net/ethernet/sfc/mdio_10g.h
index 16824fecc5ee..4a2dc4c281b7 100644
--- a/drivers/net/ethernet/sfc/mdio_10g.h
+++ b/drivers/net/ethernet/sfc/mdio_10g.h
@@ -20,7 +20,7 @@
 
 static inline unsigned efx_mdio_id_rev(u32 id) { return id & 0xf; }
 static inline unsigned efx_mdio_id_model(u32 id) { return (id >> 4) & 0x3f; }
-extern unsigned efx_mdio_id_oui(u32 id);
+unsigned efx_mdio_id_oui(u32 id);
 
 static inline int efx_mdio_read(struct efx_nic *efx, int devad, int addr)
 {
@@ -56,7 +56,7 @@ static inline bool efx_mdio_phyxgxs_lane_sync(struct efx_nic *efx)
         return sync;
 }
 
-extern const char *efx_mdio_mmd_name(int mmd);
+const char *efx_mdio_mmd_name(int mmd);
 
 /*
  * Reset a specific MMD and wait for reset to clear.
@@ -64,30 +64,29 @@ extern const char *efx_mdio_mmd_name(int mmd);
  *
  * This function will sleep
  */
-extern int efx_mdio_reset_mmd(struct efx_nic *efx, int mmd,
-                              int spins, int spintime);
+int efx_mdio_reset_mmd(struct efx_nic *efx, int mmd, int spins, int spintime);
 
 /* As efx_mdio_check_mmd but for multiple MMDs */
 int efx_mdio_check_mmds(struct efx_nic *efx, unsigned int mmd_mask);
 
 /* Check the link status of specified mmds in bit mask */
-extern bool efx_mdio_links_ok(struct efx_nic *efx, unsigned int mmd_mask);
+bool efx_mdio_links_ok(struct efx_nic *efx, unsigned int mmd_mask);
 
 /* Generic transmit disable support though PMAPMD */
-extern void efx_mdio_transmit_disable(struct efx_nic *efx);
+void efx_mdio_transmit_disable(struct efx_nic *efx);
 
 /* Generic part of reconfigure: set/clear loopback bits */
-extern void efx_mdio_phy_reconfigure(struct efx_nic *efx);
+void efx_mdio_phy_reconfigure(struct efx_nic *efx);
 
 /* Set the power state of the specified MMDs */
-extern void efx_mdio_set_mmds_lpower(struct efx_nic *efx,
-                                     int low_power, unsigned int mmd_mask);
+void efx_mdio_set_mmds_lpower(struct efx_nic *efx, int low_power,
+                              unsigned int mmd_mask);
 
 /* Set (some of) the PHY settings over MDIO */
-extern int efx_mdio_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd);
+int efx_mdio_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd);
 
 /* Push advertising flags and restart autonegotiation */
-extern void efx_mdio_an_reconfigure(struct efx_nic *efx);
+void efx_mdio_an_reconfigure(struct efx_nic *efx);
 
 /* Get pause parameters from AN if available (otherwise return
  * requested pause parameters)
@@ -95,8 +94,7 @@ extern void efx_mdio_an_reconfigure(struct efx_nic *efx);
 u8 efx_mdio_get_pause(struct efx_nic *efx);
 
 /* Wait for specified MMDs to exit reset within a timeout */
-extern int efx_mdio_wait_reset_mmds(struct efx_nic *efx,
-                                    unsigned int mmd_mask);
+int efx_mdio_wait_reset_mmds(struct efx_nic *efx, unsigned int mmd_mask);
 
 /* Set or clear flag, debouncing */
 static inline void
@@ -107,6 +105,6 @@ efx_mdio_set_flag(struct efx_nic *efx, int devad, int addr,
 }
 
 /* Liveness self-test for MDIO PHYs */
-extern int efx_mdio_test_alive(struct efx_nic *efx);
+int efx_mdio_test_alive(struct efx_nic *efx);
 
 #endif /* EFX_MDIO_10G_H */
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b172ed133055..aac22a1e85b8 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -182,6 +182,9 @@ struct efx_tx_buffer {
  * @tsoh_page: Array of pages of TSO header buffers
  * @txd: The hardware descriptor ring
  * @ptr_mask: The size of the ring minus 1.
+ * @piobuf: PIO buffer region for this TX queue (shared with its partner).
+ *      Size of the region is efx_piobuf_size.
+ * @piobuf_offset: Buffer offset to be specified in PIO descriptors
  * @initialised: Has hardware queue been initialised?
  * @read_count: Current read pointer.
  *      This is the number of buffers that have been removed from both rings.
@@ -209,6 +212,7 @@ struct efx_tx_buffer {
  *      blocks
  * @tso_packets: Number of packets via the TSO xmit path
  * @pushes: Number of times the TX push feature has been used
+ * @pio_packets: Number of times the TX PIO feature has been used
  * @empty_read_count: If the completion path has seen the queue as empty
  *      and the transmission path has not yet checked this, the value of
  *      @read_count bitwise-added to %EFX_EMPTY_COUNT_VALID; otherwise 0.
@@ -223,6 +227,8 @@ struct efx_tx_queue {
         struct efx_buffer *tsoh_page;
         struct efx_special_buffer txd;
         unsigned int ptr_mask;
+        void __iomem *piobuf;
+        unsigned int piobuf_offset;
         bool initialised;
 
         /* Members used mainly on the completion path */
@@ -238,6 +244,7 @@ struct efx_tx_queue {
         unsigned int tso_long_headers;
         unsigned int tso_packets;
         unsigned int pushes;
+        unsigned int pio_packets;
 
         /* Members shared between paths and sometimes updated */
         unsigned int empty_read_count ____cacheline_aligned_in_smp;
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index 9826594c8a48..9c90bf56090f 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -19,6 +19,7 @@
 #include "bitfield.h"
 #include "efx.h"
 #include "nic.h"
+#include "ef10_regs.h"
 #include "farch_regs.h"
 #include "io.h"
 #include "workarounds.h"
@@ -166,26 +167,30 @@ void efx_nic_fini_interrupt(struct efx_nic *efx)
 
 /* Register dump */
 
-#define REGISTER_REVISION_A     1
-#define REGISTER_REVISION_B     2
-#define REGISTER_REVISION_C     3
-#define REGISTER_REVISION_Z     3       /* latest revision */
+#define REGISTER_REVISION_FA    1
+#define REGISTER_REVISION_FB    2
+#define REGISTER_REVISION_FC    3
+#define REGISTER_REVISION_FZ    3       /* last Falcon arch revision */
+#define REGISTER_REVISION_ED    4
+#define REGISTER_REVISION_EZ    4       /* latest EF10 revision */
 
 struct efx_nic_reg {
         u32 offset:24;
-        u32 min_revision:2, max_revision:2;
+        u32 min_revision:3, max_revision:3;
 };
 
-#define REGISTER(name, min_rev, max_rev) {                              \
-        FR_ ## min_rev ## max_rev ## _ ## name,                         \
-        REGISTER_REVISION_ ## min_rev, REGISTER_REVISION_ ## max_rev    \
+#define REGISTER(name, arch, min_rev, max_rev) {                        \
+        arch ## R_ ## min_rev ## max_rev ## _ ## name,                  \
+        REGISTER_REVISION_ ## arch ## min_rev,                          \
+        REGISTER_REVISION_ ## arch ## max_rev                           \
 }
-#define REGISTER_AA(name) REGISTER(name, A, A)
-#define REGISTER_AB(name) REGISTER(name, A, B)
-#define REGISTER_AZ(name) REGISTER(name, A, Z)
-#define REGISTER_BB(name) REGISTER(name, B, B)
-#define REGISTER_BZ(name) REGISTER(name, B, Z)
-#define REGISTER_CZ(name) REGISTER(name, C, Z)
+#define REGISTER_AA(name) REGISTER(name, F, A, A)
+#define REGISTER_AB(name) REGISTER(name, F, A, B)
+#define REGISTER_AZ(name) REGISTER(name, F, A, Z)
+#define REGISTER_BB(name) REGISTER(name, F, B, B)
+#define REGISTER_BZ(name) REGISTER(name, F, B, Z)
+#define REGISTER_CZ(name) REGISTER(name, F, C, Z)
+#define REGISTER_DZ(name) REGISTER(name, E, D, Z)
 
 static const struct efx_nic_reg efx_nic_regs[] = {
         REGISTER_AZ(ADR_REGION),
@@ -292,37 +297,42 @@ static const struct efx_nic_reg efx_nic_regs[] = {
         REGISTER_AB(XX_TXDRV_CTL),
         /* XX_PRBS_CTL, XX_PRBS_CHK and XX_PRBS_ERR are not used */
         /* XX_CORE_STAT is partly RC */
+        REGISTER_DZ(BIU_HW_REV_ID),
+        REGISTER_DZ(MC_DB_LWRD),
+        REGISTER_DZ(MC_DB_HWRD),
 };
 
 struct efx_nic_reg_table {
         u32 offset:24;
-        u32 min_revision:2, max_revision:2;
+        u32 min_revision:3, max_revision:3;
         u32 step:6, rows:21;
 };
 
-#define REGISTER_TABLE_DIMENSIONS(_, offset, min_rev, max_rev, step, rows) { \
+#define REGISTER_TABLE_DIMENSIONS(_, offset, arch, min_rev, max_rev, step, rows) { \
         offset,                                                         \
-        REGISTER_REVISION_ ## min_rev, REGISTER_REVISION_ ## max_rev,   \
+        REGISTER_REVISION_ ## arch ## min_rev,                          \
+        REGISTER_REVISION_ ## arch ## max_rev,                          \
         step, rows                                                      \
 }
-#define REGISTER_TABLE(name, min_rev, max_rev)                          \
+#define REGISTER_TABLE(name, arch, min_rev, max_rev)                    \
         REGISTER_TABLE_DIMENSIONS(                                      \
-                name, FR_ ## min_rev ## max_rev ## _ ## name,           \
-                min_rev, max_rev,                                       \
-                FR_ ## min_rev ## max_rev ## _ ## name ## _STEP,        \
-                FR_ ## min_rev ## max_rev ## _ ## name ## _ROWS)
-#define REGISTER_TABLE_AA(name) REGISTER_TABLE(name, A, A)
-#define REGISTER_TABLE_AZ(name) REGISTER_TABLE(name, A, Z)
-#define REGISTER_TABLE_BB(name) REGISTER_TABLE(name, B, B)
-#define REGISTER_TABLE_BZ(name) REGISTER_TABLE(name, B, Z)
+                name, arch ## R_ ## min_rev ## max_rev ## _ ## name,    \
+                arch, min_rev, max_rev,                                 \
+                arch ## R_ ## min_rev ## max_rev ## _ ## name ## _STEP, \
+                arch ## R_ ## min_rev ## max_rev ## _ ## name ## _ROWS)
+#define REGISTER_TABLE_AA(name) REGISTER_TABLE(name, F, A, A)
+#define REGISTER_TABLE_AZ(name) REGISTER_TABLE(name, F, A, Z)
+#define REGISTER_TABLE_BB(name) REGISTER_TABLE(name, F, B, B)
+#define REGISTER_TABLE_BZ(name) REGISTER_TABLE(name, F, B, Z)
 #define REGISTER_TABLE_BB_CZ(name)                                      \
-        REGISTER_TABLE_DIMENSIONS(name, FR_BZ_ ## name, B, B,           \
+        REGISTER_TABLE_DIMENSIONS(name, FR_BZ_ ## name, F, B, B,        \
                                   FR_BZ_ ## name ## _STEP,              \
                                   FR_BB_ ## name ## _ROWS),             \
-        REGISTER_TABLE_DIMENSIONS(name, FR_BZ_ ## name, C, Z,           \
+        REGISTER_TABLE_DIMENSIONS(name, FR_BZ_ ## name, F, C, Z,        \
                                   FR_BZ_ ## name ## _STEP,              \
                                   FR_CZ_ ## name ## _ROWS)
-#define REGISTER_TABLE_CZ(name) REGISTER_TABLE(name, C, Z)
+#define REGISTER_TABLE_CZ(name) REGISTER_TABLE(name, F, C, Z)
+#define REGISTER_TABLE_DZ(name) REGISTER_TABLE(name, E, D, Z)
 
 static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         /* DRIVER is not used */
@@ -340,9 +350,9 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
          * 1K entries allows for some expansion of queue count and
          * size before we need to change the version. */
         REGISTER_TABLE_DIMENSIONS(BUF_FULL_TBL_KER, FR_AA_BUF_FULL_TBL_KER,
-                                  A, A, 8, 1024),
+                                  F, A, A, 8, 1024),
         REGISTER_TABLE_DIMENSIONS(BUF_FULL_TBL, FR_BZ_BUF_FULL_TBL,
-                                  B, Z, 8, 1024),
+                                  F, B, Z, 8, 1024),
         REGISTER_TABLE_CZ(RX_MAC_FILTER_TBL0),
         REGISTER_TABLE_BB_CZ(TIMER_TBL),
         REGISTER_TABLE_BB_CZ(TX_PACE_TBL),
@@ -353,6 +363,7 @@ static const struct efx_nic_reg_table efx_nic_reg_tables[] = {
         /* MSIX_PBA_TABLE is not mapped */
         /* SRM_DBG is not mapped (and is redundant with BUF_FLL_TBL) */
         REGISTER_TABLE_BZ(RX_FILTER_TBL0),
+        REGISTER_TABLE_DZ(BIU_MC_SFT_STATUS),
 };
 
 size_t efx_nic_get_regs_len(struct efx_nic *efx)
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 890bbbe8320e..11b6112d9249 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -30,7 +30,7 @@ static inline int efx_nic_rev(struct efx_nic *efx)
         return efx->type->revision;
 }
 
-extern u32 efx_farch_fpga_ver(struct efx_nic *efx);
+u32 efx_farch_fpga_ver(struct efx_nic *efx);
 
 /* NIC has two interlinked PCI functions for the same port. */
 static inline bool efx_nic_is_dual_func(struct efx_nic *efx)
@@ -71,6 +71,26 @@ efx_tx_desc(struct efx_tx_queue *tx_queue, unsigned int index)
         return ((efx_qword_t *) (tx_queue->txd.buf.addr)) + index;
 }
 
+/* Report whether the NIC considers this TX queue empty, given the
+ * write_count used for the last doorbell push.  May return false
+ * negative.
+ */
+static inline bool __efx_nic_tx_is_empty(struct efx_tx_queue *tx_queue,
+                                         unsigned int write_count)
+{
+        unsigned int empty_read_count = ACCESS_ONCE(tx_queue->empty_read_count);
+
+        if (empty_read_count == 0)
+                return false;
+
+        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
+}
+
+static inline bool efx_nic_tx_is_empty(struct efx_tx_queue *tx_queue)
+{
+        return __efx_nic_tx_is_empty(tx_queue, tx_queue->write_count);
+}
+
 /* Decide whether to push a TX descriptor to the NIC vs merely writing
  * the doorbell.  This can reduce latency when we are adding a single
  * descriptor to an empty queue, but is otherwise pointless.  Further,
@@ -80,14 +100,10 @@ efx_tx_desc(struct efx_tx_queue *tx_queue, unsigned int index)
 static inline bool efx_nic_may_push_tx_desc(struct efx_tx_queue *tx_queue,
                                             unsigned int write_count)
 {
-        unsigned empty_read_count = ACCESS_ONCE(tx_queue->empty_read_count);
-
-        if (empty_read_count == 0)
-                return false;
+        bool was_empty = __efx_nic_tx_is_empty(tx_queue, write_count);
 
         tx_queue->empty_read_count = 0;
-        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
-                && tx_queue->write_count - write_count == 1;
+        return was_empty && tx_queue->write_count - write_count == 1;
 }
 
 /* Returns a pointer to the specified descriptor in the RX descriptor queue */
@@ -401,6 +417,12 @@ enum {
         EF10_STAT_COUNT
 };
 
+/* Maximum number of TX PIO buffers we may allocate to a function.
+ * This matches the total number of buffers on each SFC9100-family
+ * controller.
+ */
+#define EF10_TX_PIOBUF_COUNT 16
+
 /**
  * struct efx_ef10_nic_data - EF10 architecture NIC state
  * @mcdi_buf: DMA buffer for MCDI
@@ -409,6 +431,13 @@ enum {
  * @n_allocated_vis: Number of VIs allocated to this function
  * @must_realloc_vis: Flag: VIs have yet to be reallocated after MC reboot
  * @must_restore_filters: Flag: filters have yet to be restored after MC reboot
+ * @n_piobufs: Number of PIO buffers allocated to this function
+ * @wc_membase: Base address of write-combining mapping of the memory BAR
+ * @pio_write_base: Base address for writing PIO buffers
+ * @pio_write_vi_base: Relative VI number for @pio_write_base
+ * @piobuf_handle: Handle of each PIO buffer allocated
+ * @must_restore_piobufs: Flag: PIO buffers have yet to be restored after MC
+ *      reboot
  * @rx_rss_context: Firmware handle for our RSS context
  * @stats: Hardware statistics
  * @workaround_35388: Flag: firmware supports workaround for bug 35388
@@ -424,6 +453,11 @@ struct efx_ef10_nic_data {
         unsigned int n_allocated_vis;
         bool must_realloc_vis;
         bool must_restore_filters;
+        unsigned int n_piobufs;
+        void __iomem *wc_membase, *pio_write_base;
+        unsigned int pio_write_vi_base;
+        unsigned int piobuf_handle[EF10_TX_PIOBUF_COUNT];
+        bool must_restore_piobufs;
         u32 rx_rss_context;
         u64 stats[EF10_STAT_COUNT];
         bool workaround_35388;
@@ -475,18 +509,18 @@ static inline unsigned int efx_vf_size(struct efx_nic *efx)
         return 1 << efx->vi_scale;
 }
 
-extern int efx_init_sriov(void);
-extern void efx_sriov_probe(struct efx_nic *efx);
-extern int efx_sriov_init(struct efx_nic *efx);
-extern void efx_sriov_mac_address_changed(struct efx_nic *efx);
-extern void efx_sriov_tx_flush_done(struct efx_nic *efx, efx_qword_t *event);
-extern void efx_sriov_rx_flush_done(struct efx_nic *efx, efx_qword_t *event);
-extern void efx_sriov_event(struct efx_channel *channel, efx_qword_t *event);
-extern void efx_sriov_desc_fetch_err(struct efx_nic *efx, unsigned dmaq);
-extern void efx_sriov_flr(struct efx_nic *efx, unsigned flr);
-extern void efx_sriov_reset(struct efx_nic *efx);
-extern void efx_sriov_fini(struct efx_nic *efx);
-extern void efx_fini_sriov(void);
+int efx_init_sriov(void);
+void efx_sriov_probe(struct efx_nic *efx);
+int efx_sriov_init(struct efx_nic *efx);
+void efx_sriov_mac_address_changed(struct efx_nic *efx);
+void efx_sriov_tx_flush_done(struct efx_nic *efx, efx_qword_t *event);
+void efx_sriov_rx_flush_done(struct efx_nic *efx, efx_qword_t *event);
+void efx_sriov_event(struct efx_channel *channel, efx_qword_t *event);
+void efx_sriov_desc_fetch_err(struct efx_nic *efx, unsigned dmaq);
+void efx_sriov_flr(struct efx_nic *efx, unsigned flr);
+void efx_sriov_reset(struct efx_nic *efx);
+void efx_sriov_fini(struct efx_nic *efx);
+void efx_fini_sriov(void);
 
 #else
 
@@ -512,22 +546,20 @@ static inline void efx_fini_sriov(void) {}
 
 #endif
 
-extern int efx_sriov_set_vf_mac(struct net_device *dev, int vf, u8 *mac);
-extern int efx_sriov_set_vf_vlan(struct net_device *dev, int vf,
-                                 u16 vlan, u8 qos);
-extern int efx_sriov_get_vf_config(struct net_device *dev, int vf,
-                                   struct ifla_vf_info *ivf);
-extern int efx_sriov_set_vf_spoofchk(struct net_device *net_dev, int vf,
-                                     bool spoofchk);
+int efx_sriov_set_vf_mac(struct net_device *dev, int vf, u8 *mac);
+int efx_sriov_set_vf_vlan(struct net_device *dev, int vf, u16 vlan, u8 qos);
+int efx_sriov_get_vf_config(struct net_device *dev, int vf,
+                            struct ifla_vf_info *ivf);
+int efx_sriov_set_vf_spoofchk(struct net_device *net_dev, int vf,
+                              bool spoofchk);
 
 struct ethtool_ts_info;
-extern void efx_ptp_probe(struct efx_nic *efx);
-extern int efx_ptp_ioctl(struct efx_nic *efx, struct ifreq *ifr, int cmd);
-extern void efx_ptp_get_ts_info(struct efx_nic *efx,
-                                struct ethtool_ts_info *ts_info);
-extern bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
-extern int efx_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
-extern void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev);
+void efx_ptp_probe(struct efx_nic *efx);
+int efx_ptp_ioctl(struct efx_nic *efx, struct ifreq *ifr, int cmd);
+void efx_ptp_get_ts_info(struct efx_nic *efx, struct ethtool_ts_info *ts_info);
+bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
+int efx_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
+void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev);
 
 extern const struct efx_nic_type falcon_a1_nic_type;
 extern const struct efx_nic_type falcon_b0_nic_type;
@@ -541,7 +573,7 @@ extern const struct efx_nic_type efx_hunt_a0_nic_type;
  **************************************************************************
  */
 
-extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 
 /* TX data path */
 static inline int efx_nic_probe_tx(struct efx_tx_queue *tx_queue)
@@ -609,58 +641,58 @@ static inline void efx_nic_eventq_read_ack(struct efx_channel *channel)
 {
         channel->efx->type->ev_read_ack(channel);
 }
-extern void efx_nic_event_test_start(struct efx_channel *channel);
+void efx_nic_event_test_start(struct efx_channel *channel);
 
 /* Falcon/Siena queue operations */
-extern int efx_farch_tx_probe(struct efx_tx_queue *tx_queue);
-extern void efx_farch_tx_init(struct efx_tx_queue *tx_queue);
-extern void efx_farch_tx_fini(struct efx_tx_queue *tx_queue);
-extern void efx_farch_tx_remove(struct efx_tx_queue *tx_queue);
-extern void efx_farch_tx_write(struct efx_tx_queue *tx_queue);
-extern int efx_farch_rx_probe(struct efx_rx_queue *rx_queue);
-extern void efx_farch_rx_init(struct efx_rx_queue *rx_queue);
-extern void efx_farch_rx_fini(struct efx_rx_queue *rx_queue);
-extern void efx_farch_rx_remove(struct efx_rx_queue *rx_queue);
-extern void efx_farch_rx_write(struct efx_rx_queue *rx_queue);
-extern void efx_farch_rx_defer_refill(struct efx_rx_queue *rx_queue);
-extern int efx_farch_ev_probe(struct efx_channel *channel);
-extern int efx_farch_ev_init(struct efx_channel *channel);
-extern void efx_farch_ev_fini(struct efx_channel *channel);
-extern void efx_farch_ev_remove(struct efx_channel *channel);
-extern int efx_farch_ev_process(struct efx_channel *channel, int quota);
-extern void efx_farch_ev_read_ack(struct efx_channel *channel);
-extern void efx_farch_ev_test_generate(struct efx_channel *channel);
+int efx_farch_tx_probe(struct efx_tx_queue *tx_queue);
+void efx_farch_tx_init(struct efx_tx_queue *tx_queue);
+void efx_farch_tx_fini(struct efx_tx_queue *tx_queue);
+void efx_farch_tx_remove(struct efx_tx_queue *tx_queue);
+void efx_farch_tx_write(struct efx_tx_queue *tx_queue);
+int efx_farch_rx_probe(struct efx_rx_queue *rx_queue);
+void efx_farch_rx_init(struct efx_rx_queue *rx_queue);
+void efx_farch_rx_fini(struct efx_rx_queue *rx_queue);
+void efx_farch_rx_remove(struct efx_rx_queue *rx_queue);
+void efx_farch_rx_write(struct efx_rx_queue *rx_queue);
+void efx_farch_rx_defer_refill(struct efx_rx_queue *rx_queue);
+int efx_farch_ev_probe(struct efx_channel *channel);
+int efx_farch_ev_init(struct efx_channel *channel);
+void efx_farch_ev_fini(struct efx_channel *channel);
+void efx_farch_ev_remove(struct efx_channel *channel);
+int efx_farch_ev_process(struct efx_channel *channel, int quota);
+void efx_farch_ev_read_ack(struct efx_channel *channel);
+void efx_farch_ev_test_generate(struct efx_channel *channel);
 
 /* Falcon/Siena filter operations */
-extern int efx_farch_filter_table_probe(struct efx_nic *efx);
-extern void efx_farch_filter_table_restore(struct efx_nic *efx);
-extern void efx_farch_filter_table_remove(struct efx_nic *efx);
-extern void efx_farch_filter_update_rx_scatter(struct efx_nic *efx);
-extern s32 efx_farch_filter_insert(struct efx_nic *efx,
-                                   struct efx_filter_spec *spec, bool replace);
-extern int efx_farch_filter_remove_safe(struct efx_nic *efx,
-                                        enum efx_filter_priority priority,
-                                        u32 filter_id);
-extern int efx_farch_filter_get_safe(struct efx_nic *efx,
-                                     enum efx_filter_priority priority,
-                                     u32 filter_id, struct efx_filter_spec *);
-extern void efx_farch_filter_clear_rx(struct efx_nic *efx,
-                                      enum efx_filter_priority priority);
-extern u32 efx_farch_filter_count_rx_used(struct efx_nic *efx,
-                                          enum efx_filter_priority priority);
-extern u32 efx_farch_filter_get_rx_id_limit(struct efx_nic *efx);
-extern s32 efx_farch_filter_get_rx_ids(struct efx_nic *efx,
-                                       enum efx_filter_priority priority,
-                                       u32 *buf, u32 size);
+int efx_farch_filter_table_probe(struct efx_nic *efx);
+void efx_farch_filter_table_restore(struct efx_nic *efx);
+void efx_farch_filter_table_remove(struct efx_nic *efx);
+void efx_farch_filter_update_rx_scatter(struct efx_nic *efx);
+s32 efx_farch_filter_insert(struct efx_nic *efx, struct efx_filter_spec *spec,
+                            bool replace);
+int efx_farch_filter_remove_safe(struct efx_nic *efx,
+                                 enum efx_filter_priority priority,
+                                 u32 filter_id);
+int efx_farch_filter_get_safe(struct efx_nic *efx,
+                              enum efx_filter_priority priority, u32 filter_id,
+                              struct efx_filter_spec *);
+void efx_farch_filter_clear_rx(struct efx_nic *efx,
+                               enum efx_filter_priority priority);
+u32 efx_farch_filter_count_rx_used(struct efx_nic *efx,
+                                   enum efx_filter_priority priority);
+u32 efx_farch_filter_get_rx_id_limit(struct efx_nic *efx);
+s32 efx_farch_filter_get_rx_ids(struct efx_nic *efx,
+                                enum efx_filter_priority priority, u32 *buf,
+                                u32 size);
 #ifdef CONFIG_RFS_ACCEL
-extern s32 efx_farch_filter_rfs_insert(struct efx_nic *efx,
-                                       struct efx_filter_spec *spec);
-extern bool efx_farch_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
-                                            unsigned int index);
+s32 efx_farch_filter_rfs_insert(struct efx_nic *efx,
+                                struct efx_filter_spec *spec);
+bool efx_farch_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
+                                     unsigned int index);
 #endif
-extern void efx_farch_filter_sync_rx_mode(struct efx_nic *efx);
+void efx_farch_filter_sync_rx_mode(struct efx_nic *efx);
 
-extern bool efx_nic_event_present(struct efx_channel *channel);
+bool efx_nic_event_present(struct efx_channel *channel);
 
 /* Some statistics are computed as A - B where A and B each increase
  * linearly with some hardware counter(s) and the counters are read
@@ -681,17 +713,17 @@ static inline void efx_update_diff_stat(u64 *stat, u64 diff)
 }
 
 /* Interrupts */
-extern int efx_nic_init_interrupt(struct efx_nic *efx);
-extern void efx_nic_irq_test_start(struct efx_nic *efx);
-extern void efx_nic_fini_interrupt(struct efx_nic *efx);
+int efx_nic_init_interrupt(struct efx_nic *efx);
+void efx_nic_irq_test_start(struct efx_nic *efx);
+void efx_nic_fini_interrupt(struct efx_nic *efx);
 
 /* Falcon/Siena interrupts */
-extern void efx_farch_irq_enable_master(struct efx_nic *efx);
-extern void efx_farch_irq_test_generate(struct efx_nic *efx);
-extern void efx_farch_irq_disable_master(struct efx_nic *efx);
-extern irqreturn_t efx_farch_msi_interrupt(int irq, void *dev_id);
-extern irqreturn_t efx_farch_legacy_interrupt(int irq, void *dev_id);
-extern irqreturn_t efx_farch_fatal_interrupt(struct efx_nic *efx);
+void efx_farch_irq_enable_master(struct efx_nic *efx);
+void efx_farch_irq_test_generate(struct efx_nic *efx);
+void efx_farch_irq_disable_master(struct efx_nic *efx);
+irqreturn_t efx_farch_msi_interrupt(int irq, void *dev_id);
+irqreturn_t efx_farch_legacy_interrupt(int irq, void *dev_id);
+irqreturn_t efx_farch_fatal_interrupt(struct efx_nic *efx);
 
 static inline int efx_nic_event_test_irq_cpu(struct efx_channel *channel)
 {
@@ -703,21 +735,21 @@ static inline int efx_nic_irq_test_irq_cpu(struct efx_nic *efx)
 }
 
 /* Global Resources */
-extern int efx_nic_flush_queues(struct efx_nic *efx);
-extern void siena_prepare_flush(struct efx_nic *efx);
-extern int efx_farch_fini_dmaq(struct efx_nic *efx);
-extern void siena_finish_flush(struct efx_nic *efx);
-extern void falcon_start_nic_stats(struct efx_nic *efx);
-extern void falcon_stop_nic_stats(struct efx_nic *efx);
-extern int falcon_reset_xaui(struct efx_nic *efx);
-extern void efx_farch_dimension_resources(struct efx_nic *efx, unsigned sram_lim_qw);
-extern void efx_farch_init_common(struct efx_nic *efx);
-extern void efx_ef10_handle_drain_event(struct efx_nic *efx);
+int efx_nic_flush_queues(struct efx_nic *efx);
+void siena_prepare_flush(struct efx_nic *efx);
+int efx_farch_fini_dmaq(struct efx_nic *efx);
+void siena_finish_flush(struct efx_nic *efx);
+void falcon_start_nic_stats(struct efx_nic *efx);
+void falcon_stop_nic_stats(struct efx_nic *efx);
+int falcon_reset_xaui(struct efx_nic *efx);
+void efx_farch_dimension_resources(struct efx_nic *efx, unsigned sram_lim_qw);
+void efx_farch_init_common(struct efx_nic *efx);
+void efx_ef10_handle_drain_event(struct efx_nic *efx);
 static inline void efx_nic_push_rx_indir_table(struct efx_nic *efx)
 {
         efx->type->rx_push_indir_table(efx);
 }
-extern void efx_farch_rx_push_indir_table(struct efx_nic *efx);
+void efx_farch_rx_push_indir_table(struct efx_nic *efx);
 
 int efx_nic_alloc_buffer(struct efx_nic *efx, struct efx_buffer *buffer,
                          unsigned int len, gfp_t gfp_flags);
@@ -728,24 +760,22 @@ struct efx_farch_register_test {
         unsigned address;
         efx_oword_t mask;
 };
-extern int efx_farch_test_registers(struct efx_nic *efx,
-                                    const struct efx_farch_register_test *regs,
-                                    size_t n_regs);
+int efx_farch_test_registers(struct efx_nic *efx,
+                             const struct efx_farch_register_test *regs,
+                             size_t n_regs);
 
-extern size_t efx_nic_get_regs_len(struct efx_nic *efx);
-extern void efx_nic_get_regs(struct efx_nic *efx, void *buf);
+size_t efx_nic_get_regs_len(struct efx_nic *efx);
+void efx_nic_get_regs(struct efx_nic *efx, void *buf);
 
-extern size_t
-efx_nic_describe_stats(const struct efx_hw_stat_desc *desc, size_t count,
-                       const unsigned long *mask, u8 *names);
-extern void
-efx_nic_update_stats(const struct efx_hw_stat_desc *desc, size_t count,
-                     const unsigned long *mask,
-                     u64 *stats, const void *dma_buf, bool accumulate);
+size_t efx_nic_describe_stats(const struct efx_hw_stat_desc *desc, size_t count,
+                              const unsigned long *mask, u8 *names);
+void efx_nic_update_stats(const struct efx_hw_stat_desc *desc, size_t count,
+                          const unsigned long *mask, u64 *stats,
+                          const void *dma_buf, bool accumulate);
 
 #define EFX_MAX_FLUSH_TIME 5000
 
-extern void efx_farch_generate_event(struct efx_nic *efx, unsigned int evq,
-                                     efx_qword_t *event);
+void efx_farch_generate_event(struct efx_nic *efx, unsigned int evq,
+                              efx_qword_t *event);
 
 #endif /* EFX_NIC_H */
diff --git a/drivers/net/ethernet/sfc/phy.h b/drivers/net/ethernet/sfc/phy.h
index 45eeb7075156..803bf445c08e 100644
--- a/drivers/net/ethernet/sfc/phy.h
+++ b/drivers/net/ethernet/sfc/phy.h
@@ -15,7 +15,7 @@
  */
 extern const struct efx_phy_operations falcon_sfx7101_phy_ops;
 
-extern void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
+void tenxpress_set_id_led(struct efx_nic *efx, enum efx_led_mode mode);
 
 /****************************************************************************
  * AMCC/Quake QT202x PHYs
@@ -34,7 +34,7 @@ extern const struct efx_phy_operations falcon_qt202x_phy_ops;
 #define QUAKE_LED_TXLINK        (0)
 #define QUAKE_LED_RXLINK        (8)
 
-extern void falcon_qt202x_set_led(struct efx_nic *p, int led, int state);
+void falcon_qt202x_set_led(struct efx_nic *p, int led, int state);
 
 /****************************************************************************
 * Transwitch CX4 retimer
@@ -44,7 +44,7 @@ extern const struct efx_phy_operations falcon_txc_phy_ops;
 #define TXC_GPIO_DIR_INPUT      0
 #define TXC_GPIO_DIR_OUTPUT     1
 
-extern void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir);
-extern void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int val);
+void falcon_txc_set_gpio_dir(struct efx_nic *efx, int pin, int dir);
+void falcon_txc_set_gpio_val(struct efx_nic *efx, int pin, int val);
 
 #endif
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 4a596725023f..8f09e686fc23 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -12,6 +12,7 @@
 #include <linux/in.h>
 #include <linux/slab.h>
 #include <linux/ip.h>
+#include <linux/ipv6.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <linux/prefetch.h>
@@ -818,44 +819,70 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         struct efx_nic *efx = netdev_priv(net_dev);
         struct efx_channel *channel;
         struct efx_filter_spec spec;
-        const struct iphdr *ip;
         const __be16 *ports;
+        __be16 ether_type;
         int nhoff;
         int rc;
 
-        nhoff = skb_network_offset(skb);
+        /* The core RPS/RFS code has already parsed and validated
+         * VLAN, IP and transport headers.  We assume they are in the
+         * header area.
+         */
 
         if (skb->protocol == htons(ETH_P_8021Q)) {
-                EFX_BUG_ON_PARANOID(skb_headlen(skb) <
-                                    nhoff + sizeof(struct vlan_hdr));
-                if (((const struct vlan_hdr *)skb->data + nhoff)->
-                    h_vlan_encapsulated_proto != htons(ETH_P_IP))
-                        return -EPROTONOSUPPORT;
+                const struct vlan_hdr *vh =
+                        (const struct vlan_hdr *)skb->data;
 
-                /* This is IP over 802.1q VLAN.  We can't filter on the
-                 * IP 5-tuple and the vlan together, so just strip the
-                 * vlan header and filter on the IP part.
+                /* We can't filter on the IP 5-tuple and the vlan
+                 * together, so just strip the vlan header and filter
+                 * on the IP part.
                  */
-                nhoff += sizeof(struct vlan_hdr);
-        } else if (skb->protocol != htons(ETH_P_IP)) {
-                return -EPROTONOSUPPORT;
+                EFX_BUG_ON_PARANOID(skb_headlen(skb) < sizeof(*vh));
+                ether_type = vh->h_vlan_encapsulated_proto;
+                nhoff = sizeof(struct vlan_hdr);
+        } else {
+                ether_type = skb->protocol;
+                nhoff = 0;
         }
 
-        /* RFS must validate the IP header length before calling us */
-        EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + sizeof(*ip));
-        ip = (const struct iphdr *)(skb->data + nhoff);
-        if (ip_is_fragment(ip))
+        if (ether_type != htons(ETH_P_IP) && ether_type != htons(ETH_P_IPV6))
                 return -EPROTONOSUPPORT;
-        EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
-        ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
 
         efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
                            efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
                            rxq_index);
-        rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
-                                      ip->daddr, ports[1], ip->saddr, ports[0]);
-        if (rc)
-                return rc;
+        spec.match_flags =
+                EFX_FILTER_MATCH_ETHER_TYPE | EFX_FILTER_MATCH_IP_PROTO |
+                EFX_FILTER_MATCH_LOC_HOST | EFX_FILTER_MATCH_LOC_PORT |
+                EFX_FILTER_MATCH_REM_HOST | EFX_FILTER_MATCH_REM_PORT;
+        spec.ether_type = ether_type;
+
+        if (ether_type == htons(ETH_P_IP)) {
+                const struct iphdr *ip =
+                        (const struct iphdr *)(skb->data + nhoff);
+
+                EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + sizeof(*ip));
+                if (ip_is_fragment(ip))
+                        return -EPROTONOSUPPORT;
+                spec.ip_proto = ip->protocol;
+                spec.rem_host[0] = ip->saddr;
+                spec.loc_host[0] = ip->daddr;
+                EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
+                ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
+        } else {
+                const struct ipv6hdr *ip6 =
+                        (const struct ipv6hdr *)(skb->data + nhoff);
+
+                EFX_BUG_ON_PARANOID(skb_headlen(skb) <
+                                    nhoff + sizeof(*ip6) + 4);
+                spec.ip_proto = ip6->nexthdr;
+                memcpy(spec.rem_host, &ip6->saddr, sizeof(ip6->saddr));
+                memcpy(spec.loc_host, &ip6->daddr, sizeof(ip6->daddr));
+                ports = (const __be16 *)(ip6 + 1);
+        }
+
+        spec.rem_port = ports[0];
+        spec.loc_port = ports[1];
 
         rc = efx->type->filter_rfs_insert(efx, &spec);
         if (rc < 0)
@@ -866,11 +893,18 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         channel = efx_get_channel(efx, skb_get_rx_queue(skb));
         ++channel->rfs_filters_added;
 
-        netif_info(efx, rx_status, efx->net_dev,
-                   "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d]\n",
-                   (ip->protocol == IPPROTO_TCP) ? "TCP" : "UDP",
-                   &ip->saddr, ntohs(ports[0]), &ip->daddr, ntohs(ports[1]),
-                   rxq_index, flow_id, rc);
+        if (ether_type == htons(ETH_P_IP))
+                netif_info(efx, rx_status, efx->net_dev,
+                           "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d]\n",
+                           (spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
+                           spec.rem_host, ntohs(ports[0]), spec.loc_host,
+                           ntohs(ports[1]), rxq_index, flow_id, rc);
+        else
+                netif_info(efx, rx_status, efx->net_dev,
+                           "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d]\n",
+                           (spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
+                           spec.rem_host, ntohs(ports[0]), spec.loc_host,
+                           ntohs(ports[1]), rxq_index, flow_id, rc);
 
         return rc;
 }
diff --git a/drivers/net/ethernet/sfc/selftest.h b/drivers/net/ethernet/sfc/selftest.h
index 87698ae0bf75..a2f4a06ffa4e 100644
--- a/drivers/net/ethernet/sfc/selftest.h
+++ b/drivers/net/ethernet/sfc/selftest.h
@@ -43,13 +43,12 @@ struct efx_self_tests {
         struct efx_loopback_self_tests loopback[LOOPBACK_TEST_MAX + 1];
 };
 
-extern void efx_loopback_rx_packet(struct efx_nic *efx,
-                                   const char *buf_ptr, int pkt_len);
-extern int efx_selftest(struct efx_nic *efx,
-                        struct efx_self_tests *tests,
-                        unsigned flags);
-extern void efx_selftest_async_start(struct efx_nic *efx);
-extern void efx_selftest_async_cancel(struct efx_nic *efx);
-extern void efx_selftest_async_work(struct work_struct *data);
+void efx_loopback_rx_packet(struct efx_nic *efx, const char *buf_ptr,
+                            int pkt_len);
+int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
+                 unsigned flags);
+void efx_selftest_async_start(struct efx_nic *efx);
+void efx_selftest_async_cancel(struct efx_nic *efx);
+void efx_selftest_async_work(struct work_struct *data);
 
 #endif /* EFX_SELFTEST_H */
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index 2ac91c5b5eea..282692c48e6b 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -17,10 +17,46 @@
 #include <net/ipv6.h>
 #include <linux/if_ether.h>
 #include <linux/highmem.h>
+#include <linux/cache.h>
 #include "net_driver.h"
 #include "efx.h"
+#include "io.h"
 #include "nic.h"
 #include "workarounds.h"
+#include "ef10_regs.h"
+
+#ifdef EFX_USE_PIO
+
+#define EFX_PIOBUF_SIZE_MAX ER_DZ_TX_PIOBUF_SIZE
+#define EFX_PIOBUF_SIZE_DEF ALIGN(256, L1_CACHE_BYTES)
+unsigned int efx_piobuf_size __read_mostly = EFX_PIOBUF_SIZE_DEF;
+
+#endif /* EFX_USE_PIO */
+
+static inline unsigned int
+efx_tx_queue_get_insert_index(const struct efx_tx_queue *tx_queue)
+{
+        return tx_queue->insert_count & tx_queue->ptr_mask;
+}
+
+static inline struct efx_tx_buffer *
+__efx_tx_queue_get_insert_buffer(const struct efx_tx_queue *tx_queue)
+{
+        return &tx_queue->buffer[efx_tx_queue_get_insert_index(tx_queue)];
+}
+
+static inline struct efx_tx_buffer *
+efx_tx_queue_get_insert_buffer(const struct efx_tx_queue *tx_queue)
+{
+        struct efx_tx_buffer *buffer =
+                __efx_tx_queue_get_insert_buffer(tx_queue);
+
+        EFX_BUG_ON_PARANOID(buffer->len);
+        EFX_BUG_ON_PARANOID(buffer->flags);
+        EFX_BUG_ON_PARANOID(buffer->unmap_len);
+
+        return buffer;
+}
 
 static void efx_dequeue_buffer(struct efx_tx_queue *tx_queue,
                                struct efx_tx_buffer *buffer,
@@ -83,8 +119,10 @@ unsigned int efx_tx_max_skb_descs(struct efx_nic *efx)
          */
         unsigned int max_descs = EFX_TSO_MAX_SEGS * 2 + MAX_SKB_FRAGS;
 
-        /* Possibly one more per segment for the alignment workaround */
-        if (EFX_WORKAROUND_5391(efx))
+        /* Possibly one more per segment for the alignment workaround,
+         * or for option descriptors
+         */
+        if (EFX_WORKAROUND_5391(efx) || efx_nic_rev(efx) >= EFX_REV_HUNT_A0)
                 max_descs += EFX_TSO_MAX_SEGS;
 
         /* Possibly more for PCIe page boundaries within input fragments */
@@ -145,6 +183,145 @@ static void efx_tx_maybe_stop_queue(struct efx_tx_queue *txq1)
         }
 }
 
+#ifdef EFX_USE_PIO
+
+struct efx_short_copy_buffer {
+        int used;
+        u8 buf[L1_CACHE_BYTES];
+};
+
+/* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
+ * Advances piobuf pointer. Leaves additional data in the copy buffer.
+ */
+static void efx_memcpy_toio_aligned(struct efx_nic *efx, u8 __iomem **piobuf,
+                                    u8 *data, int len,
+                                    struct efx_short_copy_buffer *copy_buf)
+{
+        int block_len = len & ~(sizeof(copy_buf->buf) - 1);
+
+        memcpy_toio(*piobuf, data, block_len);
+        *piobuf += block_len;
+        len -= block_len;
+
+        if (len) {
+                data += block_len;
+                BUG_ON(copy_buf->used);
+                BUG_ON(len > sizeof(copy_buf->buf));
+                memcpy(copy_buf->buf, data, len);
+                copy_buf->used = len;
+        }
+}
+
+/* Copy to PIO, respecting dword alignment, popping data from copy buffer first.
+ * Advances piobuf pointer. Leaves additional data in the copy buffer.
+ */
+static void efx_memcpy_toio_aligned_cb(struct efx_nic *efx, u8 __iomem **piobuf,
+                                       u8 *data, int len,
+                                       struct efx_short_copy_buffer *copy_buf)
+{
+        if (copy_buf->used) {
+                /* if the copy buffer is partially full, fill it up and write */
+                int copy_to_buf =
+                        min_t(int, sizeof(copy_buf->buf) - copy_buf->used, len);
+
+                memcpy(copy_buf->buf + copy_buf->used, data, copy_to_buf);
+                copy_buf->used += copy_to_buf;
+
+                /* if we didn't fill it up then we're done for now */
+                if (copy_buf->used < sizeof(copy_buf->buf))
+                        return;
+
+                memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+                *piobuf += sizeof(copy_buf->buf);
+                data += copy_to_buf;
+                len -= copy_to_buf;
+                copy_buf->used = 0;
+        }
+
+        efx_memcpy_toio_aligned(efx, piobuf, data, len, copy_buf);
+}
+
+static void efx_flush_copy_buffer(struct efx_nic *efx, u8 __iomem *piobuf,
+                                  struct efx_short_copy_buffer *copy_buf)
+{
+        /* if there's anything in it, write the whole buffer, including junk */
+        if (copy_buf->used)
+                memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+}
+
+/* Traverse skb structure and copy fragments in to PIO buffer.
+ * Advances piobuf pointer.
+ */
+static void efx_skb_copy_bits_to_pio(struct efx_nic *efx, struct sk_buff *skb,
+                                     u8 __iomem **piobuf,
+                                     struct efx_short_copy_buffer *copy_buf)
+{
+        int i;
+
+        efx_memcpy_toio_aligned(efx, piobuf, skb->data, skb_headlen(skb),
+                                copy_buf);
+
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; ++i) {
+                skb_frag_t *f = &skb_shinfo(skb)->frags[i];
+                u8 *vaddr;
+
+                vaddr = kmap_atomic(skb_frag_page(f));
+
+                efx_memcpy_toio_aligned_cb(efx, piobuf, vaddr + f->page_offset,
+                                           skb_frag_size(f), copy_buf);
+                kunmap_atomic(vaddr);
+        }
+
+        EFX_BUG_ON_PARANOID(skb_shinfo(skb)->frag_list);
+}
+
+static struct efx_tx_buffer *
+efx_enqueue_skb_pio(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
+{
+        struct efx_tx_buffer *buffer =
+                efx_tx_queue_get_insert_buffer(tx_queue);
+        u8 __iomem *piobuf = tx_queue->piobuf;
+
+        /* Copy to PIO buffer. Ensure the writes are padded to the end
+         * of a cache line, as this is required for write-combining to be
+         * effective on at least x86.
+         */
+
+        if (skb_shinfo(skb)->nr_frags) {
+                /* The size of the copy buffer will ensure all writes
+                 * are the size of a cache line.
+                 */
+                struct efx_short_copy_buffer copy_buf;
+
+                copy_buf.used = 0;
+
+                efx_skb_copy_bits_to_pio(tx_queue->efx, skb,
+                                         &piobuf, &copy_buf);
+                efx_flush_copy_buffer(tx_queue->efx, piobuf, &copy_buf);
+        } else {
+                /* Pad the write to the size of a cache line.
+                 * We can do this because we know the skb_shared_info sruct is
+                 * after the source, and the destination buffer is big enough.
+                 */
+                BUILD_BUG_ON(L1_CACHE_BYTES >
+                             SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
+                memcpy_toio(tx_queue->piobuf, skb->data,
+                            ALIGN(skb->len, L1_CACHE_BYTES));
+        }
+
+        EFX_POPULATE_QWORD_5(buffer->option,
+                             ESF_DZ_TX_DESC_IS_OPT, 1,
+                             ESF_DZ_TX_OPTION_TYPE, ESE_DZ_TX_OPTION_DESC_PIO,
+                             ESF_DZ_TX_PIO_CONT, 0,
+                             ESF_DZ_TX_PIO_BYTE_CNT, skb->len,
+                             ESF_DZ_TX_PIO_BUF_ADDR,
+                             tx_queue->piobuf_offset);
+        ++tx_queue->pio_packets;
+        ++tx_queue->insert_count;
+        return buffer;
+}
+#endif /* EFX_USE_PIO */
+
 /*
  * Add a socket buffer to a TX queue
  *
@@ -167,7 +344,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         struct device *dma_dev = &efx->pci_dev->dev;
         struct efx_tx_buffer *buffer;
         skb_frag_t *fragment;
-        unsigned int len, unmap_len = 0, insert_ptr;
+        unsigned int len, unmap_len = 0;
         dma_addr_t dma_addr, unmap_addr = 0;
         unsigned int dma_len;
         unsigned short dma_flags;
@@ -189,6 +366,17 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
                         return NETDEV_TX_OK;
         }
 
+        /* Consider using PIO for short packets */
+#ifdef EFX_USE_PIO
+        if (skb->len <= efx_piobuf_size && tx_queue->piobuf &&
+            efx_nic_tx_is_empty(tx_queue) &&
+            efx_nic_tx_is_empty(efx_tx_queue_partner(tx_queue))) {
+                buffer = efx_enqueue_skb_pio(tx_queue, skb);
+                dma_flags = EFX_TX_BUF_OPTION;
+                goto finish_packet;
+        }
+#endif
+
         /* Map for DMA.  Use dma_map_single rather than dma_map_page
          * since this is more efficient on machines with sparse
          * memory.
@@ -208,11 +396,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
 
                 /* Add to TX queue, splitting across DMA boundaries */
                 do {
-                        insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
-                        buffer = &tx_queue->buffer[insert_ptr];
-                        EFX_BUG_ON_PARANOID(buffer->flags);
-                        EFX_BUG_ON_PARANOID(buffer->len);
-                        EFX_BUG_ON_PARANOID(buffer->unmap_len);
+                        buffer = efx_tx_queue_get_insert_buffer(tx_queue);
 
                         dma_len = efx_max_tx_len(efx, dma_addr);
                         if (likely(dma_len >= len))
@@ -245,6 +429,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         }
 
         /* Transfer ownership of the skb to the final buffer */
+finish_packet:
         buffer->skb = skb;
         buffer->flags = EFX_TX_BUF_SKB | dma_flags;
 
@@ -270,8 +455,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         while (tx_queue->insert_count != tx_queue->write_count) {
                 unsigned int pkts_compl = 0, bytes_compl = 0;
                 --tx_queue->insert_count;
-                insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
-                buffer = &tx_queue->buffer[insert_ptr];
+                buffer = __efx_tx_queue_get_insert_buffer(tx_queue);
                 efx_dequeue_buffer(tx_queue, buffer, &pkts_compl, &bytes_compl);
         }
 
@@ -628,6 +812,9 @@ void efx_remove_tx_queue(struct efx_tx_queue *tx_queue)
  * @tcp_off: Offset of TCP header
  * @header_len: Number of bytes of header
  * @ip_base_len: IPv4 tot_len or IPv6 payload_len, before TCP payload
+ * @header_dma_addr: Header DMA address, when using option descriptors
+ * @header_unmap_len: Header DMA mapped length, or 0 if not using option
+ *      descriptors
  *
  * The state used during segmentation.  It is put into this data structure
  * just to make it easy to pass into inline functions.
@@ -636,7 +823,7 @@ struct tso_state {
         /* Output position */
         unsigned out_len;
         unsigned seqnum;
-        unsigned ipv4_id;
+        u16 ipv4_id;
         unsigned packet_space;
 
         /* Input position */
@@ -651,6 +838,8 @@ struct tso_state {
         unsigned int tcp_off;
         unsigned header_len;
         unsigned int ip_base_len;
+        dma_addr_t header_dma_addr;
+        unsigned int header_unmap_len;
 };
 
 
@@ -737,23 +926,18 @@ static void efx_tx_queue_insert(struct efx_tx_queue *tx_queue,
 {
         struct efx_tx_buffer *buffer;
         struct efx_nic *efx = tx_queue->efx;
-        unsigned dma_len, insert_ptr;
+        unsigned dma_len;
 
         EFX_BUG_ON_PARANOID(len <= 0);
 
         while (1) {
-                insert_ptr = tx_queue->insert_count & tx_queue->ptr_mask;
-                buffer = &tx_queue->buffer[insert_ptr];
+                buffer = efx_tx_queue_get_insert_buffer(tx_queue);
                 ++tx_queue->insert_count;
 
                 EFX_BUG_ON_PARANOID(tx_queue->insert_count -
                                     tx_queue->read_count >=
                                     efx->txq_entries);
 
-                EFX_BUG_ON_PARANOID(buffer->len);
-                EFX_BUG_ON_PARANOID(buffer->unmap_len);
-                EFX_BUG_ON_PARANOID(buffer->flags);
-
                 buffer->dma_addr = dma_addr;
 
                 dma_len = efx_max_tx_len(efx, dma_addr);
@@ -814,19 +998,27 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
         /* Work backwards until we hit the original insert pointer value */
         while (tx_queue->insert_count != tx_queue->write_count) {
                 --tx_queue->insert_count;
-                buffer = &tx_queue->buffer[tx_queue->insert_count &
-                                           tx_queue->ptr_mask];
+                buffer = __efx_tx_queue_get_insert_buffer(tx_queue);
                 efx_dequeue_buffer(tx_queue, buffer, NULL, NULL);
         }
 }
 
 
 /* Parse the SKB header and initialise state. */
-static void tso_start(struct tso_state *st, const struct sk_buff *skb)
+static int tso_start(struct tso_state *st, struct efx_nic *efx,
+                     const struct sk_buff *skb)
 {
+        bool use_options = efx_nic_rev(efx) >= EFX_REV_HUNT_A0;
+        struct device *dma_dev = &efx->pci_dev->dev;
+        unsigned int header_len, in_len;
+        dma_addr_t dma_addr;
+
         st->ip_off = skb_network_header(skb) - skb->data;
         st->tcp_off = skb_transport_header(skb) - skb->data;
-        st->header_len = st->tcp_off + (tcp_hdr(skb)->doff << 2u);
+        header_len = st->tcp_off + (tcp_hdr(skb)->doff << 2u);
+        in_len = skb_headlen(skb) - header_len;
+        st->header_len = header_len;
+        st->in_len = in_len;
         if (st->protocol == htons(ETH_P_IP)) {
                 st->ip_base_len = st->header_len - st->ip_off;
                 st->ipv4_id = ntohs(ip_hdr(skb)->id);
@@ -840,9 +1032,34 @@ static void tso_start(struct tso_state *st, const struct sk_buff *skb)
         EFX_BUG_ON_PARANOID(tcp_hdr(skb)->syn);
         EFX_BUG_ON_PARANOID(tcp_hdr(skb)->rst);
 
-        st->out_len = skb->len - st->header_len;
-        st->unmap_len = 0;
-        st->dma_flags = 0;
+        st->out_len = skb->len - header_len;
+
+        if (!use_options) {
+                st->header_unmap_len = 0;
+
+                if (likely(in_len == 0)) {
+                        st->dma_flags = 0;
+                        st->unmap_len = 0;
+                        return 0;
+                }
+
+                dma_addr = dma_map_single(dma_dev, skb->data + header_len,
+                                          in_len, DMA_TO_DEVICE);
+                st->dma_flags = EFX_TX_BUF_MAP_SINGLE;
+                st->dma_addr = dma_addr;
+                st->unmap_addr = dma_addr;
+                st->unmap_len = in_len;
+        } else {
+                dma_addr = dma_map_single(dma_dev, skb->data,
+                                          skb_headlen(skb), DMA_TO_DEVICE);
+                st->header_dma_addr = dma_addr;
+                st->header_unmap_len = skb_headlen(skb);
+                st->dma_flags = 0;
+                st->dma_addr = dma_addr + header_len;
+                st->unmap_len = 0;
+        }
+
+        return unlikely(dma_mapping_error(dma_dev, dma_addr)) ? -ENOMEM : 0;
 }
 
 static int tso_get_fragment(struct tso_state *st, struct efx_nic *efx,
@@ -860,24 +1077,6 @@ static int tso_get_fragment(struct tso_state *st, struct efx_nic *efx,
         return -ENOMEM;
 }
 
-static int tso_get_head_fragment(struct tso_state *st, struct efx_nic *efx,
-                                 const struct sk_buff *skb)
-{
-        int hl = st->header_len;
-        int len = skb_headlen(skb) - hl;
-
-        st->unmap_addr = dma_map_single(&efx->pci_dev->dev, skb->data + hl,
-                                        len, DMA_TO_DEVICE);
-        if (likely(!dma_mapping_error(&efx->pci_dev->dev, st->unmap_addr))) {
-                st->dma_flags = EFX_TX_BUF_MAP_SINGLE;
-                st->unmap_len = len;
-                st->in_len = len;
-                st->dma_addr = st->unmap_addr;
-                return 0;
-        }
-        return -ENOMEM;
-}
-
 
 /**
  * tso_fill_packet_with_fragment - form descriptors for the current fragment
@@ -944,55 +1143,97 @@ static int tso_start_new_packet(struct efx_tx_queue *tx_queue,
                                 struct tso_state *st)
 {
         struct efx_tx_buffer *buffer =
-                &tx_queue->buffer[tx_queue->insert_count & tx_queue->ptr_mask];
-        struct tcphdr *tsoh_th;
-        unsigned ip_length;
-        u8 *header;
-        int rc;
+                efx_tx_queue_get_insert_buffer(tx_queue);
+        bool is_last = st->out_len <= skb_shinfo(skb)->gso_size;
+        u8 tcp_flags_clear;
 
-        /* Allocate and insert a DMA-mapped header buffer. */
-        header = efx_tsoh_get_buffer(tx_queue, buffer, st->header_len);
-        if (!header)
-                return -ENOMEM;
-
-        tsoh_th = (struct tcphdr *)(header + st->tcp_off);
-
-        /* Copy and update the headers. */
-        memcpy(header, skb->data, st->header_len);
-
-        tsoh_th->seq = htonl(st->seqnum);
-        st->seqnum += skb_shinfo(skb)->gso_size;
-        if (st->out_len > skb_shinfo(skb)->gso_size) {
-                /* This packet will not finish the TSO burst. */
+        if (!is_last) {
                 st->packet_space = skb_shinfo(skb)->gso_size;
-                tsoh_th->fin = 0;
-                tsoh_th->psh = 0;
+                tcp_flags_clear = 0x09; /* mask out FIN and PSH */
         } else {
-                /* This packet will be the last in the TSO burst. */
                 st->packet_space = st->out_len;
-                tsoh_th->fin = tcp_hdr(skb)->fin;
-                tsoh_th->psh = tcp_hdr(skb)->psh;
+                tcp_flags_clear = 0x00;
         }
-        ip_length = st->ip_base_len + st->packet_space;
 
-        if (st->protocol == htons(ETH_P_IP)) {
-                struct iphdr *tsoh_iph = (struct iphdr *)(header + st->ip_off);
+        if (!st->header_unmap_len) {
+                /* Allocate and insert a DMA-mapped header buffer. */
+                struct tcphdr *tsoh_th;
+                unsigned ip_length;
+                u8 *header;
+                int rc;
+
+                header = efx_tsoh_get_buffer(tx_queue, buffer, st->header_len);
+                if (!header)
+                        return -ENOMEM;
 
-                tsoh_iph->tot_len = htons(ip_length);
+                tsoh_th = (struct tcphdr *)(header + st->tcp_off);
+
+                /* Copy and update the headers. */
+                memcpy(header, skb->data, st->header_len);
+
+                tsoh_th->seq = htonl(st->seqnum);
+                ((u8 *)tsoh_th)[13] &= ~tcp_flags_clear;
+
+                ip_length = st->ip_base_len + st->packet_space;
+
+                if (st->protocol == htons(ETH_P_IP)) {
+                        struct iphdr *tsoh_iph =
+                                (struct iphdr *)(header + st->ip_off);
+
+                        tsoh_iph->tot_len = htons(ip_length);
+                        tsoh_iph->id = htons(st->ipv4_id);
+                } else {
+                        struct ipv6hdr *tsoh_iph =
+                                (struct ipv6hdr *)(header + st->ip_off);
+
+                        tsoh_iph->payload_len = htons(ip_length);
+                }
 
-                /* Linux leaves suitable gaps in the IP ID space for us to fill. */
-                tsoh_iph->id = htons(st->ipv4_id);
-                st->ipv4_id++;
+                rc = efx_tso_put_header(tx_queue, buffer, header);
+                if (unlikely(rc))
+                        return rc;
         } else {
-                struct ipv6hdr *tsoh_iph =
-                        (struct ipv6hdr *)(header + st->ip_off);
+                /* Send the original headers with a TSO option descriptor
+                 * in front
+                 */
+                u8 tcp_flags = ((u8 *)tcp_hdr(skb))[13] & ~tcp_flags_clear;
 
-                tsoh_iph->payload_len = htons(ip_length);
+                buffer->flags = EFX_TX_BUF_OPTION;
+                buffer->len = 0;
+                buffer->unmap_len = 0;
+                EFX_POPULATE_QWORD_5(buffer->option,
+                                     ESF_DZ_TX_DESC_IS_OPT, 1,
+                                     ESF_DZ_TX_OPTION_TYPE,
+                                     ESE_DZ_TX_OPTION_DESC_TSO,
+                                     ESF_DZ_TX_TSO_TCP_FLAGS, tcp_flags,
+                                     ESF_DZ_TX_TSO_IP_ID, st->ipv4_id,
+                                     ESF_DZ_TX_TSO_TCP_SEQNO, st->seqnum);
+                ++tx_queue->insert_count;
+
+                /* We mapped the headers in tso_start().  Unmap them
+                 * when the last segment is completed.
+                 */
+                buffer = efx_tx_queue_get_insert_buffer(tx_queue);
+                buffer->dma_addr = st->header_dma_addr;
+                buffer->len = st->header_len;
+                if (is_last) {
+                        buffer->flags = EFX_TX_BUF_CONT | EFX_TX_BUF_MAP_SINGLE;
+                        buffer->unmap_len = st->header_unmap_len;
+                        /* Ensure we only unmap them once in case of a
+                         * later DMA mapping error and rollback
+                         */
+                        st->header_unmap_len = 0;
+                } else {
+                        buffer->flags = EFX_TX_BUF_CONT;
+                        buffer->unmap_len = 0;
+                }
+                ++tx_queue->insert_count;
         }
 
-        rc = efx_tso_put_header(tx_queue, buffer, header);
-        if (unlikely(rc))
-                return rc;
+        st->seqnum += skb_shinfo(skb)->gso_size;
+
+        /* Linux leaves suitable gaps in the IP ID space for us to fill. */
+        ++st->ipv4_id;
 
         ++tx_queue->tso_packets;
 
@@ -1023,12 +1264,11 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
 
         EFX_BUG_ON_PARANOID(tx_queue->write_count != tx_queue->insert_count);
 
-        tso_start(&state, skb);
+        rc = tso_start(&state, efx, skb);
+        if (rc)
+                goto mem_err;
 
-        /* Assume that skb header area contains exactly the headers, and
-         * all payload is in the frag list.
-         */
-        if (skb_headlen(skb) == state.header_len) {
+        if (likely(state.in_len == 0)) {
                 /* Grab the first payload fragment. */
                 EFX_BUG_ON_PARANOID(skb_shinfo(skb)->nr_frags < 1);
                 frag_i = 0;
@@ -1037,9 +1277,7 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
                 if (rc)
                         goto mem_err;
         } else {
-                rc = tso_get_head_fragment(&state, efx, skb);
-                if (rc)
-                        goto mem_err;
+                /* Payload starts in the header area. */
                 frag_i = -1;
         }
 
@@ -1091,6 +1329,11 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
                                        state.unmap_len, DMA_TO_DEVICE);
         }
 
+        /* Free the header DMA mapping, if using option descriptors */
+        if (state.header_unmap_len)
+                dma_unmap_single(&efx->pci_dev->dev, state.header_dma_addr,
+                                 state.header_unmap_len, DMA_TO_DEVICE);
+
         efx_enqueue_unwind(tx_queue);
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/sgi/meth.c b/drivers/net/ethernet/sgi/meth.c
index 770036bc2d87..513ed8b1ba58 100644
--- a/drivers/net/ethernet/sgi/meth.c
+++ b/drivers/net/ethernet/sgi/meth.c
@@ -839,7 +839,7 @@ static int meth_probe(struct platform_device *pdev)
         dev->watchdog_timeo     = timeout;
         dev->irq                = MACE_ETHERNET_IRQ;
         dev->base_addr          = (unsigned long)&mace->eth;
-        memcpy(dev->dev_addr, o2meth_eaddr, 6);
+        memcpy(dev->dev_addr, o2meth_eaddr, ETH_ALEN);
 
         priv = netdev_priv(dev);
         spin_lock_init(&priv->meth_lock);
diff --git a/drivers/net/ethernet/sis/sis190.c b/drivers/net/ethernet/sis/sis190.c
index ee18e6f7b4fe..acbbe48a519c 100644
--- a/drivers/net/ethernet/sis/sis190.c
+++ b/drivers/net/ethernet/sis/sis190.c
@@ -1921,7 +1921,6 @@ static void sis190_remove_one(struct pci_dev *pdev)
         cancel_work_sync(&tp->phy_task);
         unregister_netdev(dev);
         sis190_release_board(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static struct pci_driver sis190_pci_driver = {
diff --git a/drivers/net/ethernet/smsc/epic100.c b/drivers/net/ethernet/smsc/epic100.c
index 03b256af7ed5..8c5c24a16f8a 100644
--- a/drivers/net/ethernet/smsc/epic100.c
+++ b/drivers/net/ethernet/smsc/epic100.c
@@ -1535,7 +1535,6 @@ static void epic_remove_one(struct pci_dev *pdev)
         pci_release_regions(pdev);
         free_netdev(dev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         /* pci_power_off(pdev, -1); */
 }
 
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 5fdbc2686eb3..01f8459c3213 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2502,7 +2502,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
                 SMSC_TRACE(pdata, probe,
                            "MAC Address is specified by configuration");
         } else if (is_valid_ether_addr(pdata->config.mac)) {
-                memcpy(dev->dev_addr, pdata->config.mac, 6);
+                memcpy(dev->dev_addr, pdata->config.mac, ETH_ALEN);
                 SMSC_TRACE(pdata, probe,
                            "MAC Address specified by platform data");
         } else {
diff --git a/drivers/net/ethernet/smsc/smsc9420.c b/drivers/net/ethernet/smsc/smsc9420.c
index 5f9e79f7f2df..e55e3365a306 100644
--- a/drivers/net/ethernet/smsc/smsc9420.c
+++ b/drivers/net/ethernet/smsc/smsc9420.c
@@ -1707,8 +1707,6 @@ static void smsc9420_remove(struct pci_dev *pdev)
         if (!dev)
                 return;
 
-        pci_set_drvdata(pdev, NULL);
-
         pd = netdev_priv(dev);
         unregister_netdev(dev);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 7eb8babed2cb..fc94f202a43e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -451,14 +451,14 @@ struct mac_device_info {
 struct mac_device_info *dwmac1000_setup(void __iomem *ioaddr);
 struct mac_device_info *dwmac100_setup(void __iomem *ioaddr);
 
-extern void stmmac_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
-                                unsigned int high, unsigned int low);
-extern void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
-                                unsigned int high, unsigned int low);
+void stmmac_set_mac_addr(void __iomem *ioaddr, u8 addr[6],
+                         unsigned int high, unsigned int low);
+void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
+                         unsigned int high, unsigned int low);
 
-extern void stmmac_set_mac(void __iomem *ioaddr, bool enable);
+void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 
-extern void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
+void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
 extern const struct stmmac_ring_mode_ops ring_mode_ops;
 extern const struct stmmac_chain_mode_ops chain_mode_ops;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
index 8e5662ce488b..def266da55db 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
@@ -104,14 +104,13 @@
 #define DMA_STATUS_TI   0x00000001      /* Transmit Interrupt */
 #define DMA_CONTROL_FTF         0x00100000      /* Flush transmit FIFO */
 
-extern void dwmac_enable_dma_transmission(void __iomem *ioaddr);
-extern void dwmac_enable_dma_irq(void __iomem *ioaddr);
-extern void dwmac_disable_dma_irq(void __iomem *ioaddr);
-extern void dwmac_dma_start_tx(void __iomem *ioaddr);
-extern void dwmac_dma_stop_tx(void __iomem *ioaddr);
-extern void dwmac_dma_start_rx(void __iomem *ioaddr);
-extern void dwmac_dma_stop_rx(void __iomem *ioaddr);
-extern int dwmac_dma_interrupt(void __iomem *ioaddr,
-                               struct stmmac_extra_stats *x);
+void dwmac_enable_dma_transmission(void __iomem *ioaddr);
+void dwmac_enable_dma_irq(void __iomem *ioaddr);
+void dwmac_disable_dma_irq(void __iomem *ioaddr);
+void dwmac_dma_start_tx(void __iomem *ioaddr);
+void dwmac_dma_stop_tx(void __iomem *ioaddr);
+void dwmac_dma_start_rx(void __iomem *ioaddr);
+void dwmac_dma_stop_rx(void __iomem *ioaddr);
+int dwmac_dma_interrupt(void __iomem *ioaddr, struct stmmac_extra_stats *x);
 
 #endif /* __DWMAC_DMA_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc.h b/drivers/net/ethernet/stmicro/stmmac/mmc.h
index 48ec001566b5..8607488cbcfc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc.h
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc.h
@@ -128,8 +128,8 @@ struct stmmac_counters {
         unsigned int mmc_rx_icmp_err_octets;
 };
 
-extern void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode);
-extern void dwmac_mmc_intr_all_mask(void __iomem *ioaddr);
-extern void dwmac_mmc_read(void __iomem *ioaddr, struct stmmac_counters *mmc);
+void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode);
+void dwmac_mmc_intr_all_mask(void __iomem *ioaddr);
+void dwmac_mmc_read(void __iomem *ioaddr, struct stmmac_counters *mmc);
 
 #endif /* __MMC_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index f16a9bdf45bb..22f89ffdfd95 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -110,14 +110,14 @@ struct stmmac_priv {
 
 extern int phyaddr;
 
-extern int stmmac_mdio_unregister(struct net_device *ndev);
-extern int stmmac_mdio_register(struct net_device *ndev);
-extern void stmmac_set_ethtool_ops(struct net_device *netdev);
+int stmmac_mdio_unregister(struct net_device *ndev);
+int stmmac_mdio_register(struct net_device *ndev);
+void stmmac_set_ethtool_ops(struct net_device *netdev);
 extern const struct stmmac_desc_ops enh_desc_ops;
 extern const struct stmmac_desc_ops ndesc_ops;
 extern const struct stmmac_hwtimestamp stmmac_ptp;
-extern int stmmac_ptp_register(struct stmmac_priv *priv);
-extern void stmmac_ptp_unregister(struct stmmac_priv *priv);
+int stmmac_ptp_register(struct stmmac_priv *priv);
+void stmmac_ptp_unregister(struct stmmac_priv *priv);
 int stmmac_freeze(struct net_device *ndev);
 int stmmac_restore(struct net_device *ndev);
 int stmmac_resume(struct net_device *ndev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 023b7c29cb2f..644d80ece067 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -138,7 +138,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev)
 
         stmmac_dvr_remove(ndev);
 
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, priv->ioaddr);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 759441b29e53..b4d50d74ba18 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -3354,7 +3354,7 @@ use_random_mac_addr:
 #if defined(CONFIG_SPARC)
         addr = of_get_property(cp->of_node, "local-mac-address", NULL);
         if (addr != NULL) {
-                memcpy(dev_addr, addr, 6);
+                memcpy(dev_addr, addr, ETH_ALEN);
                 goto done;
         }
 #endif
@@ -5168,7 +5168,6 @@ err_out_free_netdev:
 
 err_out_disable_pdev:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return -ENODEV;
 }
 
@@ -5206,7 +5205,6 @@ static void cas_remove_one(struct pci_dev *pdev)
         free_netdev(dev);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index e62df2b81302..a235bd9fd980 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2779,7 +2779,7 @@ static int gem_get_device_address(struct gem *gp)
                 return -1;
 #endif
         }
-        memcpy(dev->dev_addr, addr, 6);
+        memcpy(dev->dev_addr, addr, ETH_ALEN);
 #else
         get_gem_mac_nonobp(gp->pdev, gp->dev->dev_addr);
 #endif
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index e37b587b3860..0dbf46f08ed5 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -2675,10 +2675,10 @@ static int happy_meal_sbus_probe_one(struct platform_device *op, int is_qfe)
 
                 addr = of_get_property(dp, "local-mac-address", &len);
 
-                if (qfe_slot != -1 && addr && len == 6)
-                        memcpy(dev->dev_addr, addr, 6);
+                if (qfe_slot != -1 && addr && len == ETH_ALEN)
+                        memcpy(dev->dev_addr, addr, ETH_ALEN);
                 else
-                        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+                        memcpy(dev->dev_addr, idprom->id_ethaddr, ETH_ALEN);
         }
 
         hp = netdev_priv(dev);
@@ -3024,9 +3024,9 @@ static int happy_meal_pci_probe(struct pci_dev *pdev,
                     (addr = of_get_property(dp, "local-mac-address", &len))
                         != NULL &&
                     len == 6) {
-                        memcpy(dev->dev_addr, addr, 6);
+                        memcpy(dev->dev_addr, addr, ETH_ALEN);
                 } else {
-                        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+                        memcpy(dev->dev_addr, idprom->id_ethaddr, ETH_ALEN);
                 }
 #else
                 get_hme_mac_nonsparc(pdev, &dev->dev_addr[0]);
@@ -3170,8 +3170,6 @@ static void happy_meal_pci_remove(struct pci_dev *pdev)
         pci_release_regions(hp->happy_dev);
 
         free_netdev(net_dev);
-
-        pci_set_drvdata(pdev, NULL);
 }
 
 static DEFINE_PCI_DEVICE_TABLE(happymeal_pci_ids) = {
diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
index b072f4dba033..5695ae2411de 100644
--- a/drivers/net/ethernet/sun/sunqe.c
+++ b/drivers/net/ethernet/sun/sunqe.c
@@ -843,7 +843,7 @@ static int qec_ether_init(struct platform_device *op)
         if (!dev)
                 return -ENOMEM;
 
-        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+        memcpy(dev->dev_addr, idprom->id_ethaddr, ETH_ALEN);
 
         qe = netdev_priv(dev);
 
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index de71b1ec4625..53150c25a96b 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -49,11 +49,19 @@ config TI_DAVINCI_CPDMA
           To compile this driver as a module, choose M here: the module
           will be called davinci_cpdma.  This is recommended.
 
+config TI_CPSW_PHY_SEL
+        boolean "TI CPSW Switch Phy sel Support"
+        depends on TI_CPSW
+        ---help---
+          This driver supports configuring of the phy mode connected to
+          the CPSW.
+
 config TI_CPSW
         tristate "TI CPSW Switch Support"
         depends on ARM && (ARCH_DAVINCI || SOC_AM33XX)
         select TI_DAVINCI_CPDMA
         select TI_DAVINCI_MDIO
+        select TI_CPSW_PHY_SEL
         ---help---
           This driver supports TI's CPSW Ethernet Switch.
 
diff --git a/drivers/net/ethernet/ti/Makefile b/drivers/net/ethernet/ti/Makefile
index c65148e8aa1d..9cfaab8152be 100644
--- a/drivers/net/ethernet/ti/Makefile
+++ b/drivers/net/ethernet/ti/Makefile
@@ -7,5 +7,6 @@ obj-$(CONFIG_CPMAC) += cpmac.o
 obj-$(CONFIG_TI_DAVINCI_EMAC) += davinci_emac.o
 obj-$(CONFIG_TI_DAVINCI_MDIO) += davinci_mdio.o
 obj-$(CONFIG_TI_DAVINCI_CPDMA) += davinci_cpdma.o
+obj-$(CONFIG_TI_CPSW_PHY_SEL) += cpsw-phy-sel.o
 obj-$(CONFIG_TI_CPSW) += ti_cpsw.o
 ti_cpsw-y := cpsw_ale.o cpsw.o cpts.o
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
new file mode 100644
index 000000000000..148da9ae8366
--- /dev/null
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -0,0 +1,161 @@
+/* Texas Instruments Ethernet Switch Driver
+ *
+ * Copyright (C) 2013 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/phy.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+
+#include "cpsw.h"
+
+/* AM33xx SoC specific definitions for the CONTROL port */
+#define AM33XX_GMII_SEL_MODE_MII        0
+#define AM33XX_GMII_SEL_MODE_RMII       1
+#define AM33XX_GMII_SEL_MODE_RGMII      2
+
+#define AM33XX_GMII_SEL_RMII2_IO_CLK_EN BIT(7)
+#define AM33XX_GMII_SEL_RMII1_IO_CLK_EN BIT(6)
+
+struct cpsw_phy_sel_priv {
+        struct device   *dev;
+        u32 __iomem     *gmii_sel;
+        bool            rmii_clock_external;
+        void (*cpsw_phy_sel)(struct cpsw_phy_sel_priv *priv,
+                             phy_interface_t phy_mode, int slave);
+};
+
+
+static void cpsw_gmii_sel_am3352(struct cpsw_phy_sel_priv *priv,
+                                 phy_interface_t phy_mode, int slave)
+{
+        u32 reg;
+        u32 mask;
+        u32 mode = 0;
+
+        reg = readl(priv->gmii_sel);
+
+        switch (phy_mode) {
+        case PHY_INTERFACE_MODE_RMII:
+                mode = AM33XX_GMII_SEL_MODE_RMII;
+                break;
+
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+                mode = AM33XX_GMII_SEL_MODE_RGMII;
+                break;
+
+        case PHY_INTERFACE_MODE_MII:
+        default:
+                mode = AM33XX_GMII_SEL_MODE_MII;
+                break;
+        };
+
+        mask = 0x3 << (slave * 2) | BIT(slave + 6);
+        mode <<= slave * 2;
+
+        if (priv->rmii_clock_external) {
+                if (slave == 0)
+                        mode |= AM33XX_GMII_SEL_RMII1_IO_CLK_EN;
+                else
+                        mode |= AM33XX_GMII_SEL_RMII2_IO_CLK_EN;
+        }
+
+        reg &= ~mask;
+        reg |= mode;
+
+        writel(reg, priv->gmii_sel);
+}
+
+static struct platform_driver cpsw_phy_sel_driver;
+static int match(struct device *dev, void *data)
+{
+        struct device_node *node = (struct device_node *)data;
+        return dev->of_node == node &&
+                dev->driver == &cpsw_phy_sel_driver.driver;
+}
+
+void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
+{
+        struct device_node *node;
+        struct cpsw_phy_sel_priv *priv;
+
+        node = of_get_child_by_name(dev->of_node, "cpsw-phy-sel");
+        if (!node) {
+                dev_err(dev, "Phy mode driver DT not found\n");
+                return;
+        }
+
+        dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        priv = dev_get_drvdata(dev);
+
+        priv->cpsw_phy_sel(priv, phy_mode, slave);
+}
+EXPORT_SYMBOL_GPL(cpsw_phy_sel);
+
+static const struct of_device_id cpsw_phy_sel_id_table[] = {
+        {
+                .compatible     = "ti,am3352-cpsw-phy-sel",
+                .data           = &cpsw_gmii_sel_am3352,
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(of, cpsw_phy_sel_id_table);
+
+static int cpsw_phy_sel_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        const struct of_device_id *of_id;
+        struct cpsw_phy_sel_priv *priv;
+
+        of_id = of_match_node(cpsw_phy_sel_id_table, pdev->dev.of_node);
+        if (!of_id)
+                return -EINVAL;
+
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv) {
+                dev_err(&pdev->dev, "unable to alloc memory for cpsw phy sel\n");
+                return -ENOMEM;
+        }
+
+        priv->cpsw_phy_sel = of_id->data;
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "gmii-sel");
+        priv->gmii_sel = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(priv->gmii_sel))
+                return PTR_ERR(priv->gmii_sel);
+
+        if (of_find_property(pdev->dev.of_node, "rmii-clock-ext", NULL))
+                priv->rmii_clock_external = true;
+
+        dev_set_drvdata(&pdev->dev, priv);
+
+        return 0;
+}
+
+static struct platform_driver cpsw_phy_sel_driver = {
+        .probe          = cpsw_phy_sel_probe,
+        .driver         = {
+                .name   = "cpsw-phy-sel",
+                .owner  = THIS_MODULE,
+                .of_match_table = cpsw_phy_sel_id_table,
+        },
+};
+
+module_platform_driver(cpsw_phy_sel_driver);
+MODULE_AUTHOR("Mugunthan V N <mugunthanvnm@ti.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index cc3ce557e4aa..90d41d26ec6d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -367,8 +367,6 @@ struct cpsw_priv {
         spinlock_t                      lock;
         struct platform_device          *pdev;
         struct net_device               *ndev;
-        struct resource                 *cpsw_res;
-        struct resource                 *cpsw_wr_res;
         struct napi_struct              napi;
         struct device                   *dev;
         struct cpsw_platform_data       data;
@@ -1016,6 +1014,10 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
                 dev_info(priv->dev, "phy found : id is : 0x%x\n",
                          slave->phy->phy_id);
                 phy_start(slave->phy);
+
+                /* Configure GMII_SEL register */
+                cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface,
+                             slave->slave_num);
         }
 }
 
@@ -1705,62 +1707,55 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
 
         if (of_property_read_u32(node, "active_slave", &prop)) {
                 pr_err("Missing active_slave property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->active_slave = prop;
 
         if (of_property_read_u32(node, "cpts_clock_mult", &prop)) {
                 pr_err("Missing cpts_clock_mult property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->cpts_clock_mult = prop;
 
         if (of_property_read_u32(node, "cpts_clock_shift", &prop)) {
                 pr_err("Missing cpts_clock_shift property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->cpts_clock_shift = prop;
 
-        data->slave_data = kcalloc(data->slaves, sizeof(struct cpsw_slave_data),
-                                   GFP_KERNEL);
+        data->slave_data = devm_kzalloc(&pdev->dev, data->slaves
+                                        * sizeof(struct cpsw_slave_data),
+                                        GFP_KERNEL);
         if (!data->slave_data)
-                return -EINVAL;
+                return -ENOMEM;
 
         if (of_property_read_u32(node, "cpdma_channels", &prop)) {
                 pr_err("Missing cpdma_channels property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->channels = prop;
 
         if (of_property_read_u32(node, "ale_entries", &prop)) {
                 pr_err("Missing ale_entries property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->ale_entries = prop;
 
         if (of_property_read_u32(node, "bd_ram_size", &prop)) {
                 pr_err("Missing bd_ram_size property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->bd_ram_size = prop;
 
         if (of_property_read_u32(node, "rx_descs", &prop)) {
                 pr_err("Missing rx_descs property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->rx_descs = prop;
 
         if (of_property_read_u32(node, "mac_control", &prop)) {
                 pr_err("Missing mac_control property in the DT.\n");
-                ret = -EINVAL;
-                goto error_ret;
+                return -EINVAL;
         }
         data->mac_control = prop;
 
@@ -1791,8 +1786,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 parp = of_get_property(slave_node, "phy_id", &lenp);
                 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         pr_err("Missing slave[%d] phy_id property\n", i);
-                        ret = -EINVAL;
-                        goto error_ret;
+                        return -EINVAL;
                 }
                 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                 phyid = be32_to_cpup(parp+1);
@@ -1822,10 +1816,6 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
         }
 
         return 0;
-
-error_ret:
-        kfree(data->slave_data);
-        return ret;
 }
 
 static int cpsw_probe_dual_emac(struct platform_device *pdev,
@@ -1867,7 +1857,6 @@ static int cpsw_probe_dual_emac(struct platform_device *pdev,
         priv_sl2->coal_intvl = 0;
         priv_sl2->bus_freq_mhz = priv->bus_freq_mhz;
 
-        priv_sl2->cpsw_res = priv->cpsw_res;
         priv_sl2->regs = priv->regs;
         priv_sl2->host_port = priv->host_port;
         priv_sl2->host_port_regs = priv->host_port_regs;
@@ -1911,8 +1900,8 @@ static int cpsw_probe(struct platform_device *pdev)
         struct cpsw_priv                *priv;
         struct cpdma_params             dma_params;
         struct cpsw_ale_params          ale_params;
-        void __iomem                    *ss_regs, *wr_regs;
-        struct resource                 *res;
+        void __iomem                    *ss_regs;
+        struct resource                 *res, *ss_res;
         u32 slave_offset, sliver_offset, slave_size;
         int ret = 0, i, k = 0;
 
@@ -1948,7 +1937,7 @@ static int cpsw_probe(struct platform_device *pdev)
         if (cpsw_probe_dt(&priv->data, pdev)) {
                 pr_err("cpsw: platform data missing\n");
                 ret = -ENODEV;
-                goto clean_ndev_ret;
+                goto clean_runtime_disable_ret;
         }
         data = &priv->data;
 
@@ -1962,11 +1951,12 @@ static int cpsw_probe(struct platform_device *pdev)
 
         memcpy(ndev->dev_addr, priv->mac_addr, ETH_ALEN);
 
-        priv->slaves = kzalloc(sizeof(struct cpsw_slave) * data->slaves,
-                               GFP_KERNEL);
+        priv->slaves = devm_kzalloc(&pdev->dev,
+                                    sizeof(struct cpsw_slave) * data->slaves,
+                                    GFP_KERNEL);
         if (!priv->slaves) {
-                ret = -EBUSY;
-                goto clean_ndev_ret;
+                ret = -ENOMEM;
+                goto clean_runtime_disable_ret;
         }
         for (i = 0; i < data->slaves; i++)
                 priv->slaves[i].slave_num = i;
@@ -1974,55 +1964,31 @@ static int cpsw_probe(struct platform_device *pdev)
         priv->slaves[0].ndev = ndev;
         priv->emac_port = 0;
 
-        priv->clk = clk_get(&pdev->dev, "fck");
+        priv->clk = devm_clk_get(&pdev->dev, "fck");
         if (IS_ERR(priv->clk)) {
-                dev_err(&pdev->dev, "fck is not found\n");
+                dev_err(priv->dev, "fck is not found\n");
                 ret = -ENODEV;
-                goto clean_slave_ret;
+                goto clean_runtime_disable_ret;
         }
         priv->coal_intvl = 0;
         priv->bus_freq_mhz = clk_get_rate(priv->clk) / 1000000;
 
-        priv->cpsw_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!priv->cpsw_res) {
-                dev_err(priv->dev, "error getting i/o resource\n");
-                ret = -ENOENT;
-                goto clean_clk_ret;
-        }
-        if (!request_mem_region(priv->cpsw_res->start,
-                                resource_size(priv->cpsw_res), ndev->name)) {
-                dev_err(priv->dev, "failed request i/o region\n");
-                ret = -ENXIO;
-                goto clean_clk_ret;
-        }
-        ss_regs = ioremap(priv->cpsw_res->start, resource_size(priv->cpsw_res));
-        if (!ss_regs) {
-                dev_err(priv->dev, "unable to map i/o region\n");
-                goto clean_cpsw_iores_ret;
+        ss_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        ss_regs = devm_ioremap_resource(&pdev->dev, ss_res);
+        if (IS_ERR(ss_regs)) {
+                ret = PTR_ERR(ss_regs);
+                goto clean_runtime_disable_ret;
         }
         priv->regs = ss_regs;
         priv->version = __raw_readl(&priv->regs->id_ver);
         priv->host_port = HOST_PORT_NUM;
 
-        priv->cpsw_wr_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        if (!priv->cpsw_wr_res) {
-                dev_err(priv->dev, "error getting i/o resource\n");
-                ret = -ENOENT;
-                goto clean_iomap_ret;
-        }
-        if (!request_mem_region(priv->cpsw_wr_res->start,
-                        resource_size(priv->cpsw_wr_res), ndev->name)) {
-                dev_err(priv->dev, "failed request i/o region\n");
-                ret = -ENXIO;
-                goto clean_iomap_ret;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        priv->wr_regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(priv->wr_regs)) {
+                ret = PTR_ERR(priv->wr_regs);
+                goto clean_runtime_disable_ret;
         }
-        wr_regs = ioremap(priv->cpsw_wr_res->start,
-                                resource_size(priv->cpsw_wr_res));
-        if (!wr_regs) {
-                dev_err(priv->dev, "unable to map i/o region\n");
-                goto clean_cpsw_wr_iores_ret;
-        }
-        priv->wr_regs = wr_regs;
 
         memset(&dma_params, 0, sizeof(dma_params));
         memset(&ale_params, 0, sizeof(ale_params));
@@ -2053,12 +2019,12 @@ static int cpsw_probe(struct platform_device *pdev)
                 slave_size           = CPSW2_SLAVE_SIZE;
                 sliver_offset        = CPSW2_SLIVER_OFFSET;
                 dma_params.desc_mem_phys =
-                        (u32 __force) priv->cpsw_res->start + CPSW2_BD_OFFSET;
+                        (u32 __force) ss_res->start + CPSW2_BD_OFFSET;
                 break;
         default:
                 dev_err(priv->dev, "unknown version 0x%08x\n", priv->version);
                 ret = -ENODEV;
-                goto clean_cpsw_wr_iores_ret;
+                goto clean_runtime_disable_ret;
         }
         for (i = 0; i < priv->data.slaves; i++) {
                 struct cpsw_slave *slave = &priv->slaves[i];
@@ -2086,7 +2052,7 @@ static int cpsw_probe(struct platform_device *pdev)
         if (!priv->dma) {
                 dev_err(priv->dev, "error initializing dma\n");
                 ret = -ENOMEM;
-                goto clean_wr_iomap_ret;
+                goto clean_runtime_disable_ret;
         }
 
         priv->txch = cpdma_chan_create(priv->dma, tx_chan_num(0),
@@ -2121,8 +2087,8 @@ static int cpsw_probe(struct platform_device *pdev)
 
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
-                        if (request_irq(i, cpsw_interrupt, 0,
-                                        dev_name(&pdev->dev), priv)) {
+                        if (devm_request_irq(&pdev->dev, i, cpsw_interrupt, 0,
+                                             dev_name(priv->dev), priv)) {
                                 dev_err(priv->dev, "error attaching irq\n");
                                 goto clean_ale_ret;
                         }
@@ -2144,7 +2110,7 @@ static int cpsw_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(priv->dev, "error registering net device\n");
                 ret = -ENODEV;
-                goto clean_irq_ret;
+                goto clean_ale_ret;
         }
 
         if (cpts_register(&pdev->dev, priv->cpts,
@@ -2152,44 +2118,27 @@ static int cpsw_probe(struct platform_device *pdev)
                 dev_err(priv->dev, "error registering cpts device\n");
 
         cpsw_notice(priv, probe, "initialized device (regs %x, irq %d)\n",
-                  priv->cpsw_res->start, ndev->irq);
+                    ss_res->start, ndev->irq);
 
         if (priv->data.dual_emac) {
                 ret = cpsw_probe_dual_emac(pdev, priv);
                 if (ret) {
                         cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
-                        goto clean_irq_ret;
+                        goto clean_ale_ret;
                 }
         }
 
         return 0;
 
-clean_irq_ret:
-        for (i = 0; i < priv->num_irqs; i++)
-                free_irq(priv->irqs_table[i], priv);
 clean_ale_ret:
         cpsw_ale_destroy(priv->ale);
 clean_dma_ret:
         cpdma_chan_destroy(priv->txch);
         cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
-clean_wr_iomap_ret:
-        iounmap(priv->wr_regs);
-clean_cpsw_wr_iores_ret:
-        release_mem_region(priv->cpsw_wr_res->start,
-                           resource_size(priv->cpsw_wr_res));
-clean_iomap_ret:
-        iounmap(priv->regs);
-clean_cpsw_iores_ret:
-        release_mem_region(priv->cpsw_res->start,
-                           resource_size(priv->cpsw_res));
-clean_clk_ret:
-        clk_put(priv->clk);
-clean_slave_ret:
+clean_runtime_disable_ret:
         pm_runtime_disable(&pdev->dev);
-        kfree(priv->slaves);
 clean_ndev_ret:
-        kfree(priv->data.slave_data);
         free_netdev(priv->ndev);
         return ret;
 }
@@ -2198,30 +2147,18 @@ static int cpsw_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct cpsw_priv *priv = netdev_priv(ndev);
-        int i;
 
         if (priv->data.dual_emac)
                 unregister_netdev(cpsw_get_slave_ndev(priv, 1));
         unregister_netdev(ndev);
 
         cpts_unregister(priv->cpts);
-        for (i = 0; i < priv->num_irqs; i++)
-                free_irq(priv->irqs_table[i], priv);
 
         cpsw_ale_destroy(priv->ale);
         cpdma_chan_destroy(priv->txch);
         cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
-        iounmap(priv->regs);
-        release_mem_region(priv->cpsw_res->start,
-                           resource_size(priv->cpsw_res));
-        iounmap(priv->wr_regs);
-        release_mem_region(priv->cpsw_wr_res->start,
-                           resource_size(priv->cpsw_wr_res));
         pm_runtime_disable(&pdev->dev);
-        clk_put(priv->clk);
-        kfree(priv->slaves);
-        kfree(priv->data.slave_data);
         if (priv->data.dual_emac)
                 free_netdev(cpsw_get_slave_ndev(priv, 1));
         free_netdev(ndev);
@@ -2277,7 +2214,7 @@ static struct platform_driver cpsw_driver = {
                 .name    = "cpsw",
                 .owner   = THIS_MODULE,
                 .pm      = &cpsw_pm_ops,
-                .of_match_table = of_match_ptr(cpsw_of_mtable),
+                .of_match_table = cpsw_of_mtable,
         },
         .probe = cpsw_probe,
         .remove = cpsw_remove,
diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h
index eb3e101ec048..574f49da693f 100644
--- a/drivers/net/ethernet/ti/cpsw.h
+++ b/drivers/net/ethernet/ti/cpsw.h
@@ -39,4 +39,6 @@ struct cpsw_platform_data {
         bool    dual_emac;      /* Enable Dual EMAC mode */
 };
 
+void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave);
+
 #endif /* __CPSW_H__ */
diff --git a/drivers/net/ethernet/ti/cpts.h b/drivers/net/ethernet/ti/cpts.h
index fe993cdd7e23..1a581ef7eee8 100644
--- a/drivers/net/ethernet/ti/cpts.h
+++ b/drivers/net/ethernet/ti/cpts.h
@@ -127,8 +127,8 @@ struct cpts {
 };
 
 #ifdef CONFIG_TI_CPTS
-extern void cpts_rx_timestamp(struct cpts *cpts, struct sk_buff *skb);
-extern void cpts_tx_timestamp(struct cpts *cpts, struct sk_buff *skb);
+void cpts_rx_timestamp(struct cpts *cpts, struct sk_buff *skb);
+void cpts_tx_timestamp(struct cpts *cpts, struct sk_buff *skb);
 #else
 static inline void cpts_rx_timestamp(struct cpts *cpts, struct sk_buff *skb)
 {
@@ -138,8 +138,7 @@ static inline void cpts_tx_timestamp(struct cpts *cpts, struct sk_buff *skb)
 }
 #endif
 
-extern int cpts_register(struct device *dev, struct cpts *cpts,
-                         u32 mult, u32 shift);
-extern void cpts_unregister(struct cpts *cpts);
+int cpts_register(struct device *dev, struct cpts *cpts, u32 mult, u32 shift);
+void cpts_unregister(struct cpts *cpts);
 
 #endif
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 6a32ef9d63ae..41ba974bf37c 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1852,7 +1852,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
         }
 
         /* MAC addr and PHY mask , RMII enable info from platform_data */
-        memcpy(priv->mac_addr, pdata->mac_addr, 6);
+        memcpy(priv->mac_addr, pdata->mac_addr, ETH_ALEN);
         priv->phy_id = pdata->phy_id;
         priv->rmii_en = pdata->rmii_en;
         priv->version = pdata->version;
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 13e6fff8ca23..628b736e5ae7 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2230,7 +2230,7 @@ static void tile_net_dev_init(const char *name, const uint8_t *mac)
                 nz_addr |= mac[i];
 
         if (nz_addr) {
-                memcpy(dev->dev_addr, mac, 6);
+                memcpy(dev->dev_addr, mac, ETH_ALEN);
                 dev->addr_len = 6;
         } else {
                 eth_hw_addr_random(dev);
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
index 309abb472aa2..8505196be9f5 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
@@ -359,27 +359,26 @@ static inline void *port_priv(struct gelic_port *port)
 }
 
 #ifdef CONFIG_PPC_EARLY_DEBUG_PS3GELIC
-extern void udbg_shutdown_ps3gelic(void);
+void udbg_shutdown_ps3gelic(void);
 #else
 static inline void udbg_shutdown_ps3gelic(void) {}
 #endif
 
-extern int gelic_card_set_irq_mask(struct gelic_card *card, u64 mask);
+int gelic_card_set_irq_mask(struct gelic_card *card, u64 mask);
 /* shared netdev ops */
-extern void gelic_card_up(struct gelic_card *card);
-extern void gelic_card_down(struct gelic_card *card);
-extern int gelic_net_open(struct net_device *netdev);
-extern int gelic_net_stop(struct net_device *netdev);
-extern int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
-extern void gelic_net_set_multi(struct net_device *netdev);
-extern void gelic_net_tx_timeout(struct net_device *netdev);
-extern int gelic_net_change_mtu(struct net_device *netdev, int new_mtu);
-extern int gelic_net_setup_netdev(struct net_device *netdev,
-                                  struct gelic_card *card);
+void gelic_card_up(struct gelic_card *card);
+void gelic_card_down(struct gelic_card *card);
+int gelic_net_open(struct net_device *netdev);
+int gelic_net_stop(struct net_device *netdev);
+int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+void gelic_net_set_multi(struct net_device *netdev);
+void gelic_net_tx_timeout(struct net_device *netdev);
+int gelic_net_change_mtu(struct net_device *netdev, int new_mtu);
+int gelic_net_setup_netdev(struct net_device *netdev, struct gelic_card *card);
 
 /* shared ethtool ops */
-extern void gelic_net_get_drvinfo(struct net_device *netdev,
-                                  struct ethtool_drvinfo *info);
-extern void gelic_net_poll_controller(struct net_device *netdev);
+void gelic_net_get_drvinfo(struct net_device *netdev,
+                           struct ethtool_drvinfo *info);
+void gelic_net_poll_controller(struct net_device *netdev);
 
 #endif /* _GELIC_NET_H */
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.h b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.h
index f7e51b7d7049..11f443d8e4ea 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.h
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.h
@@ -320,7 +320,7 @@ struct gelic_eurus_cmd {
 #define GELIC_WL_PRIV_SET_PSK           (SIOCIWFIRSTPRIV + 0)
 #define GELIC_WL_PRIV_GET_PSK           (SIOCIWFIRSTPRIV + 1)
 
-extern int gelic_wl_driver_probe(struct gelic_card *card);
-extern int gelic_wl_driver_remove(struct gelic_card *card);
-extern void gelic_wl_interrupt(struct net_device *netdev, u64 status);
+int gelic_wl_driver_probe(struct gelic_card *card);
+int gelic_wl_driver_remove(struct gelic_card *card);
+void gelic_wl_interrupt(struct net_device *netdev, u64 status);
 #endif /* _GELIC_WIRELESS_H */
diff --git a/drivers/net/ethernet/toshiba/spider_net.h b/drivers/net/ethernet/toshiba/spider_net.h
index 4ba2135474d1..9b6af0845a11 100644
--- a/drivers/net/ethernet/toshiba/spider_net.h
+++ b/drivers/net/ethernet/toshiba/spider_net.h
@@ -29,8 +29,8 @@
 
 #include <linux/sungem_phy.h>
 
-extern int spider_net_stop(struct net_device *netdev);
-extern int spider_net_open(struct net_device *netdev);
+int spider_net_stop(struct net_device *netdev);
+int spider_net_open(struct net_device *netdev);
 
 extern const struct ethtool_ops spider_net_ethtool_ops;
 
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 4c619ea5189f..74234a51c851 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -31,7 +31,7 @@
 #define DRIVER_NAME "xilinx_emaclite"
 
 /* Register offsets for the EmacLite Core */
-#define XEL_TXBUFF_OFFSET       0x0             /* Transmit Buffer */
+#define XEL_TXBUFF_OFFSET       0x0             /* Transmit Buffer */
 #define XEL_MDIOADDR_OFFSET     0x07E4          /* MDIO Address Register */
 #define XEL_MDIOWR_OFFSET       0x07E8          /* MDIO Write Data Register */
 #define XEL_MDIORD_OFFSET       0x07EC          /* MDIO Read Data Register */
@@ -63,13 +63,13 @@
 #define XEL_MDIOCTRL_MDIOEN_MASK  0x00000008    /* MDIO Enable */
 
 /* Global Interrupt Enable Register (GIER) Bit Masks */
-#define XEL_GIER_GIE_MASK       0x80000000      /* Global Enable */
+#define XEL_GIER_GIE_MASK       0x80000000      /* Global Enable */
 
 /* Transmit Status Register (TSR) Bit Masks */
-#define XEL_TSR_XMIT_BUSY_MASK   0x00000001     /* Tx complete */
-#define XEL_TSR_PROGRAM_MASK     0x00000002     /* Program the MAC address */
-#define XEL_TSR_XMIT_IE_MASK     0x00000008     /* Tx interrupt enable bit */
-#define XEL_TSR_XMIT_ACTIVE_MASK 0x80000000     /* Buffer is active, SW bit
+#define XEL_TSR_XMIT_BUSY_MASK   0x00000001     /* Tx complete */
+#define XEL_TSR_PROGRAM_MASK     0x00000002     /* Program the MAC address */
+#define XEL_TSR_XMIT_IE_MASK     0x00000008     /* Tx interrupt enable bit */
+#define XEL_TSR_XMIT_ACTIVE_MASK 0x80000000     /* Buffer is active, SW bit
                                                  * only. This is not documented
                                                  * in the HW spec */
 
@@ -77,21 +77,21 @@
 #define XEL_TSR_PROG_MAC_ADDR   (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_PROGRAM_MASK)
 
 /* Receive Status Register (RSR) */
-#define XEL_RSR_RECV_DONE_MASK  0x00000001      /* Rx complete */
-#define XEL_RSR_RECV_IE_MASK    0x00000008      /* Rx interrupt enable bit */
+#define XEL_RSR_RECV_DONE_MASK  0x00000001      /* Rx complete */
+#define XEL_RSR_RECV_IE_MASK    0x00000008      /* Rx interrupt enable bit */
 
 /* Transmit Packet Length Register (TPLR) */
-#define XEL_TPLR_LENGTH_MASK    0x0000FFFF      /* Tx packet length */
+#define XEL_TPLR_LENGTH_MASK    0x0000FFFF      /* Tx packet length */
 
 /* Receive Packet Length Register (RPLR) */
-#define XEL_RPLR_LENGTH_MASK    0x0000FFFF      /* Rx packet length */
+#define XEL_RPLR_LENGTH_MASK    0x0000FFFF      /* Rx packet length */
 
-#define XEL_HEADER_OFFSET       12              /* Offset to length field */
-#define XEL_HEADER_SHIFT        16              /* Shift value for length */
+#define XEL_HEADER_OFFSET       12              /* Offset to length field */
+#define XEL_HEADER_SHIFT        16              /* Shift value for length */
 
 /* General Ethernet Definitions */
-#define XEL_ARP_PACKET_SIZE             28      /* Max ARP packet size */
-#define XEL_HEADER_IP_LENGTH_OFFSET     16      /* IP Length Offset */
+#define XEL_ARP_PACKET_SIZE             28      /* Max ARP packet size */
+#define XEL_HEADER_IP_LENGTH_OFFSET     16      /* IP Length Offset */
 
 
 
@@ -1075,14 +1075,9 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
  * This function un maps the IO region of the Emaclite device and frees the net
  * device.
  */
-static void xemaclite_remove_ndev(struct net_device *ndev,
-                                  struct platform_device *pdev)
+static void xemaclite_remove_ndev(struct net_device *ndev)
 {
         if (ndev) {
-                struct net_local *lp = netdev_priv(ndev);
-
-                if (lp->base_addr)
-                        devm_iounmap(&pdev->dev, lp->base_addr);
                 free_netdev(ndev);
         }
 }
@@ -1177,7 +1172,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
 
         if (mac_address)
                 /* Set the MAC address. */
-                memcpy(ndev->dev_addr, mac_address, 6);
+                memcpy(ndev->dev_addr, mac_address, ETH_ALEN);
         else
                 dev_warn(dev, "No MAC address found\n");
 
@@ -1214,7 +1209,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
         return 0;
 
 error:
-        xemaclite_remove_ndev(ndev, ofdev);
+        xemaclite_remove_ndev(ndev);
         return rc;
 }
 
@@ -1248,7 +1243,7 @@ static int xemaclite_of_remove(struct platform_device *of_dev)
                 of_node_put(lp->phy_node);
         lp->phy_node = NULL;
 
-        xemaclite_remove_ndev(ndev, of_dev);
+        xemaclite_remove_ndev(ndev);
 
         return 0;
 }
diff --git a/drivers/net/fddi/skfp/fplustm.c b/drivers/net/fddi/skfp/fplustm.c
index a20ed1a98099..f83993590174 100644
--- a/drivers/net/fddi/skfp/fplustm.c
+++ b/drivers/net/fddi/skfp/fplustm.c
@@ -453,7 +453,7 @@ static void directed_beacon(struct s_smc *smc)
          */
         * (char *) a = (char) ((long)DBEACON_INFO<<24L) ;
         a[1] = 0 ;
-        memcpy((char *)a+1,(char *) &smc->mib.m[MAC0].fddiMACUpstreamNbr,6) ;
+        memcpy((char *)a+1, (char *) &smc->mib.m[MAC0].fddiMACUpstreamNbr, ETH_ALEN);
 
         CHECK_NPP() ;
          /* set memory address reg for writes */
diff --git a/drivers/net/fddi/skfp/h/smc.h b/drivers/net/fddi/skfp/h/smc.h
index 3ca308b28214..bd1166bf8f61 100644
--- a/drivers/net/fddi/skfp/h/smc.h
+++ b/drivers/net/fddi/skfp/h/smc.h
@@ -469,20 +469,20 @@ struct s_smc {
 
 extern const struct fddi_addr fddi_broadcast;
 
-extern void all_selection_criteria(struct s_smc *smc);
-extern void card_stop(struct s_smc *smc);
-extern void init_board(struct s_smc *smc, u_char *mac_addr);
-extern int init_fplus(struct s_smc *smc);
-extern void init_plc(struct s_smc *smc);
-extern int init_smt(struct s_smc *smc, u_char * mac_addr);
-extern void mac1_irq(struct s_smc *smc, u_short stu, u_short stl);
-extern void mac2_irq(struct s_smc *smc, u_short code_s2u, u_short code_s2l);
-extern void mac3_irq(struct s_smc *smc, u_short code_s3u, u_short code_s3l);
-extern int pcm_status_twisted(struct s_smc *smc);
-extern void plc1_irq(struct s_smc *smc);
-extern void plc2_irq(struct s_smc *smc);
-extern void read_address(struct s_smc *smc, u_char * mac_addr);
-extern void timer_irq(struct s_smc *smc);
+void all_selection_criteria(struct s_smc *smc);
+void card_stop(struct s_smc *smc);
+void init_board(struct s_smc *smc, u_char *mac_addr);
+int init_fplus(struct s_smc *smc);
+void init_plc(struct s_smc *smc);
+int init_smt(struct s_smc *smc, u_char *mac_addr);
+void mac1_irq(struct s_smc *smc, u_short stu, u_short stl);
+void mac2_irq(struct s_smc *smc, u_short code_s2u, u_short code_s2l);
+void mac3_irq(struct s_smc *smc, u_short code_s3u, u_short code_s3l);
+int pcm_status_twisted(struct s_smc *smc);
+void plc1_irq(struct s_smc *smc);
+void plc2_irq(struct s_smc *smc);
+void read_address(struct s_smc *smc, u_char *mac_addr);
+void timer_irq(struct s_smc *smc);
 
 #endif  /* _SCMECM_ */
 
diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c
index f5d7305a5784..713d303a06a9 100644
--- a/drivers/net/fddi/skfp/skfddi.c
+++ b/drivers/net/fddi/skfp/skfddi.c
@@ -436,7 +436,7 @@ static  int skfp_driver_init(struct net_device *dev)
         }
         read_address(smc, NULL);
         pr_debug("HW-Addr: %pMF\n", smc->hw.fddi_canon_addr.a);
-        memcpy(dev->dev_addr, smc->hw.fddi_canon_addr.a, 6);
+        memcpy(dev->dev_addr, smc->hw.fddi_canon_addr.a, ETH_ALEN);
 
         smt_reset_defaults(smc, 0);
 
@@ -503,7 +503,7 @@ static int skfp_open(struct net_device *dev)
          *               address.
          */
         read_address(smc, NULL);
-        memcpy(dev->dev_addr, smc->hw.fddi_canon_addr.a, 6);
+        memcpy(dev->dev_addr, smc->hw.fddi_canon_addr.a, ETH_ALEN);
 
         init_smt(smc, NULL);
         smt_online(smc, 1);
@@ -1213,7 +1213,7 @@ static void CheckSourceAddress(unsigned char *frame, unsigned char *hw_addr)
         if ((unsigned short) frame[1 + 10] != 0)
                 return;
         SRBit = frame[1 + 6] & 0x01;
-        memcpy(&frame[1 + 6], hw_addr, 6);
+        memcpy(&frame[1 + 6], hw_addr, ETH_ALEN);
         frame[8] |= SRBit;
 }                               // CheckSourceAddress
 
diff --git a/drivers/net/hamradio/baycom_ser_fdx.c b/drivers/net/hamradio/baycom_ser_fdx.c
index a974727dd9a2..636b65c66d49 100644
--- a/drivers/net/hamradio/baycom_ser_fdx.c
+++ b/drivers/net/hamradio/baycom_ser_fdx.c
@@ -445,7 +445,7 @@ static int ser12_open(struct net_device *dev)
         outb(0, FCR(dev->base_addr));  /* disable FIFOs */
         outb(0x0d, MCR(dev->base_addr));
         outb(0, IER(dev->base_addr));
-        if (request_irq(dev->irq, ser12_interrupt, IRQF_DISABLED | IRQF_SHARED,
+        if (request_irq(dev->irq, ser12_interrupt, IRQF_SHARED,
                         "baycom_ser_fdx", dev)) {
                 release_region(dev->base_addr, SER12_EXTENT);
                 return -EBUSY;
diff --git a/drivers/net/hamradio/baycom_ser_hdx.c b/drivers/net/hamradio/baycom_ser_hdx.c
index e349d867449b..f9a8976195ba 100644
--- a/drivers/net/hamradio/baycom_ser_hdx.c
+++ b/drivers/net/hamradio/baycom_ser_hdx.c
@@ -490,7 +490,7 @@ static int ser12_open(struct net_device *dev)
         outb(0, FCR(dev->base_addr));  /* disable FIFOs */
         outb(0x0d, MCR(dev->base_addr));
         outb(0, IER(dev->base_addr));
-        if (request_irq(dev->irq, ser12_interrupt, IRQF_DISABLED | IRQF_SHARED,
+        if (request_irq(dev->irq, ser12_interrupt, IRQF_SHARED,
                         "baycom_ser12", dev)) {
                 release_region(dev->base_addr, SER12_EXTENT);       
                 return -EBUSY;
diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index bc1d52170389..4bc6ee8e7987 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -1734,7 +1734,7 @@ static int scc_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         if (!Ivec[hwcfg.irq].used && hwcfg.irq)
                         {
                                 if (request_irq(hwcfg.irq, scc_isr,
-                                                IRQF_DISABLED, "AX.25 SCC",
+                                                0, "AX.25 SCC",
                                                 (void *)(long) hwcfg.irq))
                                         printk(KERN_WARNING "z8530drv: warning, cannot get IRQ %d\n", hwcfg.irq);
                                 else
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 5af1c3e5032a..1971411574db 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -888,7 +888,7 @@ static int yam_open(struct net_device *dev)
                 goto out_release_base;
         }
         outb(0, IER(dev->base_addr));
-        if (request_irq(dev->irq, yam_interrupt, IRQF_DISABLED | IRQF_SHARED, dev->name, dev)) {
+        if (request_irq(dev->irq, yam_interrupt, IRQF_SHARED, dev->name, dev)) {
                 printk(KERN_ERR "%s: irq %d busy\n", dev->name, dev->irq);
                 ret = -EBUSY;
                 goto out_release_base;
diff --git a/drivers/net/irda/bfin_sir.c b/drivers/net/irda/bfin_sir.c
index c74f384c87d5..303c4bd26e17 100644
--- a/drivers/net/irda/bfin_sir.c
+++ b/drivers/net/irda/bfin_sir.c
@@ -411,12 +411,12 @@ static int bfin_sir_startup(struct bfin_sir_port *port, struct net_device *dev)
 
 #else
 
-        if (request_irq(port->irq, bfin_sir_rx_int, IRQF_DISABLED, "BFIN_SIR_RX", dev)) {
+        if (request_irq(port->irq, bfin_sir_rx_int, 0, "BFIN_SIR_RX", dev)) {
                 dev_warn(&dev->dev, "Unable to attach SIR RX interrupt\n");
                 return -EBUSY;
         }
 
-        if (request_irq(port->irq+1, bfin_sir_tx_int, IRQF_DISABLED, "BFIN_SIR_TX", dev)) {
+        if (request_irq(port->irq+1, bfin_sir_tx_int, 0, "BFIN_SIR_TX", dev)) {
                 dev_warn(&dev->dev, "Unable to attach SIR TX interrupt\n");
                 free_irq(port->irq, dev);
                 return -EBUSY;
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 31bcb98ef356..768dfe9a9315 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -1352,7 +1352,7 @@ toshoboe_net_open (struct net_device *dev)
     return 0;
 
   rc = request_irq (self->io.irq, toshoboe_interrupt,
-                    IRQF_SHARED | IRQF_DISABLED, dev->name, self);
+                    IRQF_SHARED, dev->name, self);
   if (rc)
         return rc;
 
@@ -1559,7 +1559,7 @@ toshoboe_open (struct pci_dev *pci_dev, const struct pci_device_id *pdid)
   self->io.fir_base = self->base;
   self->io.fir_ext = OBOE_IO_EXTENT;
   self->io.irq = pci_dev->irq;
-  self->io.irqflags = IRQF_SHARED | IRQF_DISABLED;
+  self->io.irqflags = IRQF_SHARED;
 
   self->speed = self->io.speed = 9600;
   self->async = 0;
diff --git a/drivers/net/irda/sh_irda.c b/drivers/net/irda/sh_irda.c
index 4455425f1c77..ff45cd0d60e8 100644
--- a/drivers/net/irda/sh_irda.c
+++ b/drivers/net/irda/sh_irda.c
@@ -804,7 +804,7 @@ static int sh_irda_probe(struct platform_device *pdev)
                 goto err_mem_4;
 
         platform_set_drvdata(pdev, ndev);
-        err = request_irq(irq, sh_irda_irq, IRQF_DISABLED, "sh_irda", self);
+        err = request_irq(irq, sh_irda_irq, 0, "sh_irda", self);
         if (err) {
                 dev_warn(&pdev->dev, "Unable to attach sh_irda interrupt\n");
                 goto err_mem_4;
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 89682b49900f..8d9ae5a086d5 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -761,7 +761,7 @@ static int sh_sir_probe(struct platform_device *pdev)
                 goto err_mem_4;
 
         platform_set_drvdata(pdev, ndev);
-        err = request_irq(irq, sh_sir_irq, IRQF_DISABLED, "sh_sir", self);
+        err = request_irq(irq, sh_sir_irq, 0, "sh_sir", self);
         if (err) {
                 dev_warn(&pdev->dev, "Unable to attach sh_sir interrupt\n");
                 goto err_mem_4;
diff --git a/drivers/net/irda/sir-dev.h b/drivers/net/irda/sir-dev.h
index 6d5b1e2b1289..f50b9c1c0639 100644
--- a/drivers/net/irda/sir-dev.h
+++ b/drivers/net/irda/sir-dev.h
@@ -102,28 +102,29 @@ struct sir_driver {
 
 /* exported */
 
-extern int irda_register_dongle(struct dongle_driver *new);
-extern int irda_unregister_dongle(struct dongle_driver *drv);
+int irda_register_dongle(struct dongle_driver *new);
+int irda_unregister_dongle(struct dongle_driver *drv);
 
-extern struct sir_dev * sirdev_get_instance(const struct sir_driver *drv, const char *name);
-extern int sirdev_put_instance(struct sir_dev *self);
+struct sir_dev *sirdev_get_instance(const struct sir_driver *drv,
+                                    const char *name);
+int sirdev_put_instance(struct sir_dev *self);
 
-extern int sirdev_set_dongle(struct sir_dev *dev, IRDA_DONGLE type);
-extern void sirdev_write_complete(struct sir_dev *dev);
-extern int sirdev_receive(struct sir_dev *dev, const unsigned char *cp, size_t count);
+int sirdev_set_dongle(struct sir_dev *dev, IRDA_DONGLE type);
+void sirdev_write_complete(struct sir_dev *dev);
+int sirdev_receive(struct sir_dev *dev, const unsigned char *cp, size_t count);
 
 /* low level helpers for SIR device/dongle setup */
-extern int sirdev_raw_write(struct sir_dev *dev, const char *buf, int len);
-extern int sirdev_raw_read(struct sir_dev *dev, char *buf, int len);
-extern int sirdev_set_dtr_rts(struct sir_dev *dev, int dtr, int rts);
+int sirdev_raw_write(struct sir_dev *dev, const char *buf, int len);
+int sirdev_raw_read(struct sir_dev *dev, char *buf, int len);
+int sirdev_set_dtr_rts(struct sir_dev *dev, int dtr, int rts);
 
 /* not exported */
 
-extern int sirdev_get_dongle(struct sir_dev *self, IRDA_DONGLE type);
-extern int sirdev_put_dongle(struct sir_dev *self);
+int sirdev_get_dongle(struct sir_dev *self, IRDA_DONGLE type);
+int sirdev_put_dongle(struct sir_dev *self);
 
-extern void sirdev_enable_rx(struct sir_dev *dev);
-extern int sirdev_schedule_request(struct sir_dev *dev, int state, unsigned param);
+void sirdev_enable_rx(struct sir_dev *dev);
+int sirdev_schedule_request(struct sir_dev *dev, int state, unsigned param);
 
 /* inline helpers */
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 9bf46bd19b87..cc9845ec91c1 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -828,22 +828,21 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
+        port->count += 1;
+        err = register_netdevice(dev);
+        if (err < 0)
+                goto destroy_port;
+
         err = netdev_upper_dev_link(lowerdev, dev);
         if (err)
                 goto destroy_port;
 
-        port->count += 1;
-        err = register_netdevice(dev);
-        if (err < 0)
-                goto upper_dev_unlink;
 
         list_add_tail_rcu(&vlan->list, &port->vlans);
         netif_stacked_transfer_operstate(lowerdev, dev);
 
         return 0;
 
-upper_dev_unlink:
-        netdev_upper_dev_unlink(lowerdev, dev);
 destroy_port:
         port->count -= 1;
         if (!port->count)
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index ac22283aaf23..bc71947b1ec3 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -100,6 +100,45 @@ static void at803x_get_wol(struct phy_device *phydev,
                 wol->wolopts |= WAKE_MAGIC;
 }
 
+static int at803x_suspend(struct phy_device *phydev)
+{
+        int value;
+        int wol_enabled;
+
+        mutex_lock(&phydev->lock);
+
+        value = phy_read(phydev, AT803X_INTR_ENABLE);
+        wol_enabled = value & AT803X_WOL_ENABLE;
+
+        value = phy_read(phydev, MII_BMCR);
+
+        if (wol_enabled)
+                value |= BMCR_ISOLATE;
+        else
+                value |= BMCR_PDOWN;
+
+        phy_write(phydev, MII_BMCR, value);
+
+        mutex_unlock(&phydev->lock);
+
+        return 0;
+}
+
+static int at803x_resume(struct phy_device *phydev)
+{
+        int value;
+
+        mutex_lock(&phydev->lock);
+
+        value = phy_read(phydev, MII_BMCR);
+        value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
+        phy_write(phydev, MII_BMCR, value);
+
+        mutex_unlock(&phydev->lock);
+
+        return 0;
+}
+
 static int at803x_config_init(struct phy_device *phydev)
 {
         int val;
@@ -161,10 +200,12 @@ static struct phy_driver at803x_driver[] = {
         .config_init    = at803x_config_init,
         .set_wol        = at803x_set_wol,
         .get_wol        = at803x_get_wol,
+        .suspend        = at803x_suspend,
+        .resume         = at803x_resume,
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = &genphy_config_aneg,
-        .read_status    = &genphy_read_status,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
         .driver         = {
                 .owner = THIS_MODULE,
         },
@@ -176,10 +217,12 @@ static struct phy_driver at803x_driver[] = {
         .config_init    = at803x_config_init,
         .set_wol        = at803x_set_wol,
         .get_wol        = at803x_get_wol,
+        .suspend        = at803x_suspend,
+        .resume         = at803x_resume,
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = &genphy_config_aneg,
-        .read_status    = &genphy_read_status,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
         .driver         = {
                 .owner = THIS_MODULE,
         },
@@ -191,10 +234,12 @@ static struct phy_driver at803x_driver[] = {
         .config_init    = at803x_config_init,
         .set_wol        = at803x_set_wol,
         .get_wol        = at803x_get_wol,
+        .suspend        = at803x_suspend,
+        .resume         = at803x_resume,
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = &genphy_config_aneg,
-        .read_status    = &genphy_read_status,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
         .driver         = {
                 .owner = THIS_MODULE,
         },
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 2e91477362d4..2e3c778ea9bf 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -34,9 +34,9 @@
 #include <linux/marvell_phy.h>
 #include <linux/of.h>
 
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/irq.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #define MII_MARVELL_PHY_PAGE            22
 
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index c31aad0004cb..3ae28f420868 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -287,6 +287,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = ks8737_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8021,
@@ -300,6 +302,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8031,
@@ -313,6 +317,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8041,
@@ -326,6 +332,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8051,
@@ -339,6 +347,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8001,
@@ -351,6 +361,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8081,
@@ -363,6 +375,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ8061,
@@ -375,6 +389,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
         .phy_id         = PHY_ID_KSZ9021,
@@ -387,6 +403,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = ksz9021_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE, },
 }, {
         .phy_id         = PHY_ID_KSZ9031,
@@ -400,6 +418,8 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = ksz9021_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE, },
 }, {
         .phy_id         = PHY_ID_KSZ8873MLL,
@@ -410,6 +430,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
         .read_status    = ksz8873mll_read_status,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE, },
 }, {
         .phy_id         = PHY_ID_KSZ886X,
@@ -420,6 +442,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE, },
 } };
 
diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c
index 1f7bef90b467..7b4ff35c8bf7 100644
--- a/drivers/net/plip/plip.c
+++ b/drivers/net/plip/plip.c
@@ -1002,7 +1002,7 @@ plip_rewrite_address(const struct net_device *dev, struct ethhdr *eth)
                 /* Any address will do - we take the first */
                 const struct in_ifaddr *ifa = in_dev->ifa_list;
                 if (ifa) {
-                        memcpy(eth->h_source, dev->dev_addr, 6);
+                        memcpy(eth->h_source, dev->dev_addr, ETH_ALEN);
                         memset(eth->h_dest, 0xfc, 2);
                         memcpy(eth->h_dest+2, &ifa->ifa_address, 4);
                 }
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index 8d5cac2d8e33..df507e6dbb9c 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -640,10 +640,10 @@ static void catc_set_multicast_list(struct net_device *netdev)
 {
         struct catc *catc = netdev_priv(netdev);
         struct netdev_hw_addr *ha;
-        u8 broadcast[6];
+        u8 broadcast[ETH_ALEN];
         u8 rx = RxEnable | RxPolarity | RxMultiCast;
 
-        memset(broadcast, 0xff, 6);
+        memset(broadcast, 0xff, ETH_ALEN);
         memset(catc->multicast, 0, 64);
 
         catc_multicast(broadcast, catc->multicast);
@@ -778,7 +778,7 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct usb_device *usbdev = interface_to_usbdev(intf);
         struct net_device *netdev;
         struct catc *catc;
-        u8 broadcast[6];
+        u8 broadcast[ETH_ALEN];
         int i, pktsz;
 
         if (usb_set_interface(usbdev,
@@ -882,7 +882,7 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
                 
                 dev_dbg(dev, "Filling the multicast list.\n");
           
-                memset(broadcast, 0xff, 6);
+                memset(broadcast, 0xff, ETH_ALEN);
                 catc_multicast(broadcast, catc->multicast);
                 catc_multicast(netdev->dev_addr, catc->multicast);
                 catc_write_mem(catc, 0xfa80, catc->multicast, 64);
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 7d78669000d7..6358d420e185 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -328,7 +328,7 @@ MODULE_DEVICE_TABLE(usb, usbpn_ids);
 
 static struct usb_driver usbpn_driver;
 
-int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
         static const char ifname[] = "usbpn%d";
         const struct usb_cdc_union_desc *union_header = NULL;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 818ce90185b5..e0a4a2b08e45 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -143,16 +143,22 @@ static const struct net_device_ops qmi_wwan_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
-/* using a counter to merge subdriver requests with our own into a combined state */
+/* using a counter to merge subdriver requests with our own into a
+ * combined state
+ */
 static int qmi_wwan_manage_power(struct usbnet *dev, int on)
 {
         struct qmi_wwan_state *info = (void *)&dev->data;
         int rv = 0;
 
-        dev_dbg(&dev->intf->dev, "%s() pmcount=%d, on=%d\n", __func__, atomic_read(&info->pmcount), on);
+        dev_dbg(&dev->intf->dev, "%s() pmcount=%d, on=%d\n", __func__,
+                atomic_read(&info->pmcount), on);
 
-        if ((on && atomic_add_return(1, &info->pmcount) == 1) || (!on && atomic_dec_and_test(&info->pmcount))) {
-                /* need autopm_get/put here to ensure the usbcore sees the new value */
+        if ((on && atomic_add_return(1, &info->pmcount) == 1) ||
+            (!on && atomic_dec_and_test(&info->pmcount))) {
+                /* need autopm_get/put here to ensure the usbcore sees
+                 * the new value
+                 */
                 rv = usb_autopm_get_interface(dev->intf);
                 if (rv < 0)
                         goto err;
@@ -199,7 +205,8 @@ static int qmi_wwan_register_subdriver(struct usbnet *dev)
         atomic_set(&info->pmcount, 0);
 
         /* register subdriver */
-        subdriver = usb_cdc_wdm_register(info->control, &dev->status->desc, 4096, &qmi_wwan_cdc_wdm_manage_power);
+        subdriver = usb_cdc_wdm_register(info->control, &dev->status->desc,
+                                         4096, &qmi_wwan_cdc_wdm_manage_power);
         if (IS_ERR(subdriver)) {
                 dev_err(&info->control->dev, "subdriver registration failed\n");
                 rv = PTR_ERR(subdriver);
@@ -228,7 +235,8 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
         struct usb_driver *driver = driver_of(intf);
         struct qmi_wwan_state *info = (void *)&dev->data;
 
-        BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) < sizeof(struct qmi_wwan_state)));
+        BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) <
+                      sizeof(struct qmi_wwan_state)));
 
         /* set up initial state */
         info->control = intf;
@@ -250,7 +258,8 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
                                 goto err;
                         }
                         if (h->bLength != sizeof(struct usb_cdc_header_desc)) {
-                                dev_dbg(&intf->dev, "CDC header len %u\n", h->bLength);
+                                dev_dbg(&intf->dev, "CDC header len %u\n",
+                                        h->bLength);
                                 goto err;
                         }
                         break;
@@ -260,7 +269,8 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
                                 goto err;
                         }
                         if (h->bLength != sizeof(struct usb_cdc_union_desc)) {
-                                dev_dbg(&intf->dev, "CDC union len %u\n", h->bLength);
+                                dev_dbg(&intf->dev, "CDC union len %u\n",
+                                        h->bLength);
                                 goto err;
                         }
                         cdc_union = (struct usb_cdc_union_desc *)buf;
@@ -271,15 +281,15 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
                                 goto err;
                         }
                         if (h->bLength != sizeof(struct usb_cdc_ether_desc)) {
-                                dev_dbg(&intf->dev, "CDC ether len %u\n",  h->bLength);
+                                dev_dbg(&intf->dev, "CDC ether len %u\n",
+                                        h->bLength);
                                 goto err;
                         }
                         cdc_ether = (struct usb_cdc_ether_desc *)buf;
                         break;
                 }
 
-                /*
-                 * Remember which CDC functional descriptors we've seen.  Works
+                /* Remember which CDC functional descriptors we've seen.  Works
                  * for all types we care about, of which USB_CDC_ETHERNET_TYPE
                  * (0x0f) is the highest numbered
                  */
@@ -293,10 +303,14 @@ next_desc:
 
         /* Use separate control and data interfaces if we found a CDC Union */
         if (cdc_union) {
-                info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-                if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) {
-                        dev_err(&intf->dev, "bogus CDC Union: master=%u, slave=%u\n",
-                                cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0);
+                info->data = usb_ifnum_to_if(dev->udev,
+                                             cdc_union->bSlaveInterface0);
+                if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 ||
+                    !info->data) {
+                        dev_err(&intf->dev,
+                                "bogus CDC Union: master=%u, slave=%u\n",
+                                cdc_union->bMasterInterface0,
+                                cdc_union->bSlaveInterface0);
                         goto err;
                 }
         }
@@ -374,8 +388,7 @@ static int qmi_wwan_suspend(struct usb_interface *intf, pm_message_t message)
         struct qmi_wwan_state *info = (void *)&dev->data;
         int ret;
 
-        /*
-         * Both usbnet_suspend() and subdriver->suspend() MUST return 0
+        /* Both usbnet_suspend() and subdriver->suspend() MUST return 0
          * in system sleep context, otherwise, the resume callback has
          * to recover device from previous suspend failure.
          */
@@ -383,7 +396,8 @@ static int qmi_wwan_suspend(struct usb_interface *intf, pm_message_t message)
         if (ret < 0)
                 goto err;
 
-        if (intf == info->control && info->subdriver && info->subdriver->suspend)
+        if (intf == info->control && info->subdriver &&
+            info->subdriver->suspend)
                 ret = info->subdriver->suspend(intf, message);
         if (ret < 0)
                 usbnet_resume(intf);
@@ -396,7 +410,8 @@ static int qmi_wwan_resume(struct usb_interface *intf)
         struct usbnet *dev = usb_get_intfdata(intf);
         struct qmi_wwan_state *info = (void *)&dev->data;
         int ret = 0;
-        bool callsub = (intf == info->control && info->subdriver && info->subdriver->resume);
+        bool callsub = (intf == info->control && info->subdriver &&
+                        info->subdriver->resume);
 
         if (callsub)
                 ret = info->subdriver->resume(intf);
@@ -714,6 +729,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
         {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
 
@@ -777,7 +793,8 @@ static const struct usb_device_id products[] = {
 };
 MODULE_DEVICE_TABLE(usb, products);
 
-static int qmi_wwan_probe(struct usb_interface *intf, const struct usb_device_id *prod)
+static int qmi_wwan_probe(struct usb_interface *intf,
+                          const struct usb_device_id *prod)
 {
         struct usb_device_id *id = (struct usb_device_id *)prod;
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index eee1f19ef1e9..b2d034791e15 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -188,6 +188,11 @@ static struct rtnl_link_stats64 *veth_get_stats64(struct net_device *dev,
         return tot;
 }
 
+/* fake multicast ability */
+static void veth_set_multicast_list(struct net_device *dev)
+{
+}
+
 static int veth_open(struct net_device *dev)
 {
         struct veth_priv *priv = netdev_priv(dev);
@@ -250,6 +255,7 @@ static const struct net_device_ops veth_netdev_ops = {
         .ndo_start_xmit      = veth_xmit,
         .ndo_change_mtu      = veth_change_mtu,
         .ndo_get_stats64     = veth_get_stats64,
+        .ndo_set_rx_mode     = veth_set_multicast_list,
         .ndo_set_mac_address = eth_mac_addr,
 };
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index a03f358fd58b..12040a35d95d 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -410,9 +410,9 @@ int
 vmxnet3_create_queues(struct vmxnet3_adapter *adapter,
                       u32 tx_ring_size, u32 rx_ring_size, u32 rx_ring2_size);
 
-extern void vmxnet3_set_ethtool_ops(struct net_device *netdev);
+void vmxnet3_set_ethtool_ops(struct net_device *netdev);
 
-extern struct rtnl_link_stats64 *
+struct rtnl_link_stats64 *
 vmxnet3_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats);
 
 extern char vmxnet3_driver_name[];
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 2ef5b6219f3f..da8479479d01 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2087,7 +2087,7 @@ static void vxlan_setup(struct net_device *dev)
         vxlan->age_timer.function = vxlan_cleanup;
         vxlan->age_timer.data = (unsigned long) vxlan;
 
-        inet_get_local_port_range(&low, &high);
+        inet_get_local_port_range(dev_net(dev), &low, &high);
         vxlan->port_min = low;
         vxlan->port_max = high;
         vxlan->dst_port = htons(vxlan_port);
diff --git a/drivers/net/wan/hostess_sv11.c b/drivers/net/wan/hostess_sv11.c
index 3d80e4267de8..3d741663fd67 100644
--- a/drivers/net/wan/hostess_sv11.c
+++ b/drivers/net/wan/hostess_sv11.c
@@ -220,7 +220,7 @@ static struct z8530_dev *sv11_init(int iobase, int irq)
         /* We want a fast IRQ for this device. Actually we'd like an even faster
            IRQ ;) - This is one driver RtLinux is made for */
 
-        if (request_irq(irq, z8530_interrupt, IRQF_DISABLED,
+        if (request_irq(irq, z8530_interrupt, 0,
                         "Hostess SV11", sv) < 0) {
                 pr_warn("IRQ %d already in use\n", irq);
                 goto err_irq;
diff --git a/drivers/net/wan/sealevel.c b/drivers/net/wan/sealevel.c
index 4f7748478984..27860b4f5908 100644
--- a/drivers/net/wan/sealevel.c
+++ b/drivers/net/wan/sealevel.c
@@ -266,7 +266,7 @@ static __init struct slvl_board *slvl_init(int iobase, int irq,
         /* We want a fast IRQ for this device. Actually we'd like an even faster
            IRQ ;) - This is one driver RtLinux is made for */
 
-        if (request_irq(irq, z8530_interrupt, IRQF_DISABLED,
+        if (request_irq(irq, z8530_interrupt, 0,
                         "SeaLevel", dev) < 0) {
                 pr_warn("IRQ %d already in use\n", irq);
                 goto err_request_irq;
diff --git a/drivers/net/wan/x25_asy.h b/drivers/net/wan/x25_asy.h
index 8f0fc2e57e2b..f57ee67836ae 100644
--- a/drivers/net/wan/x25_asy.h
+++ b/drivers/net/wan/x25_asy.h
@@ -41,6 +41,6 @@ struct x25_asy {
 
 #define X25_ASY_MAGIC 0x5303
 
-extern int x25_asy_init(struct net_device *dev);
+int x25_asy_init(struct net_device *dev);
 
 #endif  /* _LINUX_X25_ASY.H */
diff --git a/drivers/net/wan/z85230.h b/drivers/net/wan/z85230.h
index f29d554fc07d..2416a9d60bd6 100644
--- a/drivers/net/wan/z85230.h
+++ b/drivers/net/wan/z85230.h
@@ -395,20 +395,19 @@ struct z8530_dev
 extern u8 z8530_dead_port[];
 extern u8 z8530_hdlc_kilostream_85230[];
 extern u8 z8530_hdlc_kilostream[];
-extern irqreturn_t z8530_interrupt(int, void *);
-extern void z8530_describe(struct z8530_dev *, char *mapping, unsigned long io);
-extern int z8530_init(struct z8530_dev *);
-extern int z8530_shutdown(struct z8530_dev *);
-extern int z8530_sync_open(struct net_device *, struct z8530_channel *);
-extern int z8530_sync_close(struct net_device *, struct z8530_channel *);
-extern int z8530_sync_dma_open(struct net_device *, struct z8530_channel *);
-extern int z8530_sync_dma_close(struct net_device *, struct z8530_channel *);
-extern int z8530_sync_txdma_open(struct net_device *, struct z8530_channel *);
-extern int z8530_sync_txdma_close(struct net_device *, struct z8530_channel *);
-extern int z8530_channel_load(struct z8530_channel *, u8 *);
-extern netdev_tx_t z8530_queue_xmit(struct z8530_channel *c,
-                                          struct sk_buff *skb);
-extern void z8530_null_rx(struct z8530_channel *c, struct sk_buff *skb);
+irqreturn_t z8530_interrupt(int, void *);
+void z8530_describe(struct z8530_dev *, char *mapping, unsigned long io);
+int z8530_init(struct z8530_dev *);
+int z8530_shutdown(struct z8530_dev *);
+int z8530_sync_open(struct net_device *, struct z8530_channel *);
+int z8530_sync_close(struct net_device *, struct z8530_channel *);
+int z8530_sync_dma_open(struct net_device *, struct z8530_channel *);
+int z8530_sync_dma_close(struct net_device *, struct z8530_channel *);
+int z8530_sync_txdma_open(struct net_device *, struct z8530_channel *);
+int z8530_sync_txdma_close(struct net_device *, struct z8530_channel *);
+int z8530_channel_load(struct z8530_channel *, u8 *);
+netdev_tx_t z8530_queue_xmit(struct z8530_channel *c, struct sk_buff *skb);
+void z8530_null_rx(struct z8530_channel *c, struct sk_buff *skb);
 
 
 /*
diff --git a/drivers/net/wimax/i2400m/i2400m-usb.h b/drivers/net/wimax/i2400m/i2400m-usb.h
index 9f1e947f3557..649ecad6844c 100644
--- a/drivers/net/wimax/i2400m/i2400m-usb.h
+++ b/drivers/net/wimax/i2400m/i2400m-usb.h
@@ -256,21 +256,20 @@ void i2400mu_init(struct i2400mu *i2400mu)
         i2400mu->rx_size_auto_shrink = 1;
 }
 
-extern int i2400mu_notification_setup(struct i2400mu *);
-extern void i2400mu_notification_release(struct i2400mu *);
+int i2400mu_notification_setup(struct i2400mu *);
+void i2400mu_notification_release(struct i2400mu *);
 
-extern int i2400mu_rx_setup(struct i2400mu *);
-extern void i2400mu_rx_release(struct i2400mu *);
-extern void i2400mu_rx_kick(struct i2400mu *);
+int i2400mu_rx_setup(struct i2400mu *);
+void i2400mu_rx_release(struct i2400mu *);
+void i2400mu_rx_kick(struct i2400mu *);
 
-extern int i2400mu_tx_setup(struct i2400mu *);
-extern void i2400mu_tx_release(struct i2400mu *);
-extern void i2400mu_bus_tx_kick(struct i2400m *);
+int i2400mu_tx_setup(struct i2400mu *);
+void i2400mu_tx_release(struct i2400mu *);
+void i2400mu_bus_tx_kick(struct i2400m *);
 
-extern ssize_t i2400mu_bus_bm_cmd_send(struct i2400m *,
-                                       const struct i2400m_bootrom_header *,
-                                       size_t, int);
-extern ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *,
-                                           struct i2400m_bootrom_header *,
-                                           size_t);
+ssize_t i2400mu_bus_bm_cmd_send(struct i2400m *,
+                                const struct i2400m_bootrom_header *, size_t,
+                                int);
+ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *,
+                                    struct i2400m_bootrom_header *, size_t);
 #endif /* #ifndef __I2400M_USB_H__ */
diff --git a/drivers/net/wimax/i2400m/i2400m.h b/drivers/net/wimax/i2400m/i2400m.h
index 79c6505b5c20..5a34e72bab9a 100644
--- a/drivers/net/wimax/i2400m/i2400m.h
+++ b/drivers/net/wimax/i2400m/i2400m.h
@@ -710,18 +710,18 @@ enum i2400m_bri {
         I2400M_BRI_MAC_REINIT = 1 << 3,
 };
 
-extern void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header *);
-extern int i2400m_dev_bootstrap(struct i2400m *, enum i2400m_bri);
-extern int i2400m_read_mac_addr(struct i2400m *);
-extern int i2400m_bootrom_init(struct i2400m *, enum i2400m_bri);
-extern int i2400m_is_boot_barker(struct i2400m *, const void *, size_t);
+void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header *);
+int i2400m_dev_bootstrap(struct i2400m *, enum i2400m_bri);
+int i2400m_read_mac_addr(struct i2400m *);
+int i2400m_bootrom_init(struct i2400m *, enum i2400m_bri);
+int i2400m_is_boot_barker(struct i2400m *, const void *, size_t);
 static inline
 int i2400m_is_d2h_barker(const void *buf)
 {
         const __le32 *barker = buf;
         return le32_to_cpu(*barker) == I2400M_D2H_MSG_BARKER;
 }
-extern void i2400m_unknown_barker(struct i2400m *, const void *, size_t);
+void i2400m_unknown_barker(struct i2400m *, const void *, size_t);
 
 /* Make/grok boot-rom header commands */
 
@@ -789,32 +789,31 @@ unsigned i2400m_brh_get_signature(const struct i2400m_bootrom_header *hdr)
 /*
  * Driver / device setup and internal functions
  */
-extern void i2400m_init(struct i2400m *);
-extern int i2400m_reset(struct i2400m *, enum i2400m_reset_type);
-extern void i2400m_netdev_setup(struct net_device *net_dev);
-extern int i2400m_sysfs_setup(struct device_driver *);
-extern void i2400m_sysfs_release(struct device_driver *);
-extern int i2400m_tx_setup(struct i2400m *);
-extern void i2400m_wake_tx_work(struct work_struct *);
-extern void i2400m_tx_release(struct i2400m *);
-
-extern int i2400m_rx_setup(struct i2400m *);
-extern void i2400m_rx_release(struct i2400m *);
-
-extern void i2400m_fw_cache(struct i2400m *);
-extern void i2400m_fw_uncache(struct i2400m *);
-
-extern void i2400m_net_rx(struct i2400m *, struct sk_buff *, unsigned,
-                          const void *, int);
-extern void i2400m_net_erx(struct i2400m *, struct sk_buff *,
-                           enum i2400m_cs);
-extern void i2400m_net_wake_stop(struct i2400m *);
+void i2400m_init(struct i2400m *);
+int i2400m_reset(struct i2400m *, enum i2400m_reset_type);
+void i2400m_netdev_setup(struct net_device *net_dev);
+int i2400m_sysfs_setup(struct device_driver *);
+void i2400m_sysfs_release(struct device_driver *);
+int i2400m_tx_setup(struct i2400m *);
+void i2400m_wake_tx_work(struct work_struct *);
+void i2400m_tx_release(struct i2400m *);
+
+int i2400m_rx_setup(struct i2400m *);
+void i2400m_rx_release(struct i2400m *);
+
+void i2400m_fw_cache(struct i2400m *);
+void i2400m_fw_uncache(struct i2400m *);
+
+void i2400m_net_rx(struct i2400m *, struct sk_buff *, unsigned, const void *,
+                   int);
+void i2400m_net_erx(struct i2400m *, struct sk_buff *, enum i2400m_cs);
+void i2400m_net_wake_stop(struct i2400m *);
 enum i2400m_pt;
-extern int i2400m_tx(struct i2400m *, const void *, size_t, enum i2400m_pt);
+int i2400m_tx(struct i2400m *, const void *, size_t, enum i2400m_pt);
 
 #ifdef CONFIG_DEBUG_FS
-extern int i2400m_debugfs_add(struct i2400m *);
-extern void i2400m_debugfs_rm(struct i2400m *);
+int i2400m_debugfs_add(struct i2400m *);
+void i2400m_debugfs_rm(struct i2400m *);
 #else
 static inline int i2400m_debugfs_add(struct i2400m *i2400m)
 {
@@ -824,8 +823,8 @@ static inline void i2400m_debugfs_rm(struct i2400m *i2400m) {}
 #endif
 
 /* Initialize/shutdown the device */
-extern int i2400m_dev_initialize(struct i2400m *);
-extern void i2400m_dev_shutdown(struct i2400m *);
+int i2400m_dev_initialize(struct i2400m *);
+void i2400m_dev_shutdown(struct i2400m *);
 
 extern struct attribute_group i2400m_dev_attr_group;
 
@@ -873,21 +872,21 @@ void i2400m_put(struct i2400m *i2400m)
         dev_put(i2400m->wimax_dev.net_dev);
 }
 
-extern int i2400m_dev_reset_handle(struct i2400m *, const char *);
-extern int i2400m_pre_reset(struct i2400m *);
-extern int i2400m_post_reset(struct i2400m *);
-extern void i2400m_error_recovery(struct i2400m *);
+int i2400m_dev_reset_handle(struct i2400m *, const char *);
+int i2400m_pre_reset(struct i2400m *);
+int i2400m_post_reset(struct i2400m *);
+void i2400m_error_recovery(struct i2400m *);
 
 /*
  * _setup()/_release() are called by the probe/disconnect functions of
  * the bus-specific drivers.
  */
-extern int i2400m_setup(struct i2400m *, enum i2400m_bri bm_flags);
-extern void i2400m_release(struct i2400m *);
+int i2400m_setup(struct i2400m *, enum i2400m_bri bm_flags);
+void i2400m_release(struct i2400m *);
 
-extern int i2400m_rx(struct i2400m *, struct sk_buff *);
-extern struct i2400m_msg_hdr *i2400m_tx_msg_get(struct i2400m *, size_t *);
-extern void i2400m_tx_msg_sent(struct i2400m *);
+int i2400m_rx(struct i2400m *, struct sk_buff *);
+struct i2400m_msg_hdr *i2400m_tx_msg_get(struct i2400m *, size_t *);
+void i2400m_tx_msg_sent(struct i2400m *);
 
 
 /*
@@ -900,20 +899,19 @@ struct device *i2400m_dev(struct i2400m *i2400m)
         return i2400m->wimax_dev.net_dev->dev.parent;
 }
 
-extern int i2400m_msg_check_status(const struct i2400m_l3l4_hdr *,
-                                   char *, size_t);
-extern int i2400m_msg_size_check(struct i2400m *,
-                                 const struct i2400m_l3l4_hdr *, size_t);
-extern struct sk_buff *i2400m_msg_to_dev(struct i2400m *, const void *, size_t);
-extern void i2400m_msg_to_dev_cancel_wait(struct i2400m *, int);
-extern void i2400m_report_hook(struct i2400m *,
-                               const struct i2400m_l3l4_hdr *, size_t);
-extern void i2400m_report_hook_work(struct work_struct *);
-extern int i2400m_cmd_enter_powersave(struct i2400m *);
-extern int i2400m_cmd_exit_idle(struct i2400m *);
-extern struct sk_buff *i2400m_get_device_info(struct i2400m *);
-extern int i2400m_firmware_check(struct i2400m *);
-extern int i2400m_set_idle_timeout(struct i2400m *, unsigned);
+int i2400m_msg_check_status(const struct i2400m_l3l4_hdr *, char *, size_t);
+int i2400m_msg_size_check(struct i2400m *, const struct i2400m_l3l4_hdr *,
+                          size_t);
+struct sk_buff *i2400m_msg_to_dev(struct i2400m *, const void *, size_t);
+void i2400m_msg_to_dev_cancel_wait(struct i2400m *, int);
+void i2400m_report_hook(struct i2400m *, const struct i2400m_l3l4_hdr *,
+                        size_t);
+void i2400m_report_hook_work(struct work_struct *);
+int i2400m_cmd_enter_powersave(struct i2400m *);
+int i2400m_cmd_exit_idle(struct i2400m *);
+struct sk_buff *i2400m_get_device_info(struct i2400m *);
+int i2400m_firmware_check(struct i2400m *);
+int i2400m_set_idle_timeout(struct i2400m *, unsigned);
 
 static inline
 struct usb_endpoint_descriptor *usb_get_epd(struct usb_interface *iface, int ep)
@@ -921,10 +919,9 @@ struct usb_endpoint_descriptor *usb_get_epd(struct usb_interface *iface, int ep)
         return &iface->cur_altsetting->endpoint[ep].desc;
 }
 
-extern int i2400m_op_rfkill_sw_toggle(struct wimax_dev *,
-                                      enum wimax_rf_state);
-extern void i2400m_report_tlv_rf_switches_status(
-        struct i2400m *, const struct i2400m_tlv_rf_switches_status *);
+int i2400m_op_rfkill_sw_toggle(struct wimax_dev *, enum wimax_rf_state);
+void i2400m_report_tlv_rf_switches_status(struct i2400m *,
+                                          const struct i2400m_tlv_rf_switches_status *);
 
 /*
  * Helpers for firmware backwards compatibility
@@ -968,8 +965,8 @@ void __i2400m_msleep(unsigned ms)
 
 
 /* module initialization helpers */
-extern int i2400m_barker_db_init(const char *);
-extern void i2400m_barker_db_exit(void);
+int i2400m_barker_db_init(const char *);
+void i2400m_barker_db_exit(void);
 
 
 
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index f9a24e599dee..cfce83e1f273 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1924,7 +1924,6 @@ static int adm8211_probe(struct pci_dev *pdev,
         pci_iounmap(pdev, priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7fe19648f10e..edf4b57c4aaa 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5570,7 +5570,6 @@ static void airo_pci_remove(struct pci_dev *pdev)
         airo_print_info(dev->name, "Unregistering...");
         stop_airo_card(dev, 1);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1abf1d421173..ba81d6292eeb 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -32,5 +32,6 @@ source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
 source "drivers/net/wireless/ath/wil6210/Kconfig"
 source "drivers/net/wireless/ath/ath10k/Kconfig"
+source "drivers/net/wireless/ath/wcn36xx/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index fb05cfd19361..363b05653c7e 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_ATH6KL)		+= ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
 obj-$(CONFIG_WIL6210)           += wil6210/
 obj-$(CONFIG_ATH10K)            += ath10k/
+obj-$(CONFIG_WCN36XX)           += wcn36xx/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 17d7fece35d2..280fc3d53a36 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1762,6 +1762,7 @@ static struct usb_device_id ar5523_id_table[] = {
         AR5523_DEVICE_UX(0x2001, 0x3a00),       /* Dlink / DWLAG132 */
         AR5523_DEVICE_UG(0x2001, 0x3a02),       /* Dlink / DWLG132 */
         AR5523_DEVICE_UX(0x2001, 0x3a04),       /* Dlink / DWLAG122 */
+        AR5523_DEVICE_UG(0x07d1, 0x3a07),       /* D-Link / WUA-2340 rev A1 */
         AR5523_DEVICE_UG(0x1690, 0x0712),       /* Gigaset / AR5523 */
         AR5523_DEVICE_UG(0x1690, 0x0710),       /* Gigaset / SMCWUSBTG */
         AR5523_DEVICE_UG(0x129b, 0x160c),       /* Gigaset / USB stick 108
diff --git a/drivers/net/wireless/ath/ath10k/bmi.c b/drivers/net/wireless/ath/ath10k/bmi.c
index 744da6d1c405..a1f099628850 100644
--- a/drivers/net/wireless/ath/ath10k/bmi.c
+++ b/drivers/net/wireless/ath/ath10k/bmi.c
@@ -22,7 +22,8 @@
 
 void ath10k_bmi_start(struct ath10k *ar)
 {
-        ath10k_dbg(ATH10K_DBG_CORE, "BMI started\n");
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi start\n");
+
         ar->bmi.done_sent = false;
 }
 
@@ -32,8 +33,10 @@ int ath10k_bmi_done(struct ath10k *ar)
         u32 cmdlen = sizeof(cmd.id) + sizeof(cmd.done);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi done\n");
+
         if (ar->bmi.done_sent) {
-                ath10k_dbg(ATH10K_DBG_CORE, "%s skipped\n", __func__);
+                ath10k_dbg(ATH10K_DBG_BMI, "bmi skipped\n");
                 return 0;
         }
 
@@ -46,7 +49,6 @@ int ath10k_bmi_done(struct ath10k *ar)
                 return ret;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE, "BMI done\n");
         return 0;
 }
 
@@ -59,6 +61,8 @@ int ath10k_bmi_get_target_info(struct ath10k *ar,
         u32 resplen = sizeof(resp.get_target_info);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi get target info\n");
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("BMI Get Target Info Command disallowed\n");
                 return -EBUSY;
@@ -80,6 +84,7 @@ int ath10k_bmi_get_target_info(struct ath10k *ar,
 
         target_info->version = __le32_to_cpu(resp.get_target_info.version);
         target_info->type    = __le32_to_cpu(resp.get_target_info.type);
+
         return 0;
 }
 
@@ -92,15 +97,14 @@ int ath10k_bmi_read_memory(struct ath10k *ar,
         u32 rxlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi read address 0x%x length %d\n",
+                   address, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, length: %d)\n",
-                   __func__, ar, address, length);
-
         while (length) {
                 rxlen = min_t(u32, length, BMI_MAX_DATA_SIZE);
 
@@ -133,15 +137,14 @@ int ath10k_bmi_write_memory(struct ath10k *ar,
         u32 txlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi write address 0x%x length %d\n",
+                   address, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, length: %d)\n",
-                   __func__, ar, address, length);
-
         while (length) {
                 txlen = min(length, BMI_MAX_DATA_SIZE - hdrlen);
 
@@ -180,15 +183,14 @@ int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
         u32 resplen = sizeof(resp.execute);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi execute address 0x%x param 0x%x\n",
+                   address, *param);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, param: %d)\n",
-                   __func__, ar, address, *param);
-
         cmd.id            = __cpu_to_le32(BMI_EXECUTE);
         cmd.execute.addr  = __cpu_to_le32(address);
         cmd.execute.param = __cpu_to_le32(*param);
@@ -216,6 +218,9 @@ int ath10k_bmi_lz_data(struct ath10k *ar, const void *buffer, u32 length)
         u32 txlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi lz data buffer 0x%p length %d\n",
+                   buffer, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
@@ -250,6 +255,9 @@ int ath10k_bmi_lz_stream_start(struct ath10k *ar, u32 address)
         u32 cmdlen = sizeof(cmd.id) + sizeof(cmd.lz_start);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi lz stream start address 0x%x\n",
+                   address);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
@@ -275,6 +283,10 @@ int ath10k_bmi_fast_download(struct ath10k *ar,
         u32 trailer_len = length - head_len;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI,
+                   "bmi fast download address 0x%x buffer 0x%p length %d\n",
+                   address, buffer, length);
+
         ret = ath10k_bmi_lz_stream_start(ar, address);
         if (ret)
                 return ret;
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index f8b969f518f8..834e29ea236c 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -76,36 +76,7 @@ static inline void ath10k_ce_src_ring_write_index_set(struct ath10k *ar,
                                                       u32 ce_ctrl_addr,
                                                       unsigned int n)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *indicator_addr;
-
-        if (!test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features)) {
-                ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
-                return;
-        }
-
-        /* workaround for QCA988x_1.0 HW CE */
-        indicator_addr = ar_pci->mem + ce_ctrl_addr + DST_WATERMARK_ADDRESS;
-
-        if (ce_ctrl_addr == ath10k_ce_base_address(CDC_WAR_DATA_CE)) {
-                iowrite32((CDC_WAR_MAGIC_STR | n), indicator_addr);
-        } else {
-                unsigned long irq_flags;
-                local_irq_save(irq_flags);
-                iowrite32(1, indicator_addr);
-
-                /*
-                 * PCIE write waits for ACK in IPQ8K, there is no
-                 * need to read back value.
-                 */
-                (void)ioread32(indicator_addr);
-                (void)ioread32(indicator_addr); /* conservative */
-
-                ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
-
-                iowrite32(0, indicator_addr);
-                local_irq_restore(irq_flags);
-        }
+        ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
 }
 
 static inline u32 ath10k_ce_src_ring_write_index_get(struct ath10k *ar,
@@ -285,7 +256,7 @@ static inline void ath10k_ce_engine_int_status_clear(struct ath10k *ar,
  * ath10k_ce_sendlist_send.
  * The caller takes responsibility for any needed locking.
  */
-static int ath10k_ce_send_nolock(struct ce_state *ce_state,
+static int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
                                  void *per_transfer_context,
                                  u32 buffer,
                                  unsigned int nbytes,
@@ -293,7 +264,7 @@ static int ath10k_ce_send_nolock(struct ce_state *ce_state,
                                  unsigned int flags)
 {
         struct ath10k *ar = ce_state->ar;
-        struct ce_ring_state *src_ring = ce_state->src_ring;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         struct ce_desc *desc, *sdesc;
         unsigned int nentries_mask = src_ring->nentries_mask;
         unsigned int sw_index = src_ring->sw_index;
@@ -306,7 +277,9 @@ static int ath10k_ce_send_nolock(struct ce_state *ce_state,
                 ath10k_warn("%s: send more we can (nbytes: %d, max: %d)\n",
                             __func__, nbytes, ce_state->src_sz_max);
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return ret;
 
         if (unlikely(CE_RING_DELTA(nentries_mask,
                                    write_index, sw_index - 1) <= 0)) {
@@ -346,7 +319,7 @@ exit:
         return ret;
 }
 
-int ath10k_ce_send(struct ce_state *ce_state,
+int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    void *per_transfer_context,
                    u32 buffer,
                    unsigned int nbytes,
@@ -365,33 +338,19 @@ int ath10k_ce_send(struct ce_state *ce_state,
         return ret;
 }
 
-void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist, u32 buffer,
-                                unsigned int nbytes, u32 flags)
-{
-        unsigned int num_items = sendlist->num_items;
-        struct ce_sendlist_item *item;
-
-        item = &sendlist->item[num_items];
-        item->data = buffer;
-        item->u.nbytes = nbytes;
-        item->flags = flags;
-        sendlist->num_items++;
-}
-
-int ath10k_ce_sendlist_send(struct ce_state *ce_state,
+int ath10k_ce_sendlist_send(struct ath10k_ce_pipe *ce_state,
                             void *per_transfer_context,
-                            struct ce_sendlist *sendlist,
-                            unsigned int transfer_id)
+                            unsigned int transfer_id,
+                            u32 paddr, unsigned int nbytes,
+                            u32 flags)
 {
-        struct ce_ring_state *src_ring = ce_state->src_ring;
-        struct ce_sendlist_item *item;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         unsigned int nentries_mask = src_ring->nentries_mask;
-        unsigned int num_items = sendlist->num_items;
         unsigned int sw_index;
         unsigned int write_index;
-        int i, delta, ret = -ENOMEM;
+        int delta, ret = -ENOMEM;
 
         spin_lock_bh(&ar_pci->ce_lock);
 
@@ -400,30 +359,12 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
 
         delta = CE_RING_DELTA(nentries_mask, write_index, sw_index - 1);
 
-        if (delta >= num_items) {
-                /*
-                 * Handle all but the last item uniformly.
-                 */
-                for (i = 0; i < num_items - 1; i++) {
-                        item = &sendlist->item[i];
-                        ret = ath10k_ce_send_nolock(ce_state,
-                                                    CE_SENDLIST_ITEM_CTXT,
-                                                    (u32) item->data,
-                                                    item->u.nbytes, transfer_id,
-                                                    item->flags |
-                                                    CE_SEND_FLAG_GATHER);
-                        if (ret)
-                                ath10k_warn("CE send failed for item: %d\n", i);
-                }
-                /*
-                 * Provide valid context pointer for final item.
-                 */
-                item = &sendlist->item[i];
+        if (delta >= 1) {
                 ret = ath10k_ce_send_nolock(ce_state, per_transfer_context,
-                                            (u32) item->data, item->u.nbytes,
-                                            transfer_id, item->flags);
+                                            paddr, nbytes,
+                                            transfer_id, flags);
                 if (ret)
-                        ath10k_warn("CE send failed for last item: %d\n", i);
+                        ath10k_warn("CE send failed: %d\n", ret);
         }
 
         spin_unlock_bh(&ar_pci->ce_lock);
@@ -431,11 +372,11 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
+int ath10k_ce_recv_buf_enqueue(struct ath10k_ce_pipe *ce_state,
                                void *per_recv_context,
                                u32 buffer)
 {
-        struct ce_ring_state *dest_ring = ce_state->dest_ring;
+        struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -448,7 +389,9 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
         write_index = dest_ring->write_index;
         sw_index = dest_ring->sw_index;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                goto out;
 
         if (CE_RING_DELTA(nentries_mask, write_index, sw_index - 1) > 0) {
                 struct ce_desc *base = dest_ring->base_addr_owner_space;
@@ -470,6 +413,8 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
                 ret = -EIO;
         }
         ath10k_pci_sleep(ar);
+
+out:
         spin_unlock_bh(&ar_pci->ce_lock);
 
         return ret;
@@ -479,14 +424,14 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
  * Guts of ath10k_ce_completed_recv_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_recv_next_nolock(struct ce_state *ce_state,
+static int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
                                                 void **per_transfer_contextp,
                                                 u32 *bufferp,
                                                 unsigned int *nbytesp,
                                                 unsigned int *transfer_idp,
                                                 unsigned int *flagsp)
 {
-        struct ce_ring_state *dest_ring = ce_state->dest_ring;
+        struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         unsigned int nentries_mask = dest_ring->nentries_mask;
         unsigned int sw_index = dest_ring->sw_index;
 
@@ -535,7 +480,7 @@ static int ath10k_ce_completed_recv_next_nolock(struct ce_state *ce_state,
         return 0;
 }
 
-int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
+int ath10k_ce_completed_recv_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -556,11 +501,11 @@ int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
+int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp)
 {
-        struct ce_ring_state *dest_ring;
+        struct ath10k_ce_ring *dest_ring;
         unsigned int nentries_mask;
         unsigned int sw_index;
         unsigned int write_index;
@@ -612,19 +557,20 @@ int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
  * Guts of ath10k_ce_completed_send_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_send_next_nolock(struct ce_state *ce_state,
+static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
                                                 void **per_transfer_contextp,
                                                 u32 *bufferp,
                                                 unsigned int *nbytesp,
                                                 unsigned int *transfer_idp)
 {
-        struct ce_ring_state *src_ring = ce_state->src_ring;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
         unsigned int nentries_mask = src_ring->nentries_mask;
         unsigned int sw_index = src_ring->sw_index;
+        struct ce_desc *sdesc, *sbase;
         unsigned int read_index;
-        int ret = -EIO;
+        int ret;
 
         if (src_ring->hw_index == sw_index) {
                 /*
@@ -634,48 +580,54 @@ static int ath10k_ce_completed_send_next_nolock(struct ce_state *ce_state,
                  * the SW has really caught up to the HW, or if the cached
                  * value of the HW index has become stale.
                  */
-                ath10k_pci_wake(ar);
+
+                ret = ath10k_pci_wake(ar);
+                if (ret)
+                        return ret;
+
                 src_ring->hw_index =
                         ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
                 src_ring->hw_index &= nentries_mask;
+
                 ath10k_pci_sleep(ar);
         }
+
         read_index = src_ring->hw_index;
 
-        if ((read_index != sw_index) && (read_index != 0xffffffff)) {
-                struct ce_desc *sbase = src_ring->shadow_base;
-                struct ce_desc *sdesc = CE_SRC_RING_TO_DESC(sbase, sw_index);
+        if ((read_index == sw_index) || (read_index == 0xffffffff))
+                return -EIO;
 
-                /* Return data from completed source descriptor */
-                *bufferp = __le32_to_cpu(sdesc->addr);
-                *nbytesp = __le16_to_cpu(sdesc->nbytes);
-                *transfer_idp = MS(__le16_to_cpu(sdesc->flags),
-                                                CE_DESC_FLAGS_META_DATA);
+        sbase = src_ring->shadow_base;
+        sdesc = CE_SRC_RING_TO_DESC(sbase, sw_index);
 
-                if (per_transfer_contextp)
-                        *per_transfer_contextp =
-                                src_ring->per_transfer_context[sw_index];
+        /* Return data from completed source descriptor */
+        *bufferp = __le32_to_cpu(sdesc->addr);
+        *nbytesp = __le16_to_cpu(sdesc->nbytes);
+        *transfer_idp = MS(__le16_to_cpu(sdesc->flags),
+                           CE_DESC_FLAGS_META_DATA);
 
-                /* sanity */
-                src_ring->per_transfer_context[sw_index] = NULL;
+        if (per_transfer_contextp)
+                *per_transfer_contextp =
+                        src_ring->per_transfer_context[sw_index];
 
-                /* Update sw_index */
-                sw_index = CE_RING_IDX_INCR(nentries_mask, sw_index);
-                src_ring->sw_index = sw_index;
-                ret = 0;
-        }
+        /* sanity */
+        src_ring->per_transfer_context[sw_index] = NULL;
 
-        return ret;
+        /* Update sw_index */
+        sw_index = CE_RING_IDX_INCR(nentries_mask, sw_index);
+        src_ring->sw_index = sw_index;
+
+        return 0;
 }
 
 /* NB: Modeled after ath10k_ce_completed_send_next */
-int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
+int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp,
                                unsigned int *nbytesp,
                                unsigned int *transfer_idp)
 {
-        struct ce_ring_state *src_ring;
+        struct ath10k_ce_ring *src_ring;
         unsigned int nentries_mask;
         unsigned int sw_index;
         unsigned int write_index;
@@ -727,7 +679,7 @@ int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_completed_send_next(struct ce_state *ce_state,
+int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -756,53 +708,29 @@ int ath10k_ce_completed_send_next(struct ce_state *ce_state,
 void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = ar_pci->ce_id_to_state[ce_id];
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         u32 ctrl_addr = ce_state->ctrl_addr;
-        void *transfer_context;
-        u32 buf;
-        unsigned int nbytes;
-        unsigned int id;
-        unsigned int flags;
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
-        ath10k_pci_wake(ar);
         spin_lock_bh(&ar_pci->ce_lock);
 
         /* Clear the copy-complete interrupts that will be handled here. */
         ath10k_ce_engine_int_status_clear(ar, ctrl_addr,
                                           HOST_IS_COPY_COMPLETE_MASK);
 
-        if (ce_state->recv_cb) {
-                /*
-                 * Pop completed recv buffers and call the registered
-                 * recv callback for each
-                 */
-                while (ath10k_ce_completed_recv_next_nolock(ce_state,
-                                                            &transfer_context,
-                                                            &buf, &nbytes,
-                                                            &id, &flags) == 0) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        ce_state->recv_cb(ce_state, transfer_context, buf,
-                                          nbytes, id, flags);
-                        spin_lock_bh(&ar_pci->ce_lock);
-                }
-        }
+        spin_unlock_bh(&ar_pci->ce_lock);
 
-        if (ce_state->send_cb) {
-                /*
-                 * Pop completed send buffers and call the registered
-                 * send callback for each
-                 */
-                while (ath10k_ce_completed_send_next_nolock(ce_state,
-                                                            &transfer_context,
-                                                            &buf,
-                                                            &nbytes,
-                                                            &id) == 0) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        ce_state->send_cb(ce_state, transfer_context,
-                                          buf, nbytes, id);
-                        spin_lock_bh(&ar_pci->ce_lock);
-                }
-        }
+        if (ce_state->recv_cb)
+                ce_state->recv_cb(ce_state);
+
+        if (ce_state->send_cb)
+                ce_state->send_cb(ce_state);
+
+        spin_lock_bh(&ar_pci->ce_lock);
 
         /*
          * Misc CE interrupts are not being handled, but still need
@@ -823,10 +751,13 @@ void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id)
 void ath10k_ce_per_engine_service_any(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ce_id;
+        int ce_id, ret;
         u32 intr_summary;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
+
         intr_summary = CE_INTERRUPT_SUMMARY(ar);
 
         for (ce_id = 0; intr_summary && (ce_id < ar_pci->ce_count); ce_id++) {
@@ -849,13 +780,16 @@ void ath10k_ce_per_engine_service_any(struct ath10k *ar)
  *
  * Called with ce_lock held.
  */
-static void ath10k_ce_per_engine_handler_adjust(struct ce_state *ce_state,
+static void ath10k_ce_per_engine_handler_adjust(struct ath10k_ce_pipe *ce_state,
                                                 int disable_copy_compl_intr)
 {
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
+        int ret;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
         if ((!disable_copy_compl_intr) &&
             (ce_state->send_cb || ce_state->recv_cb))
@@ -871,11 +805,14 @@ static void ath10k_ce_per_engine_handler_adjust(struct ce_state *ce_state,
 void ath10k_ce_disable_interrupts(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ce_id;
+        int ce_id, ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
-        ath10k_pci_wake(ar);
         for (ce_id = 0; ce_id < ar_pci->ce_count; ce_id++) {
-                struct ce_state *ce_state = ar_pci->ce_id_to_state[ce_id];
+                struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
                 u32 ctrl_addr = ce_state->ctrl_addr;
 
                 ath10k_ce_copy_complete_intr_disable(ar, ctrl_addr);
@@ -883,12 +820,8 @@ void ath10k_ce_disable_interrupts(struct ath10k *ar)
         ath10k_pci_sleep(ar);
 }
 
-void ath10k_ce_send_cb_register(struct ce_state *ce_state,
-                                void (*send_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id),
+void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts)
 {
         struct ath10k *ar = ce_state->ar;
@@ -900,13 +833,8 @@ void ath10k_ce_send_cb_register(struct ce_state *ce_state,
         spin_unlock_bh(&ar_pci->ce_lock);
 }
 
-void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
-                                void (*recv_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id,
-                                                 unsigned int flags))
+void ath10k_ce_recv_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*recv_cb)(struct ath10k_ce_pipe *))
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -919,11 +847,11 @@ void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
 
 static int ath10k_ce_init_src_ring(struct ath10k *ar,
                                    unsigned int ce_id,
-                                   struct ce_state *ce_state,
+                                   struct ath10k_ce_pipe *ce_state,
                                    const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_ring_state *src_ring;
+        struct ath10k_ce_ring *src_ring;
         unsigned int nentries = attr->src_nentries;
         unsigned int ce_nbytes;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
@@ -937,19 +865,18 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                 return 0;
         }
 
-        ce_nbytes = sizeof(struct ce_ring_state) + (nentries * sizeof(void *));
+        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
         ptr = kzalloc(ce_nbytes, GFP_KERNEL);
         if (ptr == NULL)
                 return -ENOMEM;
 
-        ce_state->src_ring = (struct ce_ring_state *)ptr;
+        ce_state->src_ring = (struct ath10k_ce_ring *)ptr;
         src_ring = ce_state->src_ring;
 
-        ptr += sizeof(struct ce_ring_state);
+        ptr += sizeof(struct ath10k_ce_ring);
         src_ring->nentries = nentries;
         src_ring->nentries_mask = nentries - 1;
 
-        ath10k_pci_wake(ar);
         src_ring->sw_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
         src_ring->sw_index &= src_ring->nentries_mask;
         src_ring->hw_index = src_ring->sw_index;
@@ -957,7 +884,6 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         src_ring->write_index =
                 ath10k_ce_src_ring_write_index_get(ar, ctrl_addr);
         src_ring->write_index &= src_ring->nentries_mask;
-        ath10k_pci_sleep(ar);
 
         src_ring->per_transfer_context = (void **)ptr;
 
@@ -970,6 +896,12 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                                      (nentries * sizeof(struct ce_desc) +
                                       CE_DESC_RING_ALIGN),
                                      &base_addr);
+        if (!src_ring->base_addr_owner_space_unaligned) {
+                kfree(ce_state->src_ring);
+                ce_state->src_ring = NULL;
+                return -ENOMEM;
+        }
+
         src_ring->base_addr_ce_space_unaligned = base_addr;
 
         src_ring->base_addr_owner_space = PTR_ALIGN(
@@ -986,12 +918,21 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         src_ring->shadow_base_unaligned =
                 kmalloc((nentries * sizeof(struct ce_desc) +
                          CE_DESC_RING_ALIGN), GFP_KERNEL);
+        if (!src_ring->shadow_base_unaligned) {
+                pci_free_consistent(ar_pci->pdev,
+                                    (nentries * sizeof(struct ce_desc) +
+                                     CE_DESC_RING_ALIGN),
+                                    src_ring->base_addr_owner_space,
+                                    src_ring->base_addr_ce_space);
+                kfree(ce_state->src_ring);
+                ce_state->src_ring = NULL;
+                return -ENOMEM;
+        }
 
         src_ring->shadow_base = PTR_ALIGN(
                         src_ring->shadow_base_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_pci_wake(ar);
         ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr,
                                          src_ring->base_addr_ce_space);
         ath10k_ce_src_ring_size_set(ar, ctrl_addr, nentries);
@@ -999,18 +940,21 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         ath10k_ce_src_ring_byte_swap_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_lowmark_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_highmark_set(ar, ctrl_addr, nentries);
-        ath10k_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot ce src ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, src_ring->base_addr_owner_space);
 
         return 0;
 }
 
 static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                                     unsigned int ce_id,
-                                    struct ce_state *ce_state,
+                                    struct ath10k_ce_pipe *ce_state,
                                     const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_ring_state *dest_ring;
+        struct ath10k_ce_ring *dest_ring;
         unsigned int nentries = attr->dest_nentries;
         unsigned int ce_nbytes;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
@@ -1024,25 +968,23 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                 return 0;
         }
 
-        ce_nbytes = sizeof(struct ce_ring_state) + (nentries * sizeof(void *));
+        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
         ptr = kzalloc(ce_nbytes, GFP_KERNEL);
         if (ptr == NULL)
                 return -ENOMEM;
 
-        ce_state->dest_ring = (struct ce_ring_state *)ptr;
+        ce_state->dest_ring = (struct ath10k_ce_ring *)ptr;
         dest_ring = ce_state->dest_ring;
 
-        ptr += sizeof(struct ce_ring_state);
+        ptr += sizeof(struct ath10k_ce_ring);
         dest_ring->nentries = nentries;
         dest_ring->nentries_mask = nentries - 1;
 
-        ath10k_pci_wake(ar);
         dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
         dest_ring->sw_index &= dest_ring->nentries_mask;
         dest_ring->write_index =
                 ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
         dest_ring->write_index &= dest_ring->nentries_mask;
-        ath10k_pci_sleep(ar);
 
         dest_ring->per_transfer_context = (void **)ptr;
 
@@ -1055,6 +997,12 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                                      (nentries * sizeof(struct ce_desc) +
                                       CE_DESC_RING_ALIGN),
                                      &base_addr);
+        if (!dest_ring->base_addr_owner_space_unaligned) {
+                kfree(ce_state->dest_ring);
+                ce_state->dest_ring = NULL;
+                return -ENOMEM;
+        }
+
         dest_ring->base_addr_ce_space_unaligned = base_addr;
 
         /*
@@ -1071,44 +1019,35 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                         dest_ring->base_addr_ce_space_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_pci_wake(ar);
         ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr,
                                           dest_ring->base_addr_ce_space);
         ath10k_ce_dest_ring_size_set(ar, ctrl_addr, nentries);
         ath10k_ce_dest_ring_byte_swap_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_lowmark_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_highmark_set(ar, ctrl_addr, nentries);
-        ath10k_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot ce dest ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, dest_ring->base_addr_owner_space);
 
         return 0;
 }
 
-static struct ce_state *ath10k_ce_init_state(struct ath10k *ar,
+static struct ath10k_ce_pipe *ath10k_ce_init_state(struct ath10k *ar,
                                              unsigned int ce_id,
                                              const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = NULL;
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
 
         spin_lock_bh(&ar_pci->ce_lock);
 
-        if (!ar_pci->ce_id_to_state[ce_id]) {
-                ce_state = kzalloc(sizeof(*ce_state), GFP_ATOMIC);
-                if (ce_state == NULL) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        return NULL;
-                }
-
-                ar_pci->ce_id_to_state[ce_id] = ce_state;
-                ce_state->ar = ar;
-                ce_state->id = ce_id;
-                ce_state->ctrl_addr = ctrl_addr;
-                ce_state->state = CE_RUNNING;
-                /* Save attribute flags */
-                ce_state->attr_flags = attr->flags;
-                ce_state->src_sz_max = attr->src_sz_max;
-        }
+        ce_state->ar = ar;
+        ce_state->id = ce_id;
+        ce_state->ctrl_addr = ctrl_addr;
+        ce_state->attr_flags = attr->flags;
+        ce_state->src_sz_max = attr->src_sz_max;
 
         spin_unlock_bh(&ar_pci->ce_lock);
 
@@ -1122,12 +1061,17 @@ static struct ce_state *ath10k_ce_init_state(struct ath10k *ar,
  * initialization. It may be that only one side or the other is
  * initialized by software/firmware.
  */
-struct ce_state *ath10k_ce_init(struct ath10k *ar,
+struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                                 unsigned int ce_id,
                                 const struct ce_attr *attr)
 {
-        struct ce_state *ce_state;
+        struct ath10k_ce_pipe *ce_state;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return NULL;
 
         ce_state = ath10k_ce_init_state(ar, ce_id, attr);
         if (!ce_state) {
@@ -1136,40 +1080,38 @@ struct ce_state *ath10k_ce_init(struct ath10k *ar,
         }
 
         if (attr->src_nentries) {
-                if (ath10k_ce_init_src_ring(ar, ce_id, ce_state, attr)) {
-                        ath10k_err("Failed to initialize CE src ring for ID: %d\n",
-                                   ce_id);
+                ret = ath10k_ce_init_src_ring(ar, ce_id, ce_state, attr);
+                if (ret) {
+                        ath10k_err("Failed to initialize CE src ring for ID: %d (%d)\n",
+                                   ce_id, ret);
                         ath10k_ce_deinit(ce_state);
                         return NULL;
                 }
         }
 
         if (attr->dest_nentries) {
-                if (ath10k_ce_init_dest_ring(ar, ce_id, ce_state, attr)) {
-                        ath10k_err("Failed to initialize CE dest ring for ID: %d\n",
-                                   ce_id);
+                ret = ath10k_ce_init_dest_ring(ar, ce_id, ce_state, attr);
+                if (ret) {
+                        ath10k_err("Failed to initialize CE dest ring for ID: %d (%d)\n",
+                                   ce_id, ret);
                         ath10k_ce_deinit(ce_state);
                         return NULL;
                 }
         }
 
         /* Enable CE error interrupts */
-        ath10k_pci_wake(ar);
         ath10k_ce_error_intr_enable(ar, ctrl_addr);
+
         ath10k_pci_sleep(ar);
 
         return ce_state;
 }
 
-void ath10k_ce_deinit(struct ce_state *ce_state)
+void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state)
 {
-        unsigned int ce_id = ce_state->id;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
-        ce_state->state = CE_UNUSED;
-        ar_pci->ce_id_to_state[ce_id] = NULL;
-
         if (ce_state->src_ring) {
                 kfree(ce_state->src_ring->shadow_base_unaligned);
                 pci_free_consistent(ar_pci->pdev,
@@ -1190,5 +1132,7 @@ void ath10k_ce_deinit(struct ce_state *ce_state)
                                     ce_state->dest_ring->base_addr_ce_space);
                 kfree(ce_state->dest_ring);
         }
-        kfree(ce_state);
+
+        ce_state->src_ring = NULL;
+        ce_state->dest_ring = NULL;
 }
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index c17f07c026f4..aec802868341 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -27,7 +27,6 @@
 
 /* Descriptor rings must be aligned to this boundary */
 #define CE_DESC_RING_ALIGN      8
-#define CE_SENDLIST_ITEMS_MAX   12
 #define CE_SEND_FLAG_GATHER     0x00010000
 
 /*
@@ -36,16 +35,9 @@
  * how to use copy engines.
  */
 
-struct ce_state;
+struct ath10k_ce_pipe;
 
 
-/* Copy Engine operational state */
-enum ce_op_state {
-        CE_UNUSED,
-        CE_PAUSED,
-        CE_RUNNING,
-};
-
 #define CE_DESC_FLAGS_GATHER         (1 << 0)
 #define CE_DESC_FLAGS_BYTE_SWAP      (1 << 1)
 #define CE_DESC_FLAGS_META_DATA_MASK 0xFFFC
@@ -57,8 +49,7 @@ struct ce_desc {
         __le16 flags; /* %CE_DESC_FLAGS_ */
 };
 
-/* Copy Engine Ring internal state */
-struct ce_ring_state {
+struct ath10k_ce_ring {
         /* Number of entries in this ring; must be power of 2 */
         unsigned int nentries;
         unsigned int nentries_mask;
@@ -116,49 +107,20 @@ struct ce_ring_state {
         void **per_transfer_context;
 };
 
-/* Copy Engine internal state */
-struct ce_state {
+struct ath10k_ce_pipe {
         struct ath10k *ar;
         unsigned int id;
 
         unsigned int attr_flags;
 
         u32 ctrl_addr;
-        enum ce_op_state state;
-
-        void (*send_cb) (struct ce_state *ce_state,
-                         void *per_transfer_send_context,
-                         u32 buffer,
-                         unsigned int nbytes,
-                         unsigned int transfer_id);
-        void (*recv_cb) (struct ce_state *ce_state,
-                         void *per_transfer_recv_context,
-                         u32 buffer,
-                         unsigned int nbytes,
-                         unsigned int transfer_id,
-                         unsigned int flags);
 
-        unsigned int src_sz_max;
-        struct ce_ring_state *src_ring;
-        struct ce_ring_state *dest_ring;
-};
+        void (*send_cb)(struct ath10k_ce_pipe *);
+        void (*recv_cb)(struct ath10k_ce_pipe *);
 
-struct ce_sendlist_item {
-        /* e.g. buffer or desc list */
-        dma_addr_t data;
-        union {
-                /* simple buffer */
-                unsigned int nbytes;
-                /* Rx descriptor list */
-                unsigned int ndesc;
-        } u;
-        /* externally-specified flags; OR-ed with internal flags */
-        u32 flags;
-};
-
-struct ce_sendlist {
-        unsigned int num_items;
-        struct ce_sendlist_item item[CE_SENDLIST_ITEMS_MAX];
+        unsigned int src_sz_max;
+        struct ath10k_ce_ring *src_ring;
+        struct ath10k_ce_ring *dest_ring;
 };
 
 /* Copy Engine settable attributes */
@@ -182,7 +144,7 @@ struct ce_attr;
  *
  * Implementation note: pushes 1 buffer to Source ring
  */
-int ath10k_ce_send(struct ce_state *ce_state,
+int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    void *per_transfer_send_context,
                    u32 buffer,
                    unsigned int nbytes,
@@ -190,21 +152,10 @@ int ath10k_ce_send(struct ce_state *ce_state,
                    unsigned int transfer_id,
                    unsigned int flags);
 
-void ath10k_ce_send_cb_register(struct ce_state *ce_state,
-                                void (*send_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id),
+void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts);
 
-/* Append a simple buffer (address/length) to a sendlist. */
-void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist,
-                                u32 buffer,
-                                unsigned int nbytes,
-                                /* OR-ed with internal flags */
-                                u32 flags);
-
 /*
  * Queue a "sendlist" of buffers to be sent using gather to a single
  * anonymous destination buffer
@@ -215,11 +166,11 @@ void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist,
  *
  * Implemenation note: Pushes multiple buffers with Gather to Source ring.
  */
-int ath10k_ce_sendlist_send(struct ce_state *ce_state,
-                            void *per_transfer_send_context,
-                            struct ce_sendlist *sendlist,
-                            /* 14 bits */
-                            unsigned int transfer_id);
+int ath10k_ce_sendlist_send(struct ath10k_ce_pipe *ce_state,
+                            void *per_transfer_context,
+                            unsigned int transfer_id,
+                            u32 paddr, unsigned int nbytes,
+                            u32 flags);
 
 /*==================Recv=======================*/
 
@@ -233,17 +184,12 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
  *
  * Implemenation note: Pushes a buffer to Dest ring.
  */
-int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
+int ath10k_ce_recv_buf_enqueue(struct ath10k_ce_pipe *ce_state,
                                void *per_transfer_recv_context,
                                u32 buffer);
 
-void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
-                                void (*recv_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id,
-                                                 unsigned int flags));
+void ath10k_ce_recv_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*recv_cb)(struct ath10k_ce_pipe *));
 
 /* recv flags */
 /* Data is byte-swapped */
@@ -253,7 +199,7 @@ void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
  * Supply data for the next completed unprocessed receive descriptor.
  * Pops buffer from Dest ring.
  */
-int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
+int ath10k_ce_completed_recv_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -263,7 +209,7 @@ int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
  * Supply data for the next completed unprocessed send descriptor.
  * Pops 1 completed send buffer from Source ring.
  */
-int ath10k_ce_completed_send_next(struct ce_state *ce_state,
+int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                            void **per_transfer_contextp,
                            u32 *bufferp,
                            unsigned int *nbytesp,
@@ -272,7 +218,7 @@ int ath10k_ce_completed_send_next(struct ce_state *ce_state,
 /*==================CE Engine Initialization=======================*/
 
 /* Initialize an instance of a CE */
-struct ce_state *ath10k_ce_init(struct ath10k *ar,
+struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                                 unsigned int ce_id,
                                 const struct ce_attr *attr);
 
@@ -282,7 +228,7 @@ struct ce_state *ath10k_ce_init(struct ath10k *ar,
  * receive buffers.  Target DMA must be stopped before using
  * this API.
  */
-int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
+int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp);
 
@@ -291,13 +237,13 @@ int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
  * pending sends.  Target DMA must be stopped before using
  * this API.
  */
-int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
+int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp,
                                unsigned int *nbytesp,
                                unsigned int *transfer_idp);
 
-void ath10k_ce_deinit(struct ce_state *ce_state);
+void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state);
 
 /*==================CE Interrupt Handlers====================*/
 void ath10k_ce_per_engine_service_any(struct ath10k *ar);
@@ -322,9 +268,6 @@ struct ce_attr {
         /* CE_ATTR_* values */
         unsigned int flags;
 
-        /* currently not in use */
-        unsigned int priority;
-
         /* #entries in source ring - Must be a power of 2 */
         unsigned int src_nentries;
 
@@ -336,21 +279,8 @@ struct ce_attr {
 
         /* #entries in destination ring - Must be a power of 2 */
         unsigned int dest_nentries;
-
-        /* Future use */
-        void *reserved;
 };
 
-/*
- * When using sendlist_send to transfer multiple buffer fragments, the
- * transfer context of each fragment, except last one, will be filled
- * with CE_SENDLIST_ITEM_CTXT. ce_completed_send will return success for
- * each fragment done with send and the transfer context would be
- * CE_SENDLIST_ITEM_CTXT. Upper layer could use this to identify the
- * status of a send completion.
- */
-#define CE_SENDLIST_ITEM_CTXT   ((void *)0xcecebeef)
-
 #define SR_BA_ADDRESS           0x0000
 #define SR_SIZE_ADDRESS         0x0004
 #define DR_BA_ADDRESS           0x0008
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 7226c23b9569..76906d5a082e 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -39,17 +39,6 @@ MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
-                .id = QCA988X_HW_1_0_VERSION,
-                .name = "qca988x hw1.0",
-                .patch_load_addr = QCA988X_HW_1_0_PATCH_LOAD_ADDR,
-                .fw = {
-                        .dir = QCA988X_HW_1_0_FW_DIR,
-                        .fw = QCA988X_HW_1_0_FW_FILE,
-                        .otp = QCA988X_HW_1_0_OTP_FILE,
-                        .board = QCA988X_HW_1_0_BOARD_DATA_FILE,
-                },
-        },
-        {
                 .id = QCA988X_HW_2_0_VERSION,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
@@ -64,7 +53,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
 
 static void ath10k_send_suspend_complete(struct ath10k *ar)
 {
-        ath10k_dbg(ATH10K_DBG_CORE, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot suspend complete\n");
 
         ar->is_target_paused = true;
         wake_up(&ar->event_queue);
@@ -112,7 +101,7 @@ static int ath10k_init_connect_htc(struct ath10k *ar)
                 goto timeout;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE, "core wmi ready\n");
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot wmi ready\n");
         return 0;
 
 timeout:
@@ -214,8 +203,8 @@ static int ath10k_push_board_ext_data(struct ath10k *ar,
                 return ret;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "ath10k: Board extended Data download addr: 0x%x\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot push board extended data addr 0x%x\n",
                    board_ext_data_addr);
 
         if (board_ext_data_addr == 0)
@@ -446,6 +435,13 @@ static int ath10k_init_uart(struct ath10k *ar)
                 return ret;
         }
 
+        /* Set the UART baud rate to 19200. */
+        ret = ath10k_bmi_write32(ar, hi_desired_baud_rate, 19200);
+        if (ret) {
+                ath10k_warn("could not set the baud rate (%d)\n", ret);
+                return ret;
+        }
+
         ath10k_info("UART prints enabled\n");
         return 0;
 }
@@ -641,6 +637,10 @@ int ath10k_core_start(struct ath10k *ar)
         if (status)
                 goto err_disconnect_htc;
 
+        status = ath10k_debug_start(ar);
+        if (status)
+                goto err_disconnect_htc;
+
         ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
 
         return 0;
@@ -658,6 +658,7 @@ EXPORT_SYMBOL(ath10k_core_start);
 
 void ath10k_core_stop(struct ath10k *ar)
 {
+        ath10k_debug_stop(ar);
         ath10k_htc_stop(&ar->htc);
         ath10k_htt_detach(&ar->htt);
         ath10k_wmi_detach(ar);
@@ -717,10 +718,46 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         return 0;
 }
 
-int ath10k_core_register(struct ath10k *ar)
+static int ath10k_core_check_chip_id(struct ath10k *ar)
+{
+        u32 hw_revision = MS(ar->chip_id, SOC_CHIP_ID_REV);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot chip_id 0x%08x hw_revision 0x%x\n",
+                   ar->chip_id, hw_revision);
+
+        /* Check that we are not using hw1.0 (some of them have same pci id
+         * as hw2.0) before doing anything else as ath10k crashes horribly
+         * due to missing hw1.0 workarounds. */
+        switch (hw_revision) {
+        case QCA988X_HW_1_0_CHIP_ID_REV:
+                ath10k_err("ERROR: qca988x hw1.0 is not supported\n");
+                return -EOPNOTSUPP;
+
+        case QCA988X_HW_2_0_CHIP_ID_REV:
+                /* known hardware revision, continue normally */
+                return 0;
+
+        default:
+                ath10k_warn("Warning: hardware revision unknown (0x%x), expect problems\n",
+                            ar->chip_id);
+                return 0;
+        }
+
+        return 0;
+}
+
+int ath10k_core_register(struct ath10k *ar, u32 chip_id)
 {
         int status;
 
+        ar->chip_id = chip_id;
+
+        status = ath10k_core_check_chip_id(ar);
+        if (status) {
+                ath10k_err("Unsupported chip id 0x%08x\n", ar->chip_id);
+                return status;
+        }
+
         status = ath10k_core_probe_fw(ar);
         if (status) {
                 ath10k_err("could not probe fw (%d)\n", status);
@@ -755,6 +792,7 @@ void ath10k_core_unregister(struct ath10k *ar)
          * Otherwise we will fail to submit commands to FW and mac80211 will be
          * unhappy about callback failures. */
         ath10k_mac_unregister(ar);
+
         ath10k_core_free_firmware_files(ar);
 }
 EXPORT_SYMBOL(ath10k_core_unregister);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index e4bba563ed42..292ad4577c98 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -52,18 +52,12 @@ struct ath10k_skb_cb {
 
         struct {
                 u8 vdev_id;
-                u16 msdu_id;
                 u8 tid;
                 bool is_offchan;
-                bool is_conf;
-                bool discard;
-                bool no_ack;
-                u8 refcount;
-                struct sk_buff *txfrag;
-                struct sk_buff *msdu;
-        } __packed htt;
 
-        /* 4 bytes left on 64bit arch */
+                u8 frag_len;
+                u8 pad_len;
+        } __packed htt;
 } __packed;
 
 static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
@@ -112,11 +106,7 @@ struct ath10k_wmi {
         enum ath10k_htc_ep_id eid;
         struct completion service_ready;
         struct completion unified_ready;
-        atomic_t pending_tx_count;
-        wait_queue_head_t wq;
-
-        struct sk_buff_head wmi_event_list;
-        struct work_struct wmi_event_work;
+        wait_queue_head_t tx_credits_wq;
 };
 
 struct ath10k_peer_stat {
@@ -203,6 +193,7 @@ struct ath10k_vif {
         enum wmi_vdev_subtype vdev_subtype;
         u32 beacon_interval;
         u32 dtim_period;
+        struct sk_buff *beacon;
 
         struct ath10k *ar;
         struct ieee80211_vif *vif;
@@ -246,6 +237,9 @@ struct ath10k_debug {
         u32 wmi_service_bitmap[WMI_SERVICE_BM_SIZE];
 
         struct completion event_stats_compl;
+
+        unsigned long htt_stats_mask;
+        struct delayed_work htt_stats_dwork;
 };
 
 enum ath10k_state {
@@ -270,12 +264,21 @@ enum ath10k_state {
         ATH10K_STATE_WEDGED,
 };
 
+enum ath10k_fw_features {
+        /* wmi_mgmt_rx_hdr contains extra RSSI information */
+        ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX = 0,
+
+        /* keep last */
+        ATH10K_FW_FEATURE_COUNT,
+};
+
 struct ath10k {
         struct ath_common ath_common;
         struct ieee80211_hw *hw;
         struct device *dev;
         u8 mac_addr[ETH_ALEN];
 
+        u32 chip_id;
         u32 target_version;
         u8 fw_version_major;
         u32 fw_version_minor;
@@ -288,6 +291,8 @@ struct ath10k {
         u32 vht_cap_info;
         u32 num_rf_chains;
 
+        DECLARE_BITMAP(fw_features, ATH10K_FW_FEATURE_COUNT);
+
         struct targetdef *targetdef;
         struct hostdef *hostdef;
 
@@ -393,7 +398,7 @@ void ath10k_core_destroy(struct ath10k *ar);
 
 int ath10k_core_start(struct ath10k *ar);
 void ath10k_core_stop(struct ath10k *ar);
-int ath10k_core_register(struct ath10k *ar);
+int ath10k_core_register(struct ath10k *ar, u32 chip_id);
 void ath10k_core_unregister(struct ath10k *ar);
 
 #endif /* _CORE_H_ */
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 3d65594fa098..59615c7f217e 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -21,6 +21,9 @@
 #include "core.h"
 #include "debug.h"
 
+/* ms */
+#define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
+
 static int ath10k_printk(const char *level, const char *fmt, ...)
 {
         struct va_format vaf;
@@ -260,7 +263,6 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
         }
 
         spin_unlock_bh(&ar->data_lock);
-        mutex_unlock(&ar->conf_mutex);
         complete(&ar->debug.event_stats_compl);
 }
 
@@ -499,6 +501,136 @@ static const struct file_operations fops_simulate_fw_crash = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_chip_id(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[50];
+
+        len = scnprintf(buf, sizeof(buf), "0x%08x\n", ar->chip_id);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_chip_id = {
+        .read = ath10k_read_chip_id,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static int ath10k_debug_htt_stats_req(struct ath10k *ar)
+{
+        u64 cookie;
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        if (ar->debug.htt_stats_mask == 0)
+                /* htt stats are disabled */
+                return 0;
+
+        if (ar->state != ATH10K_STATE_ON)
+                return 0;
+
+        cookie = get_jiffies_64();
+
+        ret = ath10k_htt_h2t_stats_req(&ar->htt, ar->debug.htt_stats_mask,
+                                       cookie);
+        if (ret) {
+                ath10k_warn("failed to send htt stats request: %d\n", ret);
+                return ret;
+        }
+
+        queue_delayed_work(ar->workqueue, &ar->debug.htt_stats_dwork,
+                           msecs_to_jiffies(ATH10K_DEBUG_HTT_STATS_INTERVAL));
+
+        return 0;
+}
+
+static void ath10k_debug_htt_stats_dwork(struct work_struct *work)
+{
+        struct ath10k *ar = container_of(work, struct ath10k,
+                                         debug.htt_stats_dwork.work);
+
+        mutex_lock(&ar->conf_mutex);
+
+        ath10k_debug_htt_stats_req(ar);
+
+        mutex_unlock(&ar->conf_mutex);
+}
+
+static ssize_t ath10k_read_htt_stats_mask(struct file *file,
+                                            char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = scnprintf(buf, sizeof(buf), "%lu\n", ar->debug.htt_stats_mask);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_htt_stats_mask(struct file *file,
+                                             const char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long mask;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
+        if (ret)
+                return ret;
+
+        /* max 8 bit masks (for now) */
+        if (mask > 0xff)
+                return -E2BIG;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.htt_stats_mask = mask;
+
+        ret = ath10k_debug_htt_stats_req(ar);
+        if (ret)
+                goto out;
+
+        ret = count;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_htt_stats_mask = {
+        .read = ath10k_read_htt_stats_mask,
+        .write = ath10k_write_htt_stats_mask,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+int ath10k_debug_start(struct ath10k *ar)
+{
+        int ret;
+
+        ret = ath10k_debug_htt_stats_req(ar);
+        if (ret)
+                /* continue normally anyway, this isn't serious */
+                ath10k_warn("failed to start htt stats workqueue: %d\n", ret);
+
+        return 0;
+}
+
+void ath10k_debug_stop(struct ath10k *ar)
+{
+        cancel_delayed_work_sync(&ar->debug.htt_stats_dwork);
+}
+
 int ath10k_debug_create(struct ath10k *ar)
 {
         ar->debug.debugfs_phy = debugfs_create_dir("ath10k",
@@ -507,6 +639,9 @@ int ath10k_debug_create(struct ath10k *ar)
         if (!ar->debug.debugfs_phy)
                 return -ENOMEM;
 
+        INIT_DELAYED_WORK(&ar->debug.htt_stats_dwork,
+                          ath10k_debug_htt_stats_dwork);
+
         init_completion(&ar->debug.event_stats_compl);
 
         debugfs_create_file("fw_stats", S_IRUSR, ar->debug.debugfs_phy, ar,
@@ -518,8 +653,15 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("simulate_fw_crash", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_simulate_fw_crash);
 
+        debugfs_create_file("chip_id", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_chip_id);
+
+        debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_htt_stats_mask);
+
         return 0;
 }
+
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 168140c54028..6576b82a8d86 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -27,21 +27,24 @@ enum ath10k_debug_mask {
         ATH10K_DBG_HTC          = 0x00000004,
         ATH10K_DBG_HTT          = 0x00000008,
         ATH10K_DBG_MAC          = 0x00000010,
-        ATH10K_DBG_CORE         = 0x00000020,
+        ATH10K_DBG_BOOT         = 0x00000020,
         ATH10K_DBG_PCI_DUMP     = 0x00000040,
         ATH10K_DBG_HTT_DUMP     = 0x00000080,
         ATH10K_DBG_MGMT         = 0x00000100,
         ATH10K_DBG_DATA         = 0x00000200,
+        ATH10K_DBG_BMI          = 0x00000400,
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
 extern unsigned int ath10k_debug_mask;
 
-extern __printf(1, 2) int ath10k_info(const char *fmt, ...);
-extern __printf(1, 2) int ath10k_err(const char *fmt, ...);
-extern __printf(1, 2) int ath10k_warn(const char *fmt, ...);
+__printf(1, 2) int ath10k_info(const char *fmt, ...);
+__printf(1, 2) int ath10k_err(const char *fmt, ...);
+__printf(1, 2) int ath10k_warn(const char *fmt, ...);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
+int ath10k_debug_start(struct ath10k *ar);
+void ath10k_debug_stop(struct ath10k *ar);
 int ath10k_debug_create(struct ath10k *ar);
 void ath10k_debug_read_service_map(struct ath10k *ar,
                                    void *service_map,
@@ -50,6 +53,15 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
                                     struct wmi_stats_event *ev);
 
 #else
+static inline int ath10k_debug_start(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline void ath10k_debug_stop(struct ath10k *ar)
+{
+}
+
 static inline int ath10k_debug_create(struct ath10k *ar)
 {
         return 0;
@@ -68,7 +80,7 @@ static inline void ath10k_debug_read_target_stats(struct ath10k *ar,
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
-extern __printf(2, 3) void ath10k_dbg(enum ath10k_debug_mask mask,
+__printf(2, 3) void ath10k_dbg(enum ath10k_debug_mask mask,
                                       const char *fmt, ...);
 void ath10k_dbg_dump(enum ath10k_debug_mask mask,
                      const char *msg, const char *prefix,
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index ef3329ef52f3..3118d7506734 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -103,10 +103,10 @@ static void ath10k_htc_prepare_tx_skb(struct ath10k_htc_ep *ep,
         struct ath10k_htc_hdr *hdr;
 
         hdr = (struct ath10k_htc_hdr *)skb->data;
-        memset(hdr, 0, sizeof(*hdr));
 
         hdr->eid = ep->eid;
         hdr->len = __cpu_to_le16(skb->len - sizeof(*hdr));
+        hdr->flags = 0;
 
         spin_lock_bh(&ep->htc->tx_lock);
         hdr->seq_no = ep->seq_no++;
@@ -117,134 +117,13 @@ static void ath10k_htc_prepare_tx_skb(struct ath10k_htc_ep *ep,
         spin_unlock_bh(&ep->htc->tx_lock);
 }
 
-static int ath10k_htc_issue_skb(struct ath10k_htc *htc,
-                                struct ath10k_htc_ep *ep,
-                                struct sk_buff *skb,
-                                u8 credits)
-{
-        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
-        int ret;
-
-        ath10k_dbg(ATH10K_DBG_HTC, "%s: ep %d skb %p\n", __func__,
-                   ep->eid, skb);
-
-        ath10k_htc_prepare_tx_skb(ep, skb);
-
-        ret = ath10k_skb_map(htc->ar->dev, skb);
-        if (ret)
-                goto err;
-
-        ret = ath10k_hif_send_head(htc->ar,
-                                   ep->ul_pipe_id,
-                                   ep->eid,
-                                   skb->len,
-                                   skb);
-        if (unlikely(ret))
-                goto err;
-
-        return 0;
-err:
-        ath10k_warn("HTC issue failed: %d\n", ret);
-
-        spin_lock_bh(&htc->tx_lock);
-        ep->tx_credits += credits;
-        spin_unlock_bh(&htc->tx_lock);
-
-        /* this is the simplest way to handle out-of-resources for non-credit
-         * based endpoints. credit based endpoints can still get -ENOSR, but
-         * this is highly unlikely as credit reservation should prevent that */
-        if (ret == -ENOSR) {
-                spin_lock_bh(&htc->tx_lock);
-                __skb_queue_head(&ep->tx_queue, skb);
-                spin_unlock_bh(&htc->tx_lock);
-
-                return ret;
-        }
-
-        skb_cb->is_aborted = true;
-        ath10k_htc_notify_tx_completion(ep, skb);
-
-        return ret;
-}
-
-static struct sk_buff *ath10k_htc_get_skb_credit_based(struct ath10k_htc *htc,
-                                                       struct ath10k_htc_ep *ep,
-                                                       u8 *credits)
-{
-        struct sk_buff *skb;
-        struct ath10k_skb_cb *skb_cb;
-        int credits_required;
-        int remainder;
-        unsigned int transfer_len;
-
-        lockdep_assert_held(&htc->tx_lock);
-
-        skb = __skb_dequeue(&ep->tx_queue);
-        if (!skb)
-                return NULL;
-
-        skb_cb = ATH10K_SKB_CB(skb);
-        transfer_len = skb->len;
-
-        if (likely(transfer_len <= htc->target_credit_size)) {
-                credits_required = 1;
-        } else {
-                /* figure out how many credits this message requires */
-                credits_required = transfer_len / htc->target_credit_size;
-                remainder = transfer_len % htc->target_credit_size;
-
-                if (remainder)
-                        credits_required++;
-        }
-
-        ath10k_dbg(ATH10K_DBG_HTC, "Credits required %d got %d\n",
-                   credits_required, ep->tx_credits);
-
-        if (ep->tx_credits < credits_required) {
-                __skb_queue_head(&ep->tx_queue, skb);
-                return NULL;
-        }
-
-        ep->tx_credits -= credits_required;
-        *credits = credits_required;
-        return skb;
-}
-
-static void ath10k_htc_send_work(struct work_struct *work)
-{
-        struct ath10k_htc_ep *ep = container_of(work,
-                                        struct ath10k_htc_ep, send_work);
-        struct ath10k_htc *htc = ep->htc;
-        struct sk_buff *skb;
-        u8 credits = 0;
-        int ret;
-
-        while (true) {
-                if (ep->ul_is_polled)
-                        ath10k_htc_send_complete_check(ep, 0);
-
-                spin_lock_bh(&htc->tx_lock);
-                if (ep->tx_credit_flow_enabled)
-                        skb = ath10k_htc_get_skb_credit_based(htc, ep,
-                                                              &credits);
-                else
-                        skb = __skb_dequeue(&ep->tx_queue);
-                spin_unlock_bh(&htc->tx_lock);
-
-                if (!skb)
-                        break;
-
-                ret = ath10k_htc_issue_skb(htc, ep, skb, credits);
-                if (ret == -ENOSR)
-                        break;
-        }
-}
-
 int ath10k_htc_send(struct ath10k_htc *htc,
                     enum ath10k_htc_ep_id eid,
                     struct sk_buff *skb)
 {
         struct ath10k_htc_ep *ep = &htc->endpoint[eid];
+        int credits = 0;
+        int ret;
 
         if (htc->ar->state == ATH10K_STATE_WEDGED)
                 return -ECOMM;
@@ -254,18 +133,55 @@ int ath10k_htc_send(struct ath10k_htc *htc,
                 return -ENOENT;
         }
 
+        /* FIXME: This looks ugly, can we fix it? */
         spin_lock_bh(&htc->tx_lock);
         if (htc->stopped) {
                 spin_unlock_bh(&htc->tx_lock);
                 return -ESHUTDOWN;
         }
+        spin_unlock_bh(&htc->tx_lock);
 
-        __skb_queue_tail(&ep->tx_queue, skb);
         skb_push(skb, sizeof(struct ath10k_htc_hdr));
-        spin_unlock_bh(&htc->tx_lock);
 
-        queue_work(htc->ar->workqueue, &ep->send_work);
+        if (ep->tx_credit_flow_enabled) {
+                credits = DIV_ROUND_UP(skb->len, htc->target_credit_size);
+                spin_lock_bh(&htc->tx_lock);
+                if (ep->tx_credits < credits) {
+                        spin_unlock_bh(&htc->tx_lock);
+                        ret = -EAGAIN;
+                        goto err_pull;
+                }
+                ep->tx_credits -= credits;
+                spin_unlock_bh(&htc->tx_lock);
+        }
+
+        ath10k_htc_prepare_tx_skb(ep, skb);
+
+        ret = ath10k_skb_map(htc->ar->dev, skb);
+        if (ret)
+                goto err_credits;
+
+        ret = ath10k_hif_send_head(htc->ar, ep->ul_pipe_id, ep->eid,
+                                   skb->len, skb);
+        if (ret)
+                goto err_unmap;
+
         return 0;
+
+err_unmap:
+        ath10k_skb_unmap(htc->ar->dev, skb);
+err_credits:
+        if (ep->tx_credit_flow_enabled) {
+                spin_lock_bh(&htc->tx_lock);
+                ep->tx_credits += credits;
+                spin_unlock_bh(&htc->tx_lock);
+
+                if (ep->ep_ops.ep_tx_credits)
+                        ep->ep_ops.ep_tx_credits(htc->ar);
+        }
+err_pull:
+        skb_pull(skb, sizeof(struct ath10k_htc_hdr));
+        return ret;
 }
 
 static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
@@ -278,39 +194,9 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
         ath10k_htc_notify_tx_completion(ep, skb);
         /* the skb now belongs to the completion handler */
 
-        /* note: when using TX credit flow, the re-checking of queues happens
-         * when credits flow back from the target.  in the non-TX credit case,
-         * we recheck after the packet completes */
-        spin_lock_bh(&htc->tx_lock);
-        if (!ep->tx_credit_flow_enabled && !htc->stopped)
-                queue_work(ar->workqueue, &ep->send_work);
-        spin_unlock_bh(&htc->tx_lock);
-
         return 0;
 }
 
-/* flush endpoint TX queue */
-static void ath10k_htc_flush_endpoint_tx(struct ath10k_htc *htc,
-                                         struct ath10k_htc_ep *ep)
-{
-        struct sk_buff *skb;
-        struct ath10k_skb_cb *skb_cb;
-
-        spin_lock_bh(&htc->tx_lock);
-        for (;;) {
-                skb = __skb_dequeue(&ep->tx_queue);
-                if (!skb)
-                        break;
-
-                skb_cb = ATH10K_SKB_CB(skb);
-                skb_cb->is_aborted = true;
-                ath10k_htc_notify_tx_completion(ep, skb);
-        }
-        spin_unlock_bh(&htc->tx_lock);
-
-        cancel_work_sync(&ep->send_work);
-}
-
 /***********/
 /* Receive */
 /***********/
@@ -340,8 +226,11 @@ ath10k_htc_process_credit_report(struct ath10k_htc *htc,
                 ep = &htc->endpoint[report->eid];
                 ep->tx_credits += report->credits;
 
-                if (ep->tx_credits && !skb_queue_empty(&ep->tx_queue))
-                        queue_work(htc->ar->workqueue, &ep->send_work);
+                if (ep->ep_ops.ep_tx_credits) {
+                        spin_unlock_bh(&htc->tx_lock);
+                        ep->ep_ops.ep_tx_credits(htc->ar);
+                        spin_lock_bh(&htc->tx_lock);
+                }
         }
         spin_unlock_bh(&htc->tx_lock);
 }
@@ -599,10 +488,8 @@ static void ath10k_htc_reset_endpoint_states(struct ath10k_htc *htc)
                 ep->max_ep_message_len = 0;
                 ep->max_tx_queue_depth = 0;
                 ep->eid = i;
-                skb_queue_head_init(&ep->tx_queue);
                 ep->htc = htc;
                 ep->tx_credit_flow_enabled = true;
-                INIT_WORK(&ep->send_work, ath10k_htc_send_work);
         }
 }
 
@@ -752,8 +639,8 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
         tx_alloc = ath10k_htc_get_credit_allocation(htc,
                                                     conn_req->service_id);
         if (!tx_alloc)
-                ath10k_dbg(ATH10K_DBG_HTC,
-                           "HTC Service %s does not allocate target credits\n",
+                ath10k_dbg(ATH10K_DBG_BOOT,
+                           "boot htc service %s does not allocate target credits\n",
                            htc_service_name(conn_req->service_id));
 
         skb = ath10k_htc_build_tx_ctrl_skb(htc->ar);
@@ -772,16 +659,16 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
 
         flags |= SM(tx_alloc, ATH10K_HTC_CONN_FLAGS_RECV_ALLOC);
 
-        req_msg = &msg->connect_service;
-        req_msg->flags = __cpu_to_le16(flags);
-        req_msg->service_id = __cpu_to_le16(conn_req->service_id);
-
         /* Only enable credit flow control for WMI ctrl service */
         if (conn_req->service_id != ATH10K_HTC_SVC_ID_WMI_CONTROL) {
                 flags |= ATH10K_HTC_CONN_FLAGS_DISABLE_CREDIT_FLOW_CTRL;
                 disable_credit_flow_ctrl = true;
         }
 
+        req_msg = &msg->connect_service;
+        req_msg->flags = __cpu_to_le16(flags);
+        req_msg->service_id = __cpu_to_le16(conn_req->service_id);
+
         INIT_COMPLETION(htc->ctl_resp);
 
         status = ath10k_htc_send(htc, ATH10K_HTC_EP_0, skb);
@@ -873,19 +760,19 @@ setup:
         if (status)
                 return status;
 
-        ath10k_dbg(ATH10K_DBG_HTC,
-                   "HTC service: %s UL pipe: %d DL pipe: %d eid: %d ready\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot htc service '%s' ul pipe %d dl pipe %d eid %d ready\n",
                    htc_service_name(ep->service_id), ep->ul_pipe_id,
                    ep->dl_pipe_id, ep->eid);
 
-        ath10k_dbg(ATH10K_DBG_HTC,
-                   "EP %d UL polled: %d, DL polled: %d\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot htc ep %d ul polled %d dl polled %d\n",
                    ep->eid, ep->ul_is_polled, ep->dl_is_polled);
 
         if (disable_credit_flow_ctrl && ep->tx_credit_flow_enabled) {
                 ep->tx_credit_flow_enabled = false;
-                ath10k_dbg(ATH10K_DBG_HTC,
-                           "HTC service: %s eid: %d TX flow control disabled\n",
+                ath10k_dbg(ATH10K_DBG_BOOT,
+                           "boot htc service '%s' eid %d TX flow control disabled\n",
                            htc_service_name(ep->service_id), assigned_eid);
         }
 
@@ -945,18 +832,10 @@ int ath10k_htc_start(struct ath10k_htc *htc)
  */
 void ath10k_htc_stop(struct ath10k_htc *htc)
 {
-        int i;
-        struct ath10k_htc_ep *ep;
-
         spin_lock_bh(&htc->tx_lock);
         htc->stopped = true;
         spin_unlock_bh(&htc->tx_lock);
 
-        for (i = ATH10K_HTC_EP_0; i < ATH10K_HTC_EP_COUNT; i++) {
-                ep = &htc->endpoint[i];
-                ath10k_htc_flush_endpoint_tx(htc, ep);
-        }
-
         ath10k_hif_stop(htc->ar);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/htc.h b/drivers/net/wireless/ath/ath10k/htc.h
index e1dd8c761853..4716d331e6b6 100644
--- a/drivers/net/wireless/ath/ath10k/htc.h
+++ b/drivers/net/wireless/ath/ath10k/htc.h
@@ -276,6 +276,7 @@ struct ath10k_htc_ops {
 struct ath10k_htc_ep_ops {
         void (*ep_tx_complete)(struct ath10k *, struct sk_buff *);
         void (*ep_rx_complete)(struct ath10k *, struct sk_buff *);
+        void (*ep_tx_credits)(struct ath10k *);
 };
 
 /* service connection information */
@@ -315,15 +316,11 @@ struct ath10k_htc_ep {
         int ul_is_polled; /* call HIF to get tx completions */
         int dl_is_polled; /* call HIF to fetch rx (not implemented) */
 
-        struct sk_buff_head tx_queue;
-
         u8 seq_no; /* for debugging */
         int tx_credits;
         int tx_credit_size;
         int tx_credits_per_max_message;
         bool tx_credit_flow_enabled;
-
-        struct work_struct send_work;
 };
 
 struct ath10k_htc_svc_tx_credits {
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 39342c5cfcb2..5f7eeebc5432 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -104,21 +104,16 @@ err_htc_attach:
 
 static int ath10k_htt_verify_version(struct ath10k_htt *htt)
 {
-        ath10k_dbg(ATH10K_DBG_HTT,
-                   "htt target version %d.%d; host version %d.%d\n",
-                    htt->target_version_major,
-                    htt->target_version_minor,
-                    HTT_CURRENT_VERSION_MAJOR,
-                    HTT_CURRENT_VERSION_MINOR);
-
-        if (htt->target_version_major != HTT_CURRENT_VERSION_MAJOR) {
-                ath10k_err("htt major versions are incompatible!\n");
+        ath10k_info("htt target version %d.%d\n",
+                    htt->target_version_major, htt->target_version_minor);
+
+        if (htt->target_version_major != 2 &&
+            htt->target_version_major != 3) {
+                ath10k_err("unsupported htt major version %d. supported versions are 2 and 3\n",
+                           htt->target_version_major);
                 return -ENOTSUPP;
         }
 
-        if (htt->target_version_minor != HTT_CURRENT_VERSION_MINOR)
-                ath10k_warn("htt minor version differ but still compatible\n");
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 318be4629cde..1a337e93b7e9 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -19,13 +19,11 @@
 #define _HTT_H_
 
 #include <linux/bug.h>
+#include <linux/interrupt.h>
 
 #include "htc.h"
 #include "rx_desc.h"
 
-#define HTT_CURRENT_VERSION_MAJOR       2
-#define HTT_CURRENT_VERSION_MINOR       1
-
 enum htt_dbg_stats_type {
         HTT_DBG_STATS_WAL_PDEV_TXRX = 1 << 0,
         HTT_DBG_STATS_RX_REORDER    = 1 << 1,
@@ -45,6 +43,9 @@ enum htt_h2t_msg_type { /* host-to-target */
         HTT_H2T_MSG_TYPE_SYNC               = 4,
         HTT_H2T_MSG_TYPE_AGGR_CFG           = 5,
         HTT_H2T_MSG_TYPE_FRAG_DESC_BANK_CFG = 6,
+
+        /* This command is used for sending management frames in HTT < 3.0.
+         * HTT >= 3.0 uses TX_FRM for everything. */
         HTT_H2T_MSG_TYPE_MGMT_TX            = 7,
 
         HTT_H2T_NUM_MSGS /* keep this last */
@@ -1268,6 +1269,7 @@ struct ath10k_htt {
         /* set if host-fw communication goes haywire
          * used to avoid further failures */
         bool rx_confused;
+        struct tasklet_struct rx_replenish_task;
 };
 
 #define RX_HTT_HDR_STATUS_LEN 64
@@ -1308,6 +1310,10 @@ struct htt_rx_desc {
 #define HTT_RX_BUF_SIZE 1920
 #define HTT_RX_MSDU_SIZE (HTT_RX_BUF_SIZE - (int)sizeof(struct htt_rx_desc))
 
+/* Refill a bunch of RX buffers for each refill round so that FW/HW can handle
+ * aggregated traffic more nicely. */
+#define ATH10K_HTT_MAX_NUM_REFILL 16
+
 /*
  * DMA_MAP expects the buffer to be an integral number of cache lines.
  * Rather than checking the actual cache line size, this code makes a
@@ -1327,6 +1333,7 @@ void ath10k_htt_rx_detach(struct ath10k_htt *htt);
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb);
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt);
+int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie);
 int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index e784c40b904b..90d4f74c28d7 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -20,6 +20,7 @@
 #include "htt.h"
 #include "txrx.h"
 #include "debug.h"
+#include "trace.h"
 
 #include <linux/log2.h>
 
@@ -40,6 +41,10 @@
 /* when under memory pressure rx ring refill may fail and needs a retry */
 #define HTT_RX_RING_REFILL_RETRY_MS 50
 
+
+static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
+
+
 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt)
 {
         int size;
@@ -177,10 +182,27 @@ static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 
 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
 {
-        int ret, num_to_fill;
+        int ret, num_deficit, num_to_fill;
 
+        /* Refilling the whole RX ring buffer proves to be a bad idea. The
+         * reason is RX may take up significant amount of CPU cycles and starve
+         * other tasks, e.g. TX on an ethernet device while acting as a bridge
+         * with ath10k wlan interface. This ended up with very poor performance
+         * once CPU the host system was overwhelmed with RX on ath10k.
+         *
+         * By limiting the number of refills the replenishing occurs
+         * progressively. This in turns makes use of the fact tasklets are
+         * processed in FIFO order. This means actual RX processing can starve
+         * out refilling. If there's not enough buffers on RX ring FW will not
+         * report RX until it is refilled with enough buffers. This
+         * automatically balances load wrt to CPU power.
+         *
+         * This probably comes at a cost of lower maximum throughput but
+         * improves the avarage and stability. */
         spin_lock_bh(&htt->rx_ring.lock);
-        num_to_fill = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
+        num_deficit = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
+        num_to_fill = min(ATH10K_HTT_MAX_NUM_REFILL, num_deficit);
+        num_deficit -= num_to_fill;
         ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill);
         if (ret == -ENOMEM) {
                 /*
@@ -191,6 +213,8 @@ static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
                  */
                 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies +
                           msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS));
+        } else if (num_deficit > 0) {
+                tasklet_schedule(&htt->rx_replenish_task);
         }
         spin_unlock_bh(&htt->rx_ring.lock);
 }
@@ -212,6 +236,7 @@ void ath10k_htt_rx_detach(struct ath10k_htt *htt)
         int sw_rd_idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 
         del_timer_sync(&htt->rx_ring.refill_retry_timer);
+        tasklet_kill(&htt->rx_replenish_task);
 
         while (sw_rd_idx != __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr))) {
                 struct sk_buff *skb =
@@ -441,6 +466,12 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         return msdu_chaining;
 }
 
+static void ath10k_htt_rx_replenish_task(unsigned long ptr)
+{
+        struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
+        ath10k_htt_rx_msdu_buff_replenish(htt);
+}
+
 int ath10k_htt_rx_attach(struct ath10k_htt *htt)
 {
         dma_addr_t paddr;
@@ -501,7 +532,10 @@ int ath10k_htt_rx_attach(struct ath10k_htt *htt)
         if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
                 goto err_fill_ring;
 
-        ath10k_dbg(ATH10K_DBG_HTT, "HTT RX ring size: %d, fill_level: %d\n",
+        tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
+                     (unsigned long)htt);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
                    htt->rx_ring.size, htt->rx_ring.fill_level);
         return 0;
 
@@ -590,134 +624,144 @@ static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr *hdr)
         return false;
 }
 
-static int ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
-                        struct htt_rx_info *info)
+struct rfc1042_hdr {
+        u8 llc_dsap;
+        u8 llc_ssap;
+        u8 llc_ctrl;
+        u8 snap_oui[3];
+        __be16 snap_type;
+} __packed;
+
+struct amsdu_subframe_hdr {
+        u8 dst[ETH_ALEN];
+        u8 src[ETH_ALEN];
+        __be16 len;
+} __packed;
+
+static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
+                                struct htt_rx_info *info)
 {
         struct htt_rx_desc *rxd;
-        struct sk_buff *amsdu;
         struct sk_buff *first;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb = info->skb;
         enum rx_msdu_decap_format fmt;
         enum htt_rx_mpdu_encrypt_type enctype;
+        struct ieee80211_hdr *hdr;
+        u8 hdr_buf[64], addr[ETH_ALEN], *qos;
         unsigned int hdr_len;
-        int crypto_len;
 
         rxd = (void *)skb->data - sizeof(*rxd);
-        fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
-                        RX_MSDU_START_INFO1_DECAP_FORMAT);
         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
 
-        /* FIXME: No idea what assumptions are safe here. Need logs */
-        if ((fmt == RX_MSDU_DECAP_RAW && skb->next) ||
-            (fmt == RX_MSDU_DECAP_8023_SNAP_LLC)) {
-                ath10k_htt_rx_free_msdu_chain(skb->next);
-                skb->next = NULL;
-                return -ENOTSUPP;
-        }
+        hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        memcpy(hdr_buf, hdr, hdr_len);
+        hdr = (struct ieee80211_hdr *)hdr_buf;
 
-        /* A-MSDU max is a little less than 8K */
-        amsdu = dev_alloc_skb(8*1024);
-        if (!amsdu) {
-                ath10k_warn("A-MSDU allocation failed\n");
-                ath10k_htt_rx_free_msdu_chain(skb->next);
-                skb->next = NULL;
-                return -ENOMEM;
-        }
-
-        if (fmt >= RX_MSDU_DECAP_NATIVE_WIFI) {
-                int hdrlen;
-
-                hdr = (void *)rxd->rx_hdr_status;
-                hdrlen = ieee80211_hdrlen(hdr->frame_control);
-                memcpy(skb_put(amsdu, hdrlen), hdr, hdrlen);
-        }
+        /* FIXME: Hopefully this is a temporary measure.
+         *
+         * Reporting individual A-MSDU subframes means each reported frame
+         * shares the same sequence number.
+         *
+         * mac80211 drops frames it recognizes as duplicates, i.e.
+         * retransmission flag is set and sequence number matches sequence
+         * number from a previous frame (as per IEEE 802.11-2012: 9.3.2.10
+         * "Duplicate detection and recovery")
+         *
+         * To avoid frames being dropped clear retransmission flag for all
+         * received A-MSDUs.
+         *
+         * Worst case: actual duplicate frames will be reported but this should
+         * still be handled gracefully by other OSI/ISO layers. */
+        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_RETRY);
 
         first = skb;
         while (skb) {
                 void *decap_hdr;
-                int decap_len = 0;
+                int len;
 
                 rxd = (void *)skb->data - sizeof(*rxd);
                 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
-                                RX_MSDU_START_INFO1_DECAP_FORMAT);
+                         RX_MSDU_START_INFO1_DECAP_FORMAT);
                 decap_hdr = (void *)rxd->rx_hdr_status;
 
-                if (skb == first) {
-                        /* We receive linked A-MSDU subframe skbuffs. The
-                         * first one contains the original 802.11 header (and
-                         * possible crypto param) in the RX descriptor. The
-                         * A-MSDU subframe header follows that. Each part is
-                         * aligned to 4 byte boundary. */
-
-                        hdr = (void *)amsdu->data;
-                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
-                        crypto_len = ath10k_htt_rx_crypto_param_len(enctype);
-
-                        decap_hdr += roundup(hdr_len, 4);
-                        decap_hdr += roundup(crypto_len, 4);
-                }
+                skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
 
-                if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
-                        /* Ethernet2 decap inserts ethernet header in place of
-                         * A-MSDU subframe header. */
-                        skb_pull(skb, 6 + 6 + 2);
-
-                        /* A-MSDU subframe header length */
-                        decap_len += 6 + 6 + 2;
-
-                        /* Ethernet2 decap also strips the LLC/SNAP so we need
-                         * to re-insert it. The LLC/SNAP follows A-MSDU
-                         * subframe header. */
-                        /* FIXME: Not all LLCs are 8 bytes long */
-                        decap_len += 8;
-
-                        memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
+                /* First frame in an A-MSDU chain has more decapped data. */
+                if (skb == first) {
+                        len = round_up(ieee80211_hdrlen(hdr->frame_control), 4);
+                        len += round_up(ath10k_htt_rx_crypto_param_len(enctype),
+                                        4);
+                        decap_hdr += len;
                 }
 
-                if (fmt == RX_MSDU_DECAP_NATIVE_WIFI) {
-                        /* Native Wifi decap inserts regular 802.11 header
-                         * in place of A-MSDU subframe header. */
+                switch (fmt) {
+                case RX_MSDU_DECAP_RAW:
+                        /* remove trailing FCS */
+                        skb_trim(skb, skb->len - FCS_LEN);
+                        break;
+                case RX_MSDU_DECAP_NATIVE_WIFI:
+                        /* pull decapped header and copy DA */
                         hdr = (struct ieee80211_hdr *)skb->data;
-                        skb_pull(skb, ieee80211_hdrlen(hdr->frame_control));
+                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                        memcpy(addr, ieee80211_get_DA(hdr), ETH_ALEN);
+                        skb_pull(skb, hdr_len);
 
-                        /* A-MSDU subframe header length */
-                        decap_len += 6 + 6 + 2;
+                        /* push original 802.11 header */
+                        hdr = (struct ieee80211_hdr *)hdr_buf;
+                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
 
-                        memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
-                }
+                        /* original A-MSDU header has the bit set but we're
+                         * not including A-MSDU subframe header */
+                        hdr = (struct ieee80211_hdr *)skb->data;
+                        qos = ieee80211_get_qos_ctl(hdr);
+                        qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 
-                if (fmt == RX_MSDU_DECAP_RAW)
-                        skb_trim(skb, skb->len - 4); /* remove FCS */
+                        /* original 802.11 header has a different DA */
+                        memcpy(ieee80211_get_DA(hdr), addr, ETH_ALEN);
+                        break;
+                case RX_MSDU_DECAP_ETHERNET2_DIX:
+                        /* strip ethernet header and insert decapped 802.11
+                         * header, amsdu subframe header and rfc1042 header */
 
-                memcpy(skb_put(amsdu, skb->len), skb->data, skb->len);
+                        len = 0;
+                        len += sizeof(struct rfc1042_hdr);
+                        len += sizeof(struct amsdu_subframe_hdr);
 
-                /* A-MSDU subframes are padded to 4bytes
-                 * but relative to first subframe, not the whole MPDU */
-                if (skb->next && ((decap_len + skb->len) & 3)) {
-                        int padlen = 4 - ((decap_len + skb->len) & 3);
-                        memset(skb_put(amsdu, padlen), 0, padlen);
+                        skb_pull(skb, sizeof(struct ethhdr));
+                        memcpy(skb_push(skb, len), decap_hdr, len);
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                        break;
+                case RX_MSDU_DECAP_8023_SNAP_LLC:
+                        /* insert decapped 802.11 header making a singly
+                         * A-MSDU */
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                        break;
                 }
 
+                info->skb = skb;
+                info->encrypt_type = enctype;
                 skb = skb->next;
-        }
+                info->skb->next = NULL;
 
-        info->skb = amsdu;
-        info->encrypt_type = enctype;
-
-        ath10k_htt_rx_free_msdu_chain(first);
+                ath10k_process_rx(htt->ar, info);
+        }
 
-        return 0;
+        /* FIXME: It might be nice to re-assemble the A-MSDU when there's a
+         * monitor interface active for sniffing purposes. */
 }
 
-static int ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
+static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
 {
         struct sk_buff *skb = info->skb;
         struct htt_rx_desc *rxd;
         struct ieee80211_hdr *hdr;
         enum rx_msdu_decap_format fmt;
         enum htt_rx_mpdu_encrypt_type enctype;
+        int hdr_len;
+        void *rfc1042;
 
         /* This shouldn't happen. If it does than it may be a FW bug. */
         if (skb->next) {
@@ -731,49 +775,53 @@ static int ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
                         RX_MSDU_START_INFO1_DECAP_FORMAT);
         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
-        hdr = (void *)skb->data - RX_HTT_HDR_STATUS_LEN;
+        hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+        skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
 
         switch (fmt) {
         case RX_MSDU_DECAP_RAW:
                 /* remove trailing FCS */
-                skb_trim(skb, skb->len - 4);
+                skb_trim(skb, skb->len - FCS_LEN);
                 break;
         case RX_MSDU_DECAP_NATIVE_WIFI:
-                /* nothing to do here */
+                /* Pull decapped header */
+                hdr = (struct ieee80211_hdr *)skb->data;
+                hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                skb_pull(skb, hdr_len);
+
+                /* Push original header */
+                hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+                hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
                 break;
         case RX_MSDU_DECAP_ETHERNET2_DIX:
-                /* macaddr[6] + macaddr[6] + ethertype[2] */
-                skb_pull(skb, 6 + 6 + 2);
-                break;
-        case RX_MSDU_DECAP_8023_SNAP_LLC:
-                /* macaddr[6] + macaddr[6] + len[2] */
-                /* we don't need this for non-A-MSDU */
-                skb_pull(skb, 6 + 6 + 2);
-                break;
-        }
+                /* strip ethernet header and insert decapped 802.11 header and
+                 * rfc1042 header */
 
-        if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
-                void *llc;
-                int llclen;
+                rfc1042 = hdr;
+                rfc1042 += roundup(hdr_len, 4);
+                rfc1042 += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
 
-                llclen = 8;
-                llc  = hdr;
-                llc += roundup(ieee80211_hdrlen(hdr->frame_control), 4);
-                llc += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
-
-                skb_push(skb, llclen);
-                memcpy(skb->data, llc, llclen);
-        }
+                skb_pull(skb, sizeof(struct ethhdr));
+                memcpy(skb_push(skb, sizeof(struct rfc1042_hdr)),
+                       rfc1042, sizeof(struct rfc1042_hdr));
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                break;
+        case RX_MSDU_DECAP_8023_SNAP_LLC:
+                /* remove A-MSDU subframe header and insert
+                 * decapped 802.11 header. rfc1042 header is already there */
 
-        if (fmt >= RX_MSDU_DECAP_ETHERNET2_DIX) {
-                int len = ieee80211_hdrlen(hdr->frame_control);
-                skb_push(skb, len);
-                memcpy(skb->data, hdr, len);
+                skb_pull(skb, sizeof(struct amsdu_subframe_hdr));
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                break;
         }
 
         info->skb = skb;
         info->encrypt_type = enctype;
-        return 0;
+
+        ath10k_process_rx(htt->ar, info);
 }
 
 static bool ath10k_htt_rx_has_decrypt_err(struct sk_buff *skb)
@@ -845,8 +893,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
         int fw_desc_len;
         u8 *fw_desc;
         int i, j;
-        int ret;
-        int ip_summed;
 
         memset(&info, 0, sizeof(info));
 
@@ -921,11 +967,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
-                        /* The skb is not yet processed and it may be
-                         * reallocated. Since the offload is in the original
-                         * skb extract the checksum now and assign it later */
-                        ip_summed = ath10k_htt_rx_get_csum_state(msdu_head);
-
                         info.skb     = msdu_head;
                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
@@ -938,28 +979,13 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
 
                         if (ath10k_htt_rx_hdr_is_amsdu(hdr))
-                                ret = ath10k_htt_rx_amsdu(htt, &info);
+                                ath10k_htt_rx_amsdu(htt, &info);
                         else
-                                ret = ath10k_htt_rx_msdu(htt, &info);
-
-                        if (ret && !info.fcs_err) {
-                                ath10k_warn("error processing msdus %d\n", ret);
-                                dev_kfree_skb_any(info.skb);
-                                continue;
-                        }
-
-                        if (ath10k_htt_rx_hdr_is_amsdu((void *)info.skb->data))
-                                ath10k_dbg(ATH10K_DBG_HTT, "htt mpdu is amsdu\n");
-
-                        info.skb->ip_summed = ip_summed;
-
-                        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt mpdu: ",
-                                        info.skb->data, info.skb->len);
-                        ath10k_process_rx(htt->ar, &info);
+                                ath10k_htt_rx_msdu(htt, &info);
                 }
         }
 
-        ath10k_htt_rx_msdu_buff_replenish(htt);
+        tasklet_schedule(&htt->rx_replenish_task);
 }
 
 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
@@ -1131,7 +1157,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
-                ath10k_txrx_tx_completed(htt, &tx_done);
+                ath10k_txrx_tx_unref(htt, &tx_done);
                 break;
         }
         case HTT_T2H_MSG_TYPE_TX_COMPL_IND: {
@@ -1165,7 +1191,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
                         msdu_id = resp->data_tx_completion.msdus[i];
                         tx_done.msdu_id = __le16_to_cpu(msdu_id);
-                        ath10k_txrx_tx_completed(htt, &tx_done);
+                        ath10k_txrx_tx_unref(htt, &tx_done);
                 }
                 break;
         }
@@ -1190,8 +1216,10 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
         case HTT_T2H_MSG_TYPE_TEST:
                 /* FIX THIS */
                 break;
-        case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
         case HTT_T2H_MSG_TYPE_STATS_CONF:
+                trace_ath10k_htt_stats(skb->data, skb->len);
+                break;
+        case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
         case HTT_T2H_MSG_TYPE_RX_ADDBA:
         case HTT_T2H_MSG_TYPE_RX_DELBA:
         case HTT_T2H_MSG_TYPE_RX_FLUSH:
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 656c2546b294..3b93c6a01c6c 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -96,7 +96,7 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
         htt->max_num_pending_tx = ath10k_hif_get_free_queue_number(htt->ar,
                                                                    pipe);
 
-        ath10k_dbg(ATH10K_DBG_HTT, "htt tx max num pending tx %d\n",
+        ath10k_dbg(ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
 
         htt->pending_tx = kzalloc(sizeof(*htt->pending_tx) *
@@ -117,7 +117,7 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
 
 static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
 {
-        struct sk_buff *txdesc;
+        struct htt_tx_done tx_done = {0};
         int msdu_id;
 
         /* No locks needed. Called after communication with the device has
@@ -127,18 +127,13 @@ static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
                 if (!test_bit(msdu_id, htt->used_msdu_ids))
                         continue;
 
-                txdesc = htt->pending_tx[msdu_id];
-                if (!txdesc)
-                        continue;
-
                 ath10k_dbg(ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
                            msdu_id);
 
-                if (ATH10K_SKB_CB(txdesc)->htt.refcount > 0)
-                        ATH10K_SKB_CB(txdesc)->htt.refcount = 1;
+                tx_done.discard = 1;
+                tx_done.msdu_id = msdu_id;
 
-                ATH10K_SKB_CB(txdesc)->htt.discard = true;
-                ath10k_txrx_tx_unref(htt, txdesc);
+                ath10k_txrx_tx_unref(htt, &tx_done);
         }
 }
 
@@ -152,26 +147,7 @@ void ath10k_htt_tx_detach(struct ath10k_htt *htt)
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
-        struct ath10k_htt *htt = &ar->htt;
-
-        if (skb_cb->htt.is_conf) {
-                dev_kfree_skb_any(skb);
-                return;
-        }
-
-        if (skb_cb->is_aborted) {
-                skb_cb->htt.discard = true;
-
-                /* if the skbuff is aborted we need to make sure we'll free up
-                 * the tx resources, we can't simply run tx_unref() 2 times
-                 * because if htt tx completion came in earlier we'd access
-                 * unallocated memory */
-                if (skb_cb->htt.refcount > 1)
-                        skb_cb->htt.refcount = 1;
-        }
-
-        ath10k_txrx_tx_unref(htt, skb);
+        dev_kfree_skb_any(skb);
 }
 
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt)
@@ -192,10 +168,48 @@ int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt)
         cmd = (struct htt_cmd *)skb->data;
         cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_VERSION_REQ;
 
-        ATH10K_SKB_CB(skb)->htt.is_conf = true;
+        ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
+        if (ret) {
+                dev_kfree_skb_any(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
+int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie)
+{
+        struct htt_stats_req *req;
+        struct sk_buff *skb;
+        struct htt_cmd *cmd;
+        int len = 0, ret;
+
+        len += sizeof(cmd->hdr);
+        len += sizeof(cmd->stats_req);
+
+        skb = ath10k_htc_alloc_skb(len);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, len);
+        cmd = (struct htt_cmd *)skb->data;
+        cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_STATS_REQ;
+
+        req = &cmd->stats_req;
+
+        memset(req, 0, sizeof(*req));
+
+        /* currently we support only max 8 bit masks so no need to worry
+         * about endian support */
+        req->upload_types[0] = mask;
+        req->reset_types[0] = mask;
+        req->stat_type = HTT_STATS_REQ_CFG_STAT_TYPE_INVALID;
+        req->cookie_lsb = cpu_to_le32(cookie & 0xffffffff);
+        req->cookie_msb = cpu_to_le32((cookie & 0xffffffff00000000ULL) >> 32);
 
         ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
         if (ret) {
+                ath10k_warn("failed to send htt type stats request: %d", ret);
                 dev_kfree_skb_any(skb);
                 return ret;
         }
@@ -279,8 +293,6 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
 
 #undef desc_offset
 
-        ATH10K_SKB_CB(skb)->htt.is_conf = true;
-
         ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
         if (ret) {
                 dev_kfree_skb_any(skb);
@@ -293,10 +305,10 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 {
         struct device *dev = htt->ar->dev;
-        struct ath10k_skb_cb *skb_cb;
         struct sk_buff *txdesc = NULL;
         struct htt_cmd *cmd;
-        u8 vdev_id = ATH10K_SKB_CB(msdu)->htt.vdev_id;
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+        u8 vdev_id = skb_cb->htt.vdev_id;
         int len = 0;
         int msdu_id = -1;
         int res;
@@ -304,30 +316,30 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         res = ath10k_htt_tx_inc_pending(htt);
         if (res)
-                return res;
+                goto err;
 
         len += sizeof(cmd->hdr);
         len += sizeof(cmd->mgmt_tx);
 
-        txdesc = ath10k_htc_alloc_skb(len);
-        if (!txdesc) {
-                res = -ENOMEM;
-                goto err;
-        }
-
         spin_lock_bh(&htt->tx_lock);
-        msdu_id = ath10k_htt_tx_alloc_msdu_id(htt);
-        if (msdu_id < 0) {
+        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
-                res = msdu_id;
-                goto err;
+                goto err_tx_dec;
         }
-        htt->pending_tx[msdu_id] = txdesc;
+        msdu_id = res;
+        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
+        txdesc = ath10k_htc_alloc_skb(len);
+        if (!txdesc) {
+                res = -ENOMEM;
+                goto err_free_msdu_id;
+        }
+
         res = ath10k_skb_map(dev, msdu);
         if (res)
-                goto err;
+                goto err_free_txdesc;
 
         skb_put(txdesc, len);
         cmd = (struct htt_cmd *)txdesc->data;
@@ -339,31 +351,27 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         memcpy(cmd->mgmt_tx.hdr, msdu->data,
                min_t(int, msdu->len, HTT_MGMT_FRM_HDR_DOWNLOAD_LEN));
 
-        /* refcount is decremented by HTC and HTT completions until it reaches
-         * zero and is freed */
-        skb_cb = ATH10K_SKB_CB(txdesc);
-        skb_cb->htt.msdu_id = msdu_id;
-        skb_cb->htt.refcount = 2;
-        skb_cb->htt.msdu = msdu;
+        skb_cb->htt.frag_len = 0;
+        skb_cb->htt.pad_len = 0;
 
         res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
         if (res)
-                goto err;
+                goto err_unmap_msdu;
 
         return 0;
 
-err:
+err_unmap_msdu:
         ath10k_skb_unmap(dev, msdu);
-
-        if (txdesc)
-                dev_kfree_skb_any(txdesc);
-        if (msdu_id >= 0) {
-                spin_lock_bh(&htt->tx_lock);
-                htt->pending_tx[msdu_id] = NULL;
-                ath10k_htt_tx_free_msdu_id(htt, msdu_id);
-                spin_unlock_bh(&htt->tx_lock);
-        }
+err_free_txdesc:
+        dev_kfree_skb_any(txdesc);
+err_free_msdu_id:
+        spin_lock_bh(&htt->tx_lock);
+        htt->pending_tx[msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, msdu_id);
+        spin_unlock_bh(&htt->tx_lock);
+err_tx_dec:
         ath10k_htt_tx_dec_pending(htt);
+err:
         return res;
 }
 
@@ -373,13 +381,12 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         struct htt_cmd *cmd;
         struct htt_data_tx_desc_frag *tx_frags;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
-        struct ath10k_skb_cb *skb_cb;
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
         struct sk_buff *txdesc = NULL;
-        struct sk_buff *txfrag = NULL;
+        bool use_frags;
         u8 vdev_id = ATH10K_SKB_CB(msdu)->htt.vdev_id;
         u8 tid;
-        int prefetch_len, desc_len, frag_len;
-        dma_addr_t frags_paddr;
+        int prefetch_len, desc_len;
         int msdu_id = -1;
         int res;
         u8 flags0;
@@ -387,69 +394,82 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         res = ath10k_htt_tx_inc_pending(htt);
         if (res)
-                return res;
+                goto err;
+
+        spin_lock_bh(&htt->tx_lock);
+        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        if (res < 0) {
+                spin_unlock_bh(&htt->tx_lock);
+                goto err_tx_dec;
+        }
+        msdu_id = res;
+        htt->pending_tx[msdu_id] = msdu;
+        spin_unlock_bh(&htt->tx_lock);
 
         prefetch_len = min(htt->prefetch_len, msdu->len);
         prefetch_len = roundup(prefetch_len, 4);
 
         desc_len = sizeof(cmd->hdr) + sizeof(cmd->data_tx) + prefetch_len;
-        frag_len = sizeof(*tx_frags) * 2;
 
         txdesc = ath10k_htc_alloc_skb(desc_len);
         if (!txdesc) {
                 res = -ENOMEM;
-                goto err;
+                goto err_free_msdu_id;
         }
 
-        txfrag = dev_alloc_skb(frag_len);
-        if (!txfrag) {
-                res = -ENOMEM;
-                goto err;
-        }
+        /* Since HTT 3.0 there is no separate mgmt tx command. However in case
+         * of mgmt tx using TX_FRM there is not tx fragment list. Instead of tx
+         * fragment list host driver specifies directly frame pointer. */
+        use_frags = htt->target_version_major < 3 ||
+                    !ieee80211_is_mgmt(hdr->frame_control);
 
         if (!IS_ALIGNED((unsigned long)txdesc->data, 4)) {
                 ath10k_warn("htt alignment check failed. dropping packet.\n");
                 res = -EIO;
-                goto err;
+                goto err_free_txdesc;
         }
 
-        spin_lock_bh(&htt->tx_lock);
-        msdu_id = ath10k_htt_tx_alloc_msdu_id(htt);
-        if (msdu_id < 0) {
-                spin_unlock_bh(&htt->tx_lock);
-                res = msdu_id;
-                goto err;
+        if (use_frags) {
+                skb_cb->htt.frag_len = sizeof(*tx_frags) * 2;
+                skb_cb->htt.pad_len = (unsigned long)msdu->data -
+                                      round_down((unsigned long)msdu->data, 4);
+
+                skb_push(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+        } else {
+                skb_cb->htt.frag_len = 0;
+                skb_cb->htt.pad_len = 0;
         }
-        htt->pending_tx[msdu_id] = txdesc;
-        spin_unlock_bh(&htt->tx_lock);
 
         res = ath10k_skb_map(dev, msdu);
         if (res)
-                goto err;
-
-        /* tx fragment list must be terminated with zero-entry */
-        skb_put(txfrag, frag_len);
-        tx_frags = (struct htt_data_tx_desc_frag *)txfrag->data;
-        tx_frags[0].paddr = __cpu_to_le32(ATH10K_SKB_CB(msdu)->paddr);
-        tx_frags[0].len   = __cpu_to_le32(msdu->len);
-        tx_frags[1].paddr = __cpu_to_le32(0);
-        tx_frags[1].len   = __cpu_to_le32(0);
-
-        res = ath10k_skb_map(dev, txfrag);
-        if (res)
-                goto err;
+                goto err_pull_txfrag;
+
+        if (use_frags) {
+                dma_sync_single_for_cpu(dev, skb_cb->paddr, msdu->len,
+                                        DMA_TO_DEVICE);
+
+                /* tx fragment list must be terminated with zero-entry */
+                tx_frags = (struct htt_data_tx_desc_frag *)msdu->data;
+                tx_frags[0].paddr = __cpu_to_le32(skb_cb->paddr +
+                                                  skb_cb->htt.frag_len +
+                                                  skb_cb->htt.pad_len);
+                tx_frags[0].len   = __cpu_to_le32(msdu->len -
+                                                  skb_cb->htt.frag_len -
+                                                  skb_cb->htt.pad_len);
+                tx_frags[1].paddr = __cpu_to_le32(0);
+                tx_frags[1].len   = __cpu_to_le32(0);
+
+                dma_sync_single_for_device(dev, skb_cb->paddr, msdu->len,
+                                           DMA_TO_DEVICE);
+        }
 
-        ath10k_dbg(ATH10K_DBG_HTT, "txfrag 0x%llx msdu 0x%llx\n",
-                   (unsigned long long) ATH10K_SKB_CB(txfrag)->paddr,
+        ath10k_dbg(ATH10K_DBG_HTT, "msdu 0x%llx\n",
                    (unsigned long long) ATH10K_SKB_CB(msdu)->paddr);
-        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "txfrag: ",
-                        txfrag->data, frag_len);
         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "msdu: ",
                         msdu->data, msdu->len);
 
         skb_put(txdesc, desc_len);
         cmd = (struct htt_cmd *)txdesc->data;
-        memset(cmd, 0, desc_len);
 
         tid = ATH10K_SKB_CB(msdu)->htt.tid;
 
@@ -459,8 +479,13 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         if (!ieee80211_has_protected(hdr->frame_control))
                 flags0 |= HTT_DATA_TX_DESC_FLAGS0_NO_ENCRYPT;
         flags0 |= HTT_DATA_TX_DESC_FLAGS0_MAC_HDR_PRESENT;
-        flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
-                     HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
+
+        if (use_frags)
+                flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
+        else
+                flags0 |= SM(ATH10K_HW_TXRX_MGMT,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
 
         flags1  = 0;
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
@@ -468,45 +493,37 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
 
-        frags_paddr = ATH10K_SKB_CB(txfrag)->paddr;
-
         cmd->hdr.msg_type        = HTT_H2T_MSG_TYPE_TX_FRM;
         cmd->data_tx.flags0      = flags0;
         cmd->data_tx.flags1      = __cpu_to_le16(flags1);
-        cmd->data_tx.len         = __cpu_to_le16(msdu->len);
+        cmd->data_tx.len         = __cpu_to_le16(msdu->len -
+                                                 skb_cb->htt.frag_len -
+                                                 skb_cb->htt.pad_len);
         cmd->data_tx.id          = __cpu_to_le16(msdu_id);
-        cmd->data_tx.frags_paddr = __cpu_to_le32(frags_paddr);
+        cmd->data_tx.frags_paddr = __cpu_to_le32(skb_cb->paddr);
         cmd->data_tx.peerid      = __cpu_to_le32(HTT_INVALID_PEERID);
 
-        memcpy(cmd->data_tx.prefetch, msdu->data, prefetch_len);
-
-        /* refcount is decremented by HTC and HTT completions until it reaches
-         * zero and is freed */
-        skb_cb = ATH10K_SKB_CB(txdesc);
-        skb_cb->htt.msdu_id = msdu_id;
-        skb_cb->htt.refcount = 2;
-        skb_cb->htt.txfrag = txfrag;
-        skb_cb->htt.msdu = msdu;
+        memcpy(cmd->data_tx.prefetch, hdr, prefetch_len);
 
         res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
         if (res)
-                goto err;
+                goto err_unmap_msdu;
 
         return 0;
-err:
-        if (txfrag)
-                ath10k_skb_unmap(dev, txfrag);
-        if (txdesc)
-                dev_kfree_skb_any(txdesc);
-        if (txfrag)
-                dev_kfree_skb_any(txfrag);
-        if (msdu_id >= 0) {
-                spin_lock_bh(&htt->tx_lock);
-                htt->pending_tx[msdu_id] = NULL;
-                ath10k_htt_tx_free_msdu_id(htt, msdu_id);
-                spin_unlock_bh(&htt->tx_lock);
-        }
-        ath10k_htt_tx_dec_pending(htt);
+
+err_unmap_msdu:
         ath10k_skb_unmap(dev, msdu);
+err_pull_txfrag:
+        skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+err_free_txdesc:
+        dev_kfree_skb_any(txdesc);
+err_free_msdu_id:
+        spin_lock_bh(&htt->tx_lock);
+        htt->pending_tx[msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, msdu_id);
+        spin_unlock_bh(&htt->tx_lock);
+err_tx_dec:
+        ath10k_htt_tx_dec_pending(htt);
+err:
         return res;
 }
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 44ed5af0a204..8c1be7685922 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -24,18 +24,14 @@
 #define SUPPORTED_FW_MAJOR      1
 #define SUPPORTED_FW_MINOR      0
 #define SUPPORTED_FW_RELEASE    0
-#define SUPPORTED_FW_BUILD      629
+#define SUPPORTED_FW_BUILD      636
 
-/* QCA988X 1.0 definitions */
-#define QCA988X_HW_1_0_VERSION          0x4000002c
-#define QCA988X_HW_1_0_FW_DIR           "ath10k/QCA988X/hw1.0"
-#define QCA988X_HW_1_0_FW_FILE          "firmware.bin"
-#define QCA988X_HW_1_0_OTP_FILE         "otp.bin"
-#define QCA988X_HW_1_0_BOARD_DATA_FILE  "board.bin"
-#define QCA988X_HW_1_0_PATCH_LOAD_ADDR  0x1234
+/* QCA988X 1.0 definitions (unsupported) */
+#define QCA988X_HW_1_0_CHIP_ID_REV      0x0
 
 /* QCA988X 2.0 definitions */
 #define QCA988X_HW_2_0_VERSION          0x4100016c
+#define QCA988X_HW_2_0_CHIP_ID_REV      0x2
 #define QCA988X_HW_2_0_FW_DIR           "ath10k/QCA988X/hw2.0"
 #define QCA988X_HW_2_0_FW_FILE          "firmware.bin"
 #define QCA988X_HW_2_0_OTP_FILE         "otp.bin"
@@ -53,6 +49,9 @@ enum ath10k_hw_txrx_mode {
         ATH10K_HW_TXRX_RAW = 0,
         ATH10K_HW_TXRX_NATIVE_WIFI = 1,
         ATH10K_HW_TXRX_ETHERNET = 2,
+
+        /* Valid for HTT >= 3.0. Used for management frames in TX_FRM. */
+        ATH10K_HW_TXRX_MGMT = 3,
 };
 
 enum ath10k_mcast2ucast_mode {
@@ -75,7 +74,11 @@ enum ath10k_mcast2ucast_mode {
 #define TARGET_RX_CHAIN_MASK                    (BIT(0) | BIT(1) | BIT(2))
 #define TARGET_RX_TIMEOUT_LO_PRI                100
 #define TARGET_RX_TIMEOUT_HI_PRI                40
-#define TARGET_RX_DECAP_MODE                    ATH10K_HW_TXRX_ETHERNET
+
+/* Native Wifi decap mode is used to align IP frames to 4-byte boundaries and
+ * avoid a very expensive re-alignment in mac80211. */
+#define TARGET_RX_DECAP_MODE                    ATH10K_HW_TXRX_NATIVE_WIFI
+
 #define TARGET_SCAN_MAX_PENDING_REQS            4
 #define TARGET_BMISS_OFFLOAD_MAX_VDEV           3
 #define TARGET_ROAM_OFFLOAD_MAX_VDEV            3
@@ -169,6 +172,10 @@ enum ath10k_mcast2ucast_mode {
 #define SOC_LPO_CAL_ENABLE_LSB                  20
 #define SOC_LPO_CAL_ENABLE_MASK                 0x00100000
 
+#define SOC_CHIP_ID_ADDRESS                     0x000000ec
+#define SOC_CHIP_ID_REV_LSB                     8
+#define SOC_CHIP_ID_REV_MASK                    0x00000f00
+
 #define WLAN_RESET_CONTROL_COLD_RST_MASK        0x00000008
 #define WLAN_RESET_CONTROL_WARM_RST_MASK        0x00000004
 #define WLAN_SYSTEM_SLEEP_DISABLE_LSB           0
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index cf2ba4d850c9..99a9bad3f398 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -460,6 +460,11 @@ static int ath10k_vdev_start(struct ath10k_vif *arvif)
                 arg.ssid_len = arvif->vif->bss_conf.ssid_len;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac vdev %d start center_freq %d phymode %s\n",
+                   arg.vdev_id, arg.channel.freq,
+                   ath10k_wmi_phymode_str(arg.channel.mode));
+
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
                 ath10k_warn("WMI vdev start failed: ret %d\n", ret);
@@ -503,13 +508,10 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 {
         struct ieee80211_channel *channel = ar->hw->conf.chandef.chan;
         struct wmi_vdev_start_request_arg arg = {};
-        enum nl80211_channel_type type;
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        type = cfg80211_get_chandef_type(&ar->hw->conf.chandef);
-
         arg.vdev_id = vdev_id;
         arg.channel.freq = channel->center_freq;
         arg.channel.band_center_freq1 = ar->hw->conf.chandef.center_freq1;
@@ -607,7 +609,7 @@ static int ath10k_monitor_create(struct ath10k *ar)
                 goto vdev_fail;
         }
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Monitor interface created, vdev id: %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
                    ar->monitor_vdev_id);
 
         ar->monitor_present = true;
@@ -639,7 +641,7 @@ static int ath10k_monitor_destroy(struct ath10k *ar)
         ar->free_vdev_map |= 1 << (ar->monitor_vdev_id);
         ar->monitor_present = false;
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Monitor interface destroyed, vdev id: %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
                    ar->monitor_vdev_id);
         return ret;
 }
@@ -668,7 +670,7 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                             arvif->vdev_id);
                 return;
         }
-        ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d up\n", arvif->vdev_id);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d up\n", arvif->vdev_id);
 }
 
 static void ath10k_control_ibss(struct ath10k_vif *arvif,
@@ -752,14 +754,14 @@ static void ath10k_ps_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 psmode = WMI_STA_PS_MODE_DISABLED;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d psmode %s\n",
+                   arvif->vdev_id, psmode ? "enable" : "disable");
+
         ar_iter->ret = ath10k_wmi_set_psmode(ar_iter->ar, arvif->vdev_id,
                                              psmode);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set PS Mode: %d for VDEV: %d\n",
                             psmode, arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC, "Set PS Mode: %d for VDEV: %d\n",
-                           psmode, arvif->vdev_id);
 }
 
 /**********************/
@@ -949,7 +951,8 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
         arg->peer_ht_rates.num_rates = n;
         arg->peer_num_spatial_streams = max((n+7) / 8, 1);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "mcs cnt %d nss %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
+                   arg->addr,
                    arg->peer_ht_rates.num_rates,
                    arg->peer_num_spatial_streams);
 }
@@ -969,11 +972,11 @@ static void ath10k_peer_assoc_h_qos_ap(struct ath10k *ar,
                 arg->peer_flags |= WMI_PEER_QOS;
 
         if (sta->wme && sta->uapsd_queues) {
-                ath10k_dbg(ATH10K_DBG_MAC, "uapsd_queues: 0x%X, max_sp: %d\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac uapsd_queues 0x%x max_sp %d\n",
                            sta->uapsd_queues, sta->max_sp);
 
                 arg->peer_flags |= WMI_PEER_APSD;
-                arg->peer_flags |= WMI_RC_UAPSD_FLAG;
+                arg->peer_rate_caps |= WMI_RC_UAPSD_FLAG;
 
                 if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
                         uapsd |= WMI_AP_PS_UAPSD_AC3_DELIVERY_EN |
@@ -1048,7 +1051,8 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
         arg->peer_vht_rates.tx_mcs_set =
                 __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "mac vht peer\n");
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
+                   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
 }
 
 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
@@ -1076,8 +1080,6 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 {
         enum wmi_phy_mode phymode = MODE_UNKNOWN;
 
-        /* FIXME: add VHT */
-
         switch (ar->hw->conf.chandef.chan->band) {
         case IEEE80211_BAND_2GHZ:
                 if (sta->ht_cap.ht_supported) {
@@ -1091,7 +1093,17 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 
                 break;
         case IEEE80211_BAND_5GHZ:
-                if (sta->ht_cap.ht_supported) {
+                /*
+                 * Check VHT first.
+                 */
+                if (sta->vht_cap.vht_supported) {
+                        if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
+                                phymode = MODE_11AC_VHT80;
+                        else if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
+                                phymode = MODE_11AC_VHT40;
+                        else if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
+                                phymode = MODE_11AC_VHT20;
+                } else if (sta->ht_cap.ht_supported) {
                         if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
                                 phymode = MODE_11NA_HT40;
                         else
@@ -1105,6 +1117,9 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
                 break;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac peer %pM phymode %s\n",
+                   sta->addr, ath10k_wmi_phymode_str(phymode));
+
         arg->peer_phymode = phymode;
         WARN_ON(phymode == MODE_UNKNOWN);
 }
@@ -1162,15 +1177,15 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         rcu_read_unlock();
 
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac vdev %d up (associated) bssid %pM aid %d\n",
+                   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
+
         ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, bss_conf->aid,
                                  bss_conf->bssid);
         if (ret)
                 ath10k_warn("VDEV: %d up failed: ret %d\n",
                             arvif->vdev_id, ret);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "VDEV: %d associated, BSSID: %pM, AID: %d\n",
-                           arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
 }
 
 /*
@@ -1191,10 +1206,11 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
          * No idea why this happens, even though VDEV-DOWN is supposed
          * to be analogous to link down, so just stop the VDEV.
          */
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d stop (disassociated\n",
+                   arvif->vdev_id);
+
+        /* FIXME: check return value */
         ret = ath10k_vdev_stop(arvif);
-        if (!ret)
-                ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d stopped\n",
-                           arvif->vdev_id);
 
         /*
          * If we don't call VDEV-DOWN after VDEV-STOP FW will remain active and
@@ -1203,12 +1219,10 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
          * interfaces as it expects there is no rx when no interface is
          * running.
          */
-        ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
-        if (ret)
-                ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d ath10k_wmi_vdev_down failed (%d)\n",
-                           arvif->vdev_id, ret);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d down\n", arvif->vdev_id);
 
-        ath10k_wmi_flush_tx(ar);
+        /* FIXME: why don't we print error if wmi call fails? */
+        ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
 
         arvif->def_wep_key_index = 0;
 }
@@ -1333,8 +1347,8 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                                 continue;
 
                         ath10k_dbg(ATH10K_DBG_WMI,
-                                   "%s: [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
-                                   __func__, ch - arg.channels, arg.n_channels,
+                                   "mac channel [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
+                                    ch - arg.channels, arg.n_channels,
                                    ch->freq, ch->max_power, ch->max_reg_power,
                                    ch->max_antenna_gain, ch->mode);
 
@@ -1421,10 +1435,6 @@ static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
         struct ieee80211_key_conf *key = info->control.hw_key;
         int ret;
 
-        /* TODO AP mode should be implemented */
-        if (vif->type != NL80211_IFTYPE_STATION)
-                return;
-
         if (!ieee80211_has_protected(hdr->frame_control))
                 return;
 
@@ -1438,7 +1448,8 @@ static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
         if (key->keyidx == arvif->def_wep_key_index)
                 return;
 
-        ath10k_dbg(ATH10K_DBG_MAC, "new wep keyidx will be %d\n", key->keyidx);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d keyidx %d\n",
+                   arvif->vdev_id, key->keyidx);
 
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                         WMI_VDEV_PARAM_DEF_KEYID,
@@ -1480,6 +1491,12 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int ret;
 
+        if (ar->htt.target_version_major >= 3) {
+                /* Since HTT 3.0 there is no separate mgmt tx command */
+                ret = ath10k_htt_tx(&ar->htt, skb);
+                goto exit;
+        }
+
         if (ieee80211_is_mgmt(hdr->frame_control))
                 ret = ath10k_htt_mgmt_tx(&ar->htt, skb);
         else if (ieee80211_is_nullfunc(hdr->frame_control))
@@ -1491,6 +1508,7 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
         else
                 ret = ath10k_htt_tx(&ar->htt, skb);
 
+exit:
         if (ret) {
                 ath10k_warn("tx failed (%d). dropping packet.\n", ret);
                 ieee80211_free_txskb(ar->hw, skb);
@@ -1534,7 +1552,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 
                 mutex_lock(&ar->conf_mutex);
 
-                ath10k_dbg(ATH10K_DBG_MAC, "processing offchannel skb %p\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac offchannel skb %p\n",
                            skb);
 
                 hdr = (struct ieee80211_hdr *)skb->data;
@@ -1546,6 +1564,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                 spin_unlock_bh(&ar->data_lock);
 
                 if (peer)
+                        /* FIXME: should this use ath10k_warn()? */
                         ath10k_dbg(ATH10K_DBG_MAC, "peer %pM on vdev %d already present\n",
                                    peer_addr, vdev_id);
 
@@ -1643,8 +1662,6 @@ static int ath10k_abort_scan(struct ath10k *ar)
                 return -EIO;
         }
 
-        ath10k_wmi_flush_tx(ar);
-
         ret = wait_for_completion_timeout(&ar->scan.completed, 3*HZ);
         if (ret == 0)
                 ath10k_warn("timed out while waiting for scan to stop\n");
@@ -1678,10 +1695,6 @@ static int ath10k_start_scan(struct ath10k *ar,
         if (ret)
                 return ret;
 
-        /* make sure we submit the command so the completion
-        * timeout makes sense */
-        ath10k_wmi_flush_tx(ar);
-
         ret = wait_for_completion_timeout(&ar->scan.started, 1*HZ);
         if (ret == 0) {
                 ath10k_abort_scan(ar);
@@ -1727,8 +1740,10 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         /* we must calculate tid before we apply qos workaround
          * as we'd lose the qos control field */
         tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
-        if (ieee80211_is_data_qos(hdr->frame_control) &&
-            is_unicast_ether_addr(ieee80211_get_DA(hdr))) {
+        if (ieee80211_is_mgmt(hdr->frame_control)) {
+                tid = HTT_DATA_TX_EXT_TID_MGMT;
+        } else if (ieee80211_is_data_qos(hdr->frame_control) &&
+                   is_unicast_ether_addr(ieee80211_get_DA(hdr))) {
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
         }
@@ -1742,7 +1757,7 @@ static void ath10k_tx(struct ieee80211_hw *hw,
                 ath10k_tx_h_seq_no(skb);
         }
 
-        memset(ATH10K_SKB_CB(skb), 0, sizeof(*ATH10K_SKB_CB(skb)));
+        ATH10K_SKB_CB(skb)->htt.is_offchan = false;
         ATH10K_SKB_CB(skb)->htt.vdev_id = vdev_id;
         ATH10K_SKB_CB(skb)->htt.tid = tid;
 
@@ -1884,7 +1899,7 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
         mutex_lock(&ar->conf_mutex);
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                ath10k_dbg(ATH10K_DBG_MAC, "Config channel %d mhz\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac config channel %d mhz\n",
                            conf->chandef.chan->center_freq);
                 spin_lock_bh(&ar->data_lock);
                 ar->rx_channel = conf->chandef.chan;
@@ -1901,7 +1916,6 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                         ret = ath10k_monitor_destroy(ar);
         }
 
-        ath10k_wmi_flush_tx(ar);
         mutex_unlock(&ar->conf_mutex);
         return ret;
 }
@@ -1973,7 +1987,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 break;
         }
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Add interface: id %d type %d subtype %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d\n",
                    arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype);
 
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
@@ -2052,7 +2066,12 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&ar->conf_mutex);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Remove interface: id %d\n", arvif->vdev_id);
+        spin_lock_bh(&ar->data_lock);
+        if (arvif->beacon) {
+                dev_kfree_skb_any(arvif->beacon);
+                arvif->beacon = NULL;
+        }
+        spin_unlock_bh(&ar->data_lock);
 
         ar->free_vdev_map |= 1 << (arvif->vdev_id);
 
@@ -2064,6 +2083,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                 kfree(arvif->u.ap.noa_data);
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev delete %d (remove interface)\n",
+                   arvif->vdev_id);
+
         ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
         if (ret)
                 ath10k_warn("WMI vdev delete failed: %d\n", ret);
@@ -2105,18 +2127,20 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
 
         if ((ar->filter_flags & FIF_PROMISC_IN_BSS) &&
             !ar->monitor_enabled) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d start\n",
+                           ar->monitor_vdev_id);
+
                 ret = ath10k_monitor_start(ar, ar->monitor_vdev_id);
                 if (ret)
                         ath10k_warn("Unable to start monitor mode\n");
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC, "Monitor mode started\n");
         } else if (!(ar->filter_flags & FIF_PROMISC_IN_BSS) &&
                    ar->monitor_enabled) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d stop\n",
+                           ar->monitor_vdev_id);
+
                 ret = ath10k_monitor_stop(ar);
                 if (ret)
                         ath10k_warn("Unable to stop monitor mode\n");
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC, "Monitor mode stopped\n");
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2141,41 +2165,41 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_BEACON_INTERVAL,
                                                 arvif->beacon_interval);
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d beacon_interval %d\n",
+                           arvif->vdev_id, arvif->beacon_interval);
+
                 if (ret)
                         ath10k_warn("Failed to set beacon interval for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Beacon interval: %d set for VDEV: %d\n",
-                                   arvif->beacon_interval, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_BEACON) {
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "vdev %d set beacon tx mode to staggered\n",
+                           arvif->vdev_id);
+
                 ret = ath10k_wmi_pdev_set_param(ar,
                                                 WMI_PDEV_PARAM_BEACON_TX_MODE,
                                                 WMI_BEACON_STAGGERED_MODE);
                 if (ret)
                         ath10k_warn("Failed to set beacon mode for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set staggered beacon mode for VDEV: %d\n",
-                                   arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_BEACON_INFO) {
                 arvif->dtim_period = info->dtim_period;
 
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d dtim_period %d\n",
+                           arvif->vdev_id, arvif->dtim_period);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_DTIM_PERIOD,
                                                 arvif->dtim_period);
                 if (ret)
                         ath10k_warn("Failed to set dtim period for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set dtim period: %d for VDEV: %d\n",
-                                   arvif->dtim_period, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_SSID &&
@@ -2188,16 +2212,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BSSID) {
                 if (!is_zero_ether_addr(info->bssid)) {
+                        ath10k_dbg(ATH10K_DBG_MAC,
+                                   "mac vdev %d create peer %pM\n",
+                                   arvif->vdev_id, info->bssid);
+
                         ret = ath10k_peer_create(ar, arvif->vdev_id,
                                                  info->bssid);
                         if (ret)
                                 ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
                                             info->bssid, arvif->vdev_id);
-                        else
-                                ath10k_dbg(ATH10K_DBG_MAC,
-                                           "Added peer: %pM for VDEV: %d\n",
-                                           info->bssid, arvif->vdev_id);
-
 
                         if (vif->type == NL80211_IFTYPE_STATION) {
                                 /*
@@ -2207,11 +2230,12 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                                 memcpy(arvif->u.sta.bssid, info->bssid,
                                        ETH_ALEN);
 
+                                ath10k_dbg(ATH10K_DBG_MAC,
+                                           "mac vdev %d start %pM\n",
+                                           arvif->vdev_id, info->bssid);
+
+                                /* FIXME: check return value */
                                 ret = ath10k_vdev_start(arvif);
-                                if (!ret)
-                                        ath10k_dbg(ATH10K_DBG_MAC,
-                                                   "VDEV: %d started with BSSID: %pM\n",
-                                                   arvif->vdev_id, info->bssid);
                         }
 
                         /*
@@ -2235,16 +2259,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         cts_prot = 0;
 
+                ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
+                           arvif->vdev_id, cts_prot);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_ENABLE_RTSCTS,
                                                 cts_prot);
                 if (ret)
                         ath10k_warn("Failed to set CTS prot for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set CTS prot: %d for VDEV: %d\n",
-                                   cts_prot, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -2255,16 +2278,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         slottime = WMI_VDEV_SLOT_TIME_LONG; /* 20us */
 
+                ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d slot_time %d\n",
+                           arvif->vdev_id, slottime);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_SLOT_TIME,
                                                 slottime);
                 if (ret)
                         ath10k_warn("Failed to set erp slot for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set slottime: %d for VDEV: %d\n",
-                                   slottime, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
@@ -2274,16 +2296,16 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         preamble = WMI_VDEV_PREAMBLE_LONG;
 
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d preamble %dn",
+                           arvif->vdev_id, preamble);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_PREAMBLE,
                                                 preamble);
                 if (ret)
                         ath10k_warn("Failed to set preamble for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set preamble: %d for VDEV: %d\n",
-                                   preamble, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
@@ -2474,27 +2496,26 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New station addition.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d peer create %pM (new sta)\n",
+                           arvif->vdev_id, sta->addr);
+
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
                                     sta->addr, arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Added peer: %pM for VDEV: %d\n",
-                                   sta->addr, arvif->vdev_id);
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
                 /*
                  * Existing station deletion.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d peer delete %pM (sta gone)\n",
+                           arvif->vdev_id, sta->addr);
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn("Failed to delete peer: %pM for VDEV: %d\n",
                                     sta->addr, arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Removed peer: %pM for VDEV: %d\n",
-                                   sta->addr, arvif->vdev_id);
 
                 if (vif->type == NL80211_IFTYPE_STATION)
                         ath10k_bss_disassoc(hw, vif);
@@ -2505,14 +2526,13 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New association.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC, "mac sta %pM associated\n",
+                           sta->addr);
+
                 ret = ath10k_station_assoc(ar, arvif, sta);
                 if (ret)
                         ath10k_warn("Failed to associate station: %pM\n",
                                     sta->addr);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Station %pM moved to assoc state\n",
-                                   sta->addr);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH &&
                    (vif->type == NL80211_IFTYPE_AP ||
@@ -2520,14 +2540,13 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * Disassociation.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
+                           sta->addr);
+
                 ret = ath10k_station_disassoc(ar, arvif, sta);
                 if (ret)
                         ath10k_warn("Failed to disassociate station: %pM\n",
                                     sta->addr);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Station %pM moved to disassociated state\n",
-                                   sta->addr);
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2747,14 +2766,13 @@ static void ath10k_set_rts_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         if (ar_iter->ar->state == ATH10K_STATE_RESTARTED)
                 return;
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d rts_threshold %d\n",
+                   arvif->vdev_id, rts);
+
         ar_iter->ret = ath10k_mac_set_rts(arvif, rts);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set RTS threshold for VDEV: %d\n",
                             arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "Set RTS threshold: %d for VDEV: %d\n",
-                           rts, arvif->vdev_id);
 }
 
 static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
@@ -2789,14 +2807,13 @@ static void ath10k_set_frag_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         if (ar_iter->ar->state == ATH10K_STATE_RESTARTED)
                 return;
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d fragmentation_threshold %d\n",
+                   arvif->vdev_id, frag);
+
         ar_iter->ret = ath10k_mac_set_frag(arvif, frag);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set frag threshold for VDEV: %d\n",
                             arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "Set frag threshold: %d for VDEV: %d\n",
-                           frag, arvif->vdev_id);
 }
 
 static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
@@ -2836,8 +2853,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                         bool empty;
 
                         spin_lock_bh(&ar->htt.tx_lock);
-                        empty = bitmap_empty(ar->htt.used_msdu_ids,
-                                             ar->htt.max_num_pending_tx);
+                        empty = (ar->htt.num_pending_tx == 0);
                         spin_unlock_bh(&ar->htt.tx_lock);
 
                         skip = (ar->state == ATH10K_STATE_WEDGED);
@@ -3326,6 +3342,10 @@ int ath10k_mac_register(struct ath10k *ar)
                         IEEE80211_HW_WANT_MONITOR_VIF |
                         IEEE80211_HW_AP_LINK_PS;
 
+        /* MSDU can have HTT TX fragment pushed in front. The additional 4
+         * bytes is used for padding/alignment if necessary. */
+        ar->hw->extra_tx_headroom += sizeof(struct htt_data_tx_desc_frag)*2 + 4;
+
         if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS)
                 ar->hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS;
 
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index e2f9ef50b1bd..dff23d97bed0 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -36,11 +36,9 @@ static unsigned int ath10k_target_ps;
 module_param(ath10k_target_ps, uint, 0644);
 MODULE_PARM_DESC(ath10k_target_ps, "Enable ath10k Target (SoC) PS option");
 
-#define QCA988X_1_0_DEVICE_ID   (0xabcd)
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
 
 static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
-        { PCI_VDEVICE(ATHEROS, QCA988X_1_0_DEVICE_ID) }, /* PCI-E QCA988X V1 */
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
         {0}
 };
@@ -50,9 +48,9 @@ static int ath10k_pci_diag_read_access(struct ath10k *ar, u32 address,
 
 static void ath10k_pci_process_ce(struct ath10k *ar);
 static int ath10k_pci_post_rx(struct ath10k *ar);
-static int ath10k_pci_post_rx_pipe(struct hif_ce_pipe_info *pipe_info,
+static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                              int num);
-static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info);
+static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info);
 static void ath10k_pci_stop_ce(struct ath10k *ar);
 static void ath10k_pci_device_reset(struct ath10k *ar);
 static int ath10k_pci_reset_target(struct ath10k *ar);
@@ -60,43 +58,145 @@ static int ath10k_pci_start_intr(struct ath10k *ar);
 static void ath10k_pci_stop_intr(struct ath10k *ar);
 
 static const struct ce_attr host_ce_config_wlan[] = {
-        /* host->target HTC control and raw streams */
-        { /* CE0 */ CE_ATTR_FLAGS, 0, 16, 256, 0, NULL,},
-        /* could be moved to share CE3 */
-        /* target->host HTT + HTC control */
-        { /* CE1 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL,},
-        /* target->host WMI */
-        { /* CE2 */ CE_ATTR_FLAGS, 0, 0, 2048, 32, NULL,},
-        /* host->target WMI */
-        { /* CE3 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
-        /* host->target HTT */
-        { /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DIS_INTR, 0,
-                    CE_HTT_H2T_MSG_SRC_NENTRIES, 256, 0, NULL,},
-        /* unused */
-        { /* CE5 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
-        /* Target autonomous hif_memcpy */
-        { /* CE6 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
-        /* ce_diag, the Diagnostic Window */
-        { /* CE7 */ CE_ATTR_FLAGS, 0, 2, DIAG_TRANSFER_LIMIT, 2, NULL,},
+        /* CE0: host->target HTC control and raw streams */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 16,
+                .src_sz_max = 256,
+                .dest_nentries = 0,
+        },
+
+        /* CE1: target->host HTT + HTC control */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 512,
+                .dest_nentries = 512,
+        },
+
+        /* CE2: target->host WMI */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 2048,
+                .dest_nentries = 32,
+        },
+
+        /* CE3: host->target WMI */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 32,
+                .src_sz_max = 2048,
+                .dest_nentries = 0,
+        },
+
+        /* CE4: host->target HTT */
+        {
+                .flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+                .src_nentries = CE_HTT_H2T_MSG_SRC_NENTRIES,
+                .src_sz_max = 256,
+                .dest_nentries = 0,
+        },
+
+        /* CE5: unused */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 0,
+                .dest_nentries = 0,
+        },
+
+        /* CE6: target autonomous hif_memcpy */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 0,
+                .dest_nentries = 0,
+        },
+
+        /* CE7: ce_diag, the Diagnostic Window */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 2,
+                .src_sz_max = DIAG_TRANSFER_LIMIT,
+                .dest_nentries = 2,
+        },
 };
 
 /* Target firmware's Copy Engine configuration. */
 static const struct ce_pipe_config target_ce_config_wlan[] = {
-        /* host->target HTC control and raw streams */
-        { /* CE0 */ 0, PIPEDIR_OUT, 32, 256, CE_ATTR_FLAGS, 0,},
-        /* target->host HTT + HTC control */
-        { /* CE1 */ 1, PIPEDIR_IN, 32, 512, CE_ATTR_FLAGS, 0,},
-        /* target->host WMI */
-        { /* CE2 */ 2, PIPEDIR_IN, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* host->target WMI */
-        { /* CE3 */ 3, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* host->target HTT */
-        { /* CE4 */ 4, PIPEDIR_OUT, 256, 256, CE_ATTR_FLAGS, 0,},
+        /* CE0: host->target HTC control and raw streams */
+        {
+                .pipenum = 0,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 256,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE1: target->host HTT + HTC control */
+        {
+                .pipenum = 1,
+                .pipedir = PIPEDIR_IN,
+                .nentries = 32,
+                .nbytes_max = 512,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE2: target->host WMI */
+        {
+                .pipenum = 2,
+                .pipedir = PIPEDIR_IN,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE3: host->target WMI */
+        {
+                .pipenum = 3,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE4: host->target HTT */
+        {
+                .pipenum = 4,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 256,
+                .nbytes_max = 256,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
         /* NB: 50% of src nentries, since tx has 2 frags */
-        /* unused */
-        { /* CE5 */ 5, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* Reserved for target autonomous hif_memcpy */
-        { /* CE6 */ 6, PIPEDIR_INOUT, 32, 4096, CE_ATTR_FLAGS, 0,},
+
+        /* CE5: unused */
+        {
+                .pipenum = 5,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE6: Reserved for target autonomous hif_memcpy */
+        {
+                .pipenum = 6,
+                .pipedir = PIPEDIR_INOUT,
+                .nentries = 32,
+                .nbytes_max = 4096,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
         /* CE7 used only by Host */
 };
 
@@ -114,7 +214,7 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
         unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
         unsigned int id;
         unsigned int flags;
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
         /* Host buffer address in CE space */
         u32 ce_data;
         dma_addr_t ce_data_base = 0;
@@ -278,7 +378,7 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
         unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
         unsigned int id;
         unsigned int flags;
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
         void *data_buf = NULL;
         u32 ce_data;    /* Host buffer address in CE space */
         dma_addr_t ce_data_base = 0;
@@ -437,7 +537,7 @@ static void ath10k_pci_wait(struct ath10k *ar)
                 ath10k_warn("Unable to wakeup target\n");
 }
 
-void ath10k_do_pci_wake(struct ath10k *ar)
+int ath10k_do_pci_wake(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         void __iomem *pci_addr = ar_pci->mem;
@@ -453,18 +553,19 @@ void ath10k_do_pci_wake(struct ath10k *ar)
         atomic_inc(&ar_pci->keep_awake_count);
 
         if (ar_pci->verified_awake)
-                return;
+                return 0;
 
         for (;;) {
                 if (ath10k_pci_target_is_awake(ar)) {
                         ar_pci->verified_awake = true;
-                        break;
+                        return 0;
                 }
 
                 if (tot_delay > PCIE_WAKE_TIMEOUT) {
-                        ath10k_warn("target takes too long to wake up (awake count %d)\n",
+                        ath10k_warn("target took longer %d us to wake up (awake count %d)\n",
+                                    PCIE_WAKE_TIMEOUT,
                                     atomic_read(&ar_pci->keep_awake_count));
-                        break;
+                        return -ETIMEDOUT;
                 }
 
                 udelay(curr_delay);
@@ -493,7 +594,7 @@ void ath10k_do_pci_sleep(struct ath10k *ar)
  * FIXME: Handle OOM properly.
  */
 static inline
-struct ath10k_pci_compl *get_free_compl(struct hif_ce_pipe_info *pipe_info)
+struct ath10k_pci_compl *get_free_compl(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k_pci_compl *compl = NULL;
 
@@ -511,39 +612,28 @@ exit:
 }
 
 /* Called by lower (CE) layer when a send to Target completes. */
-static void ath10k_pci_ce_send_done(struct ce_state *ce_state,
-                                    void *transfer_context,
-                                    u32 ce_data,
-                                    unsigned int nbytes,
-                                    unsigned int transfer_id)
+static void ath10k_pci_ce_send_done(struct ath10k_ce_pipe *ce_state)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info =  &ar_pci->pipe_info[ce_state->id];
+        struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
         struct ath10k_pci_compl *compl;
-        bool process = false;
-
-        do {
-                /*
-                 * For the send completion of an item in sendlist, just
-                 * increment num_sends_allowed. The upper layer callback will
-                 * be triggered when last fragment is done with send.
-                 */
-                if (transfer_context == CE_SENDLIST_ITEM_CTXT) {
-                        spin_lock_bh(&pipe_info->pipe_lock);
-                        pipe_info->num_sends_allowed++;
-                        spin_unlock_bh(&pipe_info->pipe_lock);
-                        continue;
-                }
+        void *transfer_context;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
 
+        while (ath10k_ce_completed_send_next(ce_state, &transfer_context,
+                                             &ce_data, &nbytes,
+                                             &transfer_id) == 0) {
                 compl = get_free_compl(pipe_info);
                 if (!compl)
                         break;
 
-                compl->send_or_recv = HIF_CE_COMPLETE_SEND;
+                compl->state = ATH10K_PCI_COMPL_SEND;
                 compl->ce_state = ce_state;
                 compl->pipe_info = pipe_info;
-                compl->transfer_context = transfer_context;
+                compl->skb = transfer_context;
                 compl->nbytes = nbytes;
                 compl->transfer_id = transfer_id;
                 compl->flags = 0;
@@ -554,46 +644,36 @@ static void ath10k_pci_ce_send_done(struct ce_state *ce_state,
                 spin_lock_bh(&ar_pci->compl_lock);
                 list_add_tail(&compl->list, &ar_pci->compl_process);
                 spin_unlock_bh(&ar_pci->compl_lock);
-
-                process = true;
-        } while (ath10k_ce_completed_send_next(ce_state,
-                                                           &transfer_context,
-                                                           &ce_data, &nbytes,
-                                                           &transfer_id) == 0);
-
-        /*
-         * If only some of the items within a sendlist have completed,
-         * don't invoke completion processing until the entire sendlist
-         * has been sent.
-         */
-        if (!process)
-                return;
+        }
 
         ath10k_pci_process_ce(ar);
 }
 
 /* Called by lower (CE) layer when data is received from the Target. */
-static void ath10k_pci_ce_recv_data(struct ce_state *ce_state,
-                                    void *transfer_context, u32 ce_data,
-                                    unsigned int nbytes,
-                                    unsigned int transfer_id,
-                                    unsigned int flags)
+static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info =  &ar_pci->pipe_info[ce_state->id];
+        struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
         struct ath10k_pci_compl *compl;
         struct sk_buff *skb;
+        void *transfer_context;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+        unsigned int flags;
 
-        do {
+        while (ath10k_ce_completed_recv_next(ce_state, &transfer_context,
+                                             &ce_data, &nbytes, &transfer_id,
+                                             &flags) == 0) {
                 compl = get_free_compl(pipe_info);
                 if (!compl)
                         break;
 
-                compl->send_or_recv = HIF_CE_COMPLETE_RECV;
+                compl->state = ATH10K_PCI_COMPL_RECV;
                 compl->ce_state = ce_state;
                 compl->pipe_info = pipe_info;
-                compl->transfer_context = transfer_context;
+                compl->skb = transfer_context;
                 compl->nbytes = nbytes;
                 compl->transfer_id = transfer_id;
                 compl->flags = flags;
@@ -608,12 +688,7 @@ static void ath10k_pci_ce_recv_data(struct ce_state *ce_state,
                 spin_lock_bh(&ar_pci->compl_lock);
                 list_add_tail(&compl->list, &ar_pci->compl_process);
                 spin_unlock_bh(&ar_pci->compl_lock);
-
-        } while (ath10k_ce_completed_recv_next(ce_state,
-                                                           &transfer_context,
-                                                           &ce_data, &nbytes,
-                                                           &transfer_id,
-                                                           &flags) == 0);
+        }
 
         ath10k_pci_process_ce(ar);
 }
@@ -625,15 +700,12 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(nbuf);
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info = &(ar_pci->pipe_info[pipe_id]);
-        struct ce_state *ce_hdl = pipe_info->ce_hdl;
-        struct ce_sendlist sendlist;
+        struct ath10k_pci_pipe *pipe_info = &(ar_pci->pipe_info[pipe_id]);
+        struct ath10k_ce_pipe *ce_hdl = pipe_info->ce_hdl;
         unsigned int len;
         u32 flags = 0;
         int ret;
 
-        memset(&sendlist, 0, sizeof(struct ce_sendlist));
-
         len = min(bytes, nbuf->len);
         bytes -= len;
 
@@ -648,8 +720,6 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
                         "ath10k tx: data: ",
                         nbuf->data, nbuf->len);
 
-        ath10k_ce_sendlist_buf_add(&sendlist, skb_cb->paddr, len, flags);
-
         /* Make sure we have resources to handle this request */
         spin_lock_bh(&pipe_info->pipe_lock);
         if (!pipe_info->num_sends_allowed) {
@@ -660,7 +730,8 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
         pipe_info->num_sends_allowed--;
         spin_unlock_bh(&pipe_info->pipe_lock);
 
-        ret = ath10k_ce_sendlist_send(ce_hdl, nbuf, &sendlist, transfer_id);
+        ret = ath10k_ce_sendlist_send(ce_hdl, nbuf, transfer_id,
+                                      skb_cb->paddr, len, flags);
         if (ret)
                 ath10k_warn("CE send failed: %p\n", nbuf);
 
@@ -670,7 +741,7 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info = &(ar_pci->pipe_info[pipe]);
+        struct ath10k_pci_pipe *pipe_info = &(ar_pci->pipe_info[pipe]);
         int ret;
 
         spin_lock_bh(&pipe_info->pipe_lock);
@@ -764,9 +835,9 @@ static void ath10k_pci_hif_set_callbacks(struct ath10k *ar,
 static int ath10k_pci_start_ce(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_diag = ar_pci->ce_diag;
+        struct ath10k_ce_pipe *ce_diag = ar_pci->ce_diag;
         const struct ce_attr *attr;
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         struct ath10k_pci_compl *compl;
         int i, pipe_num, completions, disable_interrupts;
 
@@ -805,15 +876,14 @@ static int ath10k_pci_start_ce(struct ath10k *ar)
                         continue;
 
                 for (i = 0; i < completions; i++) {
-                        compl = kmalloc(sizeof(struct ath10k_pci_compl),
-                                        GFP_KERNEL);
+                        compl = kmalloc(sizeof(*compl), GFP_KERNEL);
                         if (!compl) {
                                 ath10k_warn("No memory for completion state\n");
                                 ath10k_pci_stop_ce(ar);
                                 return -ENOMEM;
                         }
 
-                        compl->send_or_recv = HIF_CE_COMPLETE_FREE;
+                        compl->state = ATH10K_PCI_COMPL_FREE;
                         list_add_tail(&compl->list, &pipe_info->compl_free);
                 }
         }
@@ -840,7 +910,7 @@ static void ath10k_pci_stop_ce(struct ath10k *ar)
          * their associated resources */
         spin_lock_bh(&ar_pci->compl_lock);
         list_for_each_entry(compl, &ar_pci->compl_process, list) {
-                skb = (struct sk_buff *)compl->transfer_context;
+                skb = compl->skb;
                 ATH10K_SKB_CB(skb)->is_aborted = true;
         }
         spin_unlock_bh(&ar_pci->compl_lock);
@@ -850,7 +920,7 @@ static void ath10k_pci_cleanup_ce(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_compl *compl, *tmp;
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         struct sk_buff *netbuf;
         int pipe_num;
 
@@ -861,7 +931,7 @@ static void ath10k_pci_cleanup_ce(struct ath10k *ar)
 
         list_for_each_entry_safe(compl, tmp, &ar_pci->compl_process, list) {
                 list_del(&compl->list);
-                netbuf = (struct sk_buff *)compl->transfer_context;
+                netbuf = compl->skb;
                 dev_kfree_skb_any(netbuf);
                 kfree(compl);
         }
@@ -912,12 +982,14 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                 list_del(&compl->list);
                 spin_unlock_bh(&ar_pci->compl_lock);
 
-                if (compl->send_or_recv == HIF_CE_COMPLETE_SEND) {
+                switch (compl->state) {
+                case ATH10K_PCI_COMPL_SEND:
                         cb->tx_completion(ar,
-                                          compl->transfer_context,
+                                          compl->skb,
                                           compl->transfer_id);
                         send_done = 1;
-                } else {
+                        break;
+                case ATH10K_PCI_COMPL_RECV:
                         ret = ath10k_pci_post_rx_pipe(compl->pipe_info, 1);
                         if (ret) {
                                 ath10k_warn("Unable to post recv buffer for pipe: %d\n",
@@ -925,7 +997,7 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                                 break;
                         }
 
-                        skb = (struct sk_buff *)compl->transfer_context;
+                        skb = compl->skb;
                         nbytes = compl->nbytes;
 
                         ath10k_dbg(ATH10K_DBG_PCI,
@@ -944,9 +1016,17 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                                             nbytes,
                                             skb->len + skb_tailroom(skb));
                         }
+                        break;
+                case ATH10K_PCI_COMPL_FREE:
+                        ath10k_warn("free completion cannot be processed\n");
+                        break;
+                default:
+                        ath10k_warn("invalid completion state (%d)\n",
+                                    compl->state);
+                        break;
                 }
 
-                compl->send_or_recv = HIF_CE_COMPLETE_FREE;
+                compl->state = ATH10K_PCI_COMPL_FREE;
 
                 /*
                  * Add completion back to the pipe's free list.
@@ -1037,12 +1117,12 @@ static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
                                                  &dl_is_polled);
 }
 
-static int ath10k_pci_post_rx_pipe(struct hif_ce_pipe_info *pipe_info,
+static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                    int num)
 {
         struct ath10k *ar = pipe_info->hif_ce_state;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = pipe_info->ce_hdl;
+        struct ath10k_ce_pipe *ce_state = pipe_info->ce_hdl;
         struct sk_buff *skb;
         dma_addr_t ce_data;
         int i, ret = 0;
@@ -1097,7 +1177,7 @@ err:
 static int ath10k_pci_post_rx(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         const struct ce_attr *attr;
         int pipe_num, ret = 0;
 
@@ -1147,11 +1227,11 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
         return 0;
 }
 
-static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
+static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
         u32 buf_sz;
         struct sk_buff *netbuf;
         u32 ce_data;
@@ -1179,11 +1259,11 @@ static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
         }
 }
 
-static void ath10k_pci_tx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
+static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
         struct sk_buff *netbuf;
         u32 ce_data;
         unsigned int nbytes;
@@ -1206,15 +1286,14 @@ static void ath10k_pci_tx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
 
         while (ath10k_ce_cancel_send_next(ce_hdl, (void **)&netbuf,
                                           &ce_data, &nbytes, &id) == 0) {
-                if (netbuf != CE_SENDLIST_ITEM_CTXT)
-                        /*
-                         * Indicate the completion to higer layer to free
-                         * the buffer
-                         */
-                        ATH10K_SKB_CB(netbuf)->is_aborted = true;
-                        ar_pci->msg_callbacks_current.tx_completion(ar,
-                                                                    netbuf,
-                                                                    id);
+                /*
+                 * Indicate the completion to higer layer to free
+                 * the buffer
+                 */
+                ATH10K_SKB_CB(netbuf)->is_aborted = true;
+                ar_pci->msg_callbacks_current.tx_completion(ar,
+                                                            netbuf,
+                                                            id);
         }
 }
 
@@ -1232,7 +1311,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
         int pipe_num;
 
         for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
-                struct hif_ce_pipe_info *pipe_info;
+                struct ath10k_pci_pipe *pipe_info;
 
                 pipe_info = &ar_pci->pipe_info[pipe_num];
                 ath10k_pci_rx_pipe_cleanup(pipe_info);
@@ -1243,7 +1322,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
 static void ath10k_pci_ce_deinit(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         int pipe_num;
 
         for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
@@ -1293,8 +1372,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
                                            void *resp, u32 *resp_len)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_tx = ar_pci->pipe_info[BMI_CE_NUM_TO_TARG].ce_hdl;
-        struct ce_state *ce_rx = ar_pci->pipe_info[BMI_CE_NUM_TO_HOST].ce_hdl;
+        struct ath10k_pci_pipe *pci_tx = &ar_pci->pipe_info[BMI_CE_NUM_TO_TARG];
+        struct ath10k_pci_pipe *pci_rx = &ar_pci->pipe_info[BMI_CE_NUM_TO_HOST];
+        struct ath10k_ce_pipe *ce_tx = pci_tx->ce_hdl;
+        struct ath10k_ce_pipe *ce_rx = pci_rx->ce_hdl;
         dma_addr_t req_paddr = 0;
         dma_addr_t resp_paddr = 0;
         struct bmi_xfer xfer = {};
@@ -1378,13 +1459,16 @@ err_dma:
         return ret;
 }
 
-static void ath10k_pci_bmi_send_done(struct ce_state *ce_state,
-                                     void *transfer_context,
-                                     u32 data,
-                                     unsigned int nbytes,
-                                     unsigned int transfer_id)
+static void ath10k_pci_bmi_send_done(struct ath10k_ce_pipe *ce_state)
 {
-        struct bmi_xfer *xfer = transfer_context;
+        struct bmi_xfer *xfer;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+
+        if (ath10k_ce_completed_send_next(ce_state, (void **)&xfer, &ce_data,
+                                          &nbytes, &transfer_id))
+                return;
 
         if (xfer->wait_for_resp)
                 return;
@@ -1392,14 +1476,17 @@ static void ath10k_pci_bmi_send_done(struct ce_state *ce_state,
         complete(&xfer->done);
 }
 
-static void ath10k_pci_bmi_recv_data(struct ce_state *ce_state,
-                                     void *transfer_context,
-                                     u32 data,
-                                     unsigned int nbytes,
-                                     unsigned int transfer_id,
-                                     unsigned int flags)
+static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
 {
-        struct bmi_xfer *xfer = transfer_context;
+        struct bmi_xfer *xfer;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+        unsigned int flags;
+
+        if (ath10k_ce_completed_recv_next(ce_state, (void **)&xfer, &ce_data,
+                                          &nbytes, &transfer_id, &flags))
+                return;
 
         if (!xfer->wait_for_resp) {
                 ath10k_warn("unexpected: BMI data received; ignoring\n");
@@ -1679,7 +1766,7 @@ static int ath10k_pci_init_config(struct ath10k *ar)
 static int ath10k_pci_ce_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         const struct ce_attr *attr;
         int pipe_num;
 
@@ -1895,7 +1982,7 @@ static const struct ath10k_hif_ops ath10k_pci_hif_ops = {
 
 static void ath10k_pci_ce_tasklet(unsigned long ptr)
 {
-        struct hif_ce_pipe_info *pipe = (struct hif_ce_pipe_info *)ptr;
+        struct ath10k_pci_pipe *pipe = (struct ath10k_pci_pipe *)ptr;
         struct ath10k_pci *ar_pci = pipe->ar_pci;
 
         ath10k_ce_per_engine_service(ar_pci->ar, pipe->pipe_num);
@@ -2212,18 +2299,13 @@ static int ath10k_pci_reset_target(struct ath10k *ar)
 
 static void ath10k_pci_device_reset(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *mem = ar_pci->mem;
         int i;
         u32 val;
 
         if (!SOC_GLOBAL_RESET_ADDRESS)
                 return;
 
-        if (!mem)
-                return;
-
-        ath10k_pci_reg_write32(mem, PCIE_SOC_WAKE_ADDRESS,
+        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS,
                                PCIE_SOC_WAKE_V_MASK);
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
                 if (ath10k_pci_target_is_awake(ar))
@@ -2232,12 +2314,12 @@ static void ath10k_pci_device_reset(struct ath10k *ar)
         }
 
         /* Put Target, including PCIe, into RESET. */
-        val = ath10k_pci_reg_read32(mem, SOC_GLOBAL_RESET_ADDRESS);
+        val = ath10k_pci_reg_read32(ar, SOC_GLOBAL_RESET_ADDRESS);
         val |= 1;
-        ath10k_pci_reg_write32(mem, SOC_GLOBAL_RESET_ADDRESS, val);
+        ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
 
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-                if (ath10k_pci_reg_read32(mem, RTC_STATE_ADDRESS) &
+                if (ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
                                           RTC_STATE_COLD_RESET_MASK)
                         break;
                 msleep(1);
@@ -2245,16 +2327,16 @@ static void ath10k_pci_device_reset(struct ath10k *ar)
 
         /* Pull Target, including PCIe, out of RESET. */
         val &= ~1;
-        ath10k_pci_reg_write32(mem, SOC_GLOBAL_RESET_ADDRESS, val);
+        ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
 
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-                if (!(ath10k_pci_reg_read32(mem, RTC_STATE_ADDRESS) &
+                if (!(ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
                                             RTC_STATE_COLD_RESET_MASK))
                         break;
                 msleep(1);
         }
 
-        ath10k_pci_reg_write32(mem, PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
+        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
 }
 
 static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
@@ -2267,13 +2349,10 @@ static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
 
                 switch (i) {
                 case ATH10K_PCI_FEATURE_MSI_X:
-                        ath10k_dbg(ATH10K_DBG_PCI, "device supports MSI-X\n");
-                        break;
-                case ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND:
-                        ath10k_dbg(ATH10K_DBG_PCI, "QCA988X_1.0 workaround enabled\n");
+                        ath10k_dbg(ATH10K_DBG_BOOT, "device supports MSI-X\n");
                         break;
                 case ATH10K_PCI_FEATURE_SOC_POWER_SAVE:
-                        ath10k_dbg(ATH10K_DBG_PCI, "QCA98XX SoC power save enabled\n");
+                        ath10k_dbg(ATH10K_DBG_BOOT, "QCA98XX SoC power save enabled\n");
                         break;
                 }
         }
@@ -2286,7 +2365,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         int ret = 0;
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        u32 lcr_val;
+        u32 lcr_val, chip_id;
 
         ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
 
@@ -2298,9 +2377,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         ar_pci->dev = &pdev->dev;
 
         switch (pci_dev->device) {
-        case QCA988X_1_0_DEVICE_ID:
-                set_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features);
-                break;
         case QCA988X_2_0_DEVICE_ID:
                 set_bit(ATH10K_PCI_FEATURE_MSI_X, ar_pci->features);
                 break;
@@ -2322,10 +2398,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_ar_pci;
         }
 
-        /* Enable QCA988X_1.0 HW workarounds */
-        if (test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features))
-                spin_lock_init(&ar_pci->hw_v1_workaround_lock);
-
         ar_pci->ar = ar;
         ar_pci->fw_indicator_address = FW_INDICATOR_ADDRESS;
         atomic_set(&ar_pci->keep_awake_count, 0);
@@ -2395,9 +2467,20 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         spin_lock_init(&ar_pci->ce_lock);
 
-        ar_pci->cacheline_sz = dma_get_cache_alignment();
+        ret = ath10k_do_pci_wake(ar);
+        if (ret) {
+                ath10k_err("Failed to get chip id: %d\n", ret);
+                return ret;
+        }
+
+        chip_id = ath10k_pci_read32(ar,
+                                    RTC_SOC_BASE_ADDRESS + SOC_CHIP_ID_ADDRESS);
+
+        ath10k_do_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot pci_mem 0x%p\n", ar_pci->mem);
 
-        ret = ath10k_core_register(ar);
+        ret = ath10k_core_register(ar, chip_id);
         if (ret) {
                 ath10k_err("could not register driver core (%d)\n", ret);
                 goto err_iomap;
@@ -2414,7 +2497,6 @@ err_region:
 err_device:
         pci_disable_device(pdev);
 err_ar:
-        pci_set_drvdata(pdev, NULL);
         ath10k_core_destroy(ar);
 err_ar_pci:
         /* call HIF PCI free here */
@@ -2442,7 +2524,6 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
         ath10k_core_unregister(ar);
 
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ar_pci->mem);
         pci_release_region(pdev, BAR_NUM);
         pci_clear_master(pdev);
@@ -2483,9 +2564,6 @@ module_exit(ath10k_pci_exit);
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Driver support for Atheros QCA988X PCIe devices");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_FW_FILE);
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_OTP_FILE);
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_BOARD_DATA_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_OTP_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_BOARD_DATA_FILE);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index 871bb339d56d..7c49f6f96f70 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -43,22 +43,23 @@ struct bmi_xfer {
         u32 resp_len;
 };
 
+enum ath10k_pci_compl_state {
+        ATH10K_PCI_COMPL_FREE = 0,
+        ATH10K_PCI_COMPL_SEND,
+        ATH10K_PCI_COMPL_RECV,
+};
+
 struct ath10k_pci_compl {
         struct list_head list;
-        int send_or_recv;
-        struct ce_state *ce_state;
-        struct hif_ce_pipe_info *pipe_info;
-        void *transfer_context;
+        enum ath10k_pci_compl_state state;
+        struct ath10k_ce_pipe *ce_state;
+        struct ath10k_pci_pipe *pipe_info;
+        struct sk_buff *skb;
         unsigned int nbytes;
         unsigned int transfer_id;
         unsigned int flags;
 };
 
-/* compl_state.send_or_recv */
-#define HIF_CE_COMPLETE_FREE 0
-#define HIF_CE_COMPLETE_SEND 1
-#define HIF_CE_COMPLETE_RECV 2
-
 /*
  * PCI-specific Target state
  *
@@ -152,17 +153,16 @@ struct service_to_pipe {
 
 enum ath10k_pci_features {
         ATH10K_PCI_FEATURE_MSI_X                = 0,
-        ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND    = 1,
-        ATH10K_PCI_FEATURE_SOC_POWER_SAVE       = 2,
+        ATH10K_PCI_FEATURE_SOC_POWER_SAVE       = 1,
 
         /* keep last */
         ATH10K_PCI_FEATURE_COUNT
 };
 
 /* Per-pipe state. */
-struct hif_ce_pipe_info {
+struct ath10k_pci_pipe {
         /* Handle of underlying Copy Engine */
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
 
         /* Our pipe number; facilitiates use of pipe_info ptrs. */
         u8 pipe_num;
@@ -190,7 +190,6 @@ struct ath10k_pci {
         struct device *dev;
         struct ath10k *ar;
         void __iomem *mem;
-        int cacheline_sz;
 
         DECLARE_BITMAP(features, ATH10K_PCI_FEATURE_COUNT);
 
@@ -219,7 +218,7 @@ struct ath10k_pci {
 
         bool compl_processing;
 
-        struct hif_ce_pipe_info pipe_info[CE_COUNT_MAX];
+        struct ath10k_pci_pipe pipe_info[CE_COUNT_MAX];
 
         struct ath10k_hif_cb msg_callbacks_current;
 
@@ -227,16 +226,13 @@ struct ath10k_pci {
         u32 fw_indicator_address;
 
         /* Copy Engine used for Diagnostic Accesses */
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
 
         /* FIXME: document what this really protects */
         spinlock_t ce_lock;
 
         /* Map CE id to ce_state */
-        struct ce_state *ce_id_to_state[CE_COUNT_MAX];
-
-        /* makes sure that dummy reads are atomic */
-        spinlock_t hw_v1_workaround_lock;
+        struct ath10k_ce_pipe ce_states[CE_COUNT_MAX];
 };
 
 static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
@@ -244,14 +240,18 @@ static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
         return ar->hif.priv;
 }
 
-static inline u32 ath10k_pci_reg_read32(void __iomem *mem, u32 addr)
+static inline u32 ath10k_pci_reg_read32(struct ath10k *ar, u32 addr)
 {
-        return ioread32(mem + PCIE_LOCAL_BASE_ADDRESS + addr);
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        return ioread32(ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS + addr);
 }
 
-static inline void ath10k_pci_reg_write32(void __iomem *mem, u32 addr, u32 val)
+static inline void ath10k_pci_reg_write32(struct ath10k *ar, u32 addr, u32 val)
 {
-        iowrite32(val, mem + PCIE_LOCAL_BASE_ADDRESS + addr);
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        iowrite32(val, ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS + addr);
 }
 
 #define ATH_PCI_RESET_WAIT_MAX 10 /* ms */
@@ -310,23 +310,8 @@ static inline void ath10k_pci_write32(struct ath10k *ar, u32 offset,
                                       u32 value)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *addr = ar_pci->mem;
-
-        if (test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features)) {
-                unsigned long irq_flags;
 
-                spin_lock_irqsave(&ar_pci->hw_v1_workaround_lock, irq_flags);
-
-                ioread32(addr+offset+4); /* 3rd read prior to write */
-                ioread32(addr+offset+4); /* 2nd read prior to write */
-                ioread32(addr+offset+4); /* 1st read prior to write */
-                iowrite32(value, addr+offset);
-
-                spin_unlock_irqrestore(&ar_pci->hw_v1_workaround_lock,
-                                       irq_flags);
-        } else {
-                iowrite32(value, addr+offset);
-        }
+        iowrite32(value, ar_pci->mem + offset);
 }
 
 static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
@@ -336,15 +321,17 @@ static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
         return ioread32(ar_pci->mem + offset);
 }
 
-void ath10k_do_pci_wake(struct ath10k *ar);
+int ath10k_do_pci_wake(struct ath10k *ar);
 void ath10k_do_pci_sleep(struct ath10k *ar);
 
-static inline void ath10k_pci_wake(struct ath10k *ar)
+static inline int ath10k_pci_wake(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
         if (test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
-                ath10k_do_pci_wake(ar);
+                return ath10k_do_pci_wake(ar);
+
+        return 0;
 }
 
 static inline void ath10k_pci_sleep(struct ath10k *ar)
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index bfec6c8f2ecb..1c584c4b019c 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -422,10 +422,30 @@ struct rx_mpdu_end {
 #define RX_MSDU_START_INFO1_IP_FRAG             (1 << 14)
 #define RX_MSDU_START_INFO1_TCP_ONLY_ACK        (1 << 15)
 
+/* The decapped header (rx_hdr_status) contains the following:
+ *  a) 802.11 header
+ *  [padding to 4 bytes]
+ *  b) HW crypto parameter
+ *     - 0 bytes for no security
+ *     - 4 bytes for WEP
+ *     - 8 bytes for TKIP, AES
+ *  [padding to 4 bytes]
+ *  c) A-MSDU subframe header (14 bytes) if appliable
+ *  d) LLC/SNAP (RFC1042, 8 bytes)
+ *
+ * In case of A-MSDU only first frame in sequence contains (a) and (b). */
 enum rx_msdu_decap_format {
-        RX_MSDU_DECAP_RAW           = 0,
-        RX_MSDU_DECAP_NATIVE_WIFI   = 1,
+        RX_MSDU_DECAP_RAW = 0,
+
+        /* Note: QoS frames are reported as non-QoS. The rx_hdr_status in
+         * htt_rx_desc contains the original decapped 802.11 header. */
+        RX_MSDU_DECAP_NATIVE_WIFI = 1,
+
+        /* Payload contains an ethernet header (struct ethhdr). */
         RX_MSDU_DECAP_ETHERNET2_DIX = 2,
+
+        /* Payload contains two 48-bit addresses and 2-byte length (14 bytes
+         * total), followed by an RFC1042 header (8 bytes). */
         RX_MSDU_DECAP_8023_SNAP_LLC = 3
 };
 
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 85e806bf7257..90817ddc92ba 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -111,26 +111,29 @@ TRACE_EVENT(ath10k_log_dbg_dump,
 );
 
 TRACE_EVENT(ath10k_wmi_cmd,
-        TP_PROTO(int id, void *buf, size_t buf_len),
+        TP_PROTO(int id, void *buf, size_t buf_len, int ret),
 
-        TP_ARGS(id, buf, buf_len),
+        TP_ARGS(id, buf, buf_len, ret),
 
         TP_STRUCT__entry(
                 __field(unsigned int, id)
                 __field(size_t, buf_len)
                 __dynamic_array(u8, buf, buf_len)
+                __field(int, ret)
         ),
 
         TP_fast_assign(
                 __entry->id = id;
                 __entry->buf_len = buf_len;
+                __entry->ret = ret;
                 memcpy(__get_dynamic_array(buf), buf, buf_len);
         ),
 
         TP_printk(
-                "id %d len %zu",
+                "id %d len %zu ret %d",
                 __entry->id,
-                __entry->buf_len
+                __entry->buf_len,
+                __entry->ret
         )
 );
 
@@ -158,6 +161,27 @@ TRACE_EVENT(ath10k_wmi_event,
         )
 );
 
+TRACE_EVENT(ath10k_htt_stats,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "len %zu",
+                __entry->buf_len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 68b6faefd1d8..5ae373a1e294 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -44,40 +44,39 @@ out:
         spin_unlock_bh(&ar->data_lock);
 }
 
-void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
+void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+                          const struct htt_tx_done *tx_done)
 {
         struct device *dev = htt->ar->dev;
         struct ieee80211_tx_info *info;
-        struct sk_buff *txfrag = ATH10K_SKB_CB(txdesc)->htt.txfrag;
-        struct sk_buff *msdu = ATH10K_SKB_CB(txdesc)->htt.msdu;
+        struct ath10k_skb_cb *skb_cb;
+        struct sk_buff *msdu;
         int ret;
 
-        if (ATH10K_SKB_CB(txdesc)->htt.refcount == 0)
-                return;
-
-        ATH10K_SKB_CB(txdesc)->htt.refcount--;
+        ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion msdu_id %u discard %d no_ack %d\n",
+                   tx_done->msdu_id, !!tx_done->discard, !!tx_done->no_ack);
 
-        if (ATH10K_SKB_CB(txdesc)->htt.refcount > 0)
+        if (tx_done->msdu_id >= htt->max_num_pending_tx) {
+                ath10k_warn("warning: msdu_id %d too big, ignoring\n",
+                            tx_done->msdu_id);
                 return;
-
-        if (txfrag) {
-                ret = ath10k_skb_unmap(dev, txfrag);
-                if (ret)
-                        ath10k_warn("txfrag unmap failed (%d)\n", ret);
-
-                dev_kfree_skb_any(txfrag);
         }
 
+        msdu = htt->pending_tx[tx_done->msdu_id];
+        skb_cb = ATH10K_SKB_CB(msdu);
+
         ret = ath10k_skb_unmap(dev, msdu);
         if (ret)
                 ath10k_warn("data skb unmap failed (%d)\n", ret);
 
+        if (skb_cb->htt.frag_len)
+                skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+
         ath10k_report_offchan_tx(htt->ar, msdu);
 
         info = IEEE80211_SKB_CB(msdu);
-        memset(&info->status, 0, sizeof(info->status));
 
-        if (ATH10K_SKB_CB(txdesc)->htt.discard) {
+        if (tx_done->discard) {
                 ieee80211_free_txskb(htt->ar->hw, msdu);
                 goto exit;
         }
@@ -85,7 +84,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                 info->flags |= IEEE80211_TX_STAT_ACK;
 
-        if (ATH10K_SKB_CB(txdesc)->htt.no_ack)
+        if (tx_done->no_ack)
                 info->flags &= ~IEEE80211_TX_STAT_ACK;
 
         ieee80211_tx_status(htt->ar->hw, msdu);
@@ -93,36 +92,12 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
 
 exit:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[ATH10K_SKB_CB(txdesc)->htt.msdu_id] = NULL;
-        ath10k_htt_tx_free_msdu_id(htt, ATH10K_SKB_CB(txdesc)->htt.msdu_id);
+        htt->pending_tx[tx_done->msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
         __ath10k_htt_tx_dec_pending(htt);
-        if (bitmap_empty(htt->used_msdu_ids, htt->max_num_pending_tx))
+        if (htt->num_pending_tx == 0)
                 wake_up(&htt->empty_tx_wq);
         spin_unlock_bh(&htt->tx_lock);
-
-        dev_kfree_skb_any(txdesc);
-}
-
-void ath10k_txrx_tx_completed(struct ath10k_htt *htt,
-                              const struct htt_tx_done *tx_done)
-{
-        struct sk_buff *txdesc;
-
-        ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion msdu_id %u discard %d no_ack %d\n",
-                   tx_done->msdu_id, !!tx_done->discard, !!tx_done->no_ack);
-
-        if (tx_done->msdu_id >= htt->max_num_pending_tx) {
-                ath10k_warn("warning: msdu_id %d too big, ignoring\n",
-                            tx_done->msdu_id);
-                return;
-        }
-
-        txdesc = htt->pending_tx[tx_done->msdu_id];
-
-        ATH10K_SKB_CB(txdesc)->htt.discard = tx_done->discard;
-        ATH10K_SKB_CB(txdesc)->htt.no_ack = tx_done->no_ack;
-
-        ath10k_txrx_tx_unref(htt, txdesc);
 }
 
 static const u8 rx_legacy_rate_idx[] = {
@@ -293,6 +268,8 @@ void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
                    status->vht_nss,
                    status->freq,
                    status->band);
+        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
+                        info->skb->data, info->skb->len);
 
         ieee80211_rx(ar->hw, info->skb);
 }
diff --git a/drivers/net/wireless/ath/ath10k/txrx.h b/drivers/net/wireless/ath/ath10k/txrx.h
index e78632a76df7..356dc9c04c9e 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.h
+++ b/drivers/net/wireless/ath/ath10k/txrx.h
@@ -19,9 +19,8 @@
 
 #include "htt.h"
 
-void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc);
-void ath10k_txrx_tx_completed(struct ath10k_htt *htt,
-                              const struct htt_tx_done *tx_done);
+void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+                          const struct htt_tx_done *tx_done);
 void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info);
 
 struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 55f90c761868..33cb19eb3d89 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -23,30 +23,6 @@
 #include "wmi.h"
 #include "mac.h"
 
-void ath10k_wmi_flush_tx(struct ath10k *ar)
-{
-        int ret;
-
-        lockdep_assert_held(&ar->conf_mutex);
-
-        if (ar->state == ATH10K_STATE_WEDGED) {
-                ath10k_warn("wmi flush skipped - device is wedged anyway\n");
-                return;
-        }
-
-        ret = wait_event_timeout(ar->wmi.wq,
-                                 atomic_read(&ar->wmi.pending_tx_count) == 0,
-                                 5*HZ);
-        if (atomic_read(&ar->wmi.pending_tx_count) == 0)
-                return;
-
-        if (ret == 0)
-                ret = -ETIMEDOUT;
-
-        if (ret < 0)
-                ath10k_warn("wmi flush failed (%d)\n", ret);
-}
-
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
         int ret;
@@ -85,18 +61,14 @@ static struct sk_buff *ath10k_wmi_alloc_skb(u32 len)
 static void ath10k_wmi_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         dev_kfree_skb(skb);
-
-        if (atomic_sub_return(1, &ar->wmi.pending_tx_count) == 0)
-                wake_up(&ar->wmi.wq);
 }
 
-/* WMI command API */
-static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
-                               enum wmi_cmd_id cmd_id)
+static int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                                      enum wmi_cmd_id cmd_id)
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
         struct wmi_cmd_hdr *cmd_hdr;
-        int status;
+        int ret;
         u32 cmd = 0;
 
         if (skb_push(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
@@ -107,25 +79,87 @@ static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         cmd_hdr->cmd_id = __cpu_to_le32(cmd);
 
-        if (atomic_add_return(1, &ar->wmi.pending_tx_count) >
-            WMI_MAX_PENDING_TX_COUNT) {
-                /* avoid using up memory when FW hangs */
-                atomic_dec(&ar->wmi.pending_tx_count);
-                return -EBUSY;
-        }
-
         memset(skb_cb, 0, sizeof(*skb_cb));
+        ret = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb);
+        trace_ath10k_wmi_cmd(cmd_id, skb->data, skb->len, ret);
 
-        trace_ath10k_wmi_cmd(cmd_id, skb->data, skb->len);
+        if (ret)
+                goto err_pull;
 
-        status = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb);
-        if (status) {
+        return 0;
+
+err_pull:
+        skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+        return ret;
+}
+
+static void ath10k_wmi_tx_beacon_nowait(struct ath10k_vif *arvif)
+{
+        struct wmi_bcn_tx_arg arg = {0};
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->data_lock);
+
+        if (arvif->beacon == NULL)
+                return;
+
+        arg.vdev_id = arvif->vdev_id;
+        arg.tx_rate = 0;
+        arg.tx_power = 0;
+        arg.bcn = arvif->beacon->data;
+        arg.bcn_len = arvif->beacon->len;
+
+        ret = ath10k_wmi_beacon_send_nowait(arvif->ar, &arg);
+        if (ret)
+                return;
+
+        dev_kfree_skb_any(arvif->beacon);
+        arvif->beacon = NULL;
+}
+
+static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
+        ath10k_wmi_tx_beacon_nowait(arvif);
+}
+
+static void ath10k_wmi_tx_beacons_nowait(struct ath10k *ar)
+{
+        spin_lock_bh(&ar->data_lock);
+        ieee80211_iterate_active_interfaces_atomic(ar->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   ath10k_wmi_tx_beacons_iter,
+                                                   NULL);
+        spin_unlock_bh(&ar->data_lock);
+}
+
+static void ath10k_wmi_op_ep_tx_credits(struct ath10k *ar)
+{
+        /* try to send pending beacons first. they take priority */
+        ath10k_wmi_tx_beacons_nowait(ar);
+
+        wake_up(&ar->wmi.tx_credits_wq);
+}
+
+static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
+                               enum wmi_cmd_id cmd_id)
+{
+        int ret = -EINVAL;
+
+        wait_event_timeout(ar->wmi.tx_credits_wq, ({
+                /* try to send pending beacons first. they take priority */
+                ath10k_wmi_tx_beacons_nowait(ar);
+
+                ret = ath10k_wmi_cmd_send_nowait(ar, skb, cmd_id);
+                (ret != -EAGAIN);
+        }), 3*HZ);
+
+        if (ret)
                 dev_kfree_skb_any(skb);
-                atomic_dec(&ar->wmi.pending_tx_count);
-                return status;
-        }
 
-        return 0;
+        return ret;
 }
 
 static int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
@@ -315,7 +349,9 @@ static inline u8 get_rate_idx(u32 rate, enum ieee80211_band band)
 
 static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_mgmt_rx_event *event = (struct wmi_mgmt_rx_event *)skb->data;
+        struct wmi_mgmt_rx_event_v1 *ev_v1;
+        struct wmi_mgmt_rx_event_v2 *ev_v2;
+        struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
         u32 rx_status;
@@ -325,13 +361,24 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         u32 rate;
         u32 buf_len;
         u16 fc;
+        int pull_len;
+
+        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
+                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
+                ev_hdr = &ev_v2->hdr.v1;
+                pull_len = sizeof(*ev_v2);
+        } else {
+                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
+                ev_hdr = &ev_v1->hdr;
+                pull_len = sizeof(*ev_v1);
+        }
 
-        channel   = __le32_to_cpu(event->hdr.channel);
-        buf_len   = __le32_to_cpu(event->hdr.buf_len);
-        rx_status = __le32_to_cpu(event->hdr.status);
-        snr       = __le32_to_cpu(event->hdr.snr);
-        phy_mode  = __le32_to_cpu(event->hdr.phy_mode);
-        rate      = __le32_to_cpu(event->hdr.rate);
+        channel   = __le32_to_cpu(ev_hdr->channel);
+        buf_len   = __le32_to_cpu(ev_hdr->buf_len);
+        rx_status = __le32_to_cpu(ev_hdr->status);
+        snr       = __le32_to_cpu(ev_hdr->snr);
+        phy_mode  = __le32_to_cpu(ev_hdr->phy_mode);
+        rate      = __le32_to_cpu(ev_hdr->rate);
 
         memset(status, 0, sizeof(*status));
 
@@ -358,7 +405,7 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
 
-        skb_pull(skb, sizeof(event->hdr));
+        skb_pull(skb, pull_len);
 
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
@@ -734,10 +781,8 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         int i = -1;
         struct wmi_bcn_info *bcn_info;
         struct ath10k_vif *arvif;
-        struct wmi_bcn_tx_arg arg;
         struct sk_buff *bcn;
         int vdev_id = 0;
-        int ret;
 
         ath10k_dbg(ATH10K_DBG_MGMT, "WMI_HOST_SWBA_EVENTID\n");
 
@@ -794,17 +839,17 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
                 ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
 
-                arg.vdev_id = arvif->vdev_id;
-                arg.tx_rate = 0;
-                arg.tx_power = 0;
-                arg.bcn = bcn->data;
-                arg.bcn_len = bcn->len;
+                spin_lock_bh(&ar->data_lock);
+                if (arvif->beacon) {
+                        ath10k_warn("SWBA overrun on vdev %d\n",
+                                    arvif->vdev_id);
+                        dev_kfree_skb_any(arvif->beacon);
+                }
 
-                ret = ath10k_wmi_beacon_send(ar, &arg);
-                if (ret)
-                        ath10k_warn("could not send beacon (%d)\n", ret);
+                arvif->beacon = bcn;
 
-                dev_kfree_skb_any(bcn);
+                ath10k_wmi_tx_beacon_nowait(arvif);
+                spin_unlock_bh(&ar->data_lock);
         }
 }
 
@@ -943,6 +988,9 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
         ar->phy_capability = __le32_to_cpu(ev->phy_capability);
         ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
 
+        if (ar->fw_version_build > 636)
+                set_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features);
+
         if (ar->num_rf_chains > WMI_MAX_SPATIAL_STREAM) {
                 ath10k_warn("hardware advertises support for more spatial streams than it should (%d > %d)\n",
                             ar->num_rf_chains, WMI_MAX_SPATIAL_STREAM);
@@ -1007,7 +1055,7 @@ static int ath10k_wmi_ready_event_rx(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
-static void ath10k_wmi_event_process(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
@@ -1126,64 +1174,18 @@ static void ath10k_wmi_event_process(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_event_work(struct work_struct *work)
-{
-        struct ath10k *ar = container_of(work, struct ath10k,
-                                         wmi.wmi_event_work);
-        struct sk_buff *skb;
-
-        for (;;) {
-                skb = skb_dequeue(&ar->wmi.wmi_event_list);
-                if (!skb)
-                        break;
-
-                ath10k_wmi_event_process(ar, skb);
-        }
-}
-
-static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
-{
-        struct wmi_cmd_hdr *cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
-        enum wmi_event_id event_id;
-
-        event_id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
-
-        /* some events require to be handled ASAP
-         * thus can't be defered to a worker thread */
-        switch (event_id) {
-        case WMI_HOST_SWBA_EVENTID:
-        case WMI_MGMT_RX_EVENTID:
-                ath10k_wmi_event_process(ar, skb);
-                return;
-        default:
-                break;
-        }
-
-        skb_queue_tail(&ar->wmi.wmi_event_list, skb);
-        queue_work(ar->workqueue, &ar->wmi.wmi_event_work);
-}
-
 /* WMI Initialization functions */
 int ath10k_wmi_attach(struct ath10k *ar)
 {
         init_completion(&ar->wmi.service_ready);
         init_completion(&ar->wmi.unified_ready);
-        init_waitqueue_head(&ar->wmi.wq);
-
-        skb_queue_head_init(&ar->wmi.wmi_event_list);
-        INIT_WORK(&ar->wmi.wmi_event_work, ath10k_wmi_event_work);
+        init_waitqueue_head(&ar->wmi.tx_credits_wq);
 
         return 0;
 }
 
 void ath10k_wmi_detach(struct ath10k *ar)
 {
-        /* HTC should've drained the packets already */
-        if (WARN_ON(atomic_read(&ar->wmi.pending_tx_count) > 0))
-                ath10k_warn("there are still pending packets\n");
-
-        cancel_work_sync(&ar->wmi.wmi_event_work);
-        skb_queue_purge(&ar->wmi.wmi_event_list);
 }
 
 int ath10k_wmi_connect_htc_service(struct ath10k *ar)
@@ -1198,6 +1200,7 @@ int ath10k_wmi_connect_htc_service(struct ath10k *ar)
         /* these fields are the same for all service endpoints */
         conn_req.ep_ops.ep_tx_complete = ath10k_wmi_htc_tx_complete;
         conn_req.ep_ops.ep_rx_complete = ath10k_wmi_process_rx;
+        conn_req.ep_ops.ep_tx_credits = ath10k_wmi_op_ep_tx_credits;
 
         /* connect to control service */
         conn_req.service_id = ATH10K_HTC_SVC_ID_WMI_CONTROL;
@@ -1758,7 +1761,7 @@ int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
         cmd = (struct wmi_vdev_up_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(vdev_id);
         cmd->vdev_assoc_id = __cpu_to_le32(aid);
-        memcpy(&cmd->vdev_bssid.addr, bssid, 6);
+        memcpy(&cmd->vdev_bssid.addr, bssid, ETH_ALEN);
 
         ath10k_dbg(ATH10K_DBG_WMI,
                    "wmi mgmt vdev up id 0x%x assoc id %d bssid %pM\n",
@@ -1918,7 +1921,7 @@ int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
         cmd->param_id    = __cpu_to_le32(param_id);
         cmd->param_value = __cpu_to_le32(param_value);
-        memcpy(&cmd->peer_macaddr.addr, peer_addr, 6);
+        memcpy(&cmd->peer_macaddr.addr, peer_addr, ETH_ALEN);
 
         ath10k_dbg(ATH10K_DBG_WMI,
                    "wmi vdev %d peer 0x%pM set param %d value %d\n",
@@ -2108,7 +2111,8 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
         return ath10k_wmi_cmd_send(ar, skb, WMI_PEER_ASSOC_CMDID);
 }
 
-int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg)
+int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
+                                  const struct wmi_bcn_tx_arg *arg)
 {
         struct wmi_bcn_tx_cmd *cmd;
         struct sk_buff *skb;
@@ -2124,7 +2128,7 @@ int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg)
         cmd->hdr.bcn_len  = __cpu_to_le32(arg->bcn_len);
         memcpy(cmd->bcn, arg->bcn, arg->bcn_len);
 
-        return ath10k_wmi_cmd_send(ar, skb, WMI_BCN_TX_CMDID);
+        return ath10k_wmi_cmd_send_nowait(ar, skb, WMI_BCN_TX_CMDID);
 }
 
 static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 2c5a4f8daf2e..2c52c23107dd 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -508,6 +508,48 @@ enum wmi_phy_mode {
         MODE_MAX        = 14
 };
 
+static inline const char *ath10k_wmi_phymode_str(enum wmi_phy_mode mode)
+{
+        switch (mode) {
+        case MODE_11A:
+                return "11a";
+        case MODE_11G:
+                return "11g";
+        case MODE_11B:
+                return "11b";
+        case MODE_11GONLY:
+                return "11gonly";
+        case MODE_11NA_HT20:
+                return "11na-ht20";
+        case MODE_11NG_HT20:
+                return "11ng-ht20";
+        case MODE_11NA_HT40:
+                return "11na-ht40";
+        case MODE_11NG_HT40:
+                return "11ng-ht40";
+        case MODE_11AC_VHT20:
+                return "11ac-vht20";
+        case MODE_11AC_VHT40:
+                return "11ac-vht40";
+        case MODE_11AC_VHT80:
+                return "11ac-vht80";
+        case MODE_11AC_VHT20_2G:
+                return "11ac-vht20-2g";
+        case MODE_11AC_VHT40_2G:
+                return "11ac-vht40-2g";
+        case MODE_11AC_VHT80_2G:
+                return "11ac-vht80-2g";
+        case MODE_UNKNOWN:
+                /* skip */
+                break;
+
+                /* no default handler to allow compiler to check that the
+                 * enum is fully handled */
+        };
+
+        return "<unknown>";
+}
+
 #define WMI_CHAN_LIST_TAG       0x1
 #define WMI_SSID_LIST_TAG       0x2
 #define WMI_BSSID_LIST_TAG      0x3
@@ -763,14 +805,6 @@ struct wmi_service_ready_event {
         struct wlan_host_mem_req mem_reqs[1];
 } __packed;
 
-/*
- * status consists of  upper 16 bits fo int status and lower 16 bits of
- * module ID that retuned status
- */
-#define WLAN_INIT_STATUS_SUCCESS   0x0
-#define WLAN_GET_INIT_STATUS_REASON(status)    ((status) & 0xffff)
-#define WLAN_GET_INIT_STATUS_MODULE_ID(status) (((status) >> 16) & 0xffff)
-
 #define WMI_SERVICE_READY_TIMEOUT_HZ (5*HZ)
 #define WMI_UNIFIED_READY_TIMEOUT_HZ (5*HZ)
 
@@ -1268,7 +1302,7 @@ struct wmi_scan_event {
  * good idea to pass all the fields in the RX status
  * descriptor up to the host.
  */
-struct wmi_mgmt_rx_hdr {
+struct wmi_mgmt_rx_hdr_v1 {
         __le32 channel;
         __le32 snr;
         __le32 rate;
@@ -1277,8 +1311,18 @@ struct wmi_mgmt_rx_hdr {
         __le32 status; /* %WMI_RX_STATUS_ */
 } __packed;
 
-struct wmi_mgmt_rx_event {
-        struct wmi_mgmt_rx_hdr hdr;
+struct wmi_mgmt_rx_hdr_v2 {
+        struct wmi_mgmt_rx_hdr_v1 v1;
+        __le32 rssi_ctl[4];
+} __packed;
+
+struct wmi_mgmt_rx_event_v1 {
+        struct wmi_mgmt_rx_hdr_v1 hdr;
+        u8 buf[0];
+} __packed;
+
+struct wmi_mgmt_rx_event_v2 {
+        struct wmi_mgmt_rx_hdr_v2 hdr;
         u8 buf[0];
 } __packed;
 
@@ -3000,7 +3044,6 @@ struct wmi_force_fw_hang_cmd {
 
 #define WMI_MAX_EVENT 0x1000
 /* Maximum number of pending TXed WMI packets */
-#define WMI_MAX_PENDING_TX_COUNT 128
 #define WMI_SKB_HEADROOM sizeof(struct wmi_cmd_hdr)
 
 /* By default disable power save for IBSS */
@@ -3013,7 +3056,6 @@ int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
-void ath10k_wmi_flush_tx(struct ath10k *ar);
 
 int ath10k_wmi_connect_htc_service(struct ath10k *ar);
 int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
@@ -3066,7 +3108,8 @@ int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
                                enum wmi_ap_ps_peer_param param_id, u32 value);
 int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                               const struct wmi_scan_chan_list_arg *arg);
-int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg);
+int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
+                                  const struct wmi_bcn_tx_arg *arg);
 int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
                         const struct wmi_pdev_set_wmm_params_arg *arg);
 int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index e9bc9e616b69..79bffe165cab 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -37,12 +37,9 @@ ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
         struct ath5k_hw *ah = common->priv;
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         u16 *eeprom, *eeprom_end;
 
-
-
-        bcfg = pdev->dev.platform_data;
         eeprom = (u16 *) bcfg->radio;
         eeprom_end = ((void *) bcfg->config) + BOARD_CONFIG_BUFSZ;
 
@@ -57,7 +54,7 @@ ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 int ath5k_hw_read_srev(struct ath5k_hw *ah)
 {
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         ah->ah_mac_srev = bcfg->devid;
         return 0;
 }
@@ -65,7 +62,7 @@ int ath5k_hw_read_srev(struct ath5k_hw *ah)
 static int ath5k_ahb_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
 {
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         u8 *cfg_mac;
 
         if (to_platform_device(ah->dev)->id == 0)
@@ -87,7 +84,7 @@ static const struct ath_bus_ops ath_ahb_bus_ops = {
 /*Initialization*/
 static int ath_ahb_probe(struct platform_device *pdev)
 {
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         struct ath5k_hw *ah;
         struct ieee80211_hw *hw;
         struct resource *res;
@@ -96,7 +93,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         int ret = 0;
         u32 reg;
 
-        if (!pdev->dev.platform_data) {
+        if (!dev_get_platdata(&pdev->dev)) {
                 dev_err(&pdev->dev, "no platform data specified\n");
                 ret = -EINVAL;
                 goto err_out;
@@ -193,7 +190,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
 static int ath_ahb_remove(struct platform_device *pdev)
 {
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         struct ieee80211_hw *hw = platform_get_drvdata(pdev);
         struct ath5k_hw *ah;
         u32 reg;
diff --git a/drivers/net/wireless/ath/ath6kl/common.h b/drivers/net/wireless/ath/ath6kl/common.h
index 98a886154d9c..05debf700a84 100644
--- a/drivers/net/wireless/ath/ath6kl/common.h
+++ b/drivers/net/wireless/ath/ath6kl/common.h
@@ -22,8 +22,7 @@
 
 #define ATH6KL_MAX_IE                   256
 
-extern __printf(2, 3)
-int ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
 
 /*
  * Reflects the version of binary interface exposed by ATH6KL target
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index 74369de00fb5..ca9ba005f287 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -50,11 +50,10 @@ enum ATH6K_DEBUG_MASK {
 };
 
 extern unsigned int debug_mask;
-extern __printf(2, 3)
-int ath6kl_printk(const char *level, const char *fmt, ...);
-extern __printf(1, 2) int ath6kl_info(const char *fmt, ...);
-extern __printf(1, 2) int ath6kl_err(const char *fmt, ...);
-extern __printf(1, 2) int ath6kl_warn(const char *fmt, ...);
+__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(1, 2) int ath6kl_info(const char *fmt, ...);
+__printf(1, 2) int ath6kl_err(const char *fmt, ...);
+__printf(1, 2) int ath6kl_warn(const char *fmt, ...);
 
 enum ath6kl_war {
         ATH6KL_WAR_INVALID_RATE,
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 072e4b531067..2dff2765769b 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -54,7 +54,7 @@ static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
         struct platform_device *pdev = to_platform_device(sc->dev);
         struct ath9k_platform_data *pdata;
 
-        pdata = (struct ath9k_platform_data *) pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
                 ath_err(common,
                         "%s: flash read failed, offset %08x is out of range\n",
@@ -84,7 +84,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         struct ath_hw *ah;
         char hw_name[64];
 
-        if (!pdev->dev.platform_data) {
+        if (!dev_get_platdata(&pdev->dev)) {
                 dev_err(&pdev->dev, "no platform data specified\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index be466b0ef7a7..d28923b7435b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -338,10 +338,9 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
                     aniState->cckNoiseImmunityLevel !=
                     ATH9K_ANI_CCK_DEF_LEVEL) {
                         ath_dbg(common, ANI,
-                                "Restore defaults: opmode %u chan %d Mhz/0x%x is_scanning=%d ofdm:%d cck:%d\n",
+                                "Restore defaults: opmode %u chan %d Mhz is_scanning=%d ofdm:%d cck:%d\n",
                                 ah->opmode,
                                 chan->channel,
-                                chan->channelFlags,
                                 is_scanning,
                                 aniState->ofdmNoiseImmunityLevel,
                                 aniState->cckNoiseImmunityLevel);
@@ -354,10 +353,9 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
                  * restore historical levels for this channel
                  */
                 ath_dbg(common, ANI,
-                        "Restore history: opmode %u chan %d Mhz/0x%x is_scanning=%d ofdm:%d cck:%d\n",
+                        "Restore history: opmode %u chan %d Mhz is_scanning=%d ofdm:%d cck:%d\n",
                         ah->opmode,
                         chan->channel,
-                        chan->channelFlags,
                         is_scanning,
                         aniState->ofdmNoiseImmunityLevel,
                         aniState->cckNoiseImmunityLevel);
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
index dd1cc73d7946..bd048cc69a33 100644
--- a/drivers/net/wireless/ath/ath9k/antenna.c
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -332,7 +332,7 @@ static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
                 }
 
                 if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
-                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
+                    div_ant_conf->lna1_lna2_switch_delta)
                         div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
                 else
                         div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
@@ -554,42 +554,22 @@ static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf,
                         ant_conf->fast_div_bias = 0x1;
                         break;
                 case 0x10: /* LNA2 A-B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x1;
-                        }
+                        ant_conf->fast_div_bias = 0x2;
                         break;
                 case 0x12: /* LNA2 LNA1 */
-                        ant_conf->fast_div_bias = 0x39;
+                        ant_conf->fast_div_bias = 0x3f;
                         break;
                 case 0x13: /* LNA2 A+B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x1;
-                        }
+                        ant_conf->fast_div_bias = 0x2;
                         break;
                 case 0x20: /* LNA1 A-B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x4;
-                        }
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x21: /* LNA1 LNA2 */
-                        ant_conf->fast_div_bias = 0x6;
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x23: /* LNA1 A+B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x6;
-                        }
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x30: /* A+B A-B */
                         ant_conf->fast_div_bias = 0x1;
@@ -638,7 +618,7 @@ static void ath_ant_try_scan(struct ath_ant_comb *antcomb,
                 antcomb->rssi_sub = alt_rssi_avg;
                 antcomb->scan = false;
                 if (antcomb->rssi_lna2 >
-                    (antcomb->rssi_lna1 + ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
+                    (antcomb->rssi_lna1 + conf->lna1_lna2_switch_delta)) {
                         /* use LNA2 as main LNA */
                         if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
                             (antcomb->rssi_add > antcomb->rssi_sub)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 08656473c63e..ff415e863ee9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -626,12 +626,11 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
                 if (AR_SREV_9287_11_OR_LATER(ah))
                         val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
 
+                val |= AR_PCU_MISC_MODE2_CFP_IGNORE;
+
                 REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
         }
 
-        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
-                    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
-
         if (AR_SREV_9280_20_OR_LATER(ah))
                 return;
         /*
@@ -667,14 +666,13 @@ static void ar5008_hw_set_channel_regs(struct ath_hw *ah,
         if (IS_CHAN_HT40(chan)) {
                 phymode |= AR_PHY_FC_DYN2040_EN;
 
-                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                if (IS_CHAN_HT40PLUS(chan))
                         phymode |= AR_PHY_FC_DYN2040_PRI_CH;
 
         }
         REG_WRITE(ah, AR_PHY_TURBO, phymode);
 
-        ath9k_hw_set11nmac2040(ah);
+        ath9k_hw_set11nmac2040(ah, chan);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
@@ -692,31 +690,12 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         int i, regWrites = 0;
         u32 modesIndex, freqIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                freqIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
+        if (IS_CHAN_5GHZ(chan)) {
                 freqIndex = 1;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                freqIndex = 2;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        } else {
                 freqIndex = 2;
-                break;
-
-        default:
-                return -EINVAL;
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
         }
 
         /*
@@ -815,8 +794,10 @@ static void ar5008_hw_set_rfmode(struct ath_hw *ah, struct ath9k_channel *chan)
         if (chan == NULL)
                 return;
 
-        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
-                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+        if (IS_CHAN_2GHZ(chan))
+                rfMode |= AR_PHY_MODE_DYNAMIC;
+        else
+                rfMode |= AR_PHY_MODE_OFDM;
 
         if (!AR_SREV_9280_20_OR_LATER(ah))
                 rfMode |= (IS_CHAN_5GHZ(chan)) ?
@@ -1219,12 +1200,11 @@ static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
 
         iniDef = &aniState->iniDef;
 
-        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz\n",
                 ah->hw_version.macVersion,
                 ah->hw_version.macRev,
                 ah->opmode,
-                chan->channel,
-                chan->channelFlags);
+                chan->channel);
 
         val = REG_READ(ah, AR_PHY_SFCORR);
         iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 9f589744a9f9..cdc74005650c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -33,15 +33,12 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
         bool supported = false;
         switch (ah->supp_cals & cal_type) {
         case IQ_MISMATCH_CAL:
-                /* Run IQ Mismatch for non-CCK only */
-                if (!IS_CHAN_B(chan))
-                        supported = true;
+                supported = true;
                 break;
         case ADC_GAIN_CAL:
         case ADC_DC_CAL:
                 /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
-                if (!IS_CHAN_B(chan) &&
-                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                if (!((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
                       IS_CHAN_HT20(chan)))
                         supported = true;
                 break;
@@ -671,7 +668,7 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 
         nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
         if (ah->caldata)
-                nfcal_pending = ah->caldata->nfcal_pending;
+                nfcal_pending = test_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         if (currCal && !nfcal &&
             (currCal->calState == CAL_RUNNING ||
@@ -861,7 +858,7 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         ar9002_hw_pa_cal(ah, true);
 
         if (ah->caldata)
-                ah->caldata->nfcal_pending = true;
+                set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index fb61b081d172..5c95fd9e9c9e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -419,28 +419,10 @@ void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan)
         u32 modesIndex;
         int i;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         ENABLE_REGWRITE_BUFFER(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index 1fc1fa955d44..17970d49d858 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -485,7 +485,7 @@ static void ar9002_hw_do_getnf(struct ath_hw *ah,
         if (IS_CHAN_HT40(ah->curchan))
                 nfarray[3] = sign_extend32(nf, 8);
 
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+        if (!(ah->rxchainmask & BIT(1)))
                 return;
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_CCA), AR9280_PHY_CH1_MINCCA_PWR);
@@ -532,6 +532,7 @@ static void ar9002_hw_antdiv_comb_conf_get(struct ath_hw *ah,
                                  AR_PHY_9285_ANT_DIV_ALT_LNACONF_S;
         antconf->fast_div_bias = (regval & AR_PHY_9285_FAST_DIV_BIAS) >>
                                   AR_PHY_9285_FAST_DIV_BIAS_S;
+        antconf->lna1_lna2_switch_delta = -1;
         antconf->lna1_lna2_delta = -3;
         antconf->div_group = 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 6988e1d081f2..22934d3ca544 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -727,8 +727,12 @@ static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
         REG_RMW_FIELD(ah, AR_PHY_RX_IQCAL_CORR_B0,
                       AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN, 0x1);
 
-        if (caldata)
-                caldata->done_txiqcal_once = is_reusable;
+        if (caldata) {
+                if (is_reusable)
+                        set_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                else
+                        clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+        }
 
         return;
 }
@@ -961,18 +965,44 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
 }
 
 static void ar9003_hw_do_manual_peak_cal(struct ath_hw *ah,
-                                         struct ath9k_channel *chan)
+                                         struct ath9k_channel *chan,
+                                         bool run_rtt_cal)
 {
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         int i;
 
         if (!AR_SREV_9462(ah) && !AR_SREV_9565(ah) && !AR_SREV_9485(ah))
                 return;
 
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_RTT) && !run_rtt_cal)
+                return;
+
         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                 if (!(ah->rxchainmask & (1 << i)))
                         continue;
                 ar9003_hw_manual_peak_cal(ah, i, IS_CHAN_2GHZ(chan));
         }
+
+        if (caldata)
+                set_bit(SW_PKDET_DONE, &caldata->cal_flags);
+
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_RTT) && caldata) {
+                if (IS_CHAN_2GHZ(chan)){
+                        caldata->caldac[0] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(0),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR);
+                        caldata->caldac[1] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(1),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR);
+                } else {
+                        caldata->caldac[0] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(0),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR);
+                        caldata->caldac[1] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(1),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR);
+                }
+        }
 }
 
 static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
@@ -990,7 +1020,7 @@ static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
         txclcal_done = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) &
                           AR_PHY_AGC_CONTROL_CLC_SUCCESS);
 
-        if (caldata->done_txclcal_once) {
+        if (test_bit(TXCLCAL_DONE, &caldata->cal_flags)) {
                 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                         if (!(ah->txchainmask & (1 << i)))
                                 continue;
@@ -1006,7 +1036,7 @@ static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
                                 caldata->tx_clcal[i][j] =
                                         REG_READ(ah, CL_TAB_ENTRY(cl_idx[i]));
                 }
-                caldata->done_txclcal_once = true;
+                set_bit(TXCLCAL_DONE, &caldata->cal_flags);
         }
 }
 
@@ -1019,6 +1049,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         bool is_reusable = true, status = true;
         bool run_rtt_cal = false, run_agc_cal, sep_iq_cal = false;
         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
+        u32 rx_delay = 0;
         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
@@ -1042,17 +1073,22 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                 ar9003_hw_rtt_clear_hist(ah);
         }
 
-        if (rtt && !run_rtt_cal) {
-                agc_ctrl = REG_READ(ah, AR_PHY_AGC_CONTROL);
-                agc_supp_cals &= agc_ctrl;
-                agc_ctrl &= ~(AR_PHY_AGC_CONTROL_OFFSET_CAL |
-                             AR_PHY_AGC_CONTROL_FLTR_CAL |
-                             AR_PHY_AGC_CONTROL_PKDET_CAL);
-                REG_WRITE(ah, AR_PHY_AGC_CONTROL, agc_ctrl);
+        if (rtt) {
+                if (!run_rtt_cal) {
+                        agc_ctrl = REG_READ(ah, AR_PHY_AGC_CONTROL);
+                        agc_supp_cals &= agc_ctrl;
+                        agc_ctrl &= ~(AR_PHY_AGC_CONTROL_OFFSET_CAL |
+                                      AR_PHY_AGC_CONTROL_FLTR_CAL |
+                                      AR_PHY_AGC_CONTROL_PKDET_CAL);
+                        REG_WRITE(ah, AR_PHY_AGC_CONTROL, agc_ctrl);
+                } else {
+                        if (ah->ah_flags & AH_FASTCC)
+                                run_agc_cal = true;
+                }
         }
 
         if (ah->enabled_cals & TX_CL_CAL) {
-                if (caldata && caldata->done_txclcal_once)
+                if (caldata && test_bit(TXCLCAL_DONE, &caldata->cal_flags))
                         REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL,
                                     AR_PHY_CL_CAL_ENABLE);
                 else {
@@ -1076,14 +1112,14 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
          * AGC calibration
          */
         if (ah->enabled_cals & TX_IQ_ON_AGC_CAL) {
-                if (caldata && !caldata->done_txiqcal_once)
+                if (caldata && !test_bit(TXIQCAL_DONE, &caldata->cal_flags))
                         REG_SET_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 else
                         REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 txiqcal_done = run_agc_cal = true;
-        } else if (caldata && !caldata->done_txiqcal_once) {
+        } else if (caldata && !test_bit(TXIQCAL_DONE, &caldata->cal_flags)) {
                 run_agc_cal = true;
                 sep_iq_cal = true;
         }
@@ -1099,6 +1135,15 @@ skip_tx_iqcal:
                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
         }
 
+        if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
+                rx_delay = REG_READ(ah, AR_PHY_RX_DELAY);
+                /* Disable BB_active */
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+                udelay(5);
+                REG_WRITE(ah, AR_PHY_RX_DELAY, AR_PHY_RX_DELAY_DELAY);
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+        }
+
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
                 /* Calibrate the AGC */
                 REG_WRITE(ah, AR_PHY_AGC_CONTROL,
@@ -1110,7 +1155,12 @@ skip_tx_iqcal:
                                        AR_PHY_AGC_CONTROL_CAL,
                                        0, AH_WAIT_TIMEOUT);
 
-                ar9003_hw_do_manual_peak_cal(ah, chan);
+                ar9003_hw_do_manual_peak_cal(ah, chan, run_rtt_cal);
+        }
+
+        if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
+                REG_WRITE(ah, AR_PHY_RX_DELAY, rx_delay);
+                udelay(5);
         }
 
         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
@@ -1133,19 +1183,23 @@ skip_tx_iqcal:
 
         if (txiqcal_done)
                 ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
-        else if (caldata && caldata->done_txiqcal_once)
+        else if (caldata && test_bit(TXIQCAL_DONE, &caldata->cal_flags))
                 ar9003_hw_tx_iq_cal_reload(ah);
 
         ar9003_hw_cl_cal_post_proc(ah, is_reusable);
 
         if (run_rtt_cal && caldata) {
                 if (is_reusable) {
-                        if (!ath9k_hw_rfbus_req(ah))
+                        if (!ath9k_hw_rfbus_req(ah)) {
                                 ath_err(ath9k_hw_common(ah),
                                         "Could not stop baseband\n");
-                        else
+                        } else {
                                 ar9003_hw_rtt_fill_hist(ah);
 
+                                if (test_bit(SW_PKDET_DONE, &caldata->cal_flags))
+                                        ar9003_hw_rtt_load_hist(ah);
+                        }
+
                         ath9k_hw_rfbus_done(ah);
                 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index f4864807e15b..1ec52356b5a1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -2991,7 +2991,10 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
         case EEP_CHAIN_MASK_REDUCE:
                 return (pBase->miscConfiguration >> 0x3) & 0x1;
         case EEP_ANT_DIV_CTL1:
-                return eep->base_ext1.ant_div_control;
+                if (AR_SREV_9565(ah))
+                        return AR9300_EEP_ANTDIV_CONTROL_DEFAULT_VALUE;
+                else
+                        return eep->base_ext1.ant_div_control;
         case EEP_ANTENNA_GAIN_5G:
                 return eep->modalHeader5G.antennaGain;
         case EEP_ANTENNA_GAIN_2G:
@@ -3424,12 +3427,12 @@ static u32 ath9k_hw_ar9003_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct ar9300_base_eep_hdr *pBase;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader2G);
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "5GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "5GHz modal Header");
                 len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader5G);
                 goto out;
@@ -3479,8 +3482,8 @@ static u32 ath9k_hw_ar9003_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Rx Gain", pBase->txrxgain & 0xf);
         PR_EEP("SW Reg", le32_to_cpu(pBase->swreg));
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        ah->eeprom.ar9300_eep.macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         ah->eeprom.ar9300_eep.macAddr);
 out:
         if (len > size)
                 len = size;
@@ -3656,9 +3659,23 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
                 if (AR_SREV_9565(ah)) {
                         if (common->bt_ant_diversity) {
                                 regval |= (1 << AR_PHY_ANT_SW_RX_PROT_S);
+
+                                REG_SET_BIT(ah, AR_PHY_RESTART,
+                                            AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
+
+                                /* Force WLAN LNA diversity ON */
+                                REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
+                                            AR_BTCOEX_WL_LNADIV_FORCE_ON);
                         } else {
                                 regval &= ~(1 << AR_PHY_ANT_DIV_LNADIV_S);
                                 regval &= ~(1 << AR_PHY_ANT_SW_RX_PROT_S);
+
+                                REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                            (1 << AR_PHY_ANT_SW_RX_PROT_S));
+
+                                /* Force WLAN LNA diversity OFF */
+                                REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
+                                            AR_BTCOEX_WL_LNADIV_FORCE_ON);
                         }
                 }
 
@@ -3669,7 +3686,8 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
                 regval &= (~AR_FAST_DIV_ENABLE);
                 regval |= ((value >> 7) & 0x1) << AR_FAST_DIV_ENABLE_S;
 
-                if (AR_SREV_9485(ah) && common->bt_ant_diversity)
+                if ((AR_SREV_9485(ah) || AR_SREV_9565(ah))
+                    && common->bt_ant_diversity)
                         regval |= AR_FAST_DIV_ENABLE;
 
                 REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 75d4fb41962f..0e5daa58a4fc 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -52,6 +52,8 @@
 #define AR9300_PAPRD_SCALE_2            0x70000000
 #define AR9300_PAPRD_SCALE_2_S          28
 
+#define AR9300_EEP_ANTDIV_CONTROL_DEFAULT_VALUE 0xc9
+
 /* Delta from which to start power to pdadc table */
 /* This offset is used in both open loop and closed loop power control
  * schemes. In open loop power control, it is not really needed, but for
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 608bb4824e2a..b07f164d65cf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -364,6 +364,8 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                 ar9565_1p0_modes_fast_clock);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9565_1p0_baseband_core_txfir_coeff_japan_2484);
         } else {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -628,6 +630,9 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9462_common_rx_gain_table_2p0);
+        else if (AR_SREV_9565(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9565_1p0_Common_rx_gain_table);
         else
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9300Common_rx_gain_table_2p2);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.c b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
index 8dd069259e7b..7b94a6c7db3d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
@@ -753,9 +753,9 @@ int ar9003_mci_end_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                     1 << AR_PHY_TIMING_CONTROL4_DO_GAIN_DC_IQ_CAL_SHIFT);
 
         if (caldata) {
-                caldata->done_txiqcal_once = false;
-                caldata->done_txclcal_once = false;
-                caldata->rtt_done = false;
+                clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                clear_bit(TXCLCAL_DONE, &caldata->cal_flags);
+                clear_bit(RTT_DONE, &caldata->cal_flags);
         }
 
         if (!ath9k_hw_init_cal(ah, chan))
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index e897648d3233..f3adafd33704 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -551,8 +551,7 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
         if (IS_CHAN_HT40(chan)) {
                 phymode |= AR_PHY_GC_DYN2040_EN;
                 /* Configure control (primary) channel at +-10MHz */
-                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                if (IS_CHAN_HT40PLUS(chan))
                         phymode |= AR_PHY_GC_DYN2040_PRI_CH;
 
         }
@@ -565,7 +564,7 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_GEN_CTRL, phymode);
 
         /* Configure MAC for 20/40 operation */
-        ath9k_hw_set11nmac2040(ah);
+        ath9k_hw_set11nmac2040(ah, chan);
 
         /* global transmit timeout (25 TUs default)*/
         REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
@@ -627,11 +626,10 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
          * MAC addr only will fail.
          */
         val = REG_READ(ah, AR_PCU_MISC_MODE2) & (~AR_ADHOC_MCAST_KEYID_ENABLE);
-        REG_WRITE(ah, AR_PCU_MISC_MODE2,
-                  val | AR_AGG_WEP_ENABLE_FIX | AR_AGG_WEP_ENABLE);
-
-        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
-                    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+        val |= AR_AGG_WEP_ENABLE_FIX |
+               AR_AGG_WEP_ENABLE |
+               AR_PCU_MISC_MODE2_CFP_IGNORE;
+        REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
 
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_WRITE(ah, AR_GLB_SWREG_DISCONT_MODE,
@@ -683,41 +681,22 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
 {
         int ret;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                if (chan->channel <= 5350)
-                        ret = 1;
-                else if ((chan->channel > 5350) && (chan->channel <= 5600))
-                        ret = 3;
+        if (IS_CHAN_2GHZ(chan)) {
+                if (IS_CHAN_HT40(chan))
+                        return 7;
                 else
-                        ret = 5;
-                break;
-
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                if (chan->channel <= 5350)
-                        ret = 2;
-                else if ((chan->channel > 5350) && (chan->channel <= 5600))
-                        ret = 4;
-                else
-                        ret = 6;
-                break;
-
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                ret = 8;
-                break;
+                        return 8;
+        }
 
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                ret = 7;
-                break;
+        if (chan->channel <= 5350)
+                ret = 1;
+        else if ((chan->channel > 5350) && (chan->channel <= 5600))
+                ret = 3;
+        else
+                ret = 5;
 
-        default:
-                ret = -EINVAL;
-        }
+        if (IS_CHAN_HT40(chan))
+                ret++;
 
         return ret;
 }
@@ -728,28 +707,10 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         unsigned int regWrites = 0, i;
         u32 modesIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return -EINVAL;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         /*
          * SOC, MAC, BB, RADIO initvals.
@@ -847,8 +808,10 @@ static void ar9003_hw_set_rfmode(struct ath_hw *ah,
         if (chan == NULL)
                 return;
 
-        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
-                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+        if (IS_CHAN_2GHZ(chan))
+                rfMode |= AR_PHY_MODE_DYNAMIC;
+        else
+                rfMode |= AR_PHY_MODE_OFDM;
 
         if (IS_CHAN_A_FAST_CLOCK(ah, chan))
                 rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
@@ -1274,12 +1237,11 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         aniState = &ah->ani;
         iniDef = &aniState->iniDef;
 
-        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz\n",
                 ah->hw_version.macVersion,
                 ah->hw_version.macRev,
                 ah->opmode,
-                chan->channel,
-                chan->channelFlags);
+                chan->channel);
 
         val = REG_READ(ah, AR_PHY_SFCORR);
         iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
@@ -1375,15 +1337,19 @@ static void ar9003_hw_antdiv_comb_conf_get(struct ath_hw *ah,
                                   AR_PHY_ANT_FAST_DIV_BIAS_S;
 
         if (AR_SREV_9330_11(ah)) {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 1;
         } else if (AR_SREV_9485(ah)) {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 2;
         } else if (AR_SREV_9565(ah)) {
-                antconf->lna1_lna2_delta = -3;
+                antconf->lna1_lna2_switch_delta = 3;
+                antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 3;
         } else {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -3;
                 antconf->div_group = 0;
         }
@@ -1489,17 +1455,24 @@ static void ar9003_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
         } else if (AR_SREV_9565(ah)) {
                 if (enable) {
                         REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                    AR_ANT_DIV_ENABLE);
+                        REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
                                     (1 << AR_PHY_ANT_SW_RX_PROT_S));
-                        if (ah->curchan && IS_CHAN_2GHZ(ah->curchan))
-                                REG_SET_BIT(ah, AR_PHY_RESTART,
-                                            AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
+                        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
+                                    AR_FAST_DIV_ENABLE);
+                        REG_SET_BIT(ah, AR_PHY_RESTART,
+                                    AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
                         REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
                                     AR_BTCOEX_WL_LNADIV_FORCE_ON);
                 } else {
-                        REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                    AR_ANT_DIV_ENABLE);
                         REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
                                     (1 << AR_PHY_ANT_SW_RX_PROT_S));
-                        REG_CLR_BIT(ah, AR_PHY_CCK_DETECT, AR_FAST_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_CCK_DETECT,
+                                    AR_FAST_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_RESTART,
+                                    AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
                         REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
                                     AR_BTCOEX_WL_LNADIV_FORCE_ON);
 
@@ -1526,28 +1499,10 @@ static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
         unsigned int regWrites = 0;
         u32 modesIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return -EINVAL;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         if (modesIndex == ah->modes_index) {
                 *ini_reloaded = false;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 6fd752321e36..fca624322dc8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -343,8 +343,12 @@
 
 #define AR_PHY_CCA_NOM_VAL_9462_2GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_2GHZ     -127
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_2GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ -95
 #define AR_PHY_CCA_NOM_VAL_9462_5GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_5GHZ     -127
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_5GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ -100
 
 #define AR_PHY_CCA_NOM_VAL_9330_2GHZ          -118
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_rtt.c b/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
index 74de3539c2c8..934418872e8e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
@@ -118,6 +118,27 @@ void ar9003_hw_rtt_load_hist(struct ath_hw *ah)
         }
 }
 
+static void ar9003_hw_patch_rtt(struct ath_hw *ah, int index, int chain)
+{
+        int agc, caldac;
+
+        if (!test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags))
+                return;
+
+        if ((index != 5) || (chain >= 2))
+                return;
+
+        agc = REG_READ_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
+                             AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE);
+        if (!agc)
+                return;
+
+        caldac = ah->caldata->caldac[chain];
+        ah->caldata->rtt_table[chain][index] &= 0xFFFF05FF;
+        caldac = (caldac & 0x20) | ((caldac & 0x1F) << 7);
+        ah->caldata->rtt_table[chain][index] |= (caldac << 4);
+}
+
 static int ar9003_hw_rtt_fill_hist_entry(struct ath_hw *ah, u8 chain, u32 index)
 {
         u32 val;
@@ -155,13 +176,16 @@ void ar9003_hw_rtt_fill_hist(struct ath_hw *ah)
                 for (i = 0; i < MAX_RTT_TABLE_ENTRY; i++) {
                         ah->caldata->rtt_table[chain][i] =
                                 ar9003_hw_rtt_fill_hist_entry(ah, chain, i);
+
+                        ar9003_hw_patch_rtt(ah, i, chain);
+
                         ath_dbg(ath9k_hw_common(ah), CALIBRATE,
                                 "RTT value at idx %d, chain %d is: 0x%x\n",
                                 i, chain, ah->caldata->rtt_table[chain][i]);
                 }
         }
 
-        ah->caldata->rtt_done = true;
+        set_bit(RTT_DONE, &ah->caldata->cal_flags);
 }
 
 void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
@@ -176,7 +200,7 @@ void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
         }
 
         if (ah->caldata)
-                ah->caldata->rtt_done = false;
+                clear_bit(RTT_DONE, &ah->caldata->cal_flags);
 }
 
 bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
@@ -186,11 +210,37 @@ bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
         if (!ah->caldata)
                 return false;
 
-        if (!ah->caldata->rtt_done)
+        if (test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags)) {
+                if (IS_CHAN_2GHZ(chan)){
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR,
+                                      ah->caldata->caldac[0]);
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR,
+                                      ah->caldata->caldac[1]);
+                } else {
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR,
+                                      ah->caldata->caldac[0]);
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR,
+                                      ah->caldata->caldac[1]);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                              AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                              AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
+        }
+
+        if (!test_bit(RTT_DONE, &ah->caldata->cal_flags))
                 return false;
 
         ar9003_hw_rtt_enable(ah);
-        ar9003_hw_rtt_set_mask(ah, 0x10);
+
+        if (test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags))
+                ar9003_hw_rtt_set_mask(ah, 0x30);
+        else
+                ar9003_hw_rtt_set_mask(ah, 0x10);
 
         if (!ath9k_hw_rfbus_req(ah)) {
                 ath_err(ath9k_hw_common(ah), "Could not stop baseband\n");
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 88ff1d7b53ab..6f899c692647 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -20,7 +20,17 @@
 
 /* AR9485 1.1 */
 
-#define ar9485_1_1_mac_postamble ar9300_2p2_mac_postamble
+static const u32 ar9485_1_1_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
         /* Addr      allmodes  */
@@ -34,6 +44,7 @@ static const u32 ar9485Common_wo_xlna_rx_gain_1_1[][2] = {
         {0x00009e00, 0x037216a0},
         {0x00009e04, 0x00182020},
         {0x00009e18, 0x00000000},
+        {0x00009e20, 0x000003a8},
         {0x00009e2c, 0x00004121},
         {0x00009e44, 0x02282324},
         {0x0000a000, 0x00060005},
@@ -174,7 +185,7 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050da, 0x000050da},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
         {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
@@ -200,14 +211,14 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
         {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62001eee, 0x62001eee},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x66001ff6, 0x66001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
         {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -263,6 +274,11 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
 static const u32 ar9485Modes_green_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
         {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
@@ -297,6 +313,22 @@ static const u32 ar9485Modes_green_ob_db_tx_gain_1_1[][5] = {
         {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a594, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a598, 0x00000000, 0x00000000, 0x01404501, 0x01404501},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x02808803, 0x02808803},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x04c14b04, 0x04c14b04},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
         {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
@@ -341,6 +373,100 @@ static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         {0x0000a2e0, 0x00000000, 0x00000000, 0xffc63a84, 0xffc63a84},
         {0x0000a2e4, 0x00000000, 0x00000000, 0xfe0fc000, 0xfe0fc000},
         {0x0000a2e8, 0x00000000, 0x00000000, 0xfff00000, 0xfff00000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050da, 0x000050da},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
+        {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x11062202, 0x11062202, 0x0d000200, 0x0d000200},
+        {0x0000a510, 0x17022e00, 0x17022e00, 0x11000202, 0x11000202},
+        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x15000400, 0x15000400},
+        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x19000402, 0x19000402},
+        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x1d000404, 0x1d000404},
+        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x21000603, 0x21000603},
+        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x25000605, 0x25000605},
+        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x2a000a03, 0x2a000a03},
+        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2c000a04, 0x2c000a04},
+        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x34000e20, 0x34000e20},
+        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x35000e21, 0x35000e21},
+        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x43000e62, 0x43000e62},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x45000e63, 0x45000e63},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x49000e65, 0x49000e65},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4b000e66, 0x4b000e66},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4d001645, 0x4d001645},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62001eee, 0x62001eee},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x66001ff6, 0x66001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a594, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a598, 0x00000000, 0x00000000, 0x01404501, 0x01404501},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x02808803, 0x02808803},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x04c14b04, 0x04c14b04},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000b500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b504, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b508, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b50c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b510, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b514, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b518, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b51c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b520, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b524, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b528, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b52c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b530, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b534, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b538, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b53c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b540, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b544, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b548, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b54c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b550, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b554, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b558, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b55c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b560, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b564, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b568, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b56c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b570, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b574, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b578, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b57c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00016044, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db},
+        {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
+};
+
+static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
@@ -427,7 +553,7 @@ static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
-static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
+static const u32 ar9485_modes_lowest_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
         {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
@@ -521,12 +647,15 @@ static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
-#define ar9485_modes_lowest_ob_db_tx_gain_1_1 ar9485Modes_low_ob_db_tx_gain_1_1
-
 static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xffad452a, 0xffad452a},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xffc98634, 0xffc98634},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfff60780, 0xfff60780},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfffff800, 0xfffff800},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
         {0x0000a504, 0x05062002, 0x05062002, 0x03000201, 0x03000201},
@@ -543,23 +672,39 @@ static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
         {0x0000a530, 0x48023ec6, 0x48023ec6, 0x310006e0, 0x310006e0},
         {0x0000a534, 0x4d023f01, 0x4d023f01, 0x330006e0, 0x330006e0},
         {0x0000a538, 0x53023f4b, 0x53023f4b, 0x3e0008e3, 0x3e0008e3},
-        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x410008e5, 0x410008e5},
-        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x430008e6, 0x430008e6},
-        {0x0000a544, 0x6502feca, 0x6502feca, 0x4a0008ec, 0x4a0008ec},
-        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4e0008f1, 0x4e0008f1},
-        {0x0000a54c, 0x7203feca, 0x7203feca, 0x520008f3, 0x520008f3},
-        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x54000eed, 0x54000eed},
-        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x58000ef1, 0x58000ef1},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5c000ef3, 0x5c000ef3},
-        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x60000ef5, 0x60000ef5},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x62000ef6, 0x62000ef6},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x430008e6, 0x430008e6},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x4a0008ec, 0x4a0008ec},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4e0008f1, 0x4e0008f1},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x520008f3, 0x520008f3},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x54000eed, 0x54000eed},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x58000ef1, 0x58000ef1},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x5c000ef3, 0x5c000ef3},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x66001ff0, 0x66001ff0},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x68001ff6, 0x68001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x01804000, 0x01804000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a594, 0x00000000, 0x00000000, 0x0340ca02, 0x0340ca02},
+        {0x0000a598, 0x00000000, 0x00000000, 0x0340cd03, 0x0340cd03},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x0340cd03, 0x0340cd03},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x06415304, 0x06415304},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x04c11905, 0x04c11905},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
         {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
@@ -823,6 +968,7 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
         {0x00009e00, 0x03721b20},
         {0x00009e04, 0x00082020},
         {0x00009e18, 0x0300501e},
+        {0x00009e20, 0x000003ba},
         {0x00009e2c, 0x00002e21},
         {0x00009e44, 0x02182324},
         {0x0000a000, 0x00060005},
@@ -1001,7 +1147,6 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
         {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec80d2e, 0x7ec80d2e},
         {0x00009e14, 0x31395d53, 0x31396053, 0x312e6053, 0x312e5d53},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcf946222, 0xcf946222},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302010, 0x50302010},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -1020,7 +1165,7 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x000002a0, 0x000002a0},
         {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
         {0x0000a2d0, 0x00071981, 0x00071981, 0x00071982, 0x00071982},
         {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1206,6 +1351,11 @@ static const u32 ar9485_1_1_mac_core[][2] = {
         {0x000083d0, 0x000301ff},
 };
 
-#define ar9485_1_1_baseband_core_txfir_coeff_japan_2484 ar9462_2p0_baseband_core_txfir_coeff_japan_2484
+static const u32 ar9485_1_1_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
 
 #endif /* INITVALS_9485_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
index e85a8b076c22..a8c757b6124f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
@@ -272,9 +272,9 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
         {0x0000a398, 0x001f0e0f},
         {0x0000a39c, 0x0075393f},
         {0x0000a3a0, 0xb79f6427},
-        {0x0000a3a4, 0x00000000},
-        {0x0000a3a8, 0xaaaaaaaa},
-        {0x0000a3ac, 0x3c466478},
+        {0x0000a3a4, 0x00000011},
+        {0x0000a3a8, 0xaaaaaa6e},
+        {0x0000a3ac, 0x3c466455},
         {0x0000a3c0, 0x20202020},
         {0x0000a3c4, 0x22222220},
         {0x0000a3c8, 0x20200020},
@@ -295,11 +295,11 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
         {0x0000a404, 0x00000000},
         {0x0000a408, 0x0e79e5c6},
         {0x0000a40c, 0x00820820},
-        {0x0000a414, 0x1ce739ce},
+        {0x0000a414, 0x1ce739c5},
         {0x0000a418, 0x2d001dce},
-        {0x0000a41c, 0x1ce739ce},
+        {0x0000a41c, 0x1ce739c5},
         {0x0000a420, 0x000001ce},
-        {0x0000a424, 0x1ce739ce},
+        {0x0000a424, 0x1ce739c5},
         {0x0000a428, 0x000001ce},
         {0x0000a42c, 0x1ce739ce},
         {0x0000a430, 0x1ce739ce},
@@ -351,9 +351,9 @@ static const u32 ar9565_1p0_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003a4, 0x000003a4},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946222, 0xcf946222},
+        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946220, 0xcf946220},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -452,6 +452,7 @@ static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
         /* Addr      allmodes  */
         {0x00004050, 0x00300300},
         {0x0000406c, 0x00100000},
+        {0x00009e20, 0x000003b6},
         {0x0000a000, 0x00010000},
         {0x0000a004, 0x00030002},
         {0x0000a008, 0x00050004},
@@ -1230,4 +1231,11 @@ static const u32 ar9565_1p0_modes_high_power_tx_gain_table[][5] = {
         {0x00016054, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
 };
 
+static const u32 ar9565_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
+
 #endif /* INITVALS_9565_1P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 2ee35f677c0e..14ff7e9dde4c 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -64,7 +64,6 @@ struct ath_node;
 
 struct ath_config {
         u16 txpowlimit;
-        u8 cabqReadytime;
 };
 
 /*************************/
@@ -207,6 +206,14 @@ struct ath_frame_info {
         u8 baw_tracked : 1;
 };
 
+struct ath_rxbuf {
+        struct list_head list;
+        struct sk_buff *bf_mpdu;
+        void *bf_desc;
+        dma_addr_t bf_daddr;
+        dma_addr_t bf_buf_addr;
+};
+
 struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
@@ -307,7 +314,7 @@ struct ath_rx {
         struct ath_descdma rxdma;
         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
 
-        struct ath_buf *buf_hold;
+        struct ath_rxbuf *buf_hold;
         struct sk_buff *frag;
 
         u32 ampdu_ref;
@@ -459,8 +466,8 @@ void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 
 #define ATH_DUMP_BTCOEX(_s, _val)                               \
         do {                                                    \
-                len += snprintf(buf + len, size - len,          \
-                                "%20s : %10d\n", _s, (_val));   \
+                len += scnprintf(buf + len, size - len,         \
+                                 "%20s : %10d\n", _s, (_val));  \
         } while (0)
 
 enum bt_op_flags {
@@ -581,7 +588,6 @@ static inline void ath_fill_led_pin(struct ath_softc *sc)
 #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO_LOW_RSSI 50
 #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2_LOW_RSSI 50
 
-#define ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA -1
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_HI -4
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_MID -2
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_LOW 2
@@ -626,12 +632,15 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 /* Main driver core */
 /********************/
 
-#define ATH9K_PCI_CUS198     0x0001
-#define ATH9K_PCI_CUS230     0x0002
-#define ATH9K_PCI_CUS217     0x0004
-#define ATH9K_PCI_WOW        0x0008
-#define ATH9K_PCI_BT_ANT_DIV 0x0010
-#define ATH9K_PCI_D3_L1_WAR  0x0020
+#define ATH9K_PCI_CUS198      0x0001
+#define ATH9K_PCI_CUS230      0x0002
+#define ATH9K_PCI_CUS217      0x0004
+#define ATH9K_PCI_CUS252      0x0008
+#define ATH9K_PCI_WOW         0x0010
+#define ATH9K_PCI_BT_ANT_DIV  0x0020
+#define ATH9K_PCI_D3_L1_WAR   0x0040
+#define ATH9K_PCI_AR9565_1ANT 0x0080
+#define ATH9K_PCI_AR9565_2ANT 0x0100
 
 /*
  * Default cache line size, in bytes.
@@ -924,7 +933,6 @@ void ath9k_deinit_device(struct ath_softc *sc);
 void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_reload_chainmask_settings(struct ath_softc *sc);
 
-bool ath9k_uses_beacons(int type);
 void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
 int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
                                enum spectral_mode spectral_mode);
@@ -952,7 +960,7 @@ void ath9k_ps_restore(struct ath_softc *sc);
 u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate);
 
 void ath_start_rfkill_poll(struct ath_softc *sc);
-extern void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
+void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
 void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct ath9k_vif_iter_data *iter_data);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index b5c16b3a37b9..17be35392bb4 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -334,6 +334,8 @@ void ath9k_beacon_tasklet(unsigned long data)
         if (ath9k_hw_numtxpending(ah, sc->beacon.beaconq) != 0) {
                 sc->beacon.bmisscnt++;
 
+                ath9k_hw_check_nav(ah);
+
                 if (!ath9k_hw_check_alive(ah))
                         ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 5e8219a91e25..d8db74b0ef66 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -119,7 +119,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
                         ath_dbg(common, CALIBRATE,
                                 "NFmid[%d] (%d) > MAX (%d), %s\n",
                                 i, h[i].privNF, limit->max,
-                                (cal->nfcal_interference ?
+                                (test_bit(NFCAL_INTF, &cal->cal_flags) ?
                                  "not corrected (due to interference)" :
                                  "correcting to MAX"));
 
@@ -130,7 +130,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
                          * we bypass this limit here in order to better deal
                          * with our environment.
                          */
-                        if (!cal->nfcal_interference)
+                        if (!test_bit(NFCAL_INTF, &cal->cal_flags))
                                 h[i].privNF = limit->max;
                 }
         }
@@ -141,7 +141,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
          * Re-enable the enforcement of the NF maximum again.
          */
         if (!high_nf_mid)
-                cal->nfcal_interference = false;
+                clear_bit(NFCAL_INTF, &cal->cal_flags);
 }
 
 static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
@@ -186,7 +186,6 @@ void ath9k_hw_reset_calibration(struct ath_hw *ah,
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
 
         if (!ah->caldata)
@@ -208,7 +207,7 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
                 return true;
 
         ath_dbg(common, CALIBRATE, "Resetting Cal %d state for channel %u\n",
-                currCal->calData->calType, conf->chandef.chan->center_freq);
+                currCal->calData->calType, ah->curchan->chan->center_freq);
 
         ah->caldata->CalValid &= ~currCal->calData->calType;
         currCal->calState = CAL_WAITING;
@@ -220,7 +219,7 @@ EXPORT_SYMBOL(ath9k_hw_reset_calvalid);
 void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
 {
         if (ah->caldata)
-                ah->caldata->nfcal_pending = true;
+                set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
                     AR_PHY_AGC_CONTROL_ENABLE_NF);
@@ -242,7 +241,6 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         int32_t val;
         u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
 
         if (ah->caldata)
@@ -252,7 +250,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 if (chainmask & (1 << i)) {
                         s16 nfval;
 
-                        if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf))
+                        if ((i >= AR5416_MAX_CHAINS) && !IS_CHAN_HT40(chan))
                                 continue;
 
                         if (h)
@@ -314,7 +312,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         ENABLE_REGWRITE_BUFFER(ah);
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 if (chainmask & (1 << i)) {
-                        if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf))
+                        if ((i >= AR5416_MAX_CHAINS) && !IS_CHAN_HT40(chan))
                                 continue;
 
                         val = REG_READ(ah, ah->nf_regs[i]);
@@ -391,7 +389,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         h = caldata->nfCalHist;
-        caldata->nfcal_pending = false;
+        clear_bit(NFCAL_PENDING, &caldata->cal_flags);
         ath9k_hw_update_nfcal_hist_buffer(ah, caldata, nfarray);
         chan->noisefloor = h[0].privNF;
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
@@ -408,7 +406,6 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
 
         ah->caldata->channel = chan->channel;
         ah->caldata->channelFlags = chan->channelFlags;
-        ah->caldata->chanmode = chan->chanmode;
         h = ah->caldata->nfCalHist;
         default_nf = ath9k_hw_get_default_nf(ah, chan);
         for (i = 0; i < NUM_NF_READINGS; i++) {
@@ -437,12 +434,12 @@ void ath9k_hw_bstuck_nfcal(struct ath_hw *ah)
          * the baseband update the internal NF value itself, similar to
          * what is being done after a full reset.
          */
-        if (!caldata->nfcal_pending)
+        if (!test_bit(NFCAL_PENDING, &caldata->cal_flags))
                 ath9k_hw_start_nfcal(ah, true);
         else if (!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
                 ath9k_hw_getnf(ah, ah->curchan);
 
-        caldata->nfcal_interference = true;
+        set_bit(NFCAL_INTF, &caldata->cal_flags);
 }
 EXPORT_SYMBOL(ath9k_hw_bstuck_nfcal);
 
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index d3063c21e16c..a7e5a05b2eff 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -49,103 +49,64 @@ int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_keytype);
 
-static u32 ath9k_get_extchanmode(struct cfg80211_chan_def *chandef)
-{
-        u32 chanmode = 0;
-
-        switch (chandef->chan->band) {
-        case IEEE80211_BAND_2GHZ:
-                switch (chandef->width) {
-                case NL80211_CHAN_WIDTH_20_NOHT:
-                case NL80211_CHAN_WIDTH_20:
-                        chanmode = CHANNEL_G_HT20;
-                        break;
-                case NL80211_CHAN_WIDTH_40:
-                        if (chandef->center_freq1 > chandef->chan->center_freq)
-                                chanmode = CHANNEL_G_HT40PLUS;
-                        else
-                                chanmode = CHANNEL_G_HT40MINUS;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        case IEEE80211_BAND_5GHZ:
-                switch (chandef->width) {
-                case NL80211_CHAN_WIDTH_20_NOHT:
-                case NL80211_CHAN_WIDTH_20:
-                        chanmode = CHANNEL_A_HT20;
-                        break;
-                case NL80211_CHAN_WIDTH_40:
-                        if (chandef->center_freq1 > chandef->chan->center_freq)
-                                chanmode = CHANNEL_A_HT40PLUS;
-                        else
-                                chanmode = CHANNEL_A_HT40MINUS;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        default:
-                break;
-        }
-
-        return chanmode;
-}
-
 /*
  * Update internal channel flags.
  */
-void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct cfg80211_chan_def *chandef)
+static void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
+                                      struct cfg80211_chan_def *chandef)
 {
-        ichan->channel = chandef->chan->center_freq;
-        ichan->chan = chandef->chan;
-
-        if (chandef->chan->band == IEEE80211_BAND_2GHZ) {
-                ichan->chanmode = CHANNEL_G;
-                ichan->channelFlags = CHANNEL_2GHZ | CHANNEL_OFDM;
-        } else {
-                ichan->chanmode = CHANNEL_A;
-                ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
-        }
+        struct ieee80211_channel *chan = chandef->chan;
+        u16 flags = 0;
+
+        ichan->channel = chan->center_freq;
+        ichan->chan = chan;
+
+        if (chan->band == IEEE80211_BAND_5GHZ)
+                flags |= CHANNEL_5GHZ;
 
         switch (chandef->width) {
         case NL80211_CHAN_WIDTH_5:
-                ichan->channelFlags |= CHANNEL_QUARTER;
+                flags |= CHANNEL_QUARTER;
                 break;
         case NL80211_CHAN_WIDTH_10:
-                ichan->channelFlags |= CHANNEL_HALF;
+                flags |= CHANNEL_HALF;
                 break;
         case NL80211_CHAN_WIDTH_20_NOHT:
                 break;
         case NL80211_CHAN_WIDTH_20:
+                flags |= CHANNEL_HT;
+                break;
         case NL80211_CHAN_WIDTH_40:
-                ichan->chanmode = ath9k_get_extchanmode(chandef);
+                if (chandef->center_freq1 > chandef->chan->center_freq)
+                        flags |= CHANNEL_HT40PLUS | CHANNEL_HT;
+                else
+                        flags |= CHANNEL_HT40MINUS | CHANNEL_HT;
                 break;
         default:
                 WARN_ON(1);
         }
+
+        ichan->channelFlags = flags;
 }
-EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
 
 /*
  * Get the internal channel reference.
  */
-struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
-                                               struct ath_hw *ah)
+struct ath9k_channel *ath9k_cmn_get_channel(struct ieee80211_hw *hw,
+                                            struct ath_hw *ah,
+                                            struct cfg80211_chan_def *chandef)
 {
-        struct ieee80211_channel *curchan = hw->conf.chandef.chan;
+        struct ieee80211_channel *curchan = chandef->chan;
         struct ath9k_channel *channel;
         u8 chan_idx;
 
         chan_idx = curchan->hw_value;
         channel = &ah->channels[chan_idx];
-        ath9k_cmn_update_ichannel(channel, &hw->conf.chandef);
+        ath9k_cmn_update_ichannel(channel, chandef);
 
         return channel;
 }
-EXPORT_SYMBOL(ath9k_cmn_get_curchannel);
+EXPORT_SYMBOL(ath9k_cmn_get_channel);
 
 int ath9k_cmn_count_streams(unsigned int chainmask, int max)
 {
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index e039bcbfbd79..eb85e1bdca88 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -43,10 +43,9 @@
         (((x) + ((mul)/2)) / (mul))
 
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
-void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct cfg80211_chan_def *chandef);
-struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
-                                               struct ath_hw *ah);
+struct ath9k_channel *ath9k_cmn_get_channel(struct ieee80211_hw *hw,
+                                            struct ath_hw *ah,
+                                            struct cfg80211_chan_def *chandef);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
 void ath9k_cmn_btcoex_bt_stomp(struct ath_common *common,
                                   enum ath_stomp_type stomp_type);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index c088744a6bfb..1be2c787aac9 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -104,37 +104,37 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (common->disable_ani) {
-                len += snprintf(buf + len, size - len, "%s: %s\n",
-                                "ANI", "DISABLED");
+                len += scnprintf(buf + len, size - len, "%s: %s\n",
+                                 "ANI", "DISABLED");
                 goto exit;
         }
 
-        len += snprintf(buf + len, size - len, "%15s: %s\n",
-                        "ANI", "ENABLED");
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "ANI RESET", ah->stats.ast_ani_reset);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "SPUR UP", ah->stats.ast_ani_spurup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "SPUR DOWN", ah->stats.ast_ani_spurup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "MRC-CCK ON", ah->stats.ast_ani_ccklow);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "FIR-STEP UP", ah->stats.ast_ani_stepup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "CCK ERRORS", ah->stats.ast_ani_cckerrs);
+        len += scnprintf(buf + len, size - len, "%15s: %s\n",
+                         "ANI", "ENABLED");
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "ANI RESET", ah->stats.ast_ani_reset);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "SPUR UP", ah->stats.ast_ani_spurup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "SPUR DOWN", ah->stats.ast_ani_spurup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "MRC-CCK ON", ah->stats.ast_ani_ccklow);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "FIR-STEP UP", ah->stats.ast_ani_stepup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "CCK ERRORS", ah->stats.ast_ani_cckerrs);
 exit:
         if (len > size)
                 len = size;
@@ -280,70 +280,70 @@ static ssize_t read_file_antenna_diversity(struct file *file,
                 return -ENOMEM;
 
         if (!(pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)) {
-                len += snprintf(buf + len, size - len, "%s\n",
-                                "Antenna Diversity Combining is disabled");
+                len += scnprintf(buf + len, size - len, "%s\n",
+                                 "Antenna Diversity Combining is disabled");
                 goto exit;
         }
 
         ath9k_ps_wakeup(sc);
         ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
-        len += snprintf(buf + len, size - len, "Current MAIN config : %s\n",
-                        lna_conf_str[div_ant_conf.main_lna_conf]);
-        len += snprintf(buf + len, size - len, "Current ALT config  : %s\n",
-                        lna_conf_str[div_ant_conf.alt_lna_conf]);
-        len += snprintf(buf + len, size - len, "Average MAIN RSSI   : %d\n",
-                        as_main->rssi_avg);
-        len += snprintf(buf + len, size - len, "Average ALT RSSI    : %d\n\n",
-                        as_alt->rssi_avg);
+        len += scnprintf(buf + len, size - len, "Current MAIN config : %s\n",
+                         lna_conf_str[div_ant_conf.main_lna_conf]);
+        len += scnprintf(buf + len, size - len, "Current ALT config  : %s\n",
+                         lna_conf_str[div_ant_conf.alt_lna_conf]);
+        len += scnprintf(buf + len, size - len, "Average MAIN RSSI   : %d\n",
+                         as_main->rssi_avg);
+        len += scnprintf(buf + len, size - len, "Average ALT RSSI    : %d\n\n",
+                         as_alt->rssi_avg);
         ath9k_ps_restore(sc);
 
-        len += snprintf(buf + len, size - len, "Packet Receive Cnt:\n");
-        len += snprintf(buf + len, size - len, "-------------------\n");
-
-        len += snprintf(buf + len, size - len, "%30s%15s\n",
-                        "MAIN", "ALT");
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "TOTAL COUNT",
-                        as_main->recv_cnt,
-                        as_alt->recv_cnt);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 + LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 - LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
-
-        len += snprintf(buf + len, size - len, "\nLNA Config Attempts:\n");
-        len += snprintf(buf + len, size - len, "--------------------\n");
-
-        len += snprintf(buf + len, size - len, "%30s%15s\n",
-                        "MAIN", "ALT");
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 + LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 - LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "Packet Receive Cnt:\n");
+        len += scnprintf(buf + len, size - len, "-------------------\n");
+
+        len += scnprintf(buf + len, size - len, "%30s%15s\n",
+                         "MAIN", "ALT");
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "TOTAL COUNT",
+                         as_main->recv_cnt,
+                         as_alt->recv_cnt);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 + LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 - LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
+
+        len += scnprintf(buf + len, size - len, "\nLNA Config Attempts:\n");
+        len += scnprintf(buf + len, size - len, "--------------------\n");
+
+        len += scnprintf(buf + len, size - len, "%30s%15s\n",
+                         "MAIN", "ALT");
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 + LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 - LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
 
 exit:
         if (len > size)
@@ -385,21 +385,21 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                    (AR_MACMISC_MISC_OBS_BUS_1 <<
                     AR_MACMISC_MISC_OBS_BUS_MSB_S)));
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "Raw DMA Debug values:\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "Raw DMA Debug values:\n");
 
         for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++) {
                 if (i % 4 == 0)
-                        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
+                        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
                 val[i] = REG_READ_D(ah, AR_DMADBG_0 + (i * sizeof(u32)));
-                len += snprintf(buf + len, DMA_BUF_LEN - len, "%d: %08x ",
-                                i, val[i]);
+                len += scnprintf(buf + len, DMA_BUF_LEN - len, "%d: %08x ",
+                                 i, val[i]);
         }
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n\n");
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
 
         for (i = 0; i < ATH9K_NUM_QUEUES; i++, qcuOffset += 4, dcuOffset += 5) {
                 if (i == 8) {
@@ -412,39 +412,39 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                         dcuBase++;
                 }
 
-                len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "%2d          %2x      %1x     %2x           %2x\n",
-                        i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
-                        (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                        val[2] & (0x7 << (i * 3)) >> (i * 3),
-                        (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
+                len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "%2d          %2x      %1x     %2x           %2x\n",
+                         i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
+                         (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
+                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_stitch state:   %2x    qcu_fetch state:        %2x\n",
                 (val[3] & 0x003c0000) >> 18, (val[3] & 0x03c00000) >> 22);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_complete state: %2x    dcu_complete state:     %2x\n",
                 (val[3] & 0x1c000000) >> 26, (val[6] & 0x3));
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "dcu_arb state:      %2x    dcu_fp state:           %2x\n",
                 (val[5] & 0x06000000) >> 25, (val[5] & 0x38000000) >> 27);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "chan_idle_dur:     %3d    chan_idle_dur_valid:     %1d\n",
                 (val[6] & 0x000003fc) >> 2, (val[6] & 0x00000400) >> 10);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_valid_0:      %1d    txfifo_valid_1:          %1d\n",
                 (val[6] & 0x00000800) >> 11, (val[6] & 0x00001000) >> 12);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_dcu_num_0:   %2d    txfifo_dcu_num_1:       %2d\n",
                 (val[6] & 0x0001e000) >> 13, (val[6] & 0x001e0000) >> 17);
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "pcu observe: 0x%x\n",
-                        REG_READ_D(ah, AR_OBS_BUS_1));
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "AR_CR: 0x%x\n", REG_READ_D(ah, AR_CR));
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "pcu observe: 0x%x\n",
+                         REG_READ_D(ah, AR_OBS_BUS_1));
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "AR_CR: 0x%x\n", REG_READ_D(ah, AR_CR));
 
         ath9k_ps_restore(sc);
 
@@ -530,9 +530,9 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
 
 #define PR_IS(a, s)                                             \
         do {                                                    \
-                len += snprintf(buf + len, mxlen - len,         \
-                                "%21s: %10u\n", a,              \
-                                sc->debug.stats.istats.s);      \
+                len += scnprintf(buf + len, mxlen - len,        \
+                                 "%21s: %10u\n", a,             \
+                                 sc->debug.stats.istats.s);     \
         } while (0)
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
@@ -563,8 +563,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
         PR_IS("GENTIMER", gen_timer);
         PR_IS("TOTAL", total);
 
-        len += snprintf(buf + len, mxlen - len,
-                        "SYNC_CAUSE stats:\n");
+        len += scnprintf(buf + len, mxlen - len,
+                         "SYNC_CAUSE stats:\n");
 
         PR_IS("Sync-All", sync_cause_all);
         PR_IS("RTC-IRQ", sync_rtc_irq);
@@ -655,16 +655,16 @@ static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
 
         ath_txq_lock(sc, txq);
 
-        len += snprintf(buf + len, size - len, "%s: %d ",
-                        "qnum", txq->axq_qnum);
-        len += snprintf(buf + len, size - len, "%s: %2d ",
-                        "qdepth", txq->axq_depth);
-        len += snprintf(buf + len, size - len, "%s: %2d ",
-                        "ampdu-depth", txq->axq_ampdu_depth);
-        len += snprintf(buf + len, size - len, "%s: %3d ",
-                        "pending", txq->pending_frames);
-        len += snprintf(buf + len, size - len, "%s: %d\n",
-                        "stopped", txq->stopped);
+        len += scnprintf(buf + len, size - len, "%s: %d ",
+                         "qnum", txq->axq_qnum);
+        len += scnprintf(buf + len, size - len, "%s: %2d ",
+                         "qdepth", txq->axq_depth);
+        len += scnprintf(buf + len, size - len, "%s: %2d ",
+                         "ampdu-depth", txq->axq_ampdu_depth);
+        len += scnprintf(buf + len, size - len, "%s: %3d ",
+                         "pending", txq->pending_frames);
+        len += scnprintf(buf + len, size - len, "%s: %d\n",
+                         "stopped", txq->stopped);
 
         ath_txq_unlock(sc, txq);
         return len;
@@ -687,11 +687,11 @@ static ssize_t read_file_queues(struct file *file, char __user *user_buf,
 
         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                 txq = sc->tx.txq_map[i];
-                len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
+                len += scnprintf(buf + len, size - len, "(%s):  ", qname[i]);
                 len += print_queue(sc, txq, buf + len, size - len);
         }
 
-        len += snprintf(buf + len, size - len, "(CAB): ");
+        len += scnprintf(buf + len, size - len, "(CAB): ");
         len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
 
         if (len > size)
@@ -716,80 +716,82 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
         unsigned int reg;
         u32 rxfilter;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "BSSID: %pM\n", common->curbssid);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "BSSID-MASK: %pM\n", common->bssidmask);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "OPMODE: %s\n", ath_opmode_to_string(sc->sc_ah->opmode));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "BSSID: %pM\n", common->curbssid);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "BSSID-MASK: %pM\n", common->bssidmask);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "OPMODE: %s\n",
+                         ath_opmode_to_string(sc->sc_ah->opmode));
 
         ath9k_ps_wakeup(sc);
         rxfilter = ath9k_hw_getrxfilter(sc->sc_ah);
         ath9k_ps_restore(sc);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "RXFILTER: 0x%x", rxfilter);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "RXFILTER: 0x%x", rxfilter);
 
         if (rxfilter & ATH9K_RX_FILTER_UCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " UCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " UCAST");
         if (rxfilter & ATH9K_RX_FILTER_MCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " MCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MCAST");
         if (rxfilter & ATH9K_RX_FILTER_BCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " BCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BCAST");
         if (rxfilter & ATH9K_RX_FILTER_CONTROL)
-                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CONTROL");
         if (rxfilter & ATH9K_RX_FILTER_BEACON)
-                len += snprintf(buf + len, sizeof(buf) - len, " BEACON");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BEACON");
         if (rxfilter & ATH9K_RX_FILTER_PROM)
-                len += snprintf(buf + len, sizeof(buf) - len, " PROM");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PROM");
         if (rxfilter & ATH9K_RX_FILTER_PROBEREQ)
-                len += snprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
         if (rxfilter & ATH9K_RX_FILTER_PHYERR)
-                len += snprintf(buf + len, sizeof(buf) - len, " PHYERR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PHYERR");
         if (rxfilter & ATH9K_RX_FILTER_MYBEACON)
-                len += snprintf(buf + len, sizeof(buf) - len, " MYBEACON");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MYBEACON");
         if (rxfilter & ATH9K_RX_FILTER_COMP_BAR)
-                len += snprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
         if (rxfilter & ATH9K_RX_FILTER_PSPOLL)
-                len += snprintf(buf + len, sizeof(buf) - len, " PSPOLL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PSPOLL");
         if (rxfilter & ATH9K_RX_FILTER_PHYRADAR)
-                len += snprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
         if (rxfilter & ATH9K_RX_FILTER_MCAST_BCAST_ALL)
-                len += snprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL");
         if (rxfilter & ATH9K_RX_FILTER_CONTROL_WRAPPER)
-                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL_WRAPPER");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CONTROL_WRAPPER");
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
         reg = sc->sc_ah->imask;
 
-        len += snprintf(buf + len, sizeof(buf) - len, "INTERRUPT-MASK: 0x%x", reg);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "INTERRUPT-MASK: 0x%x", reg);
 
         if (reg & ATH9K_INT_SWBA)
-                len += snprintf(buf + len, sizeof(buf) - len, " SWBA");
+                len += scnprintf(buf + len, sizeof(buf) - len, " SWBA");
         if (reg & ATH9K_INT_BMISS)
-                len += snprintf(buf + len, sizeof(buf) - len, " BMISS");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BMISS");
         if (reg & ATH9K_INT_CST)
-                len += snprintf(buf + len, sizeof(buf) - len, " CST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CST");
         if (reg & ATH9K_INT_RX)
-                len += snprintf(buf + len, sizeof(buf) - len, " RX");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RX");
         if (reg & ATH9K_INT_RXHP)
-                len += snprintf(buf + len, sizeof(buf) - len, " RXHP");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RXHP");
         if (reg & ATH9K_INT_RXLP)
-                len += snprintf(buf + len, sizeof(buf) - len, " RXLP");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RXLP");
         if (reg & ATH9K_INT_BB_WATCHDOG)
-                len += snprintf(buf + len, sizeof(buf) - len, " BB_WATCHDOG");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BB_WATCHDOG");
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
         ath9k_calculate_iter_data(hw, NULL, &iter_data);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "VIF-COUNTS: AP: %i STA: %i MESH: %i WDS: %i"
-                        " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
-                        iter_data.naps, iter_data.nstations, iter_data.nmeshes,
-                        iter_data.nwds, iter_data.nadhocs,
-                        sc->nvifs, sc->nbcnvifs);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "VIF-COUNTS: AP: %i STA: %i MESH: %i WDS: %i"
+                         " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
+                         iter_data.naps, iter_data.nstations, iter_data.nmeshes,
+                         iter_data.nwds, iter_data.nadhocs,
+                         sc->nvifs, sc->nbcnvifs);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -805,27 +807,27 @@ static ssize_t read_file_reset(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Baseband Hang",
-                        sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Baseband Watchdog",
-                        sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Fatal HW Error",
-                        sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "TX HW error",
-                        sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "TX Path Hang",
-                        sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "PLL RX Hang",
-                        sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "MCI Reset",
-                        sc->debug.stats.reset[RESET_TYPE_MCI]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Baseband Hang",
+                         sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Baseband Watchdog",
+                         sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Fatal HW Error",
+                         sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "TX HW error",
+                         sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "TX Path Hang",
+                         sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "PLL RX Hang",
+                         sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "MCI Reset",
+                         sc->debug.stats.reset[RESET_TYPE_MCI]);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -902,14 +904,14 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
 #define PHY_ERR(s, p) \
-        len += snprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                        sc->debug.stats.rxstats.phy_err_stats[p]);
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         sc->debug.stats.rxstats.phy_err_stats[p]);
 
 #define RXS_ERR(s, e)                                       \
         do {                                                \
-                len += snprintf(buf + len, size - len,      \
-                                "%22s : %10u\n", s,         \
-                                sc->debug.stats.rxstats.e); \
+                len += scnprintf(buf + len, size - len,     \
+                                 "%22s : %10u\n", s,        \
+                                 sc->debug.stats.rxstats.e);\
         } while (0)
 
         struct ath_softc *sc = file->private_data;
@@ -1439,22 +1441,22 @@ static ssize_t read_file_dump_nfcal(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "Channel Noise Floor : %d\n", ah->noise);
-        len += snprintf(buf + len, size - len,
-                        "Chain | privNF | # Readings | NF Readings\n");
+        len += scnprintf(buf + len, size - len,
+                         "Channel Noise Floor : %d\n", ah->noise);
+        len += scnprintf(buf + len, size - len,
+                         "Chain | privNF | # Readings | NF Readings\n");
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 if (!(chainmask & (1 << i)) ||
                     ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf)))
                         continue;
 
                 nread = AR_PHY_CCA_FILTERWINDOW_LENGTH - h[i].invalidNFcount;
-                len += snprintf(buf + len, size - len, " %d\t %d\t %d\t\t",
-                                i, h[i].privNF, nread);
+                len += scnprintf(buf + len, size - len, " %d\t %d\t %d\t\t",
+                                 i, h[i].privNF, nread);
                 for (j = 0; j < nread; j++)
-                        len += snprintf(buf + len, size - len,
-                                        " %d", h[i].nfCalBuffer[j]);
-                len += snprintf(buf + len, size - len, "\n");
+                        len += scnprintf(buf + len, size - len,
+                                         " %d", h[i].nfCalBuffer[j]);
+                len += scnprintf(buf + len, size - len, "\n");
         }
 
         if (len > size)
@@ -1543,8 +1545,8 @@ static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (!sc->sc_ah->common.btcoex_enabled) {
-                len = snprintf(buf, size, "%s\n",
-                               "BTCOEX is disabled");
+                len = scnprintf(buf, size, "%s\n",
+                                "BTCOEX is disabled");
                 goto exit;
         }
 
@@ -1582,43 +1584,43 @@ static ssize_t read_file_node_stat(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (!an->sta->ht_cap.ht_supported) {
-                len = snprintf(buf, size, "%s\n",
-                               "HT not supported");
+                len = scnprintf(buf, size, "%s\n",
+                                "HT not supported");
                 goto exit;
         }
 
-        len = snprintf(buf, size, "Max-AMPDU: %d\n",
-                       an->maxampdu);
-        len += snprintf(buf + len, size - len, "MPDU Density: %d\n\n",
-                        an->mpdudensity);
+        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
+                        an->maxampdu);
+        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
+                         an->mpdudensity);
 
-        len += snprintf(buf + len, size - len,
-                        "%2s%7s\n", "AC", "SCHED");
+        len += scnprintf(buf + len, size - len,
+                         "%2s%7s\n", "AC", "SCHED");
 
         for (acno = 0, ac = &an->ac[acno];
              acno < IEEE80211_NUM_ACS; acno++, ac++) {
                 txq = ac->txq;
                 ath_txq_lock(sc, txq);
-                len += snprintf(buf + len, size - len,
-                                "%2d%7d\n",
-                                acno, ac->sched);
+                len += scnprintf(buf + len, size - len,
+                                 "%2d%7d\n",
+                                 acno, ac->sched);
                 ath_txq_unlock(sc, txq);
         }
 
-        len += snprintf(buf + len, size - len,
-                        "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
-                        "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
-                        "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
+        len += scnprintf(buf + len, size - len,
+                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
+                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
+                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
 
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
                 txq = tid->ac->txq;
                 ath_txq_lock(sc, txq);
-                len += snprintf(buf + len, size - len,
-                                "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
-                                tid->tidno, tid->seq_start, tid->seq_next,
-                                tid->baw_size, tid->baw_head, tid->baw_tail,
-                                tid->bar_index, tid->sched, tid->paused);
+                len += scnprintf(buf + len, size - len,
+                                 "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                 tid->tidno, tid->seq_start, tid->seq_next,
+                                 tid->baw_size, tid->baw_head, tid->baw_tail,
+                                 tid->bar_index, tid->sched, tid->paused);
                 ath_txq_unlock(sc, txq);
         }
 exit:
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 6e1556fa2f3e..d6e3fa4299a4 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -193,12 +193,12 @@ struct ath_tx_stats {
 #define TXSTATS sc->debug.stats.txstats
 #define PR(str, elem)                                                   \
         do {                                                            \
-                len += snprintf(buf + len, size - len,                  \
-                                "%s%13u%11u%10u%10u\n", str,            \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_BE)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_BK)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_VI)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
+                len += scnprintf(buf + len, size - len,                 \
+                                 "%s%13u%11u%10u%10u\n", str,           \
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_BE)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_BK)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_VI)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
         } while(0)
 
 #define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.c b/drivers/net/wireless/ath/ath9k/dfs_debug.c
index 3c6e4138a95d..821599135d8a 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
@@ -25,11 +25,11 @@
 struct ath_dfs_pool_stats global_dfs_pool_stats = { 0 };
 
 #define ATH9K_DFS_STAT(s, p) \
-        len += snprintf(buf + len, size - len, "%28s : %10u\n", s, \
-                        sc->debug.stats.dfs_stats.p);
+        len += scnprintf(buf + len, size - len, "%28s : %10u\n", s, \
+                         sc->debug.stats.dfs_stats.p);
 #define ATH9K_DFS_POOL_STAT(s, p) \
-        len += snprintf(buf + len, size - len, "%28s : %10u\n", s, \
-                        global_dfs_pool_stats.p);
+        len += scnprintf(buf + len, size - len, "%28s : %10u\n", s, \
+                         global_dfs_pool_stats.p);
 
 static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
@@ -44,12 +44,12 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len, "DFS support for "
-                        "macVersion = 0x%x, macRev = 0x%x: %s\n",
-                        hw_ver->macVersion, hw_ver->macRev,
-                        (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
+        len += scnprintf(buf + len, size - len, "DFS support for "
+                         "macVersion = 0x%x, macRev = 0x%x: %s\n",
+                         hw_ver->macVersion, hw_ver->macRev,
+                         (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
                                         "enabled" : "disabled");
-        len += snprintf(buf + len, size - len, "Pulse detector statistics:\n");
+        len += scnprintf(buf + len, size - len, "Pulse detector statistics:\n");
         ATH9K_DFS_STAT("pulse events reported   ", pulses_total);
         ATH9K_DFS_STAT("invalid pulse events    ", pulses_no_dfs);
         ATH9K_DFS_STAT("DFS pulses detected     ", pulses_detected);
@@ -59,11 +59,12 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         ATH9K_DFS_STAT("Primary channel pulses  ", pri_phy_errors);
         ATH9K_DFS_STAT("Secondary channel pulses", ext_phy_errors);
         ATH9K_DFS_STAT("Dual channel pulses     ", dc_phy_errors);
-        len += snprintf(buf + len, size - len, "Radar detector statistics "
-                        "(current DFS region: %d)\n", sc->dfs_detector->region);
+        len += scnprintf(buf + len, size - len, "Radar detector statistics "
+                         "(current DFS region: %d)\n",
+                         sc->dfs_detector->region);
         ATH9K_DFS_STAT("Pulse events processed  ", pulses_processed);
         ATH9K_DFS_STAT("Radars detected         ", radar_detected);
-        len += snprintf(buf + len, size - len, "Global Pool statistics:\n");
+        len += scnprintf(buf + len, size - len, "Global Pool statistics:\n");
         ATH9K_DFS_POOL_STAT("Pool references         ", pool_reference);
         ATH9K_DFS_POOL_STAT("Pulses allocated        ", pulse_allocated);
         ATH9K_DFS_POOL_STAT("Pulses alloc error      ", pulse_alloc_error);
diff --git a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
index 5ba4b6fe37c0..c718fc379a10 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
@@ -392,7 +392,7 @@ static struct pri_sequence *pri_detector_add_pulse(struct pri_detector *de,
 
         if (!pseq_handler_create_sequences(de, ts, max_updated_seq)) {
                 pri_detector_reset(de, ts);
-                return false;
+                return NULL;
         }
 
         ps = pseq_handler_check_detection(de);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 9ea8e4b779c9..b4091716e9b3 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -129,10 +129,10 @@ static u32 ath9k_hw_4k_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_header_4k *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ath9k_dump_4k_modal_eeprom(buf, len, size,
-                                                  &eep->modalHeader);
+                                                 &eep->modalHeader);
                 goto out;
         }
 
@@ -160,8 +160,8 @@ static u32 ath9k_hw_4k_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Cal Bin Build", (pBase->binBuildNumber >> 8) & 0xFF);
         PR_EEP("TX Gain type", pBase->txGainType);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 3ae1f3df0637..e1d0c217c104 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -125,8 +125,8 @@ static u32 ath9k_hw_ar9287_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_ar9287_header *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ar9287_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader);
                 goto out;
@@ -157,8 +157,8 @@ static u32 ath9k_hw_ar9287_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Power Table Offset", pBase->pwrTableOffset);
         PR_EEP("OpenLoop Power Ctrl", pBase->openLoopPwrCntl);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 1c25368b3836..39107e31e79a 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -205,12 +205,12 @@ static u32 ath9k_hw_def_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_header *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[0]);
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "5GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "5GHz modal Header");
                 len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[1]);
                 goto out;
@@ -240,8 +240,8 @@ static u32 ath9k_hw_def_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Cal Bin Build", (pBase->binBuildNumber >> 8) & 0xFF);
         PR_EEP("OpenLoop Power Ctrl", pBase->openLoopPwrCntl);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 4b412aaf4f36..c34f21241da9 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -522,22 +522,22 @@ static int ath9k_dump_mci_btcoex(struct ath_softc *sc, u8 *buf, u32 size)
         ATH_DUMP_BTCOEX("Concurrent Tx", btcoex_hw->mci.concur_tx);
         ATH_DUMP_BTCOEX("Concurrent RSSI cnt", btcoex->rssi_count);
 
-        len += snprintf(buf + len, size - len, "BT Weights: ");
+        len += scnprintf(buf + len, size - len, "BT Weights: ");
         for (i = 0; i < AR9300_NUM_BT_WEIGHTS; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
-                                btcoex_hw->bt_weight[i]);
-        len += snprintf(buf + len, size - len, "\n");
-        len += snprintf(buf + len, size - len, "WLAN Weights: ");
+                len += scnprintf(buf + len, size - len, "%08x ",
+                                 btcoex_hw->bt_weight[i]);
+        len += scnprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "WLAN Weights: ");
         for (i = 0; i < AR9300_NUM_BT_WEIGHTS; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
-                                btcoex_hw->wlan_weight[i]);
-        len += snprintf(buf + len, size - len, "\n");
-        len += snprintf(buf + len, size - len, "Tx Priorities: ");
+                len += scnprintf(buf + len, size - len, "%08x ",
+                                 btcoex_hw->wlan_weight[i]);
+        len += scnprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "Tx Priorities: ");
         for (i = 0; i < ATH_BTCOEX_STOMP_MAX; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
+                len += scnprintf(buf + len, size - len, "%08x ",
                                 btcoex_hw->tx_prio[i]);
 
-        len += snprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "\n");
 
         return len;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index c1b45e2f8481..fb071ee4fcfb 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -37,29 +37,29 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RX",
-                        be32_to_cpu(cmd_rsp.rx));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RX",
+                         be32_to_cpu(cmd_rsp.rx));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RXORN",
-                        be32_to_cpu(cmd_rsp.rxorn));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RXORN",
+                         be32_to_cpu(cmd_rsp.rxorn));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RXEOL",
-                        be32_to_cpu(cmd_rsp.rxeol));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RXEOL",
+                         be32_to_cpu(cmd_rsp.rxeol));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TXURN",
-                        be32_to_cpu(cmd_rsp.txurn));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TXURN",
+                         be32_to_cpu(cmd_rsp.txurn));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TXTO",
-                        be32_to_cpu(cmd_rsp.txto));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TXTO",
+                         be32_to_cpu(cmd_rsp.txto));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "CST",
-                        be32_to_cpu(cmd_rsp.cst));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "CST",
+                         be32_to_cpu(cmd_rsp.cst));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -95,41 +95,41 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Xretries",
-                        be32_to_cpu(cmd_rsp.xretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Xretries",
+                         be32_to_cpu(cmd_rsp.xretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "FifoErr",
-                        be32_to_cpu(cmd_rsp.fifoerr));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "FifoErr",
+                         be32_to_cpu(cmd_rsp.fifoerr));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Filtered",
-                        be32_to_cpu(cmd_rsp.filtered));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Filtered",
+                         be32_to_cpu(cmd_rsp.filtered));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TimerExp",
-                        be32_to_cpu(cmd_rsp.timer_exp));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TimerExp",
+                         be32_to_cpu(cmd_rsp.timer_exp));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "ShortRetries",
-                        be32_to_cpu(cmd_rsp.shortretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "ShortRetries",
+                         be32_to_cpu(cmd_rsp.shortretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "LongRetries",
-                        be32_to_cpu(cmd_rsp.longretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "LongRetries",
+                         be32_to_cpu(cmd_rsp.longretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "QueueNull",
-                        be32_to_cpu(cmd_rsp.qnull));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "QueueNull",
+                         be32_to_cpu(cmd_rsp.qnull));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "EncapFail",
-                        be32_to_cpu(cmd_rsp.encap_fail));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "EncapFail",
+                         be32_to_cpu(cmd_rsp.encap_fail));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "NoBuf",
-                        be32_to_cpu(cmd_rsp.nobuf));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "NoBuf",
+                         be32_to_cpu(cmd_rsp.nobuf));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -165,17 +165,17 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "NoBuf",
-                        be32_to_cpu(cmd_rsp.nobuf));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "NoBuf",
+                         be32_to_cpu(cmd_rsp.nobuf));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "HostSend",
-                        be32_to_cpu(cmd_rsp.host_send));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "HostSend",
+                         be32_to_cpu(cmd_rsp.host_send));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "HostDone",
-                        be32_to_cpu(cmd_rsp.host_done));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "HostDone",
+                         be32_to_cpu(cmd_rsp.host_done));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -197,37 +197,37 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers queued",
-                        priv->debug.tx_stats.buf_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers completed",
-                        priv->debug.tx_stats.buf_completed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs queued",
-                        priv->debug.tx_stats.skb_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs success",
-                        priv->debug.tx_stats.skb_success);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs failed",
-                        priv->debug.tx_stats.skb_failed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "CAB queued",
-                        priv->debug.tx_stats.cab_queued);
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BE queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_BE]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BK queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_BK]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VI queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_VI]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VO queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_VO]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Buffers queued",
+                         priv->debug.tx_stats.buf_queued);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Buffers completed",
+                         priv->debug.tx_stats.buf_completed);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs queued",
+                         priv->debug.tx_stats.skb_queued);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs success",
+                         priv->debug.tx_stats.skb_success);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs failed",
+                         priv->debug.tx_stats.skb_failed);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "CAB queued",
+                         priv->debug.tx_stats.cab_queued);
+
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "BE queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_BE]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "BK queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_BK]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "VI queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_VI]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "VO queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_VO]);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -273,8 +273,8 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
 #define PHY_ERR(s, p)                                                   \
-        len += snprintf(buf + len, size - len, "%20s : %10u\n", s,      \
-                        priv->debug.rx_stats.err_phy_stats[p]);
+        len += scnprintf(buf + len, size - len, "%20s : %10u\n", s,     \
+                         priv->debug.rx_stats.err_phy_stats[p]);
 
         struct ath9k_htc_priv *priv = file->private_data;
         char *buf;
@@ -285,37 +285,37 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs allocated",
-                        priv->debug.rx_stats.skb_allocated);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs completed",
-                        priv->debug.rx_stats.skb_completed);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs Dropped",
-                        priv->debug.rx_stats.skb_dropped);
-
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "CRC ERR",
-                        priv->debug.rx_stats.err_crc);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "DECRYPT CRC ERR",
-                        priv->debug.rx_stats.err_decrypt_crc);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "MIC ERR",
-                        priv->debug.rx_stats.err_mic);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "PRE-DELIM CRC ERR",
-                        priv->debug.rx_stats.err_pre_delim);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "POST-DELIM CRC ERR",
-                        priv->debug.rx_stats.err_post_delim);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "DECRYPT BUSY ERR",
-                        priv->debug.rx_stats.err_decrypt_busy);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "TOTAL PHY ERR",
-                        priv->debug.rx_stats.err_phy);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs allocated",
+                         priv->debug.rx_stats.skb_allocated);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs completed",
+                         priv->debug.rx_stats.skb_completed);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs Dropped",
+                         priv->debug.rx_stats.skb_dropped);
+
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "CRC ERR",
+                         priv->debug.rx_stats.err_crc);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "DECRYPT CRC ERR",
+                         priv->debug.rx_stats.err_decrypt_crc);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "MIC ERR",
+                         priv->debug.rx_stats.err_mic);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "PRE-DELIM CRC ERR",
+                         priv->debug.rx_stats.err_pre_delim);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "POST-DELIM CRC ERR",
+                         priv->debug.rx_stats.err_post_delim);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "DECRYPT BUSY ERR",
+                         priv->debug.rx_stats.err_decrypt_busy);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "TOTAL PHY ERR",
+                         priv->debug.rx_stats.err_phy);
 
 
         PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
@@ -372,16 +372,16 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
 
         spin_lock_bh(&priv->tx.tx_lock);
 
-        len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
+        len += scnprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
 
         len += bitmap_scnprintf(buf + len, sizeof(buf) - len,
                                priv->tx.tx_slot, MAX_TX_BUF_NUM);
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "Used slots     : %d\n",
-                        bitmap_weight(priv->tx.tx_slot, MAX_TX_BUF_NUM));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "Used slots     : %d\n",
+                         bitmap_weight(priv->tx.tx_slot, MAX_TX_BUF_NUM));
 
         spin_unlock_bh(&priv->tx.tx_lock);
 
@@ -405,30 +405,30 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Cab endpoint", skb_queue_len(&priv->tx.cab_ep_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Cab endpoint", skb_queue_len(&priv->tx.cab_ep_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data BE endpoint", skb_queue_len(&priv->tx.data_be_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data BE endpoint", skb_queue_len(&priv->tx.data_be_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data BK endpoint", skb_queue_len(&priv->tx.data_bk_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data BK endpoint", skb_queue_len(&priv->tx.data_bk_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data VI endpoint", skb_queue_len(&priv->tx.data_vi_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data VI endpoint", skb_queue_len(&priv->tx.data_vi_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data VO endpoint", skb_queue_len(&priv->tx.data_vo_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data VO endpoint", skb_queue_len(&priv->tx.data_vo_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Failed queue", skb_queue_len(&priv->tx.tx_failed));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Failed queue", skb_queue_len(&priv->tx.tx_failed));
 
         spin_lock_bh(&priv->tx.tx_lock);
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Queued count", priv->tx.queued_cnt);
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Queued count", priv->tx.queued_cnt);
         spin_unlock_bh(&priv->tx.tx_lock);
 
         if (len > sizeof(buf))
@@ -507,70 +507,70 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Major Version",
-                        pBase->version >> 12);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Minor Version",
-                        pBase->version & 0xFFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Checksum",
-                        pBase->checksum);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Length",
-                        pBase->length);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "RegDomain1",
-                        pBase->regDmn[0]);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "RegDomain2",
-                        pBase->regDmn[1]);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "TX Mask", pBase->txMask);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "RX Mask", pBase->rxMask);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Allow 5GHz",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Allow 2GHz",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 2GHz HT20",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 2GHz HT40",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 5Ghz HT20",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 5Ghz HT40",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Big Endian",
-                        !!(pBase->eepMisc & 0x01));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Major Ver",
-                        (pBase->binBuildNumber >> 24) & 0xFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Minor Ver",
-                        (pBase->binBuildNumber >> 16) & 0xFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Build",
-                        (pBase->binBuildNumber >> 8) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Major Version",
+                         pBase->version >> 12);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Minor Version",
+                         pBase->version & 0xFFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Checksum",
+                         pBase->checksum);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Length",
+                         pBase->length);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "RegDomain1",
+                         pBase->regDmn[0]);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "RegDomain2",
+                         pBase->regDmn[1]);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "TX Mask", pBase->txMask);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "RX Mask", pBase->rxMask);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Allow 5GHz",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Allow 2GHz",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 2GHz HT20",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 2GHz HT40",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 5Ghz HT20",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 5Ghz HT40",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Big Endian",
+                         !!(pBase->eepMisc & 0x01));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Major Ver",
+                         (pBase->binBuildNumber >> 24) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Minor Ver",
+                         (pBase->binBuildNumber >> 16) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Build",
+                         (pBase->binBuildNumber >> 8) & 0xFF);
 
         /*
          * UB91 specific data.
@@ -579,10 +579,10 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
                 struct base_eep_header_4k *pBase4k =
                         &priv->ah->eeprom.map4k.baseEepHeader;
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10d\n",
-                                "TX Gain type",
-                                pBase4k->txGainType);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10d\n",
+                                 "TX Gain type",
+                                 pBase4k->txGainType);
         }
 
         /*
@@ -592,19 +592,19 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
                 struct base_eep_ar9287_header *pBase9287 =
                         &priv->ah->eeprom.map9287.baseEepHeader;
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10ddB\n",
-                                "Power Table Offset",
-                                pBase9287->pwrTableOffset);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10ddB\n",
+                                 "Power Table Offset",
+                                 pBase9287->pwrTableOffset);
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10d\n",
-                                "OpenLoop Power Ctrl",
-                                pBase9287->openLoopPwrCntl);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10d\n",
+                                 "OpenLoop Power Ctrl",
+                                 pBase9287->openLoopPwrCntl);
         }
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
         if (len > size)
                 len = size;
 
@@ -627,8 +627,8 @@ static ssize_t read_4k_modal_eeprom(struct file *file,
 {
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
         struct ath9k_htc_priv *priv = file->private_data;
@@ -708,12 +708,12 @@ static ssize_t read_def_modal_eeprom(struct file *file,
         do {                                                            \
                 if (pBase->opCapFlags & AR5416_OPFLAGS_11G) {           \
                         pModal = &priv->ah->eeprom.def.modalHeader[1];  \
-                        len += snprintf(buf + len, size - len, "%20s : %8d%7s", \
-                                        _s, (_val), "|");               \
+                        len += scnprintf(buf + len, size - len, "%20s : %8d%7s", \
+                                         _s, (_val), "|");              \
                 }                                                       \
                 if (pBase->opCapFlags & AR5416_OPFLAGS_11A) {           \
                         pModal = &priv->ah->eeprom.def.modalHeader[0];  \
-                        len += snprintf(buf + len, size - len, "%9d\n", \
+                        len += scnprintf(buf + len, size - len, "%9d\n",\
                                         (_val));                        \
                 }                                                       \
         } while (0)
@@ -729,10 +729,10 @@ static ssize_t read_def_modal_eeprom(struct file *file,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%31s %15s\n", "2G", "5G");
-        len += snprintf(buf + len, size - len,
-                        "%32s %16s\n", "====", "====\n");
+        len += scnprintf(buf + len, size - len,
+                         "%31s %15s\n", "2G", "5G");
+        len += scnprintf(buf + len, size - len,
+                         "%32s %16s\n", "====", "====\n");
 
         PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
         PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
@@ -814,8 +814,8 @@ static ssize_t read_9287_modal_eeprom(struct file *file,
 {
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
         struct ath9k_htc_priv *priv = file->private_data;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index d44258172c0f..9a2657fdd9cc 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -24,30 +24,10 @@
 static enum htc_phymode ath9k_htc_get_curmode(struct ath9k_htc_priv *priv,
                                               struct ath9k_channel *ichan)
 {
-        enum htc_phymode mode;
-
-        mode = -EINVAL;
-
-        switch (ichan->chanmode) {
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                mode = HTC_MODE_11NG;
-                break;
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                mode = HTC_MODE_11NA;
-                break;
-        default:
-                break;
-        }
+        if (IS_CHAN_5GHZ(ichan))
+                return HTC_MODE_11NA;
 
-        WARN_ON(mode < 0);
-
-        return mode;
+        return HTC_MODE_11NG;
 }
 
 bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
@@ -926,7 +906,7 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         WMI_CMD(WMI_FLUSH_RECV_CMDID);
 
         /* setup initial channel */
-        init_channel = ath9k_cmn_get_curchannel(hw, ah);
+        init_channel = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         ret = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (ret) {
@@ -1208,9 +1188,7 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 ath_dbg(common, CONFIG, "Set channel: %d MHz\n",
                         curchan->center_freq);
 
-                ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
-                                          &hw->conf.chandef);
-
+                ath9k_cmn_get_channel(hw, priv->ah, &hw->conf.chandef);
                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
                         ath_err(common, "Unable to set channel\n");
                         ret = -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ecc6ec4a1edb..dcdbab48709e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -130,29 +130,29 @@ void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause)
 
 static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
         unsigned int clockrate;
 
         /* AR9287 v1.3+ uses async FIFO and runs the MAC at 117 MHz */
         if (AR_SREV_9287(ah) && AR_SREV_9287_13_OR_LATER(ah))
                 clockrate = 117;
-        else if (!ah->curchan) /* should really check for CCK instead */
+        else if (!chan) /* should really check for CCK instead */
                 clockrate = ATH9K_CLOCK_RATE_CCK;
-        else if (conf->chandef.chan->band == IEEE80211_BAND_2GHZ)
+        else if (IS_CHAN_2GHZ(chan))
                 clockrate = ATH9K_CLOCK_RATE_2GHZ_OFDM;
         else if (ah->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK)
                 clockrate = ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
         else
                 clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
 
-        if (conf_is_ht40(conf))
+        if (IS_CHAN_HT40(chan))
                 clockrate *= 2;
 
         if (ah->curchan) {
-                if (IS_CHAN_HALF_RATE(ah->curchan))
+                if (IS_CHAN_HALF_RATE(chan))
                         clockrate /= 2;
-                if (IS_CHAN_QUARTER_RATE(ah->curchan))
+                if (IS_CHAN_QUARTER_RATE(chan))
                         clockrate /= 4;
         }
 
@@ -190,10 +190,7 @@ EXPORT_SYMBOL(ath9k_hw_wait);
 void ath9k_hw_synth_delay(struct ath_hw *ah, struct ath9k_channel *chan,
                           int hw_delay)
 {
-        if (IS_CHAN_B(chan))
-                hw_delay = (4 * hw_delay) / 22;
-        else
-                hw_delay /= 10;
+        hw_delay /= 10;
 
         if (IS_CHAN_HALF_RATE(chan))
                 hw_delay *= 2;
@@ -294,8 +291,7 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
                 return;
         }
 
-        if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-            (chan->chanmode == CHANNEL_G_HT40PLUS)) {
+        if (IS_CHAN_HT40PLUS(chan)) {
                 centers->synth_center =
                         chan->channel + HT40_CHANNEL_CENTER_SHIFT;
                 extoff = 1;
@@ -549,6 +545,18 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
 
         ath9k_hw_ani_init(ah);
 
+        /*
+         * EEPROM needs to be initialized before we do this.
+         * This is required for regulatory compliance.
+         */
+        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                u16 regdmn = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
+                if ((regdmn & 0xF0) == CTL_FCC) {
+                        ah->nf_2g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ;
+                        ah->nf_5g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ;
+                }
+        }
+
         return 0;
 }
 
@@ -1030,7 +1038,6 @@ static bool ath9k_hw_set_global_txtimeout(struct ath_hw *ah, u32 tu)
 void ath9k_hw_init_global_settings(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         const struct ath9k_channel *chan = ah->curchan;
         int acktimeout, ctstimeout, ack_offset = 0;
         int slottime;
@@ -1105,8 +1112,7 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
          * BA frames in some implementations, but it has been found to fix ACK
          * timeout issues in other cases as well.
          */
-        if (conf->chandef.chan &&
-            conf->chandef.chan->band == IEEE80211_BAND_2GHZ &&
+        if (IS_CHAN_2GHZ(chan) &&
             !IS_CHAN_HALF_RATE(chan) && !IS_CHAN_QUARTER_RATE(chan)) {
                 acktimeout += 64 - sifstime - ah->slottime;
                 ctstimeout += 48 - sifstime - ah->slottime;
@@ -1148,9 +1154,7 @@ u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan)
 {
         u32 ctl = ath_regd_get_band_ctl(reg, chan->chan->band);
 
-        if (IS_CHAN_B(chan))
-                ctl |= CTL_11B;
-        else if (IS_CHAN_G(chan))
+        if (IS_CHAN_2GHZ(chan))
                 ctl |= CTL_11G;
         else
                 ctl |= CTL_11A;
@@ -1498,10 +1502,8 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         int r;
 
         if (pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) {
-                u32 cur = ah->curchan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
-                u32 new = chan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
-                band_switch = (cur != new);
-                mode_diff = (chan->chanmode != ah->curchan->chanmode);
+                band_switch = IS_CHAN_5GHZ(ah->curchan) != IS_CHAN_5GHZ(chan);
+                mode_diff = (chan->channelFlags != ah->curchan->channelFlags);
         }
 
         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
@@ -1540,9 +1542,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         ath9k_hw_set_clockrate(ah);
         ath9k_hw_apply_txpower(ah, chan, false);
 
-        if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
-                ath9k_hw_set_delta_slope(ah, chan);
-
+        ath9k_hw_set_delta_slope(ah, chan);
         ath9k_hw_spur_mitigate_freq(ah, chan);
 
         if (band_switch || ini_reloaded)
@@ -1644,6 +1644,19 @@ hang_check_iter:
         return true;
 }
 
+void ath9k_hw_check_nav(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 val;
+
+        val = REG_READ(ah, AR_NAV);
+        if (val != 0xdeadbeef && val > 0x7fff) {
+                ath_dbg(common, BSTUCK, "Abnormal NAV: 0x%x\n", val);
+                REG_WRITE(ah, AR_NAV, 0);
+        }
+}
+EXPORT_SYMBOL(ath9k_hw_check_nav);
+
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
         int count = 50;
@@ -1799,20 +1812,11 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
                 goto fail;
 
         /*
-         * If cross-band fcc is not supoprted, bail out if
-         * either channelFlags or chanmode differ.
-         *
-         * chanmode will be different if the HT operating mode
-         * changes because of CSA.
+         * If cross-band fcc is not supoprted, bail out if channelFlags differ.
          */
-        if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH)) {
-                if ((chan->channelFlags & CHANNEL_ALL) !=
-                    (ah->curchan->channelFlags & CHANNEL_ALL))
-                        goto fail;
-
-                if (chan->chanmode != ah->curchan->chanmode)
-                        goto fail;
-        }
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) &&
+            chan->channelFlags != ah->curchan->channelFlags)
+                goto fail;
 
         if (!ath9k_hw_check_alive(ah))
                 goto fail;
@@ -1822,9 +1826,9 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
          * re-using are present.
          */
         if (AR_SREV_9462(ah) && (ah->caldata &&
-                                 (!ah->caldata->done_txiqcal_once ||
-                                  !ah->caldata->done_txclcal_once ||
-                                  !ah->caldata->rtt_done)))
+                                 (!test_bit(TXIQCAL_DONE, &ah->caldata->cal_flags) ||
+                                  !test_bit(TXCLCAL_DONE, &ah->caldata->cal_flags) ||
+                                  !test_bit(RTT_DONE, &ah->caldata->cal_flags))))
                 goto fail;
 
         ath_dbg(common, RESET, "FastChannelChange for %d -> %d\n",
@@ -1874,13 +1878,12 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ah->caldata = caldata;
         if (caldata && (chan->channel != caldata->channel ||
-                        chan->channelFlags != caldata->channelFlags ||
-                        chan->chanmode != caldata->chanmode)) {
+                        chan->channelFlags != caldata->channelFlags)) {
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
         } else if (caldata) {
-                caldata->paprd_packet_sent = false;
+                clear_bit(PAPRD_PACKET_SENT, &caldata->cal_flags);
         }
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
 
@@ -1964,9 +1967,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_init_mfp(ah);
 
-        if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
-                ath9k_hw_set_delta_slope(ah, chan);
-
+        ath9k_hw_set_delta_slope(ah, chan);
         ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
@@ -2017,8 +2018,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_init_bb(ah, chan);
 
         if (caldata) {
-                caldata->done_txiqcal_once = false;
-                caldata->done_txclcal_once = false;
+                clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                clear_bit(TXCLCAL_DONE, &caldata->cal_flags);
         }
         if (!ath9k_hw_init_cal(ah, chan))
                 return -EIO;
@@ -2943,12 +2944,11 @@ void ath9k_hw_set_tsfadjust(struct ath_hw *ah, bool set)
 }
 EXPORT_SYMBOL(ath9k_hw_set_tsfadjust);
 
-void ath9k_hw_set11nmac2040(struct ath_hw *ah)
+void ath9k_hw_set11nmac2040(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         u32 macmode;
 
-        if (conf_is_ht40(conf) && !ah->config.cwm_ignore_extcca)
+        if (IS_CHAN_HT40(chan) && !ah->config.cwm_ignore_extcca)
                 macmode = AR_2040_JOINED_RX_CLEAR;
         else
                 macmode = 0;
@@ -3240,19 +3240,19 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len)
 
         /* chipsets >= AR9280 are single-chip */
         if (AR_SREV_9280_20_OR_LATER(ah)) {
-                used = snprintf(hw_name, len,
-                               "Atheros AR%s Rev:%x",
-                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
-                               ah->hw_version.macRev);
+                used = scnprintf(hw_name, len,
+                                 "Atheros AR%s Rev:%x",
+                                 ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                                 ah->hw_version.macRev);
         }
         else {
-                used = snprintf(hw_name, len,
-                               "Atheros AR%s MAC/BB Rev:%x AR%s RF Rev:%x",
-                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
-                               ah->hw_version.macRev,
-                               ath9k_hw_rf_name((ah->hw_version.analog5GhzRev &
-                                                AR_RADIO_SREV_MAJOR)),
-                               ah->hw_version.phyRev);
+                used = scnprintf(hw_name, len,
+                                 "Atheros AR%s MAC/BB Rev:%x AR%s RF Rev:%x",
+                                 ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                                 ah->hw_version.macRev,
+                                 ath9k_hw_rf_name((ah->hw_version.analog5GhzRev
+                                                  & AR_RADIO_SREV_MAJOR)),
+                                 ah->hw_version.phyRev);
         }
 
         hw_name[used] = '\0';
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 69a907b55a73..81fcbc756122 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -98,8 +98,8 @@
 
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
 #define SM(_v, _f)  (((_v) << _f##_S) & _f)
@@ -369,55 +369,30 @@ enum ath9k_int {
         ATH9K_INT_NOCARD = 0xffffffff
 };
 
-#define CHANNEL_CCK       0x00020
-#define CHANNEL_OFDM      0x00040
-#define CHANNEL_2GHZ      0x00080
-#define CHANNEL_5GHZ      0x00100
-#define CHANNEL_PASSIVE   0x00200
-#define CHANNEL_DYN       0x00400
-#define CHANNEL_HALF      0x04000
-#define CHANNEL_QUARTER   0x08000
-#define CHANNEL_HT20      0x10000
-#define CHANNEL_HT40PLUS  0x20000
-#define CHANNEL_HT40MINUS 0x40000
-
-#define CHANNEL_A           (CHANNEL_5GHZ|CHANNEL_OFDM)
-#define CHANNEL_B           (CHANNEL_2GHZ|CHANNEL_CCK)
-#define CHANNEL_G           (CHANNEL_2GHZ|CHANNEL_OFDM)
-#define CHANNEL_G_HT20      (CHANNEL_2GHZ|CHANNEL_HT20)
-#define CHANNEL_A_HT20      (CHANNEL_5GHZ|CHANNEL_HT20)
-#define CHANNEL_G_HT40PLUS  (CHANNEL_2GHZ|CHANNEL_HT40PLUS)
-#define CHANNEL_G_HT40MINUS (CHANNEL_2GHZ|CHANNEL_HT40MINUS)
-#define CHANNEL_A_HT40PLUS  (CHANNEL_5GHZ|CHANNEL_HT40PLUS)
-#define CHANNEL_A_HT40MINUS (CHANNEL_5GHZ|CHANNEL_HT40MINUS)
-#define CHANNEL_ALL                             \
-        (CHANNEL_OFDM|                          \
-         CHANNEL_CCK|                           \
-         CHANNEL_2GHZ |                         \
-         CHANNEL_5GHZ |                         \
-         CHANNEL_HT20 |                         \
-         CHANNEL_HT40PLUS |                     \
-         CHANNEL_HT40MINUS)
-
 #define MAX_RTT_TABLE_ENTRY     6
 #define MAX_IQCAL_MEASUREMENT   8
 #define MAX_CL_TAB_ENTRY        16
 #define CL_TAB_ENTRY(reg_base)  (reg_base + (4 * j))
 
+enum ath9k_cal_flags {
+        RTT_DONE,
+        PAPRD_PACKET_SENT,
+        PAPRD_DONE,
+        NFCAL_PENDING,
+        NFCAL_INTF,
+        TXIQCAL_DONE,
+        TXCLCAL_DONE,
+        SW_PKDET_DONE,
+};
+
 struct ath9k_hw_cal_data {
         u16 channel;
-        u32 channelFlags;
-        u32 chanmode;
+        u16 channelFlags;
+        unsigned long cal_flags;
         int32_t CalValid;
         int8_t iCoff;
         int8_t qCoff;
-        bool rtt_done;
-        bool paprd_packet_sent;
-        bool paprd_done;
-        bool nfcal_pending;
-        bool nfcal_interference;
-        bool done_txiqcal_once;
-        bool done_txclcal_once;
+        u8 caldac[2];
         u16 small_signal_gain[AR9300_MAX_CHAINS];
         u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
         u32 num_measures[AR9300_MAX_CHAINS];
@@ -430,33 +405,34 @@ struct ath9k_hw_cal_data {
 struct ath9k_channel {
         struct ieee80211_channel *chan;
         u16 channel;
-        u32 channelFlags;
-        u32 chanmode;
+        u16 channelFlags;
         s16 noisefloor;
 };
 
-#define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
-       (((_c)->channelFlags & CHANNEL_G_HT20) == CHANNEL_G_HT20) || \
-       (((_c)->channelFlags & CHANNEL_G_HT40PLUS) == CHANNEL_G_HT40PLUS) || \
-       (((_c)->channelFlags & CHANNEL_G_HT40MINUS) == CHANNEL_G_HT40MINUS))
-#define IS_CHAN_OFDM(_c) (((_c)->channelFlags & CHANNEL_OFDM) != 0)
-#define IS_CHAN_5GHZ(_c) (((_c)->channelFlags & CHANNEL_5GHZ) != 0)
-#define IS_CHAN_2GHZ(_c) (((_c)->channelFlags & CHANNEL_2GHZ) != 0)
-#define IS_CHAN_HALF_RATE(_c) (((_c)->channelFlags & CHANNEL_HALF) != 0)
-#define IS_CHAN_QUARTER_RATE(_c) (((_c)->channelFlags & CHANNEL_QUARTER) != 0)
+#define CHANNEL_5GHZ            BIT(0)
+#define CHANNEL_HALF            BIT(1)
+#define CHANNEL_QUARTER         BIT(2)
+#define CHANNEL_HT              BIT(3)
+#define CHANNEL_HT40PLUS        BIT(4)
+#define CHANNEL_HT40MINUS       BIT(5)
+
+#define IS_CHAN_5GHZ(_c) (!!((_c)->channelFlags & CHANNEL_5GHZ))
+#define IS_CHAN_2GHZ(_c) (!IS_CHAN_5GHZ(_c))
+
+#define IS_CHAN_HALF_RATE(_c) (!!((_c)->channelFlags & CHANNEL_HALF))
+#define IS_CHAN_QUARTER_RATE(_c) (!!((_c)->channelFlags & CHANNEL_QUARTER))
 #define IS_CHAN_A_FAST_CLOCK(_ah, _c)                   \
-        ((((_c)->channelFlags & CHANNEL_5GHZ) != 0) &&  \
-         ((_ah)->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK))
-
-/* These macros check chanmode and not channelFlags */
-#define IS_CHAN_B(_c) ((_c)->chanmode == CHANNEL_B)
-#define IS_CHAN_HT20(_c) (((_c)->chanmode == CHANNEL_A_HT20) || \
-                          ((_c)->chanmode == CHANNEL_G_HT20))
-#define IS_CHAN_HT40(_c) (((_c)->chanmode == CHANNEL_A_HT40PLUS) ||     \
-                          ((_c)->chanmode == CHANNEL_A_HT40MINUS) ||    \
-                          ((_c)->chanmode == CHANNEL_G_HT40PLUS) ||     \
-                          ((_c)->chanmode == CHANNEL_G_HT40MINUS))
-#define IS_CHAN_HT(_c) (IS_CHAN_HT20((_c)) || IS_CHAN_HT40((_c)))
+        (IS_CHAN_5GHZ(_c) && ((_ah)->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK))
+
+#define IS_CHAN_HT(_c) ((_c)->channelFlags & CHANNEL_HT)
+
+#define IS_CHAN_HT20(_c) (IS_CHAN_HT(_c) && !IS_CHAN_HT40(_c))
+
+#define IS_CHAN_HT40(_c) \
+        (!!((_c)->channelFlags & (CHANNEL_HT40PLUS | CHANNEL_HT40MINUS)))
+
+#define IS_CHAN_HT40PLUS(_c) ((_c)->channelFlags & CHANNEL_HT40PLUS)
+#define IS_CHAN_HT40MINUS(_c) ((_c)->channelFlags & CHANNEL_HT40MINUS)
 
 enum ath9k_power_mode {
         ATH9K_PM_AWAKE = 0,
@@ -558,6 +534,7 @@ struct ath_hw_antcomb_conf {
         u8 main_gaintb;
         u8 alt_gaintb;
         int lna1_lna2_delta;
+        int lna1_lna2_switch_delta;
         u8 div_group;
 };
 
@@ -1026,10 +1003,11 @@ void ath9k_hw_reset_tsf(struct ath_hw *ah);
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, bool set);
 void ath9k_hw_init_global_settings(struct ath_hw *ah);
 u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah);
-void ath9k_hw_set11nmac2040(struct ath_hw *ah);
+void ath9k_hw_set11nmac2040(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs);
+void ath9k_hw_check_nav(struct ath_hw *ah);
 bool ath9k_hw_check_alive(struct ath_hw *ah);
 
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 9a1f349f9260..7df728f36330 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -347,7 +347,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u8 *ds;
-        struct ath_buf *bf;
         int i, bsize, desc_len;
 
         ath_dbg(common, CONFIG, "%s DMA: %u buffers %u desc/buf\n",
@@ -399,33 +398,68 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                 ito64(dd->dd_desc_paddr), /*XXX*/(u32) dd->dd_desc_len);
 
         /* allocate buffers */
-        bsize = sizeof(struct ath_buf) * nbuf;
-        bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
-        if (!bf)
-                return -ENOMEM;
+        if (is_tx) {
+                struct ath_buf *bf;
+
+                bsize = sizeof(struct ath_buf) * nbuf;
+                bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
+                if (!bf)
+                        return -ENOMEM;
+
+                for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
+                        bf->bf_desc = ds;
+                        bf->bf_daddr = DS2PHYS(dd, ds);
+
+                        if (!(sc->sc_ah->caps.hw_caps &
+                                  ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                                /*
+                                 * Skip descriptor addresses which can cause 4KB
+                                 * boundary crossing (addr + length) with a 32 dword
+                                 * descriptor fetch.
+                                 */
+                                while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
+                                        BUG_ON((caddr_t) bf->bf_desc >=
+                                                   ((caddr_t) dd->dd_desc +
+                                                dd->dd_desc_len));
+
+                                        ds += (desc_len * ndesc);
+                                        bf->bf_desc = ds;
+                                        bf->bf_daddr = DS2PHYS(dd, ds);
+                                }
+                        }
+                        list_add_tail(&bf->list, head);
+                }
+        } else {
+                struct ath_rxbuf *bf;
+
+                bsize = sizeof(struct ath_rxbuf) * nbuf;
+                bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
+                if (!bf)
+                        return -ENOMEM;
 
-        for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
-                bf->bf_desc = ds;
-                bf->bf_daddr = DS2PHYS(dd, ds);
-
-                if (!(sc->sc_ah->caps.hw_caps &
-                      ATH9K_HW_CAP_4KB_SPLITTRANS)) {
-                        /*
-                         * Skip descriptor addresses which can cause 4KB
-                         * boundary crossing (addr + length) with a 32 dword
-                         * descriptor fetch.
-                         */
-                        while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
-                                BUG_ON((caddr_t) bf->bf_desc >=
-                                       ((caddr_t) dd->dd_desc +
-                                        dd->dd_desc_len));
-
-                                ds += (desc_len * ndesc);
-                                bf->bf_desc = ds;
-                                bf->bf_daddr = DS2PHYS(dd, ds);
+                for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
+                        bf->bf_desc = ds;
+                        bf->bf_daddr = DS2PHYS(dd, ds);
+
+                        if (!(sc->sc_ah->caps.hw_caps &
+                                  ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                                /*
+                                 * Skip descriptor addresses which can cause 4KB
+                                 * boundary crossing (addr + length) with a 32 dword
+                                 * descriptor fetch.
+                                 */
+                                while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
+                                        BUG_ON((caddr_t) bf->bf_desc >=
+                                                   ((caddr_t) dd->dd_desc +
+                                                dd->dd_desc_len));
+
+                                        ds += (desc_len * ndesc);
+                                        bf->bf_desc = ds;
+                                        bf->bf_daddr = DS2PHYS(dd, ds);
+                                }
                         }
+                        list_add_tail(&bf->list, head);
                 }
-                list_add_tail(&bf->list, head);
         }
         return 0;
 }
@@ -437,7 +471,6 @@ static int ath9k_init_queues(struct ath_softc *sc)
         sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
         sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
 
-        sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
         ath_cabq_update(sc);
 
         sc->tx.uapsdq = ath_txq_setup(sc, ATH9K_TX_QUEUE_UAPSD, 0);
@@ -547,6 +580,26 @@ static void ath9k_init_platform(struct ath_softc *sc)
         if (sc->driver_data & ATH9K_PCI_CUS217)
                 ath_info(common, "CUS217 card detected\n");
 
+        if (sc->driver_data & ATH9K_PCI_CUS252)
+                ath_info(common, "CUS252 card detected\n");
+
+        if (sc->driver_data & ATH9K_PCI_AR9565_1ANT)
+                ath_info(common, "WB335 1-ANT card detected\n");
+
+        if (sc->driver_data & ATH9K_PCI_AR9565_2ANT)
+                ath_info(common, "WB335 2-ANT card detected\n");
+
+        /*
+         * Some WB335 cards do not support antenna diversity. Since
+         * we use a hardcoded value for AR9565 instead of using the
+         * EEPROM/OTP data, remove the combining feature from
+         * the HW capabilities bitmap.
+         */
+        if (sc->driver_data & (ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_AR9565_2ANT)) {
+                if (!(sc->driver_data & ATH9K_PCI_BT_ANT_DIV))
+                        pCap->hw_caps &= ~ATH9K_HW_CAP_ANT_DIV_COMB;
+        }
+
         if (sc->driver_data & ATH9K_PCI_BT_ANT_DIV) {
                 pCap->hw_caps |= ATH9K_HW_CAP_BT_ANT_DIV;
                 ath_info(common, "Set BT/WLAN RX diversity capability\n");
@@ -748,7 +801,7 @@ static void ath9k_init_band_txpower(struct ath_softc *sc, int band)
                 chan = &sband->channels[i];
                 ah->curchan = &ah->channels[chan->hw_value];
                 cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
-                ath9k_cmn_update_ichannel(ah->curchan, &chandef);
+                ath9k_cmn_get_channel(sc->hw, ah, &chandef);
                 ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 2f831db396ac..84a60644f93a 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -184,7 +184,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
         struct ath9k_hw_cal_data *caldata = ah->caldata;
         int chain;
 
-        if (!caldata || !caldata->paprd_done) {
+        if (!caldata || !test_bit(PAPRD_DONE, &caldata->cal_flags)) {
                 ath_dbg(common, CALIBRATE, "Failed to activate PAPRD\n");
                 return;
         }
@@ -256,7 +256,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int len = 1800;
         int ret;
 
-        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done) {
+        if (!caldata ||
+            !test_bit(PAPRD_PACKET_SENT, &caldata->cal_flags) ||
+            test_bit(PAPRD_DONE, &caldata->cal_flags)) {
                 ath_dbg(common, CALIBRATE, "Skipping PAPRD calibration\n");
                 return;
         }
@@ -316,7 +318,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         kfree_skb(skb);
 
         if (chain_ok) {
-                caldata->paprd_done = true;
+                set_bit(PAPRD_DONE, &caldata->cal_flags);
                 ath_paprd_activate(sc);
         }
 
@@ -343,7 +345,7 @@ void ath_ani_calibrate(unsigned long data)
         u32 cal_interval, short_cal_interval, long_cal_interval;
         unsigned long flags;
 
-        if (ah->caldata && ah->caldata->nfcal_interference)
+        if (ah->caldata && test_bit(NFCAL_INTF, &ah->caldata->cal_flags))
                 long_cal_interval = ATH_LONG_CALINTERVAL_INT;
         else
                 long_cal_interval = ATH_LONG_CALINTERVAL;
@@ -432,7 +434,7 @@ set_timer:
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
 
         if (ar9003_is_paprd_enabled(ah) && ah->caldata) {
-                if (!ah->caldata->paprd_done) {
+                if (!test_bit(PAPRD_DONE, &ah->caldata->cal_flags)) {
                         ieee80211_queue_work(sc->hw, &sc->paprd_work);
                 } else if (!ah->paprd_table_write_done) {
                         ath9k_ps_wakeup(sc);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index a3eff0986a3f..6a18f9d3e9cc 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -374,7 +374,6 @@ EXPORT_SYMBOL(ath9k_hw_releasetxqueue);
 bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_channel *chan = ah->curchan;
         struct ath9k_tx_queue_info *qi;
         u32 cwMin, chanCwMin, value;
 
@@ -387,10 +386,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         ath_dbg(common, QUEUE, "Reset TX queue: %u\n", q);
 
         if (qi->tqi_cwmin == ATH9K_TXQ_USEDEFAULT) {
-                if (chan && IS_CHAN_B(chan))
-                        chanCwMin = INIT_CWMIN_11B;
-                else
-                        chanCwMin = INIT_CWMIN;
+                chanCwMin = INIT_CWMIN;
 
                 for (cwMin = 1; cwMin < chanCwMin; cwMin = (cwMin << 1) | 1);
         } else
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index bfccaceed44e..e3eed81f2439 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -603,8 +603,6 @@ enum ath9k_tx_queue_flags {
 #define ATH9K_TXQ_USE_LOCKOUT_BKOFF_DIS 0x00000001
 
 #define ATH9K_DECOMP_MASK_SIZE     128
-#define ATH9K_READY_TIME_LO_BOUND  50
-#define ATH9K_READY_TIME_HI_BOUND  96
 
 enum ath9k_pkt_type {
         ATH9K_PKT_TYPE_NORMAL = 0,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 709301f88dcd..20a2fbc1e34f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -312,17 +312,91 @@ out:
  * by reseting the chip.  To accomplish this we must first cleanup any pending
  * DMA, then restart stuff.
 */
-static int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
-                    struct ath9k_channel *hchan)
+static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chandef)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath9k_channel *hchan;
+        struct ieee80211_channel *chan = chandef->chan;
+        unsigned long flags;
+        bool offchannel;
+        int pos = chan->hw_value;
+        int old_pos = -1;
         int r;
 
         if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return -EIO;
 
+        offchannel = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
+
+        if (ah->curchan)
+                old_pos = ah->curchan - &ah->channels[0];
+
+        ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
+                chan->center_freq, chandef->width);
+
+        /* update survey stats for the old channel before switching */
+        spin_lock_irqsave(&common->cc_lock, flags);
+        ath_update_survey_stats(sc);
+        spin_unlock_irqrestore(&common->cc_lock, flags);
+
+        ath9k_cmn_get_channel(hw, ah, chandef);
+
+        /*
+         * If the operating channel changes, change the survey in-use flags
+         * along with it.
+         * Reset the survey data for the new channel, unless we're switching
+         * back to the operating channel from an off-channel operation.
+         */
+        if (!offchannel && sc->cur_survey != &sc->survey[pos]) {
+                if (sc->cur_survey)
+                        sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
+
+                sc->cur_survey = &sc->survey[pos];
+
+                memset(sc->cur_survey, 0, sizeof(struct survey_info));
+                sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
+        } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
+                memset(&sc->survey[pos], 0, sizeof(struct survey_info));
+        }
+
+        hchan = &sc->sc_ah->channels[pos];
         r = ath_reset_internal(sc, hchan);
+        if (r)
+                return r;
 
-        return r;
+        /*
+         * The most recent snapshot of channel->noisefloor for the old
+         * channel is only available after the hardware reset. Copy it to
+         * the survey stats now.
+         */
+        if (old_pos >= 0)
+                ath_update_survey_nf(sc, old_pos);
+
+        /*
+         * Enable radar pulse detection if on a DFS channel. Spectral
+         * scanning and radar detection can not be used concurrently.
+         */
+        if (hw->conf.radar_enabled) {
+                u32 rxfilter;
+
+                /* set HW specific DFS configuration */
+                ath9k_hw_set_radar_params(ah);
+                rxfilter = ath9k_hw_getrxfilter(ah);
+                rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
+                                ATH9K_RX_FILTER_PHYERR;
+                ath9k_hw_setrxfilter(ah, rxfilter);
+                ath_dbg(common, DFS, "DFS enabled at freq %d\n",
+                        chan->center_freq);
+        } else {
+                /* perform spectral scan if requested. */
+                if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
+                        sc->spectral_mode == SPECTRAL_CHANSCAN)
+                        ath9k_spectral_scan_trigger(hw);
+        }
+
+        return 0;
 }
 
 static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
@@ -372,6 +446,13 @@ void ath9k_tasklet(unsigned long data)
                         type = RESET_TYPE_BB_WATCHDOG;
 
                 ath9k_queue_reset(sc, type);
+
+                /*
+                 * Increment the ref. counter here so that
+                 * interrupts are enabled in the reset routine.
+                 */
+                atomic_inc(&ah->intr_ref_cnt);
+                ath_dbg(common, ANY, "FATAL: Skipping interrupts\n");
                 goto out;
         }
 
@@ -410,10 +491,9 @@ void ath9k_tasklet(unsigned long data)
 
         ath9k_btcoex_handle_interrupt(sc, status);
 
-out:
         /* re-enable hardware interrupt */
         ath9k_hw_enable_interrupts(ah);
-
+out:
         spin_unlock(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
 }
@@ -594,7 +674,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
         ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
-        init_channel = ath9k_cmn_get_curchannel(hw, ah);
+        init_channel = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         /* Reset SERDES registers */
         ath9k_hw_configpcipowersave(ah, false);
@@ -797,7 +877,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         }
 
         if (!ah->curchan)
-                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
+                ah->curchan = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         ath9k_hw_phy_disable(ah);
@@ -816,7 +896,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         ath_dbg(common, CONFIG, "Driver halt\n");
 }
 
-bool ath9k_uses_beacons(int type)
+static bool ath9k_uses_beacons(int type)
 {
         switch (type) {
         case NL80211_IFTYPE_AP:
@@ -1201,81 +1281,12 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         }
 
         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
-                struct ieee80211_channel *curchan = hw->conf.chandef.chan;
-                int pos = curchan->hw_value;
-                int old_pos = -1;
-                unsigned long flags;
-
-                if (ah->curchan)
-                        old_pos = ah->curchan - &ah->channels[0];
-
-                ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
-                        curchan->center_freq, hw->conf.chandef.width);
-
-                /* update survey stats for the old channel before switching */
-                spin_lock_irqsave(&common->cc_lock, flags);
-                ath_update_survey_stats(sc);
-                spin_unlock_irqrestore(&common->cc_lock, flags);
-
-                ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
-                                          &conf->chandef);
-
-                /*
-                 * If the operating channel changes, change the survey in-use flags
-                 * along with it.
-                 * Reset the survey data for the new channel, unless we're switching
-                 * back to the operating channel from an off-channel operation.
-                 */
-                if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) &&
-                    sc->cur_survey != &sc->survey[pos]) {
-
-                        if (sc->cur_survey)
-                                sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
-
-                        sc->cur_survey = &sc->survey[pos];
-
-                        memset(sc->cur_survey, 0, sizeof(struct survey_info));
-                        sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
-                } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
-                        memset(&sc->survey[pos], 0, sizeof(struct survey_info));
-                }
-
-                if (ath_set_channel(sc, hw, &sc->sc_ah->channels[pos]) < 0) {
+                if (ath_set_channel(sc, &hw->conf.chandef) < 0) {
                         ath_err(common, "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         ath9k_ps_restore(sc);
                         return -EINVAL;
                 }
-
-                /*
-                 * The most recent snapshot of channel->noisefloor for the old
-                 * channel is only available after the hardware reset. Copy it to
-                 * the survey stats now.
-                 */
-                if (old_pos >= 0)
-                        ath_update_survey_nf(sc, old_pos);
-
-                /*
-                 * Enable radar pulse detection if on a DFS channel. Spectral
-                 * scanning and radar detection can not be used concurrently.
-                 */
-                if (hw->conf.radar_enabled) {
-                        u32 rxfilter;
-
-                        /* set HW specific DFS configuration */
-                        ath9k_hw_set_radar_params(ah);
-                        rxfilter = ath9k_hw_getrxfilter(ah);
-                        rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
-                                    ATH9K_RX_FILTER_PHYERR;
-                        ath9k_hw_setrxfilter(ah, rxfilter);
-                        ath_dbg(common, DFS, "DFS enabled at freq %d\n",
-                                curchan->center_freq);
-                } else {
-                        /* perform spectral scan if requested. */
-                        if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
-                            sc->spectral_mode == SPECTRAL_CHANSCAN)
-                                ath9k_spectral_scan_trigger(hw);
-                }
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 815bee21c19a..0ac1b5f04256 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -661,9 +661,9 @@ void ath9k_mci_update_wlan_channels(struct ath_softc *sc, bool allow_all)
         chan_start = wlan_chan - 10;
         chan_end = wlan_chan + 10;
 
-        if (chan->chanmode == CHANNEL_G_HT40PLUS)
+        if (IS_CHAN_HT40PLUS(chan))
                 chan_end += 20;
-        else if (chan->chanmode == CHANNEL_G_HT40MINUS)
+        else if (IS_CHAN_HT40MINUS(chan))
                 chan_start -= 20;
 
         /* adjust side band */
@@ -707,11 +707,11 @@ void ath9k_mci_set_txpower(struct ath_softc *sc, bool setchannel,
 
         if (setchannel) {
                 struct ath9k_hw_cal_data *caldata = &sc->caldata;
-                if ((caldata->chanmode == CHANNEL_G_HT40PLUS) &&
+                if (IS_CHAN_HT40PLUS(ah->curchan) &&
                     (ah->curchan->channel > caldata->channel) &&
                     (ah->curchan->channel <= caldata->channel + 20))
                         return;
-                if ((caldata->chanmode == CHANNEL_G_HT40MINUS) &&
+                if (IS_CHAN_HT40MINUS(ah->curchan) &&
                     (ah->curchan->channel < caldata->channel) &&
                     (ah->curchan->channel >= caldata->channel - 20))
                         return;
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index d089a7cf01c4..7e4c2524b630 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -269,7 +269,200 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
 
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
         { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
-        { PCI_VDEVICE(ATHEROS, 0x0036) }, /* PCI-E  AR9565 */
+
+        /* CUS252 */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3028),
+          .driver_data = ATH9K_PCI_CUS252 |
+                         ATH9K_PCI_AR9565_2ANT |
+                         ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2176),
+          .driver_data = ATH9K_PCI_CUS252 |
+                         ATH9K_PCI_AR9565_2ANT |
+                         ATH9K_PCI_BT_ANT_DIV },
+
+        /* WB335 1-ANT */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE068),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0xA119),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0632),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x6671),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2811),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2812),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+
+        /* WB335 1-ANT / Antenna Diversity */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3025),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x302B),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE069),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0x3028),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0622),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0672),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0662),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_HP,
+                         0x18E3),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_HP,
+                         0x217F),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_DELL,
+                         0x020E),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+
+        /* WB335 2-ANT */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411A),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411D),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411E),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+
+        /* WB335 2-ANT / Antenna-Diversity */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3027),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x302C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0642),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0652),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0612),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2130),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x144F, /* ASKEY */
+                         0x7202),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2810),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0x3027),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+
+        /* PCI-E AR9565 (WB335) */
+        { PCI_VDEVICE(ATHEROS, 0x0036),
+          .driver_data = ATH9K_PCI_BT_ANT_DIV },
+
         { 0 }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index d3d7c51fa6c8..d829bb62a3fc 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1387,31 +1387,31 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
                 int used_mcs = 0, used_htmode = 0;
 
                 if (WLAN_RC_PHY_HT(rc->rate_table->info[i].phy)) {
-                        used_mcs = snprintf(mcs, 5, "%d",
-                                rc->rate_table->info[i].ratecode);
+                        used_mcs = scnprintf(mcs, 5, "%d",
+                                             rc->rate_table->info[i].ratecode);
 
                         if (WLAN_RC_PHY_40(rc->rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT40");
+                                used_htmode = scnprintf(htmode, 5, "HT40");
                         else if (WLAN_RC_PHY_20(rc->rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT20");
+                                used_htmode = scnprintf(htmode, 5, "HT20");
                         else
-                                used_htmode = snprintf(htmode, 5, "????");
+                                used_htmode = scnprintf(htmode, 5, "????");
                 }
 
                 mcs[used_mcs] = '\0';
                 htmode[used_htmode] = '\0';
 
-                len += snprintf(buf + len, max - len,
-                        "%6s %6s %3u.%d: "
-                        "%10u %10u %10u %10u\n",
-                        htmode,
-                        mcs,
-                        ratekbps / 1000,
-                        (ratekbps % 1000) / 100,
-                        stats->success,
-                        stats->retries,
-                        stats->xretries,
-                        stats->per);
+                len += scnprintf(buf + len, max - len,
+                                 "%6s %6s %3u.%d: "
+                                 "%10u %10u %10u %10u\n",
+                                 htmode,
+                                 mcs,
+                                 ratekbps / 1000,
+                                 (ratekbps % 1000) / 100,
+                                 stats->success,
+                                 stats->retries,
+                                 stats->xretries,
+                                 stats->per);
         }
 
         if (len > max)
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index ab9e3a8410bc..8b788efb41fd 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -19,7 +19,7 @@
 #include "ath9k.h"
 #include "ar9003_mac.h"
 
-#define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
+#define SKB_CB_ATHBUF(__skb)    (*((struct ath_rxbuf **)__skb->cb))
 
 static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
 {
@@ -35,7 +35,7 @@ static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
  * buffer (or rx fifo). This can incorrectly acknowledge packets
  * to a sender if last desc is self-linked.
  */
-static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -68,7 +68,7 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
         sc->rx.rxlink = &ds->ds_link;
 }
 
-static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
 {
         if (sc->rx.buf_hold)
                 ath_rx_buf_link(sc, sc->rx.buf_hold);
@@ -112,13 +112,13 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
         struct ath_hw *ah = sc->sc_ah;
         struct ath_rx_edma *rx_edma;
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         rx_edma = &sc->rx.rx_edma[qtype];
         if (skb_queue_len(&rx_edma->rx_fifo) >= rx_edma->rx_fifo_hwsize)
                 return false;
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         list_del_init(&bf->list);
 
         skb = bf->bf_mpdu;
@@ -138,7 +138,7 @@ static void ath_rx_addbuffer_edma(struct ath_softc *sc,
                                   enum ath9k_rx_qtype qtype)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_buf *bf, *tbf;
+        struct ath_rxbuf *bf, *tbf;
 
         if (list_empty(&sc->rx.rxbuf)) {
                 ath_dbg(common, QUEUE, "No free rx buf available\n");
@@ -154,7 +154,7 @@ static void ath_rx_addbuffer_edma(struct ath_softc *sc,
 static void ath_rx_remove_buffer(struct ath_softc *sc,
                                  enum ath9k_rx_qtype qtype)
 {
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         struct ath_rx_edma *rx_edma;
         struct sk_buff *skb;
 
@@ -171,7 +171,7 @@ static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
@@ -199,7 +199,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_hw *ah = sc->sc_ah;
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int error = 0, i;
         u32 size;
 
@@ -211,7 +211,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
         ath_rx_edma_init_queue(&sc->rx.rx_edma[ATH9K_RX_QUEUE_HP],
                                ah->caps.rx_hp_qdepth);
 
-        size = sizeof(struct ath_buf) * nbufs;
+        size = sizeof(struct ath_rxbuf) * nbufs;
         bf = devm_kzalloc(sc->dev, size, GFP_KERNEL);
         if (!bf)
                 return -ENOMEM;
@@ -271,7 +271,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
@@ -332,7 +332,7 @@ void ath_rx_cleanup(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 ath_rx_edma_cleanup(sc);
@@ -427,7 +427,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
 int ath_startrecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath_buf *bf, *tbf;
+        struct ath_rxbuf *bf, *tbf;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 ath_edma_start_recv(sc);
@@ -447,7 +447,7 @@ int ath_startrecv(struct ath_softc *sc)
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         ath9k_hw_putrxbuf(ah, bf->bf_daddr);
         ath9k_hw_rxena(ah);
 
@@ -603,13 +603,13 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb, bool mybeacon)
 static bool ath_edma_get_buffers(struct ath_softc *sc,
                                  enum ath9k_rx_qtype qtype,
                                  struct ath_rx_status *rs,
-                                 struct ath_buf **dest)
+                                 struct ath_rxbuf **dest)
 {
         struct ath_rx_edma *rx_edma = &sc->rx.rx_edma[qtype];
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int ret;
 
         skb = skb_peek(&rx_edma->rx_fifo);
@@ -653,11 +653,11 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
         return true;
 }
 
-static struct ath_buf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
+static struct ath_rxbuf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
                                                 struct ath_rx_status *rs,
                                                 enum ath9k_rx_qtype qtype)
 {
-        struct ath_buf *bf = NULL;
+        struct ath_rxbuf *bf = NULL;
 
         while (ath_edma_get_buffers(sc, qtype, rs, &bf)) {
                 if (!bf)
@@ -668,13 +668,13 @@ static struct ath_buf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
         return NULL;
 }
 
-static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                                            struct ath_rx_status *rs)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath_desc *ds;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int ret;
 
         if (list_empty(&sc->rx.rxbuf)) {
@@ -682,7 +682,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                 return NULL;
         }
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         if (bf == sc->rx.buf_hold)
                 return NULL;
 
@@ -702,7 +702,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
         ret = ath9k_hw_rxprocdesc(ah, ds, rs);
         if (ret == -EINPROGRESS) {
                 struct ath_rx_status trs;
-                struct ath_buf *tbf;
+                struct ath_rxbuf *tbf;
                 struct ath_desc *tds;
 
                 memset(&trs, 0, sizeof(trs));
@@ -711,7 +711,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
                 }
 
-                tbf = list_entry(bf->list.next, struct ath_buf, list);
+                tbf = list_entry(bf->list.next, struct ath_rxbuf, list);
 
                 /*
                  * On some hardware the descriptor status words could
@@ -1308,7 +1308,7 @@ static void ath9k_apply_ampdu_details(struct ath_softc *sc,
 
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         struct sk_buff *skb = NULL, *requeue_skb, *hdr_skb;
         struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index fde6da619f30..0db37f230018 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -39,7 +39,7 @@ struct wmi_fw_version {
 struct wmi_event_swba {
         __be64 tsf;
         u8 beacon_pending;
-};
+} __packed;
 
 /*
  * 64 - HTC header - WMI header - 1 / txstatus
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index dd30452df966..47696d29743c 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1704,16 +1704,9 @@ int ath_cabq_update(struct ath_softc *sc)
         int qnum = sc->beacon.cabq->axq_qnum;
 
         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
-        /*
-         * Ensure the readytime % is within the bounds.
-         */
-        if (sc->config.cabqReadytime < ATH9K_READY_TIME_LO_BOUND)
-                sc->config.cabqReadytime = ATH9K_READY_TIME_LO_BOUND;
-        else if (sc->config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
-                sc->config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;
 
         qi.tqi_readyTime = (cur_conf->beacon_interval *
-                            sc->config.cabqReadytime) / 100;
+                            ATH_CABQ_READY_TIME) / 100;
         ath_txq_update(sc, qnum, &qi);
 
         return 0;
@@ -2037,8 +2030,7 @@ u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate)
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_channel *curchan = ah->curchan;
 
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) &&
-            (curchan->channelFlags & CHANNEL_5GHZ) &&
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && IS_CHAN_5GHZ(curchan) &&
             (chainmask == 0x7) && (rate < 0x90))
                 return 0x3;
         else if (AR_SREV_9462(ah) && ath9k_hw_btcoex_is_enabled(ah) &&
@@ -2329,7 +2321,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
         if (sc->sc_ah->caldata)
-                sc->sc_ah->caldata->paprd_packet_sent = true;
+                set_bit(PAPRD_PACKET_SENT, &sc->sc_ah->caldata->cal_flags);
 
         if (!(tx_flags & ATH_TX_ERROR))
                 /* Frame was ACKed */
diff --git a/drivers/net/wireless/ath/wcn36xx/Kconfig b/drivers/net/wireless/ath/wcn36xx/Kconfig
new file mode 100644
index 000000000000..591ebaea8265
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Kconfig
@@ -0,0 +1,16 @@
+config WCN36XX
+        tristate "Qualcomm Atheros WCN3660/3680 support"
+        depends on MAC80211 && HAS_DMA
+        ---help---
+          This module adds support for wireless adapters based on
+          Qualcomm Atheros WCN3660 and WCN3680 mobile chipsets.
+
+          If you choose to build a module, it'll be called wcn36xx.
+
+config WCN36XX_DEBUGFS
+        bool "WCN36XX debugfs support"
+        depends on WCN36XX
+        ---help---
+          Enabled debugfs support
+
+          If unsure, say Y to make it easier to debug problems.
diff --git a/drivers/net/wireless/ath/wcn36xx/Makefile b/drivers/net/wireless/ath/wcn36xx/Makefile
new file mode 100644
index 000000000000..50c43b4382ba
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_WCN36XX) := wcn36xx.o
+wcn36xx-y +=   main.o \
+               dxe.o \
+               txrx.o \
+               smd.o \
+               pmc.o \
+               debug.o
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.c b/drivers/net/wireless/ath/wcn36xx/debug.c
new file mode 100644
index 000000000000..5b84f7ae0b1e
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.c
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include "wcn36xx.h"
+#include "debug.h"
+#include "pmc.h"
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+
+static ssize_t read_file_bool_bmps(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        char buf[3];
+
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                if (vif_priv->pw_state == WCN36XX_BMPS)
+                                        buf[0] = '1';
+                                else
+                                        buf[0] = '0';
+                                break;
+                        }
+        }
+        buf[1] = '\n';
+        buf[2] = 0x00;
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t write_file_bool_bmps(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+
+        char buf[32];
+        int buf_size;
+
+        buf_size = min(count, (sizeof(buf)-1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        switch (buf[0]) {
+        case 'y':
+        case 'Y':
+        case '1':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                wcn36xx_enable_keep_alive_null_packet(wcn, vif);
+                                wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                        }
+                }
+                break;
+        case 'n':
+        case 'N':
+        case '0':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+                break;
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_bmps = {
+        .open = simple_open,
+        .read  =       read_file_bool_bmps,
+        .write =       write_file_bool_bmps,
+};
+
+static ssize_t write_file_dump(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        char buf[255], *tmp;
+        int buf_size;
+        u32 arg[WCN36xx_MAX_DUMP_ARGS];
+        int i;
+
+        memset(buf, 0, sizeof(buf));
+        memset(arg, 0, sizeof(arg));
+
+        buf_size = min(count, (sizeof(buf) - 1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        tmp = buf;
+
+        for (i = 0; i < WCN36xx_MAX_DUMP_ARGS; i++) {
+                char *begin;
+                begin = strsep(&tmp, " ");
+                if (begin == NULL)
+                        break;
+
+                if (kstrtoul(begin, 0, (unsigned long *)(arg + i)) != 0)
+                        break;
+        }
+
+        wcn36xx_info("DUMP args is %d %d %d %d %d\n", arg[0], arg[1], arg[2],
+                     arg[3], arg[4]);
+        wcn36xx_smd_dump_cmd_req(wcn, arg[0], arg[1], arg[2], arg[3], arg[4]);
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_dump = {
+        .open = simple_open,
+        .write =       write_file_dump,
+};
+
+#define ADD_FILE(name, mode, fop, priv_data)            \
+        do {                                                    \
+                struct dentry *d;                               \
+                d = debugfs_create_file(__stringify(name),      \
+                                        mode, dfs->rootdir,     \
+                                        priv_data, fop);        \
+                dfs->file_##name.dentry = d;                    \
+                if (IS_ERR(d)) {                                \
+                        wcn36xx_warn("Create the debugfs entry failed");\
+                        dfs->file_##name.dentry = NULL;         \
+                }                                               \
+        } while (0)
+
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+
+        dfs->rootdir = debugfs_create_dir(KBUILD_MODNAME,
+                                          wcn->hw->wiphy->debugfsdir);
+        if (IS_ERR(dfs->rootdir)) {
+                wcn36xx_warn("Create the debugfs failed\n");
+                dfs->rootdir = NULL;
+        }
+
+        ADD_FILE(bmps_switcher, S_IRUSR | S_IWUSR,
+                 &fops_wcn36xx_bmps, wcn);
+        ADD_FILE(dump, S_IWUSR, &fops_wcn36xx_dump, wcn);
+}
+
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+        debugfs_remove_recursive(dfs->rootdir);
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.h b/drivers/net/wireless/ath/wcn36xx/debug.h
new file mode 100644
index 000000000000..46307aa562d3
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_DEBUG_H_
+#define _WCN36XX_DEBUG_H_
+
+#include <linux/kernel.h>
+
+#define WCN36xx_MAX_DUMP_ARGS   5
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+struct wcn36xx_dfs_file {
+        struct dentry *dentry;
+        u32 value;
+};
+
+struct wcn36xx_dfs_entry {
+        struct dentry *rootdir;
+        struct wcn36xx_dfs_file file_bmps_switcher;
+        struct wcn36xx_dfs_file file_dump;
+};
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn);
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn);
+
+#else
+static inline void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+}
+static inline void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+#endif  /* _WCN36XX_DEBUG_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
new file mode 100644
index 000000000000..ee25786b4447
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -0,0 +1,805 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* DXE - DMA transfer engine
+ * we have 2 channels(High prio and Low prio) for TX and 2 channels for RX.
+ * through low channels data packets are transfered
+ * through high channels managment packets are transfered
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/interrupt.h>
+#include "wcn36xx.h"
+#include "txrx.h"
+
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low)
+{
+        struct wcn36xx_dxe_ch *ch = is_low ?
+                &wcn->dxe_tx_l_ch :
+                &wcn->dxe_tx_h_ch;
+
+        return ch->head_blk_ctl->bd_cpu_addr;
+}
+
+static void wcn36xx_dxe_write_register(struct wcn36xx *wcn, int addr, int data)
+{
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_write_register: addr=%x, data=%x\n",
+                    addr, data);
+
+        writel(data, wcn->mmio + addr);
+}
+
+static void wcn36xx_dxe_read_register(struct wcn36xx *wcn, int addr, int *data)
+{
+        *data = readl(wcn->mmio + addr);
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_read_register: addr=%x, data=%x\n",
+                    addr, *data);
+}
+
+static void wcn36xx_dxe_free_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl, *next;
+        int i;
+
+        for (i = 0; i < ch->desc_num && ctl; i++) {
+                next = ctl->next;
+                kfree(ctl);
+                ctl = next;
+        }
+}
+
+static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *prev_ctl = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        int i;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                cur_ctl = kzalloc(sizeof(*cur_ctl), GFP_KERNEL);
+                if (!cur_ctl)
+                        goto out_fail;
+
+                cur_ctl->ctl_blk_order = i;
+                if (i == 0) {
+                        ch->head_blk_ctl = cur_ctl;
+                        ch->tail_blk_ctl = cur_ctl;
+                } else if (ch->desc_num - 1 == i) {
+                        prev_ctl->next = cur_ctl;
+                        cur_ctl->next = ch->head_blk_ctl;
+                } else {
+                        prev_ctl->next = cur_ctl;
+                }
+                prev_ctl = cur_ctl;
+        }
+
+        return 0;
+
+out_fail:
+        wcn36xx_dxe_free_ctl_block(ch);
+        return -ENOMEM;
+}
+
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn)
+{
+        int ret;
+
+        wcn->dxe_tx_l_ch.ch_type = WCN36XX_DXE_CH_TX_L;
+        wcn->dxe_tx_h_ch.ch_type = WCN36XX_DXE_CH_TX_H;
+        wcn->dxe_rx_l_ch.ch_type = WCN36XX_DXE_CH_RX_L;
+        wcn->dxe_rx_h_ch.ch_type = WCN36XX_DXE_CH_RX_H;
+
+        wcn->dxe_tx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        wcn->dxe_tx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        wcn->dxe_rx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_L;
+        wcn->dxe_rx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_H;
+
+        wcn->dxe_tx_l_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_L;
+        wcn->dxe_tx_h_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_H;
+
+        wcn->dxe_tx_l_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_L_BD;
+        wcn->dxe_tx_h_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_H_BD;
+
+        wcn->dxe_tx_l_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_L_SKB;
+        wcn->dxe_tx_h_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_H_SKB;
+
+        wcn->dxe_tx_l_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_L;
+        wcn->dxe_tx_h_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_H;
+
+        wcn->dxe_tx_l_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_L;
+        wcn->dxe_tx_h_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_H;
+
+        /* DXE control block allocation */
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_h_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_h_ch);
+        if (ret)
+                goto out_err;
+
+        /* Initialize SMSM state  Clear TX Enable RING EMPTY STATE */
+        ret = wcn->ctrl_ops->smsm_change_state(
+                WCN36XX_SMSM_WLAN_TX_ENABLE,
+                WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY);
+
+        return 0;
+
+out_err:
+        wcn36xx_err("Failed to allocate DXE control blocks\n");
+        wcn36xx_dxe_free_ctl_blks(wcn);
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn)
+{
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_h_ch);
+}
+
+static int wcn36xx_dxe_init_descs(struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_desc *cur_dxe = NULL;
+        struct wcn36xx_dxe_desc *prev_dxe = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        size_t size;
+        int i;
+
+        size = wcn_ch->desc_num * sizeof(struct wcn36xx_dxe_desc);
+        wcn_ch->cpu_addr = dma_alloc_coherent(NULL, size, &wcn_ch->dma_addr,
+                                              GFP_KERNEL);
+        if (!wcn_ch->cpu_addr)
+                return -ENOMEM;
+
+        memset(wcn_ch->cpu_addr, 0, size);
+
+        cur_dxe = (struct wcn36xx_dxe_desc *)wcn_ch->cpu_addr;
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                cur_ctl->desc = cur_dxe;
+                cur_ctl->desc_phy_addr = wcn_ch->dma_addr +
+                        i * sizeof(struct wcn36xx_dxe_desc);
+
+                switch (wcn_ch->ch_type) {
+                case WCN36XX_DXE_CH_TX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_L;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_L;
+                        break;
+                case WCN36XX_DXE_CH_TX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_H;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_H;
+                        break;
+                case WCN36XX_DXE_CH_RX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_L;
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_H;
+                        break;
+                }
+                if (0 == i) {
+                        cur_dxe->phy_next_l = 0;
+                } else if ((0 < i) && (i < wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                } else if (i == (wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                        cur_dxe->phy_next_l =
+                                wcn_ch->head_blk_ctl->desc_phy_addr;
+                }
+                cur_ctl = cur_ctl->next;
+                prev_dxe = cur_dxe;
+                cur_dxe++;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_init_tx_bd(struct wcn36xx_dxe_ch *ch,
+                                   struct wcn36xx_dxe_mem_pool *pool)
+{
+        int i, chunk_size = pool->chunk_size;
+        dma_addr_t bd_phy_addr = pool->phy_addr;
+        void *bd_cpu_addr = pool->virt_addr;
+        struct wcn36xx_dxe_ctl *cur = ch->head_blk_ctl;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                /* Only every second dxe needs a bd pointer,
+                   the other will point to the skb data */
+                if (!(i & 1)) {
+                        cur->bd_phy_addr = bd_phy_addr;
+                        cur->bd_cpu_addr = bd_cpu_addr;
+                        bd_phy_addr += chunk_size;
+                        bd_cpu_addr += chunk_size;
+                } else {
+                        cur->bd_phy_addr = 0;
+                        cur->bd_cpu_addr = NULL;
+                }
+                cur = cur->next;
+        }
+}
+
+static int wcn36xx_dxe_enable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
+{
+        int reg_data = 0;
+
+        wcn36xx_dxe_read_register(wcn,
+                                  WCN36XX_DXE_INT_MASK_REG,
+                                  &reg_data);
+
+        reg_data |= wcn_ch;
+
+        wcn36xx_dxe_write_register(wcn,
+                                   WCN36XX_DXE_INT_MASK_REG,
+                                   (int)reg_data);
+        return 0;
+}
+
+static int wcn36xx_dxe_fill_skb(struct wcn36xx_dxe_ctl *ctl)
+{
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(WCN36XX_PKT_SIZE, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        dxe->dst_addr_l = dma_map_single(NULL,
+                                         skb_tail_pointer(skb),
+                                         WCN36XX_PKT_SIZE,
+                                         DMA_FROM_DEVICE);
+        ctl->skb = skb;
+
+        return 0;
+}
+
+static int wcn36xx_dxe_ch_alloc_skb(struct wcn36xx *wcn,
+                                    struct wcn36xx_dxe_ch *wcn_ch)
+{
+        int i;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                wcn36xx_dxe_fill_skb(cur_ctl);
+                cur_ctl = cur_ctl->next;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_ch_free_skbs(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_ctl *cur = wcn_ch->head_blk_ctl;
+        int i;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                kfree_skb(cur->skb);
+                cur = cur->next;
+        }
+}
+
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status)
+{
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wcn->dxe_lock, flags);
+        skb = wcn->tx_ack_skb;
+        wcn->tx_ack_skb = NULL;
+        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+        if (!skb) {
+                wcn36xx_warn("Spurious TX complete indication\n");
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (status == 1)
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ack status: %d\n", status);
+
+        ieee80211_tx_status_irqsafe(wcn->hw, skb);
+        ieee80211_wake_queues(wcn->hw);
+}
+
+static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->tail_blk_ctl;
+        struct ieee80211_tx_info *info;
+        unsigned long flags;
+
+        /*
+         * Make at least one loop of do-while because in case ring is
+         * completely full head and tail are pointing to the same element
+         * and while-do will not make any cycles.
+         */
+        do {
+                if (ctl->skb) {
+                        dma_unmap_single(NULL, ctl->desc->src_addr_l,
+                                         ctl->skb->len, DMA_TO_DEVICE);
+                        info = IEEE80211_SKB_CB(ctl->skb);
+                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
+                                /* Keep frame until TX status comes */
+                                ieee80211_free_txskb(wcn->hw, ctl->skb);
+                        }
+                        spin_lock_irqsave(&ctl->skb_lock, flags);
+                        if (wcn->queues_stopped) {
+                                wcn->queues_stopped = false;
+                                ieee80211_wake_queues(wcn->hw);
+                        }
+                        spin_unlock_irqrestore(&ctl->skb_lock, flags);
+
+                        ctl->skb = NULL;
+                }
+                ctl = ctl->next;
+        } while (ctl != ch->head_blk_ctl &&
+               !(ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK));
+
+        ch->tail_blk_ctl = ctl;
+}
+
+static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+        int int_src, int_reason;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_H) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H,
+                                          &int_reason);
+
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready high\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_h_ch);
+        }
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_L) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L,
+                                          &int_reason);
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready low\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_l_ch);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wcn36xx_irq_rx_ready(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+
+        disable_irq_nosync(wcn->rx_irq);
+        wcn36xx_dxe_rx_frame(wcn);
+        enable_irq(wcn->rx_irq);
+        return IRQ_HANDLED;
+}
+
+static int wcn36xx_dxe_request_irqs(struct wcn36xx *wcn)
+{
+        int ret;
+
+        ret = request_irq(wcn->tx_irq, wcn36xx_irq_tx_complete,
+                          IRQF_TRIGGER_HIGH, "wcn36xx_tx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc tx irq\n");
+                goto out_err;
+        }
+
+        ret = request_irq(wcn->rx_irq, wcn36xx_irq_rx_ready, IRQF_TRIGGER_HIGH,
+                          "wcn36xx_rx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc rx irq\n");
+                goto out_txirq;
+        }
+
+        enable_irq_wake(wcn->rx_irq);
+
+        return 0;
+
+out_txirq:
+        free_irq(wcn->tx_irq, wcn);
+out_err:
+        return ret;
+
+}
+
+static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl;
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        dma_addr_t  dma_addr;
+        struct sk_buff *skb;
+
+        while (!(dxe->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)) {
+                skb = ctl->skb;
+                dma_addr = dxe->dst_addr_l;
+                wcn36xx_dxe_fill_skb(ctl);
+
+                switch (ch->ch_type) {
+                case WCN36XX_DXE_CH_RX_L:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH1_MASK);
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH3_MASK);
+                        break;
+                default:
+                        wcn36xx_warn("Unknown channel\n");
+                }
+
+                dma_unmap_single(NULL, dma_addr, WCN36XX_PKT_SIZE,
+                                 DMA_FROM_DEVICE);
+                wcn36xx_rx_skb(wcn, skb);
+                ctl = ctl->next;
+                dxe = ctl->desc;
+        }
+
+        ch->head_blk_ctl = ctl;
+
+        return 0;
+}
+
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn)
+{
+        int int_src;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        /* RX_LOW_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH1_MASK) {
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH1_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_l_ch));
+        }
+
+        /* RX_HIGH_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH3_MASK) {
+                /* Clean up all the INT within this channel */
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH3_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_h_ch));
+        }
+
+        if (!int_src)
+                wcn36xx_warn("No DXE interrupt pending\n");
+}
+
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn)
+{
+        size_t s;
+        void *cpu_addr;
+
+        /* Allocate BD headers for MGMT frames */
+
+        /* Where this come from ask QC */
+        wcn->mgmt_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->mgmt_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->mgmt_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->mgmt_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        /* Allocate BD headers for DATA frames */
+
+        /* Where this come from ask QC */
+        wcn->data_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->data_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->data_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->data_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        return 0;
+
+out_err:
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_err("Failed to allocate BD mempool\n");
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn)
+{
+        if (wcn->mgmt_mem_pool.virt_addr)
+                dma_free_coherent(NULL, wcn->mgmt_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_H,
+                                  wcn->mgmt_mem_pool.virt_addr,
+                                  wcn->mgmt_mem_pool.phy_addr);
+
+        if (wcn->data_mem_pool.virt_addr) {
+                dma_free_coherent(NULL, wcn->data_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_L,
+                                  wcn->data_mem_pool.virt_addr,
+                                  wcn->data_mem_pool.phy_addr);
+        }
+}
+
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low)
+{
+        struct wcn36xx_dxe_ctl *ctl = NULL;
+        struct wcn36xx_dxe_desc *desc = NULL;
+        struct wcn36xx_dxe_ch *ch = NULL;
+        unsigned long flags;
+
+        ch = is_low ? &wcn->dxe_tx_l_ch : &wcn->dxe_tx_h_ch;
+
+        ctl = ch->head_blk_ctl;
+
+        spin_lock_irqsave(&ctl->next->skb_lock, flags);
+
+        /*
+         * If skb is not null that means that we reached the tail of the ring
+         * hence ring is full. Stop queues to let mac80211 back off until ring
+         * has an empty slot again.
+         */
+        if (NULL != ctl->next->skb) {
+                ieee80211_stop_queues(wcn->hw);
+                wcn->queues_stopped = true;
+                spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+                return -EBUSY;
+        }
+        spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+
+        ctl->skb = NULL;
+        desc = ctl->desc;
+
+        /* Set source address of the BD we send */
+        desc->src_addr_l = ctl->bd_phy_addr;
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = sizeof(struct wcn36xx_tx_bd);
+        desc->ctrl = ch->ctrl_bd;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "DXE TX\n");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC1 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP,
+                         "BD   >>> ", (char *)ctl->bd_cpu_addr,
+                         sizeof(struct wcn36xx_tx_bd));
+
+        /* Set source address of the SKB we send */
+        ctl = ctl->next;
+        ctl->skb = skb;
+        desc = ctl->desc;
+        if (ctl->bd_cpu_addr) {
+                wcn36xx_err("bd_cpu_addr cannot be NULL for skb DXE\n");
+                return -EINVAL;
+        }
+
+        desc->src_addr_l = dma_map_single(NULL,
+                                          ctl->skb->data,
+                                          ctl->skb->len,
+                                          DMA_TO_DEVICE);
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = ctl->skb->len;
+
+        /* set dxe descriptor to VALID */
+        desc->ctrl = ch->ctrl_skb;
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC2 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "SKB   >>> ",
+                         (char *)ctl->skb->data, ctl->skb->len);
+
+        /* Move the head of the ring to the next empty descriptor */
+         ch->head_blk_ctl = ctl->next;
+
+        /*
+         * When connected and trying to send data frame chip can be in sleep
+         * mode and writing to the register will not wake up the chip. Instead
+         * notify chip about new frame through SMSM bus.
+         */
+        if (is_low &&  vif_priv->pw_state == WCN36XX_BMPS) {
+                wcn->ctrl_ops->smsm_change_state(
+                                  0,
+                                  WCN36XX_SMSM_WLAN_TX_ENABLE);
+        } else {
+                /* indicate End Of Packet and generate interrupt on descriptor
+                 * done.
+                 */
+                wcn36xx_dxe_write_register(wcn,
+                        ch->reg_ctrl, ch->def_ctrl);
+        }
+
+        return 0;
+}
+
+int wcn36xx_dxe_init(struct wcn36xx *wcn)
+{
+        int reg_data = 0, ret;
+
+        reg_data = WCN36XX_DXE_REG_RESET;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CSR_RESET, reg_data);
+
+        /* Setting interrupt path */
+        reg_data = WCN36XX_DXE_CCU_INT;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CCU_INT, reg_data);
+
+        /***************************************/
+        /* Init descriptors for TX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_l_ch, &wcn->data_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L,
+                wcn->dxe_tx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX LOW */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_L,
+                WCN36XX_DXE_WQ_TX_L);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+
+        /***************************************/
+        /* Init descriptors for TX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_h_ch, &wcn->mgmt_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H,
+                wcn->dxe_tx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX HIGH */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_H,
+                WCN36XX_DXE_WQ_TX_H);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+
+        /***************************************/
+        /* Init descriptors for RX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_l_ch);
+
+        /* For RX we need to preallocated buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_l_ch);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_L,
+                WCN36XX_DXE_WQ_RX_L);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_L,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_L);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+
+        /***************************************/
+        /* Init descriptors for RX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_h_ch);
+
+        /* For RX we need to prealocat buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_h_ch);
+
+        /* Write chanel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H,
+                wcn->dxe_rx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_H,
+                WCN36XX_DXE_WQ_RX_H);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_H,
+                 wcn->dxe_rx_h_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_H,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_H);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+
+        ret = wcn36xx_dxe_request_irqs(wcn);
+        if (ret < 0)
+                goto out_err;
+
+        return 0;
+
+out_err:
+        return ret;
+}
+
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
+{
+        free_irq(wcn->tx_irq, wcn);
+        free_irq(wcn->rx_irq, wcn);
+
+        if (wcn->tx_ack_skb) {
+                ieee80211_tx_status_irqsafe(wcn->hw, wcn->tx_ack_skb);
+                wcn->tx_ack_skb = NULL;
+        }
+
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.h b/drivers/net/wireless/ath/wcn36xx/dxe.h
new file mode 100644
index 000000000000..c88562f85de1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _DXE_H_
+#define _DXE_H_
+
+#include "wcn36xx.h"
+
+/*
+TX_LOW  = DMA0
+TX_HIGH = DMA4
+RX_LOW  = DMA1
+RX_HIGH = DMA3
+H2H_TEST_RX_TX = DMA2
+*/
+
+/* DXE registers */
+#define WCN36XX_DXE_MEM_BASE                    0x03000000
+#define WCN36XX_DXE_MEM_REG                     0x202000
+
+#define WCN36XX_DXE_CCU_INT                     0xA0011
+#define WCN36XX_DXE_REG_CCU_INT                 0x200b10
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_CTRL_TX_L                   0x328a44
+#define WCN36XX_DXE_CTRL_TX_H                   0x32ce44
+#define WCN36XX_DXE_CTRL_RX_L                   0x12ad2f
+#define WCN36XX_DXE_CTRL_RX_H                   0x12d12f
+#define WCN36XX_DXE_CTRL_TX_H_BD                0x30ce45
+#define WCN36XX_DXE_CTRL_TX_H_SKB               0x32ce4d
+#define WCN36XX_DXE_CTRL_TX_L_BD                0x308a45
+#define WCN36XX_DXE_CTRL_TX_L_SKB               0x328a4d
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_WQ_TX_L                     0x17
+#define WCN36XX_DXE_WQ_TX_H                     0x17
+#define WCN36XX_DXE_WQ_RX_L                     0xB
+#define WCN36XX_DXE_WQ_RX_H                     0x4
+
+/* DXE descriptor control filed */
+#define WCN36XX_DXE_CTRL_VALID_MASK (0x00000001)
+
+/* TODO This must calculated properly but not hardcoded */
+/* DXE default control register values */
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_L         0x847EAD2F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_H         0x84FED12F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_H         0x853ECF4D
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_L         0x843e8b4d
+
+/* Common DXE registers */
+#define WCN36XX_DXE_MEM_CSR                     (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_REG_CSR_RESET               (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_ENCH_ADDR                   (WCN36XX_DXE_MEM_REG + 0x04)
+#define WCN36XX_DXE_REG_CH_EN                   (WCN36XX_DXE_MEM_REG + 0x08)
+#define WCN36XX_DXE_REG_CH_DONE                 (WCN36XX_DXE_MEM_REG + 0x0C)
+#define WCN36XX_DXE_REG_CH_ERR                  (WCN36XX_DXE_MEM_REG + 0x10)
+#define WCN36XX_DXE_INT_MASK_REG                (WCN36XX_DXE_MEM_REG + 0x18)
+#define WCN36XX_DXE_INT_SRC_RAW_REG             (WCN36XX_DXE_MEM_REG + 0x20)
+        /* #define WCN36XX_DXE_INT_CH6_MASK     0x00000040 */
+        /* #define WCN36XX_DXE_INT_CH5_MASK     0x00000020 */
+        #define WCN36XX_DXE_INT_CH4_MASK        0x00000010
+        #define WCN36XX_DXE_INT_CH3_MASK        0x00000008
+        /* #define WCN36XX_DXE_INT_CH2_MASK     0x00000004 */
+        #define WCN36XX_DXE_INT_CH1_MASK        0x00000002
+        #define WCN36XX_DXE_INT_CH0_MASK        0x00000001
+#define WCN36XX_DXE_0_INT_CLR                   (WCN36XX_DXE_MEM_REG + 0x30)
+#define WCN36XX_DXE_0_INT_ED_CLR                (WCN36XX_DXE_MEM_REG + 0x34)
+#define WCN36XX_DXE_0_INT_DONE_CLR              (WCN36XX_DXE_MEM_REG + 0x38)
+#define WCN36XX_DXE_0_INT_ERR_CLR               (WCN36XX_DXE_MEM_REG + 0x3C)
+
+#define WCN36XX_DXE_0_CH0_STATUS                (WCN36XX_DXE_MEM_REG + 0x404)
+#define WCN36XX_DXE_0_CH1_STATUS                (WCN36XX_DXE_MEM_REG + 0x444)
+#define WCN36XX_DXE_0_CH2_STATUS                (WCN36XX_DXE_MEM_REG + 0x484)
+#define WCN36XX_DXE_0_CH3_STATUS                (WCN36XX_DXE_MEM_REG + 0x4C4)
+#define WCN36XX_DXE_0_CH4_STATUS                (WCN36XX_DXE_MEM_REG + 0x504)
+
+#define WCN36XX_DXE_REG_RESET                   0x5c89
+
+/* Temporary BMU Workqueue 4 */
+#define WCN36XX_DXE_BMU_WQ_RX_LOW               0xB
+#define WCN36XX_DXE_BMU_WQ_RX_HIGH              0x4
+/* DMA channel offset */
+#define WCN36XX_DXE_TX_LOW_OFFSET               0x400
+#define WCN36XX_DXE_TX_HIGH_OFFSET              0x500
+#define WCN36XX_DXE_RX_LOW_OFFSET               0x440
+#define WCN36XX_DXE_RX_HIGH_OFFSET              0x4C0
+
+/* Address of the next DXE descriptor */
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR           0x001C
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+
+/* DXE Descriptor source address */
+#define WCN36XX_DXE_CH_SRC_ADDR                 0x000C
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_L            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_H            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+
+/* DXE Descriptor address destination address */
+#define WCN36XX_DXE_CH_DEST_ADDR                0x0014
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+
+/* Interrupt status */
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR          0x0004
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+
+
+/* DXE default control register */
+#define WCN36XX_DXE_REG_CTL_RX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET)
+#define WCN36XX_DXE_REG_CTL_RX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET)
+
+#define WCN36XX_SMSM_WLAN_TX_ENABLE             0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY        0x00000200
+
+
+/* Interrupt control channel mask */
+#define WCN36XX_INT_MASK_CHAN_TX_L              0x00000001
+#define WCN36XX_INT_MASK_CHAN_RX_L              0x00000002
+#define WCN36XX_INT_MASK_CHAN_RX_H              0x00000008
+#define WCN36XX_INT_MASK_CHAN_TX_H              0x00000010
+
+#define WCN36XX_BD_CHUNK_SIZE                   128
+
+#define WCN36XX_PKT_SIZE                        0xF20
+enum wcn36xx_dxe_ch_type {
+        WCN36XX_DXE_CH_TX_L,
+        WCN36XX_DXE_CH_TX_H,
+        WCN36XX_DXE_CH_RX_L,
+        WCN36XX_DXE_CH_RX_H
+};
+
+/* amount of descriptors per channel */
+enum wcn36xx_dxe_ch_desc_num {
+        WCN36XX_DXE_CH_DESC_NUMB_TX_L           = 128,
+        WCN36XX_DXE_CH_DESC_NUMB_TX_H           = 10,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_L           = 512,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_H           = 40
+};
+
+/**
+ * struct wcn36xx_dxe_desc - describes descriptor of one DXE buffer
+ *
+ * @ctrl: is a union that consists of following bits:
+ * union {
+ *      u32     valid           :1; //0 = DMA stop, 1 = DMA continue with this
+ *                                  //descriptor
+ *      u32     transfer_type   :2; //0 = Host to Host space
+ *      u32     eop             :1; //End of Packet
+ *      u32     bd_handling     :1; //if transferType = Host to BMU, then 0
+ *                                  // means first 128 bytes contain BD, and 1
+ *                                  // means create new empty BD
+ *      u32     siq             :1; // SIQ
+ *      u32     diq             :1; // DIQ
+ *      u32     pdu_rel         :1; //0 = don't release BD and PDUs when done,
+ *                                  // 1 = release them
+ *      u32     bthld_sel       :4; //BMU Threshold Select
+ *      u32     prio            :3; //Specifies the priority level to use for
+ *                                  // the transfer
+ *      u32     stop_channel    :1; //1 = DMA stops processing further, channel
+ *                                  //requires re-enabling after this
+ *      u32     intr            :1; //Interrupt on Descriptor Done
+ *      u32     rsvd            :1; //reserved
+ *      u32     size            :14;//14 bits used - ignored for BMU transfers,
+ *                                  //only used for host to host transfers?
+ * } ctrl;
+ */
+struct wcn36xx_dxe_desc {
+        u32     ctrl;
+        u32     fr_len;
+
+        u32     src_addr_l;
+        u32     dst_addr_l;
+        u32     phy_next_l;
+        u32     src_addr_h;
+        u32     dst_addr_h;
+        u32     phy_next_h;
+} __packed;
+
+/* DXE Control block */
+struct wcn36xx_dxe_ctl {
+        struct wcn36xx_dxe_ctl  *next;
+        struct wcn36xx_dxe_desc *desc;
+        unsigned int            desc_phy_addr;
+        int                     ctl_blk_order;
+        struct sk_buff          *skb;
+        spinlock_t              skb_lock;
+        void                    *bd_cpu_addr;
+        dma_addr_t              bd_phy_addr;
+};
+
+struct wcn36xx_dxe_ch {
+        enum wcn36xx_dxe_ch_type        ch_type;
+        void                            *cpu_addr;
+        dma_addr_t                      dma_addr;
+        enum wcn36xx_dxe_ch_desc_num    desc_num;
+        /* DXE control block ring */
+        struct wcn36xx_dxe_ctl          *head_blk_ctl;
+        struct wcn36xx_dxe_ctl          *tail_blk_ctl;
+
+        /* DXE channel specific configs */
+        u32                             dxe_wq;
+        u32                             ctrl_bd;
+        u32                             ctrl_skb;
+        u32                             reg_ctrl;
+        u32                             def_ctrl;
+};
+
+/* Memory Pool for BD headers */
+struct wcn36xx_dxe_mem_pool {
+        int             chunk_size;
+        void            *virt_addr;
+        dma_addr_t      phy_addr;
+};
+
+struct wcn36xx_vif;
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn);
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn);
+int wcn36xx_dxe_init(struct wcn36xx *wcn);
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn);
+int wcn36xx_dxe_init_channels(struct wcn36xx *wcn);
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low);
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status);
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low);
+#endif  /* _DXE_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/hal.h b/drivers/net/wireless/ath/wcn36xx/hal.h
new file mode 100644
index 000000000000..c02dbc618724
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/hal.h
@@ -0,0 +1,4657 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HAL_H_
+#define _HAL_H_
+
+/*---------------------------------------------------------------------------
+  API VERSIONING INFORMATION
+
+  The RIVA API is versioned as MAJOR.MINOR.VERSION.REVISION
+  The MAJOR is incremented for major product/architecture changes
+      (and then MINOR/VERSION/REVISION are zeroed)
+  The MINOR is incremented for minor product/architecture changes
+      (and then VERSION/REVISION are zeroed)
+  The VERSION is incremented if a significant API change occurs
+      (and then REVISION is zeroed)
+  The REVISION is incremented if an insignificant API change occurs
+      or if a new API is added
+  All values are in the range 0..255 (ie they are 8-bit values)
+ ---------------------------------------------------------------------------*/
+#define WCN36XX_HAL_VER_MAJOR 1
+#define WCN36XX_HAL_VER_MINOR 4
+#define WCN36XX_HAL_VER_VERSION 1
+#define WCN36XX_HAL_VER_REVISION 2
+
+/* This is to force compiler to use the maximum of an int ( 4 bytes ) */
+#define WCN36XX_HAL_MAX_ENUM_SIZE    0x7FFFFFFF
+#define WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE    0x7FFF
+
+/* Max no. of transmit categories */
+#define STACFG_MAX_TC    8
+
+/* The maximum value of access category */
+#define WCN36XX_HAL_MAX_AC  4
+
+#define WCN36XX_HAL_IPV4_ADDR_LEN       4
+
+#define WALN_HAL_STA_INVALID_IDX 0xFF
+#define WCN36XX_HAL_BSS_INVALID_IDX 0xFF
+
+/* Default Beacon template size */
+#define BEACON_TEMPLATE_SIZE 0x180
+
+/* Param Change Bitmap sent to HAL */
+#define PARAM_BCN_INTERVAL_CHANGED                      (1 << 0)
+#define PARAM_SHORT_PREAMBLE_CHANGED                 (1 << 1)
+#define PARAM_SHORT_SLOT_TIME_CHANGED                 (1 << 2)
+#define PARAM_llACOEXIST_CHANGED                            (1 << 3)
+#define PARAM_llBCOEXIST_CHANGED                            (1 << 4)
+#define PARAM_llGCOEXIST_CHANGED                            (1 << 5)
+#define PARAM_HT20MHZCOEXIST_CHANGED                  (1<<6)
+#define PARAM_NON_GF_DEVICES_PRESENT_CHANGED (1<<7)
+#define PARAM_RIFS_MODE_CHANGED                            (1<<8)
+#define PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED   (1<<9)
+#define PARAM_OBSS_MODE_CHANGED                               (1<<10)
+#define PARAM_BEACON_UPDATE_MASK \
+        (PARAM_BCN_INTERVAL_CHANGED |                                   \
+         PARAM_SHORT_PREAMBLE_CHANGED |                                 \
+         PARAM_SHORT_SLOT_TIME_CHANGED |                                \
+         PARAM_llACOEXIST_CHANGED |                                     \
+         PARAM_llBCOEXIST_CHANGED |                                     \
+         PARAM_llGCOEXIST_CHANGED |                                     \
+         PARAM_HT20MHZCOEXIST_CHANGED |                                 \
+         PARAM_NON_GF_DEVICES_PRESENT_CHANGED |                         \
+         PARAM_RIFS_MODE_CHANGED |                                      \
+         PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED |                         \
+         PARAM_OBSS_MODE_CHANGED)
+
+/* dump command response Buffer size */
+#define DUMPCMD_RSP_BUFFER 100
+
+/* version string max length (including NULL) */
+#define WCN36XX_HAL_VERSION_LENGTH  64
+
+/* message types for messages exchanged between WDI and HAL */
+enum wcn36xx_hal_host_msg_type {
+        /* Init/De-Init */
+        WCN36XX_HAL_START_REQ = 0,
+        WCN36XX_HAL_START_RSP = 1,
+        WCN36XX_HAL_STOP_REQ = 2,
+        WCN36XX_HAL_STOP_RSP = 3,
+
+        /* Scan */
+        WCN36XX_HAL_INIT_SCAN_REQ = 4,
+        WCN36XX_HAL_INIT_SCAN_RSP = 5,
+        WCN36XX_HAL_START_SCAN_REQ = 6,
+        WCN36XX_HAL_START_SCAN_RSP = 7,
+        WCN36XX_HAL_END_SCAN_REQ = 8,
+        WCN36XX_HAL_END_SCAN_RSP = 9,
+        WCN36XX_HAL_FINISH_SCAN_REQ = 10,
+        WCN36XX_HAL_FINISH_SCAN_RSP = 11,
+
+        /* HW STA configuration/deconfiguration */
+        WCN36XX_HAL_CONFIG_STA_REQ = 12,
+        WCN36XX_HAL_CONFIG_STA_RSP = 13,
+        WCN36XX_HAL_DELETE_STA_REQ = 14,
+        WCN36XX_HAL_DELETE_STA_RSP = 15,
+        WCN36XX_HAL_CONFIG_BSS_REQ = 16,
+        WCN36XX_HAL_CONFIG_BSS_RSP = 17,
+        WCN36XX_HAL_DELETE_BSS_REQ = 18,
+        WCN36XX_HAL_DELETE_BSS_RSP = 19,
+
+        /* Infra STA asscoiation */
+        WCN36XX_HAL_JOIN_REQ = 20,
+        WCN36XX_HAL_JOIN_RSP = 21,
+        WCN36XX_HAL_POST_ASSOC_REQ = 22,
+        WCN36XX_HAL_POST_ASSOC_RSP = 23,
+
+        /* Security */
+        WCN36XX_HAL_SET_BSSKEY_REQ = 24,
+        WCN36XX_HAL_SET_BSSKEY_RSP = 25,
+        WCN36XX_HAL_SET_STAKEY_REQ = 26,
+        WCN36XX_HAL_SET_STAKEY_RSP = 27,
+        WCN36XX_HAL_RMV_BSSKEY_REQ = 28,
+        WCN36XX_HAL_RMV_BSSKEY_RSP = 29,
+        WCN36XX_HAL_RMV_STAKEY_REQ = 30,
+        WCN36XX_HAL_RMV_STAKEY_RSP = 31,
+
+        /* Qos Related */
+        WCN36XX_HAL_ADD_TS_REQ = 32,
+        WCN36XX_HAL_ADD_TS_RSP = 33,
+        WCN36XX_HAL_DEL_TS_REQ = 34,
+        WCN36XX_HAL_DEL_TS_RSP = 35,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_REQ = 36,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_RSP = 37,
+        WCN36XX_HAL_ADD_BA_REQ = 38,
+        WCN36XX_HAL_ADD_BA_RSP = 39,
+        WCN36XX_HAL_DEL_BA_REQ = 40,
+        WCN36XX_HAL_DEL_BA_RSP = 41,
+
+        WCN36XX_HAL_CH_SWITCH_REQ = 42,
+        WCN36XX_HAL_CH_SWITCH_RSP = 43,
+        WCN36XX_HAL_SET_LINK_ST_REQ = 44,
+        WCN36XX_HAL_SET_LINK_ST_RSP = 45,
+        WCN36XX_HAL_GET_STATS_REQ = 46,
+        WCN36XX_HAL_GET_STATS_RSP = 47,
+        WCN36XX_HAL_UPDATE_CFG_REQ = 48,
+        WCN36XX_HAL_UPDATE_CFG_RSP = 49,
+
+        WCN36XX_HAL_MISSED_BEACON_IND = 50,
+        WCN36XX_HAL_UNKNOWN_ADDR2_FRAME_RX_IND = 51,
+        WCN36XX_HAL_MIC_FAILURE_IND = 52,
+        WCN36XX_HAL_FATAL_ERROR_IND = 53,
+        WCN36XX_HAL_SET_KEYDONE_MSG = 54,
+
+        /* NV Interface */
+        WCN36XX_HAL_DOWNLOAD_NV_REQ = 55,
+        WCN36XX_HAL_DOWNLOAD_NV_RSP = 56,
+
+        WCN36XX_HAL_ADD_BA_SESSION_REQ = 57,
+        WCN36XX_HAL_ADD_BA_SESSION_RSP = 58,
+        WCN36XX_HAL_TRIGGER_BA_REQ = 59,
+        WCN36XX_HAL_TRIGGER_BA_RSP = 60,
+        WCN36XX_HAL_UPDATE_BEACON_REQ = 61,
+        WCN36XX_HAL_UPDATE_BEACON_RSP = 62,
+        WCN36XX_HAL_SEND_BEACON_REQ = 63,
+        WCN36XX_HAL_SEND_BEACON_RSP = 64,
+
+        WCN36XX_HAL_SET_BCASTKEY_REQ = 65,
+        WCN36XX_HAL_SET_BCASTKEY_RSP = 66,
+        WCN36XX_HAL_DELETE_STA_CONTEXT_IND = 67,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ = 68,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP = 69,
+
+        /* PTT interface support */
+        WCN36XX_HAL_PROCESS_PTT_REQ = 70,
+        WCN36XX_HAL_PROCESS_PTT_RSP = 71,
+
+        /* BTAMP related events */
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_REQ = 72,
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_RSP = 73,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_REQ = 74,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_RSP = 75,
+
+        WCN36XX_HAL_ENTER_IMPS_REQ = 76,
+        WCN36XX_HAL_EXIT_IMPS_REQ = 77,
+        WCN36XX_HAL_ENTER_BMPS_REQ = 78,
+        WCN36XX_HAL_EXIT_BMPS_REQ = 79,
+        WCN36XX_HAL_ENTER_UAPSD_REQ = 80,
+        WCN36XX_HAL_EXIT_UAPSD_REQ = 81,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_REQ = 82,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_REQ = 83,
+        WCN36XX_HAL_ADD_BCN_FILTER_REQ = 84,
+        WCN36XX_HAL_REM_BCN_FILTER_REQ = 85,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN = 86,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN = 87,
+        WCN36XX_HAL_ENTER_WOWL_REQ = 88,
+        WCN36XX_HAL_EXIT_WOWL_REQ = 89,
+        WCN36XX_HAL_HOST_OFFLOAD_REQ = 90,
+        WCN36XX_HAL_SET_RSSI_THRESH_REQ = 91,
+        WCN36XX_HAL_GET_RSSI_REQ = 92,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_REQ = 93,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_REQ = 94,
+
+        WCN36XX_HAL_ENTER_IMPS_RSP = 95,
+        WCN36XX_HAL_EXIT_IMPS_RSP = 96,
+        WCN36XX_HAL_ENTER_BMPS_RSP = 97,
+        WCN36XX_HAL_EXIT_BMPS_RSP = 98,
+        WCN36XX_HAL_ENTER_UAPSD_RSP = 99,
+        WCN36XX_HAL_EXIT_UAPSD_RSP = 100,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_RSP = 101,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_RSP = 102,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_RSP = 103,
+        WCN36XX_HAL_ADD_BCN_FILTER_RSP = 104,
+        WCN36XX_HAL_REM_BCN_FILTER_RSP = 105,
+        WCN36XX_HAL_SET_RSSI_THRESH_RSP = 106,
+        WCN36XX_HAL_HOST_OFFLOAD_RSP = 107,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN_RSP = 108,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN_RSP = 109,
+        WCN36XX_HAL_ENTER_WOWL_RSP = 110,
+        WCN36XX_HAL_EXIT_WOWL_RSP = 111,
+        WCN36XX_HAL_RSSI_NOTIFICATION_IND = 112,
+        WCN36XX_HAL_GET_RSSI_RSP = 113,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_RSP = 114,
+
+        /* 11k related events */
+        WCN36XX_HAL_SET_MAX_TX_POWER_REQ = 115,
+        WCN36XX_HAL_SET_MAX_TX_POWER_RSP = 116,
+
+        /* 11R related msgs */
+        WCN36XX_HAL_AGGR_ADD_TS_REQ = 117,
+        WCN36XX_HAL_AGGR_ADD_TS_RSP = 118,
+
+        /* P2P  WLAN_FEATURE_P2P */
+        WCN36XX_HAL_SET_P2P_GONOA_REQ = 119,
+        WCN36XX_HAL_SET_P2P_GONOA_RSP = 120,
+
+        /* WLAN Dump commands */
+        WCN36XX_HAL_DUMP_COMMAND_REQ = 121,
+        WCN36XX_HAL_DUMP_COMMAND_RSP = 122,
+
+        /* OEM_DATA FEATURE SUPPORT */
+        WCN36XX_HAL_START_OEM_DATA_REQ = 123,
+        WCN36XX_HAL_START_OEM_DATA_RSP = 124,
+
+        /* ADD SELF STA REQ and RSP */
+        WCN36XX_HAL_ADD_STA_SELF_REQ = 125,
+        WCN36XX_HAL_ADD_STA_SELF_RSP = 126,
+
+        /* DEL SELF STA SUPPORT */
+        WCN36XX_HAL_DEL_STA_SELF_REQ = 127,
+        WCN36XX_HAL_DEL_STA_SELF_RSP = 128,
+
+        /* Coex Indication */
+        WCN36XX_HAL_COEX_IND = 129,
+
+        /* Tx Complete Indication */
+        WCN36XX_HAL_OTA_TX_COMPL_IND = 130,
+
+        /* Host Suspend/resume messages */
+        WCN36XX_HAL_HOST_SUSPEND_IND = 131,
+        WCN36XX_HAL_HOST_RESUME_REQ = 132,
+        WCN36XX_HAL_HOST_RESUME_RSP = 133,
+
+        WCN36XX_HAL_SET_TX_POWER_REQ = 134,
+        WCN36XX_HAL_SET_TX_POWER_RSP = 135,
+        WCN36XX_HAL_GET_TX_POWER_REQ = 136,
+        WCN36XX_HAL_GET_TX_POWER_RSP = 137,
+
+        WCN36XX_HAL_P2P_NOA_ATTR_IND = 138,
+
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_REQ = 139,
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_RSP = 140,
+        WCN36XX_HAL_GET_TPC_REPORT_REQ = 141,
+        WCN36XX_HAL_GET_TPC_REPORT_RSP = 142,
+        WCN36XX_HAL_RADAR_DETECT_IND = 143,
+        WCN36XX_HAL_RADAR_DETECT_INTR_IND = 144,
+        WCN36XX_HAL_KEEP_ALIVE_REQ = 145,
+        WCN36XX_HAL_KEEP_ALIVE_RSP = 146,
+
+        /* PNO messages */
+        WCN36XX_HAL_SET_PREF_NETWORK_REQ = 147,
+        WCN36XX_HAL_SET_PREF_NETWORK_RSP = 148,
+        WCN36XX_HAL_SET_RSSI_FILTER_REQ = 149,
+        WCN36XX_HAL_SET_RSSI_FILTER_RSP = 150,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ = 151,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP = 152,
+        WCN36XX_HAL_PREF_NETW_FOUND_IND = 153,
+
+        WCN36XX_HAL_SET_TX_PER_TRACKING_REQ = 154,
+        WCN36XX_HAL_SET_TX_PER_TRACKING_RSP = 155,
+        WCN36XX_HAL_TX_PER_HIT_IND = 156,
+
+        WCN36XX_HAL_8023_MULTICAST_LIST_REQ = 157,
+        WCN36XX_HAL_8023_MULTICAST_LIST_RSP = 158,
+
+        WCN36XX_HAL_SET_PACKET_FILTER_REQ = 159,
+        WCN36XX_HAL_SET_PACKET_FILTER_RSP = 160,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_REQ = 161,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_RSP = 162,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_REQ = 163,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_RSP = 164,
+
+        /*
+         * This is temp fix. Should be removed once Host and Riva code is
+         * in sync.
+         */
+        WCN36XX_HAL_INIT_SCAN_CON_REQ = 165,
+
+        WCN36XX_HAL_SET_POWER_PARAMS_REQ = 166,
+        WCN36XX_HAL_SET_POWER_PARAMS_RSP = 167,
+
+        WCN36XX_HAL_TSM_STATS_REQ = 168,
+        WCN36XX_HAL_TSM_STATS_RSP = 169,
+
+        /* wake reason indication (WOW) */
+        WCN36XX_HAL_WAKE_REASON_IND = 170,
+
+        /* GTK offload support */
+        WCN36XX_HAL_GTK_OFFLOAD_REQ = 171,
+        WCN36XX_HAL_GTK_OFFLOAD_RSP = 172,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_REQ = 173,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_RSP = 174,
+
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ = 175,
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP = 176,
+        WCN36XX_HAL_EXCLUDE_UNENCRYPTED_IND = 177,
+
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ = 178,
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_RSP = 179,
+
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_REQ = 182,
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_RSP = 183,
+
+        WCN36XX_HAL_P2P_NOA_START_IND = 184,
+
+        WCN36XX_HAL_GET_ROAM_RSSI_REQ = 185,
+        WCN36XX_HAL_GET_ROAM_RSSI_RSP = 186,
+
+        WCN36XX_HAL_CLASS_B_STATS_IND = 187,
+        WCN36XX_HAL_DEL_BA_IND = 188,
+        WCN36XX_HAL_DHCP_START_IND = 189,
+        WCN36XX_HAL_DHCP_STOP_IND = 190,
+
+        WCN36XX_HAL_MSG_MAX = WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE
+};
+
+/* Enumeration for Version */
+enum wcn36xx_hal_host_msg_version {
+        WCN36XX_HAL_MSG_VERSION0 = 0,
+        WCN36XX_HAL_MSG_VERSION1 = 1,
+        /* define as 2 bytes data */
+        WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION = 0x7FFF,
+        WCN36XX_HAL_MSG_VERSION_MAX_FIELD = WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION
+};
+
+enum driver_type {
+        DRIVER_TYPE_PRODUCTION = 0,
+        DRIVER_TYPE_MFG = 1,
+        DRIVER_TYPE_DVT = 2,
+        DRIVER_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stop_type {
+        HAL_STOP_TYPE_SYS_RESET,
+        HAL_STOP_TYPE_SYS_DEEP_SLEEP,
+        HAL_STOP_TYPE_RF_KILL,
+        HAL_STOP_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_sys_mode {
+        HAL_SYS_MODE_NORMAL,
+        HAL_SYS_MODE_LEARN,
+        HAL_SYS_MODE_SCAN,
+        HAL_SYS_MODE_PROMISC,
+        HAL_SYS_MODE_SUSPEND_LINK,
+        HAL_SYS_MODE_ROAM_SCAN,
+        HAL_SYS_MODE_ROAM_SUSPEND_LINK,
+        HAL_SYS_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum phy_chan_bond_state {
+        /* 20MHz IF bandwidth centered on IF carrier */
+        PHY_SINGLE_CHANNEL_CENTERED = 0,
+
+        /* 40MHz IF bandwidth with lower 20MHz supporting the primary channel */
+        PHY_DOUBLE_CHANNEL_LOW_PRIMARY = 1,
+
+        /* 40MHz IF bandwidth centered on IF carrier */
+        PHY_DOUBLE_CHANNEL_CENTERED = 2,
+
+        /* 40MHz IF bandwidth with higher 20MHz supporting the primary ch */
+        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY = 3,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED = 4,
+
+        /* 20/40MHZ offset CENTERED 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED = 5,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED = 6,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW = 7,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW = 8,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH = 9,
+
+        /* 20/40MHZ offset-HIGH 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH = 10,
+
+        PHY_CHANNEL_BONDING_STATE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Spatial Multiplexing(SM) Power Save mode */
+enum wcn36xx_hal_ht_mimo_state {
+        /* Static SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_STATIC = 0,
+
+        /* Dynamic SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_DYNAMIC = 1,
+
+        /* reserved */
+        WCN36XX_HAL_HT_MIMO_PS_NA = 2,
+
+        /* SM Power Save disabled */
+        WCN36XX_HAL_HT_MIMO_PS_NO_LIMIT = 3,
+
+        WCN36XX_HAL_HT_MIMO_PS_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* each station added has a rate mode which specifies the sta attributes */
+enum sta_rate_mode {
+        STA_TAURUS = 0,
+        STA_TITAN,
+        STA_POLARIS,
+        STA_11b,
+        STA_11bg,
+        STA_11a,
+        STA_11n,
+        STA_11ac,
+        STA_INVALID_RATE_MODE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* 1,2,5.5,11 */
+#define WCN36XX_HAL_NUM_DSSS_RATES           4
+
+/* 6,9,12,18,24,36,48,54 */
+#define WCN36XX_HAL_NUM_OFDM_RATES           8
+
+/* 72,96,108 */
+#define WCN36XX_HAL_NUM_POLARIS_RATES       3
+
+#define WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET    16
+
+enum wcn36xx_hal_bss_type {
+        WCN36XX_HAL_INFRASTRUCTURE_MODE,
+
+        /* Added for softAP support */
+        WCN36XX_HAL_INFRA_AP_MODE,
+
+        WCN36XX_HAL_IBSS_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_STA_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_AP_MODE,
+
+        WCN36XX_HAL_AUTO_MODE,
+
+        WCN36XX_HAL_DONOT_USE_BSS_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_nw_type {
+        WCN36XX_HAL_11A_NW_TYPE,
+        WCN36XX_HAL_11B_NW_TYPE,
+        WCN36XX_HAL_11G_NW_TYPE,
+        WCN36XX_HAL_11N_NW_TYPE,
+        WCN36XX_HAL_DONOT_USE_NW_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WCN36XX_HAL_MAC_RATESET_EID_MAX            12
+
+enum wcn36xx_hal_ht_operating_mode {
+        /* No Protection */
+        WCN36XX_HAL_HT_OP_MODE_PURE,
+
+        /* Overlap Legacy device present, protection is optional */
+        WCN36XX_HAL_HT_OP_MODE_OVERLAP_LEGACY,
+
+        /* No legacy device, but 20 MHz HT present */
+        WCN36XX_HAL_HT_OP_MODE_NO_LEGACY_20MHZ_HT,
+
+        /* Protection is required */
+        WCN36XX_HAL_HT_OP_MODE_MIXED,
+
+        WCN36XX_HAL_HT_OP_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type enum used with peer */
+enum ani_ed_type {
+        WCN36XX_HAL_ED_NONE,
+        WCN36XX_HAL_ED_WEP40,
+        WCN36XX_HAL_ED_WEP104,
+        WCN36XX_HAL_ED_TKIP,
+        WCN36XX_HAL_ED_CCMP,
+        WCN36XX_HAL_ED_WPI,
+        WCN36XX_HAL_ED_AES_128_CMAC,
+        WCN36XX_HAL_ED_NOT_IMPLEMENTED = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WLAN_MAX_KEY_RSC_LEN                16
+#define WLAN_WAPI_KEY_RSC_LEN               16
+
+/* MAX key length when ULA is used */
+#define WCN36XX_HAL_MAC_MAX_KEY_LENGTH              32
+#define WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS     4
+
+/*
+ * Enum to specify whether key is used for TX only, RX only or both.
+ */
+enum ani_key_direction {
+        WCN36XX_HAL_TX_ONLY,
+        WCN36XX_HAL_RX_ONLY,
+        WCN36XX_HAL_TX_RX,
+        WCN36XX_HAL_TX_DEFAULT,
+        WCN36XX_HAL_DONOT_USE_KEY_DIRECTION = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum ani_wep_type {
+        WCN36XX_HAL_WEP_STATIC,
+        WCN36XX_HAL_WEP_DYNAMIC,
+        WCN36XX_HAL_WEP_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_link_state {
+
+        WCN36XX_HAL_LINK_IDLE_STATE = 0,
+        WCN36XX_HAL_LINK_PREASSOC_STATE = 1,
+        WCN36XX_HAL_LINK_POSTASSOC_STATE = 2,
+        WCN36XX_HAL_LINK_AP_STATE = 3,
+        WCN36XX_HAL_LINK_IBSS_STATE = 4,
+
+        /* BT-AMP Case */
+        WCN36XX_HAL_LINK_BTAMP_PREASSOC_STATE = 5,
+        WCN36XX_HAL_LINK_BTAMP_POSTASSOC_STATE = 6,
+        WCN36XX_HAL_LINK_BTAMP_AP_STATE = 7,
+        WCN36XX_HAL_LINK_BTAMP_STA_STATE = 8,
+
+        /* Reserved for HAL Internal Use */
+        WCN36XX_HAL_LINK_LEARN_STATE = 9,
+        WCN36XX_HAL_LINK_SCAN_STATE = 10,
+        WCN36XX_HAL_LINK_FINISH_SCAN_STATE = 11,
+        WCN36XX_HAL_LINK_INIT_CAL_STATE = 12,
+        WCN36XX_HAL_LINK_FINISH_CAL_STATE = 13,
+        WCN36XX_HAL_LINK_LISTEN_STATE = 14,
+
+        WCN36XX_HAL_LINK_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stats_mask {
+        HAL_SUMMARY_STATS_INFO = 0x00000001,
+        HAL_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        HAL_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        HAL_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        HAL_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        HAL_PER_STA_STATS_INFO = 0x00000020
+};
+
+/* BT-AMP events type */
+enum bt_amp_event_type {
+        BTAMP_EVENT_CONNECTION_START,
+        BTAMP_EVENT_CONNECTION_STOP,
+        BTAMP_EVENT_CONNECTION_TERMINATED,
+
+        /* This and beyond are invalid values */
+        BTAMP_EVENT_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+/* PE Statistics */
+enum pe_stats_mask {
+        PE_SUMMARY_STATS_INFO = 0x00000001,
+        PE_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        PE_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        PE_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        PE_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        PE_PER_STA_STATS_INFO = 0x00000020,
+
+        /* This and beyond are invalid values */
+        PE_STATS_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/*
+ * Configuration Parameter IDs
+ */
+#define WCN36XX_HAL_CFG_STA_ID                          0
+#define WCN36XX_HAL_CFG_CURRENT_TX_ANTENNA              1
+#define WCN36XX_HAL_CFG_CURRENT_RX_ANTENNA              2
+#define WCN36XX_HAL_CFG_LOW_GAIN_OVERRIDE               3
+#define WCN36XX_HAL_CFG_POWER_STATE_PER_CHAIN           4
+#define WCN36XX_HAL_CFG_CAL_PERIOD                      5
+#define WCN36XX_HAL_CFG_CAL_CONTROL                     6
+#define WCN36XX_HAL_CFG_PROXIMITY                       7
+#define WCN36XX_HAL_CFG_NETWORK_DENSITY                 8
+#define WCN36XX_HAL_CFG_MAX_MEDIUM_TIME                 9
+#define WCN36XX_HAL_CFG_MAX_MPDUS_IN_AMPDU              10
+#define WCN36XX_HAL_CFG_RTS_THRESHOLD                   11
+#define WCN36XX_HAL_CFG_SHORT_RETRY_LIMIT               12
+#define WCN36XX_HAL_CFG_LONG_RETRY_LIMIT                13
+#define WCN36XX_HAL_CFG_FRAGMENTATION_THRESHOLD         14
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ZERO          15
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ONE           16
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_TWO           17
+#define WCN36XX_HAL_CFG_FIXED_RATE                      18
+#define WCN36XX_HAL_CFG_RETRYRATE_POLICY                19
+#define WCN36XX_HAL_CFG_RETRYRATE_SECONDARY             20
+#define WCN36XX_HAL_CFG_RETRYRATE_TERTIARY              21
+#define WCN36XX_HAL_CFG_FORCE_POLICY_PROTECTION         22
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_24GHZ      23
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_5GHZ       24
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_24GHZ        25
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_5GHZ         26
+#define WCN36XX_HAL_CFG_MAX_BA_SESSIONS                 27
+#define WCN36XX_HAL_CFG_PS_DATA_INACTIVITY_TIMEOUT      28
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_FILTER            29
+#define WCN36XX_HAL_CFG_PS_ENABLE_RSSI_MONITOR          30
+#define WCN36XX_HAL_CFG_NUM_BEACON_PER_RSSI_AVERAGE     31
+#define WCN36XX_HAL_CFG_STATS_PERIOD                    32
+#define WCN36XX_HAL_CFG_CFP_MAX_DURATION                33
+#define WCN36XX_HAL_CFG_FRAME_TRANS_ENABLED             34
+#define WCN36XX_HAL_CFG_DTIM_PERIOD                     35
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBK                   36
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBE                   37
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVO                   38
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVI                   39
+#define WCN36XX_HAL_CFG_BA_THRESHOLD_HIGH               40
+#define WCN36XX_HAL_CFG_MAX_BA_BUFFERS                  41
+#define WCN36XX_HAL_CFG_RPE_POLLING_THRESHOLD           42
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG 43
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG 44
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG 45
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG 46
+#define WCN36XX_HAL_CFG_NO_OF_ONCHIP_REORDER_SESSIONS   47
+#define WCN36XX_HAL_CFG_PS_LISTEN_INTERVAL              48
+#define WCN36XX_HAL_CFG_PS_HEART_BEAT_THRESHOLD         49
+#define WCN36XX_HAL_CFG_PS_NTH_BEACON_FILTER            50
+#define WCN36XX_HAL_CFG_PS_MAX_PS_POLL                  51
+#define WCN36XX_HAL_CFG_PS_MIN_RSSI_THRESHOLD           52
+#define WCN36XX_HAL_CFG_PS_RSSI_FILTER_PERIOD           53
+#define WCN36XX_HAL_CFG_PS_BROADCAST_FRAME_FILTER_ENABLE 54
+#define WCN36XX_HAL_CFG_PS_IGNORE_DTIM                  55
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_EARLY_TERM        56
+#define WCN36XX_HAL_CFG_DYNAMIC_PS_POLL_VALUE           57
+#define WCN36XX_HAL_CFG_PS_NULLDATA_AP_RESP_TIMEOUT     58
+#define WCN36XX_HAL_CFG_TELE_BCN_WAKEUP_EN              59
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI               60
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS     61
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI                 62
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI_IDLE_BCNS       63
+#define WCN36XX_HAL_CFG_TX_PWR_CTRL_ENABLE              64
+#define WCN36XX_HAL_CFG_VALID_RADAR_CHANNEL_LIST        65
+#define WCN36XX_HAL_CFG_TX_POWER_24_20                  66
+#define WCN36XX_HAL_CFG_TX_POWER_24_40                  67
+#define WCN36XX_HAL_CFG_TX_POWER_50_20                  68
+#define WCN36XX_HAL_CFG_TX_POWER_50_40                  69
+#define WCN36XX_HAL_CFG_MCAST_BCAST_FILTER_SETTING      70
+#define WCN36XX_HAL_CFG_BCN_EARLY_TERM_WAKEUP_INTERVAL  71
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_2_4                72
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_5                  73
+#define WCN36XX_HAL_CFG_INFRA_STA_KEEP_ALIVE_PERIOD     74
+#define WCN36XX_HAL_CFG_ENABLE_CLOSE_LOOP               75
+#define WCN36XX_HAL_CFG_BTC_EXECUTION_MODE              76
+#define WCN36XX_HAL_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK      77
+#define WCN36XX_HAL_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS  78
+#define WCN36XX_HAL_CFG_PS_TX_INACTIVITY_TIMEOUT        79
+#define WCN36XX_HAL_CFG_WCNSS_API_VERSION               80
+#define WCN36XX_HAL_CFG_AP_KEEPALIVE_TIMEOUT            81
+#define WCN36XX_HAL_CFG_GO_KEEPALIVE_TIMEOUT            82
+#define WCN36XX_HAL_CFG_ENABLE_MC_ADDR_LIST             83
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_BT           84
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_BT          85
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_BT          86
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_BT            87
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_WLAN         88
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_WLAN        89
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_WLAN        90
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_WLAN          91
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_BT              92
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_WLAN            93
+#define WCN36XX_HAL_CFG_BTC_MAX_SCO_BLOCK_PERC          94
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_A2DP           95
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_SCO            96
+#define WCN36XX_HAL_CFG_ENABLE_UNICAST_FILTER           97
+#define WCN36XX_HAL_CFG_MAX_ASSOC_LIMIT                 98
+#define WCN36XX_HAL_CFG_ENABLE_LPWR_IMG_TRANSITION      99
+#define WCN36XX_HAL_CFG_ENABLE_MCC_ADAPTIVE_SCHEDULER   100
+#define WCN36XX_HAL_CFG_ENABLE_DETECT_PS_SUPPORT        101
+#define WCN36XX_HAL_CFG_AP_LINK_MONITOR_TIMEOUT         102
+#define WCN36XX_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER       103
+#define WCN36XX_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE         104
+#define WCN36XX_HAL_CFG_MAX_PARAMS                      105
+
+/* Message definitons - All the messages below need to be packed */
+
+/* Definition for HAL API Version. */
+struct wcnss_wlan_version {
+        u8 revision;
+        u8 version;
+        u8 minor;
+        u8 major;
+} __packed;
+
+/* Definition for Encryption Keys */
+struct wcn36xx_hal_keys {
+        u8 id;
+
+        /* 0 for multicast */
+        u8 unicast;
+
+        enum ani_key_direction direction;
+
+        /* Usage is unknown */
+        u8 rsc[WLAN_MAX_KEY_RSC_LEN];
+
+        /* =1 for authenticator,=0 for supplicant */
+        u8 pae_role;
+
+        u16 length;
+        u8 key[WCN36XX_HAL_MAC_MAX_KEY_LENGTH];
+} __packed;
+
+/*
+ * set_sta_key_params Moving here since it is shared by
+ * configbss/setstakey msgs
+ */
+struct wcn36xx_hal_set_sta_key_params {
+        /* STA Index */
+        u16 sta_index;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* STATIC/DYNAMIC - valid only for WEP */
+        enum ani_wep_type wep_type;
+
+        /* Default WEP key, valid only for static WEP, must between 0 and 3. */
+        u8 def_wep_idx;
+
+        /* valid only for non-static WEP encyrptions */
+        struct wcn36xx_hal_keys key[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /*
+         * Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX
+         */
+        u8 single_tid_rc;
+
+} __packed;
+
+/* 4-byte control message header used by HAL*/
+struct wcn36xx_hal_msg_header {
+        enum wcn36xx_hal_host_msg_type msg_type:16;
+        enum wcn36xx_hal_host_msg_version msg_version:16;
+        u32 len;
+} __packed;
+
+/* Config format required by HAL for each CFG item*/
+struct wcn36xx_hal_cfg {
+        /* Cfg Id. The Id required by HAL is exported by HAL
+         * in shared header file between UMAC and HAL.*/
+        u16 id;
+
+        /* Length of the Cfg. This parameter is used to go to next cfg
+         * in the TLV format.*/
+        u16 len;
+
+        /* Padding bytes for unaligned address's */
+        u16 pad_bytes;
+
+        /* Reserve bytes for making cfgVal to align address */
+        u16 reserve;
+
+        /* Following the uCfgLen field there should be a 'uCfgLen' bytes
+         * containing the uCfgValue ; u8 uCfgValue[uCfgLen] */
+} __packed;
+
+struct wcn36xx_hal_mac_start_parameters {
+        /* Drive Type - Production or FTM etc */
+        enum driver_type type;
+
+        /* Length of the config buffer */
+        u32 len;
+
+        /* Following this there is a TLV formatted buffer of length
+         * "len" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+} __packed;
+
+struct wcn36xx_hal_mac_start_req_msg {
+        /* config buffer must start in TLV format just here */
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_parameters params;
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_params {
+        /* success or failure */
+        u16 status;
+
+        /* Max number of STA supported by the device */
+        u8 stations;
+
+        /* Max number of BSS supported by the device */
+        u8 bssids;
+
+        /* API Version */
+        struct wcnss_wlan_version version;
+
+        /* CRM build information */
+        u8 crm_version[WCN36XX_HAL_VERSION_LENGTH];
+
+        /* hardware/chipset/misc version information */
+        u8 wlan_version[WCN36XX_HAL_VERSION_LENGTH];
+
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_rsp_params start_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_params {
+        /* The reason for which the device is being stopped */
+        enum wcn36xx_hal_stop_type reason;
+
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_stop_req_params stop_req_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_update_cfg_req_msg {
+        /*
+         * Note: The length specified in tHalUpdateCfgReqMsg messages should be
+         * header.msgLen = sizeof(tHalUpdateCfgReqMsg) + uConfigBufferLen
+         */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Length of the config buffer. Allows UMAC to update multiple CFGs */
+        u32 len;
+
+        /*
+         * Following this there is a TLV formatted buffer of length
+         * "uConfigBufferLen" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+
+} __packed;
+
+struct wcn36xx_hal_update_cfg_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+/* Frame control field format (2 bytes) */
+struct wcn36xx_hal_mac_frame_ctl {
+
+#ifndef ANI_LITTLE_BIT_ENDIAN
+
+        u8 subType:4;
+        u8 type:2;
+        u8 protVer:2;
+
+        u8 order:1;
+        u8 wep:1;
+        u8 moreData:1;
+        u8 powerMgmt:1;
+        u8 retry:1;
+        u8 moreFrag:1;
+        u8 fromDS:1;
+        u8 toDS:1;
+
+#else
+
+        u8 protVer:2;
+        u8 type:2;
+        u8 subType:4;
+
+        u8 toDS:1;
+        u8 fromDS:1;
+        u8 moreFrag:1;
+        u8 retry:1;
+        u8 powerMgmt:1;
+        u8 moreData:1;
+        u8 wep:1;
+        u8 order:1;
+
+#endif
+
+};
+
+/* Sequence control field */
+struct wcn36xx_hal_mac_seq_ctl {
+        u8 fragNum:4;
+        u8 seqNumLo:4;
+        u8 seqNumHi:8;
+};
+
+/* Management header format */
+struct wcn36xx_hal_mac_mgmt_hdr {
+        struct wcn36xx_hal_mac_frame_ctl fc;
+        u8 durationLo;
+        u8 durationHi;
+        u8 da[6];
+        u8 sa[6];
+        u8 bssId[6];
+        struct wcn36xx_hal_mac_seq_ctl seqControl;
+};
+
+/* FIXME: pronto v1 apparently has 4 */
+#define WCN36XX_HAL_NUM_BSSID               2
+
+/* Scan Entry to hold active BSS idx's */
+struct wcn36xx_hal_scan_entry {
+        u8 bss_index[WCN36XX_HAL_NUM_BSSID];
+        u8 active_bss_count;
+};
+
+struct wcn36xx_hal_init_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_len;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+};
+
+struct wcn36xx_hal_init_scan_con_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+        /* Single NoA usage in Scanning */
+        u8 use_noa;
+
+        /* Indicates the scan duration (in ms) */
+        u16 scan_duration;
+
+};
+
+struct wcn36xx_hal_init_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+struct wcn36xx_hal_start_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to scan */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u32 start_tsf[2];
+        u8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_end_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to stop scanning. Not used really. But
+         * retained for symmetry with "start Scan" message. It can also
+         * help in error check if needed. */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_end_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_finish_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Identifies the operational state of the AP/STA
+         * LEARN - AP Role SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* Operating channel to tune to. */
+        u8 oper_channel;
+
+        /* Channel Bonding state If 20/40 MHz is operational, this will
+         * indicate the 40 MHz extension channel in combination with the
+         * control channel */
+        enum phy_chan_bond_state cb_state;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+} __packed;
+
+struct wcn36xx_hal_finish_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+enum wcn36xx_hal_rate_index {
+        HW_RATE_INDEX_1MBPS     = 0x82,
+        HW_RATE_INDEX_2MBPS     = 0x84,
+        HW_RATE_INDEX_5_5MBPS   = 0x8B,
+        HW_RATE_INDEX_6MBPS     = 0x0C,
+        HW_RATE_INDEX_9MBPS     = 0x12,
+        HW_RATE_INDEX_11MBPS    = 0x96,
+        HW_RATE_INDEX_12MBPS    = 0x18,
+        HW_RATE_INDEX_18MBPS    = 0x24,
+        HW_RATE_INDEX_24MBPS    = 0x30,
+        HW_RATE_INDEX_36MBPS    = 0x48,
+        HW_RATE_INDEX_48MBPS    = 0x60,
+        HW_RATE_INDEX_54MBPS    = 0x6C
+};
+
+struct wcn36xx_hal_supported_rates {
+        /*
+         * For Self STA Entry: this represents Self Mode.
+         * For Peer Stations, this represents the mode of the peer.
+         * On Station:
+         *
+         * --this mode is updated when PE adds the Self Entry.
+         *
+         * -- OR when PE sends 'ADD_BSS' message and station context in BSS
+         *    is used to indicate the mode of the AP.
+         *
+         * ON AP:
+         *
+         * -- this mode is updated when PE sends 'ADD_BSS' and Sta entry
+         *     for that BSS is used to indicate the self mode of the AP.
+         *
+         * -- OR when a station is associated, PE sends 'ADD_STA' message
+         *    with this mode updated.
+         */
+
+        enum sta_rate_mode op_rate_mode;
+
+        /* 11b, 11a and aniLegacyRates are IE rates which gives rate in
+         * unit of 500Kbps */
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES];
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES];
+        u16 legacy_rates[WCN36XX_HAL_NUM_POLARIS_RATES];
+        u16 reserved;
+
+        /* Taurus only supports 26 Titan Rates(no ESF/concat Rates will be
+         * supported) First 26 bits are reserved for those Titan rates and
+         * the last 4 bits(bit28-31) for Taurus, 2(bit26-27) bits are
+         * reserved. */
+        /* Titan and Taurus Rates */
+        u32 enhanced_rate_bitmap;
+
+        /*
+         * 0-76 bits used, remaining reserved
+         * bits 0-15 and 32 should be set.
+         */
+        u8 supported_mcs_set[WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET];
+
+        /*
+         * RX Highest Supported Data Rate defines the highest data
+         * rate that the STA is able to receive, in unites of 1Mbps.
+         * This value is derived from "Supported MCS Set field" inside
+         * the HT capability element.
+         */
+        u16 rx_highest_data_rate;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_params {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* TODO move this parameter to the end for 3680 */
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* TODO add this parameter for 3680. */
+        /* Reserved to align next field on a dword boundary */
+        /* u8 reserved; */
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params sta_params;
+} __packed;
+
+struct wcn36xx_hal_config_sta_params_v1 {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params_v1 sta_params;
+} __packed;
+
+struct config_sta_rsp_params {
+        /* success or failure */
+        u32 status;
+
+        /* Station index; valid only when 'status' field value SUCCESS */
+        u8 sta_index;
+
+        /* BSSID Index of BSS to which the station is associated */
+        u8 bssid_index;
+
+        /* DPU Index for PTK */
+        u8 dpu_index;
+
+        /* DPU Index for GTK */
+        u8 bcast_dpu_index;
+
+        /* DPU Index for IGTK  */
+        u8 bcast_mgmt_dpu_idx;
+
+        /* PTK DPU signature */
+        u8 uc_ucast_sig;
+
+        /* GTK DPU isignature */
+        u8 uc_bcast_sig;
+
+        /* IGTK DPU signature */
+        u8 uc_mgmt_sig;
+
+        u8 p2p;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct config_sta_rsp_params params;
+} __packed;
+
+/* Delete STA Request message */
+struct wcn36xx_hal_delete_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Index of STA to delete */
+        u8 sta_index;
+
+} __packed;
+
+/* Delete STA Response message */
+struct wcn36xx_hal_delete_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Index of STA deleted */
+        u8 sta_id;
+} __packed;
+
+/* 12 Bytes long because this structure can be used to represent rate and
+ * extended rate set IEs. The parser assume this to be at least 12 */
+struct wcn36xx_hal_rate_set {
+        u8 num_rates;
+        u8 rate[WCN36XX_HAL_MAC_RATESET_EID_MAX];
+} __packed;
+
+/* access category record */
+struct wcn36xx_hal_aci_aifsn {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:1;
+        u8 aci:2;
+        u8 acm:1;
+        u8 aifsn:4;
+#else
+        u8 aifsn:4;
+        u8 acm:1;
+        u8 aci:2;
+        u8 rsvd:1;
+#endif
+} __packed;
+
+/* contention window size */
+struct wcn36xx_hal_mac_cw {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 max:4;
+        u8 min:4;
+#else
+        u8 min:4;
+        u8 max:4;
+#endif
+} __packed;
+
+struct wcn36xx_hal_edca_param_record {
+        struct wcn36xx_hal_aci_aifsn aci;
+        struct wcn36xx_hal_mac_cw cw;
+        u16 txop_limit;
+} __packed;
+
+struct wcn36xx_hal_mac_ssid {
+        u8 length;
+        u8 ssid[32];
+} __packed;
+
+/* Concurrency role. These are generic IDs that identify the various roles
+ *  in the software system. */
+enum wcn36xx_hal_con_mode {
+        WCN36XX_HAL_STA_MODE = 0,
+
+        /* to support softAp mode . This is misleading.
+           It means AP MODE only. */
+        WCN36XX_HAL_STA_SAP_MODE = 1,
+
+        WCN36XX_HAL_P2P_CLIENT_MODE,
+        WCN36XX_HAL_P2P_GO_MODE,
+        WCN36XX_HAL_MONITOR_MODE,
+};
+
+/* This is a bit pattern to be set for each mode
+ * bit 0 - sta mode
+ * bit 1 - ap mode
+ * bit 2 - p2p client mode
+ * bit 3 - p2p go mode */
+enum wcn36xx_hal_concurrency_mode {
+        HAL_STA = 1,
+        HAL_SAP = 2,
+
+        /* to support sta, softAp  mode . This means STA+AP mode */
+        HAL_STA_SAP = 3,
+
+        HAL_P2P_CLIENT = 4,
+        HAL_P2P_GO = 8,
+        HAL_MAX_CONCURRENCY_PERSONA = 4
+};
+
+struct wcn36xx_hal_config_bss_params {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* TODO move sta to the end for 3680 */
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params sta;
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_params_v1 {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params_v1 sta;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params_v1 bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_params {
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index allocated by HAL */
+        u8 bss_index;
+
+        /* DPU descriptor index for PTK */
+        u8 dpu_desc_index;
+
+        /* PTK DPU signature */
+        u8 ucast_dpu_signature;
+
+        /* DPU descriptor index for GTK */
+        u8 bcast_dpu_desc_indx;
+
+        /* GTK DPU signature */
+        u8 bcast_dpu_signature;
+
+        /* DPU descriptor for IGTK */
+        u8 mgmt_dpu_desc_index;
+
+        /* IGTK DPU signature */
+        u8 mgmt_dpu_signature;
+
+        /* Station Index for BSS entry */
+        u8 bss_sta_index;
+
+        /* Self station index for this BSS */
+        u8 bss_self_sta_index;
+
+        /* Bcast station for buffering bcast frames in AP role */
+        u8 bss_bcast_sta_idx;
+
+        /* MAC Address of STA(PEER/SELF) in staContext of configBSSReq */
+        u8 mac[ETH_ALEN];
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        s8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_delete_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS index to be deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_delete_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index that has been deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_join_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the BSSID to which STA is going to associate */
+        u8 bssid[ETH_ALEN];
+
+        /* Indicates the channel to switch to. */
+        u8 channel;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* link State */
+        enum wcn36xx_hal_link_state link_state;
+
+        /* Max TX power */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_join_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+} __packed;
+
+struct post_assoc_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct wcn36xx_hal_config_sta_params sta_params;
+        struct wcn36xx_hal_config_bss_params bss_params;
+};
+
+struct post_assoc_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct config_sta_rsp_params sta_rsp_params;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+};
+
+/* This is used to create a set of WEP keys for a given BSS. */
+struct wcn36xx_hal_set_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Number of keys */
+        u8 num_keys;
+
+        /* Array of keys. */
+        struct wcn36xx_hal_keys keys[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /* Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX */
+        u8 single_tid_rc;
+} __packed;
+
+/* tagged version of set bss key */
+struct wcn36xx_hal_set_bss_key_req_msg_tagged {
+        struct wcn36xx_hal_set_bss_key_req_msg Msg;
+        u32 tag;
+} __packed;
+
+struct wcn36xx_hal_set_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used  configure the key information on a given station.
+ * When the sec_type is WEP40 or WEP104, the def_wep_idx is used to locate
+ * a preconfigured key from a BSS the station assoicated with; otherwise
+ * a new key descriptor is created based on the key field.
+ */
+struct wcn36xx_hal_set_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_set_sta_key_params set_sta_key_params;
+} __packed;
+
+struct wcn36xx_hal_set_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* STATIC/DYNAMIC. Used in Nullifying in Key Descriptors for
+         * Static/Dynamic keys */
+        enum ani_wep_type wep_type;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used by PE to Remove the key information on a given station.
+ */
+struct wcn36xx_hal_remove_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA Index */
+        u16 sta_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* Whether to invalidate the Broadcast key or Unicast key. In case
+         * of WEP, the same key is used for both broadcast and unicast. */
+        u8 unicast;
+
+} __packed;
+
+struct wcn36xx_hal_remove_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+} __packed;
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
+#ifndef OEM_DATA_REQ_SIZE
+#define OEM_DATA_REQ_SIZE 134
+#endif
+
+#ifndef OEM_DATA_RSP_SIZE
+#define OEM_DATA_RSP_SIZE 1968
+#endif
+
+struct start_oem_data_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        tSirMacAddr self_mac_addr;
+        u8 oem_data_req[OEM_DATA_REQ_SIZE];
+
+};
+
+struct start_oem_data_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 oem_data_rsp[OEM_DATA_RSP_SIZE];
+};
+
+#endif
+
+struct wcn36xx_hal_switch_channel_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Channel number */
+        u8 channel_number;
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        u8 tx_mgmt_power;
+
+        /* Max TX power */
+        u8 max_tx_power;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* VO WIFI comment: BSSID needed to identify session. As the
+         * request has power constraints, this should be applied only to
+         * that session Since MTU timing and EDCA are sessionized, this
+         * struct needs to be sessionized and bssid needs to be out of the
+         * VOWifi feature flag V IMP: Keep bssId field at the end of this
+         * msg. It is used to mantain backward compatbility by way of
+         * ignoring if using new host/old FW or old host/new FW since it is
+         * at the end of this struct
+         */
+        u8 bssid[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_switch_channel_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Status */
+        u32 status;
+
+        /* Channel number - same as in request */
+        u8 channel_number;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+
+        /* BSSID needed to identify session - same as in request */
+        u8 bssid[ETH_ALEN];
+
+} __packed;
+
+struct update_edca_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*BSS Index */
+        u16 bss_index;
+
+        /* Best Effort */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* Background */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* Video */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* Voice */
+        struct wcn36xx_hal_edca_param_record acvo;
+};
+
+struct update_edca_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct dpu_stats_params {
+        /* Index of STA to which the statistics */
+        u16 sta_index;
+
+        /* Encryption mode */
+        u8 enc_mode;
+
+        /* status */
+        u32 status;
+
+        /* Statistics */
+        u32 send_blocks;
+        u32 recv_blocks;
+        u32 replays;
+        u8 mic_error_cnt;
+        u32 prot_excl_cnt;
+        u16 format_err_cnt;
+        u16 un_decryptable_cnt;
+        u32 decrypt_err_cnt;
+        u32 decrypt_ok_cnt;
+};
+
+struct wcn36xx_hal_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+
+        /* Categories of stats requested as specified in eHalStatsMask */
+        u32 stats_mask;
+};
+
+struct ani_summary_stats_info {
+        /* Total number of packets(per AC) that were successfully
+         * transmitted with retries */
+        u32 retry_cnt[4];
+
+        /* The number of MSDU packets and MMPDU frames per AC that the
+         * 802.11 station successfully transmitted after more than one
+         * retransmission attempt */
+        u32 multiple_retry_cnt[4];
+
+        /* Total number of packets(per AC) that were successfully
+         * transmitted (with and without retries, including multi-cast,
+         * broadcast) */
+        u32 tx_frm_cnt[4];
+
+        /* Total number of packets that were successfully received (after
+         * appropriate filter rules including multi-cast, broadcast) */
+        u32 rx_frm_cnt;
+
+        /* Total number of duplicate frames received successfully */
+        u32 frm_dup_cnt;
+
+        /* Total number packets(per AC) failed to transmit */
+        u32 fail_cnt[4];
+
+        /* Total number of RTS/CTS sequence failures for transmission of a
+         * packet */
+        u32 rts_fail_cnt;
+
+        /* Total number packets failed transmit because of no ACK from the
+         * remote entity */
+        u32 ack_fail_cnt;
+
+        /* Total number of RTS/CTS sequence success for transmission of a
+         * packet */
+        u32 rts_succ_cnt;
+
+        /* The sum of the receive error count and dropped-receive-buffer
+         * error count. HAL will provide this as a sum of (FCS error) +
+         * (Fail get BD/PDU in HW) */
+        u32 rx_discard_cnt;
+
+        /*
+         * The receive error count. HAL will provide the RxP FCS error
+         * global counter. */
+        u32 rx_error_cnt;
+
+        /* The sum of the transmit-directed byte count, transmit-multicast
+         * byte count and transmit-broadcast byte count. HAL will sum TPE
+         * UC/MC/BCAST global counters to provide this. */
+        u32 tx_byte_cnt;
+};
+
+/* defines tx_rate_flags */
+enum tx_rate_info {
+        /* Legacy rates */
+        HAL_TX_RATE_LEGACY = 0x1,
+
+        /* HT20 rates */
+        HAL_TX_RATE_HT20 = 0x2,
+
+        /* HT40 rates */
+        HAL_TX_RATE_HT40 = 0x4,
+
+        /* Rate with Short guard interval */
+        HAL_TX_RATE_SGI = 0x8,
+
+        /* Rate with Long guard interval */
+        HAL_TX_RATE_LGI = 0x10
+};
+
+struct ani_global_class_a_stats_info {
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames */
+        u32 rx_frag_cnt;
+
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames when a promiscuous packet filter
+         * was enabled */
+        u32 promiscuous_rx_frag_cnt;
+
+        /* The receiver input sensitivity referenced to a FER of 8% at an
+         * MPDU length of 1024 bytes at the antenna connector. Each element
+         * of the array shall correspond to a supported rate and the order
+         * shall be the same as the supporteRates parameter. */
+        u32 rx_input_sensitivity;
+
+        /* The maximum transmit power in dBm upto one decimal. for eg: if
+         * it is 10.5dBm, the value would be 105 */
+        u32 max_pwr;
+
+        /* Number of times the receiver failed to synchronize with the
+         * incoming signal after detecting the sync in the preamble of the
+         * transmitted PLCP protocol data unit. */
+        u32 sync_fail_cnt;
+
+        /* Legacy transmit rate, in units of 500 kbit/sec, for the most
+         * recently transmitted frame */
+        u32 tx_rate;
+
+        /* mcs index for HT20 and HT40 rates */
+        u32 mcs_index;
+
+        /* to differentiate between HT20 and HT40 rates; short and long
+         * guard interval */
+        u32 tx_rate_flags;
+};
+
+struct ani_global_security_stats {
+        /* The number of unencrypted received MPDU frames that the MAC
+         * layer discarded when the IEEE 802.11 dot11ExcludeUnencrypted
+         * management information base (MIB) object is enabled */
+        u32 rx_wep_unencrypted_frm_cnt;
+
+        /* The number of received MSDU packets that that the 802.11 station
+         * discarded because of MIC failures */
+        u32 rx_mic_fail_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a TKIP ICV error */
+        u32 tkip_icv_err;
+
+        /* The number of received MPDU frames that the 802.11 discarded
+         * because of an invalid AES-CCMP format */
+        u32 aes_ccmp_format_err;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of the AES-CCMP replay protection procedure */
+        u32 aes_ccmp_replay_cnt;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of errors detected by the AES-CCMP decryption
+         * algorithm */
+        u32 aes_ccmp_decrpt_err;
+
+        /* The number of encrypted MPDU frames received for which a WEP
+         * decryption key was not available on the 802.11 station */
+        u32 wep_undecryptable_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a WEP ICV error */
+        u32 wep_icv_err;
+
+        /* The number of received encrypted packets that the 802.11 station
+         * successfully decrypted */
+        u32 rx_decrypt_succ_cnt;
+
+        /* The number of encrypted packets that the 802.11 station failed
+         * to decrypt */
+        u32 rx_decrypt_fail_cnt;
+};
+
+struct ani_global_class_b_stats_info {
+        struct ani_global_security_stats uc_stats;
+        struct ani_global_security_stats mc_bc_stats;
+};
+
+struct ani_global_class_c_stats_info {
+        /* This counter shall be incremented for a received A-MSDU frame
+         * with the stations MAC address in the address 1 field or an
+         * A-MSDU frame with a group address in the address 1 field */
+        u32 rx_amsdu_cnt;
+
+        /* This counter shall be incremented when the MAC receives an AMPDU
+         * from the PHY */
+        u32 rx_ampdu_cnt;
+
+        /* This counter shall be incremented when a Frame is transmitted
+         * only on the primary channel */
+        u32 tx_20_frm_cnt;
+
+        /* This counter shall be incremented when a Frame is received only
+         * on the primary channel */
+        u32 rx_20_frm_cnt;
+
+        /* This counter shall be incremented by the number of MPDUs
+         * received in the A-MPDU when an A-MPDU is received */
+        u32 rx_mpdu_in_ampdu_cnt;
+
+        /* This counter shall be incremented when an MPDU delimiter has a
+         * CRC error when this is the first CRC error in the received AMPDU
+         * or when the previous delimiter has been decoded correctly */
+        u32 ampdu_delimiter_crc_err;
+};
+
+struct ani_per_sta_stats_info {
+        /* The number of MPDU frames that the 802.11 station transmitted
+         * and acknowledged through a received 802.11 ACK frame */
+        u32 tx_frag_cnt[4];
+
+        /* This counter shall be incremented when an A-MPDU is transmitted */
+        u32 tx_ampdu_cnt;
+
+        /* This counter shall increment by the number of MPDUs in the AMPDU
+         * when an A-MPDU is transmitted */
+        u32 tx_mpdu_in_ampdu_cnt;
+};
+
+struct wcn36xx_hal_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* STA Idx */
+        u32 sta_index;
+
+        /* Categories of STATS being returned as per eHalStatsMask */
+        u32 stats_mask;
+
+        /* message type is same as the request type */
+        u16 msg_type;
+
+        /* length of the entire request, includes the pStatsBuf length too */
+        u16 msg_len;
+};
+
+struct wcn36xx_hal_set_link_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        enum wcn36xx_hal_link_state state;
+        u8 self_mac_addr[ETH_ALEN];
+
+} __packed;
+
+struct set_link_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* TSPEC Params */
+struct wcn36xx_hal_ts_info_tfc {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u16 ackPolicy:2;
+        u16 userPrio:3;
+        u16 psb:1;
+        u16 aggregation:1;
+        u16 accessPolicy:2;
+        u16 direction:2;
+        u16 tsid:4;
+        u16 trafficType:1;
+#else
+        u16 trafficType:1;
+        u16 tsid:4;
+        u16 direction:2;
+        u16 accessPolicy:2;
+        u16 aggregation:1;
+        u16 psb:1;
+        u16 userPrio:3;
+        u16 ackPolicy:2;
+#endif
+};
+
+/* Flag to schedule the traffic type */
+struct wcn36xx_hal_ts_info_sch {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:7;
+        u8 schedule:1;
+#else
+        u8 schedule:1;
+        u8 rsvd:7;
+#endif
+};
+
+/* Traffic and scheduling info */
+struct wcn36xx_hal_ts_info {
+        struct wcn36xx_hal_ts_info_tfc traffic;
+        struct wcn36xx_hal_ts_info_sch schedule;
+};
+
+/* Information elements */
+struct wcn36xx_hal_tspec_ie {
+        u8 type;
+        u8 length;
+        struct wcn36xx_hal_ts_info ts_info;
+        u16 nom_msdu_size;
+        u16 max_msdu_size;
+        u32 min_svc_interval;
+        u32 max_svc_interval;
+        u32 inact_interval;
+        u32 suspend_interval;
+        u32 svc_start_time;
+        u32 min_data_rate;
+        u32 mean_data_rate;
+        u32 peak_data_rate;
+        u32 max_burst_sz;
+        u32 delay_bound;
+        u32 min_phy_rate;
+        u16 surplus_bw;
+        u16 medium_time;
+};
+
+struct add_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct add_rs_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct del_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC identifier uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To lookup station id using the mac address */
+        u8 bssid[ETH_ALEN];
+};
+
+struct del_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* End of TSpec Parameters */
+
+/* Start of BLOCK ACK related Parameters */
+
+struct wcn36xx_hal_add_ba_session_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* Peer MAC Address */
+        u8 mac_addr[ETH_ALEN];
+
+        /* ADDBA Action Frame dialog token
+           HAL will not interpret this object */
+        u8 dialog_token;
+
+        /* TID for which the BA is being setup
+           This identifies the TC or TS of interest */
+        u8 tid;
+
+        /* 0 - Delayed BA (Not supported)
+           1 - Immediate BA */
+        u8 policy;
+
+        /* Indicates the number of buffers for this TID (baTID)
+           NOTE - This is the requested buffer size. When this
+           is processed by HAL and subsequently by HDD, it is
+           possible that HDD may change this buffer size. Any
+           change in the buffer size should be noted by PE and
+           advertized appropriately in the ADDBA response */
+        u16 buffer_size;
+
+        /* BA timeout in TU's 0 means no timeout will occur */
+        u16 timeout;
+
+        /* b0..b3 - Fragment Number - Always set to 0
+           b4..b15 - Starting Sequence Number of first MSDU
+           for which this BA is setup */
+        u16 ssn;
+
+        /* ADDBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_add_ba_session_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+
+        /* TID for which the BA session has been setup */
+        u8 ba_tid;
+
+        /* BA Buffer Size allocated for the current BA session */
+        u8 ba_buffer_size;
+
+        u8 ba_session_id;
+
+        /* Reordering Window buffer */
+        u8 win_size;
+
+        /* Station Index to id the sta */
+        u8 sta_index;
+
+        /* Starting Sequence Number */
+        u16 ssn;
+} __packed;
+
+struct wcn36xx_hal_add_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* Reorder Window Size */
+        u8 win_size;
+/* Old FW 1.2.2.4 does not support this*/
+#ifdef FEATURE_ON_CHIP_REORDERING
+        u8 reordering_done_on_chip;
+#endif
+} __packed;
+
+struct wcn36xx_hal_add_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+} __packed;
+
+struct add_ba_info {
+        u16 ba_enable:1;
+        u16 starting_seq_num:12;
+        u16 reserved:3;
+};
+
+struct wcn36xx_hal_trigger_ba_rsp_candidate {
+        u8 sta_addr[ETH_ALEN];
+        struct add_ba_info ba_info[STACFG_MAX_TC];
+} __packed;
+
+struct wcn36xx_hal_trigget_ba_req_candidate {
+        u8 sta_index;
+        u8 tid_bitmap;
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Candidate List(tTriggerBaCandidate)
+         */
+        u16 candidate_cnt;
+
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Rsp Candidate List(tTriggerRspBaCandidate)
+         */
+        u16 candidate_cnt;
+} __packed;
+
+struct wcn36xx_hal_del_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TID for which the BA session is being deleted */
+        u8 tid;
+
+        /* DELBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_del_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct tsm_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Traffic Id */
+        u8 tid;
+
+        u8 bssid[ETH_ALEN];
+};
+
+struct tsm_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        /* Uplink Packet Queue delay */
+        u16 uplink_pkt_queue_delay;
+
+        /* Uplink Packet Queue delay histogram */
+        u16 uplink_pkt_queue_delay_hist[4];
+
+        /* Uplink Packet Transmit delay */
+        u32 uplink_pkt_tx_delay;
+
+        /* Uplink Packet loss */
+        u16 uplink_pkt_loss;
+
+        /* Uplink Packet count */
+        u16 uplink_pkt_count;
+
+        /* Roaming count */
+        u8 roaming_count;
+
+        /* Roaming Delay */
+        u16 roaming_delay;
+};
+
+struct set_key_done_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*bssid of the keys */
+        u8 bssidx;
+        u8 enc_type;
+};
+
+struct wcn36xx_hal_nv_img_download_req_msg {
+        /* Note: The length specified in wcn36xx_hal_nv_img_download_req_msg
+         * messages should be
+         * header.len = sizeof(wcn36xx_hal_nv_img_download_req_msg) +
+         * nv_img_buffer_size */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Fragment sequence number of the NV Image. Note that NV Image
+         * might not fit into one message due to size limitation of the SMD
+         * channel FIFO. UMAC can hence choose to chop the NV blob into
+         * multiple fragments starting with seqeunce number 0, 1, 2 etc.
+         * The last fragment MUST be indicated by marking the
+         * isLastFragment field to 1. Note that all the NV blobs would be
+         * concatenated together by HAL without any padding bytes in
+         * between.*/
+        u16 frag_number;
+
+        /* Is this the last fragment? When set to 1 it indicates that no
+         * more fragments will be sent by UMAC and HAL can concatenate all
+         * the NV blobs rcvd & proceed with the parsing. HAL would generate
+         * a WCN36XX_HAL_DOWNLOAD_NV_RSP to the WCN36XX_HAL_DOWNLOAD_NV_REQ
+         * after it receives each fragment */
+        u16 last_fragment;
+
+        /* NV Image size (number of bytes) */
+        u32 nv_img_buffer_size;
+
+        /* Following the 'nv_img_buffer_size', there should be
+         * nv_img_buffer_size bytes of NV Image i.e.
+         * u8[nv_img_buffer_size] */
+} __packed;
+
+struct wcn36xx_hal_nv_img_download_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure. HAL would generate a
+         * WCN36XX_HAL_DOWNLOAD_NV_RSP after each fragment */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_nv_store_ind {
+        /* Note: The length specified in tHalNvStoreInd messages should be
+         * header.msgLen = sizeof(tHalNvStoreInd) + nvBlobSize */
+        struct wcn36xx_hal_msg_header header;
+
+        /* NV Item */
+        u32 table_id;
+
+        /* Size of NV Blob */
+        u32 nv_blob_size;
+
+        /* Following the 'nvBlobSize', there should be nvBlobSize bytes of
+         * NV blob i.e. u8[nvBlobSize] */
+};
+
+/* End of Block Ack Related Parameters */
+
+#define WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE 6
+
+/* Definition for MIC failure indication MAC reports this each time a MIC
+ * failure occures on Rx TKIP packet
+ */
+struct mic_failure_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+
+        /* address used to compute MIC */
+        u8 src_addr[ETH_ALEN];
+
+        /* transmitter address */
+        u8 ta_addr[ETH_ALEN];
+
+        u8 dst_addr[ETH_ALEN];
+
+        u8 multicast;
+
+        /* first byte of IV */
+        u8 iv1;
+
+        /* second byte of IV */
+        u8 key_id;
+
+        /* sequence number */
+        u8 tsc[WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE];
+
+        /* receive address */
+        u8 rx_addr[ETH_ALEN];
+};
+
+struct update_vht_op_mode_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 op_mode;
+        u16 sta_id;
+};
+
+struct update_vht_op_mode_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+};
+
+struct update_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* shortPreamble mode. HAL should update all the STA rates when it
+         * receives this message */
+        u8 short_preamble;
+
+        /* short Slot time. */
+        u8 short_slot_time;
+
+        /* Beacon Interval */
+        u16 beacon_interval;
+
+        /* Protection related */
+        u8 lla_coexist;
+        u8 llb_coexist;
+        u8 llg_coexist;
+        u8 ht20_coexist;
+        u8 lln_non_gf_coexist;
+        u8 lsig_tx_op_protection_full_support;
+        u8 rifs_mode;
+
+        u16 param_change_bitmap;
+};
+
+struct update_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+};
+
+struct wcn36xx_hal_send_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* length of the template. */
+        u32 beacon_length;
+
+        /* Beacon data. */
+        u8 beacon[BEACON_TEMPLATE_SIZE];
+
+        u8 bssid[ETH_ALEN];
+
+        /* TIM IE offset from the beginning of the template. */
+        u32 tim_ie_offset;
+
+        /* P2P IE offset from the begining of the template */
+        u16 p2p_ie_offset;
+} __packed;
+
+struct send_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+} __packed;
+
+struct enable_radar_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        u8 channel;
+};
+
+struct enable_radar_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Link Parameters */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+};
+
+struct radar_detect_intr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 radar_det_channel;
+};
+
+struct radar_detect_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* channel number in which the RADAR detected */
+        u8 channel_number;
+
+        /* RADAR pulse width in usecond */
+        u16 radar_pulse_width;
+
+        /* Number of RADAR pulses */
+        u16 num_radar_pulse;
+};
+
+struct wcn36xx_hal_get_tpc_report_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta[ETH_ALEN];
+        u8 dialog_token;
+        u8 txpower;
+};
+
+struct wcn36xx_hal_get_tpc_report_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_send_probe_resp_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 probe_resp_template[BEACON_TEMPLATE_SIZE];
+        u32 probe_resp_template_len;
+        u32 proxy_probe_req_valid_ie_bmap[8];
+        u8 bssid[ETH_ALEN];
+};
+
+struct send_probe_resp_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct send_unknown_frame_rx_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_delete_sta_context_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 aid;
+        u16 sta_id;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* HAL copies bssid from the sta table. */
+        u8 addr2[ETH_ALEN];
+
+        /* To unify the keepalive / unknown A2 / tim-based disa */
+        u16 reason_code;
+} __packed;
+
+struct indicate_del_sta {
+        struct wcn36xx_hal_msg_header header;
+        u8 aid;
+        u8 sta_index;
+        u8 bss_index;
+        u8 reason_code;
+        u32 status;
+};
+
+struct bt_amp_event_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        enum bt_amp_event_type btAmpEventType;
+};
+
+struct bt_amp_event_rsp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct tl_hal_flush_ac_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+};
+
+struct tl_hal_flush_ac_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_imps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_exit_imps_req {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_enter_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* TBTT value derived from the last beacon */
+#ifndef BUILD_QWPTTSTATIC
+        u64 tbtt;
+#endif
+        u8 dtim_count;
+
+        /* DTIM period given to HAL during association may not be valid, if
+         * association is based on ProbeRsp instead of beacon. */
+        u8 dtim_period;
+
+        /* For CCX and 11R Roaming */
+        u32 rssi_filter_period;
+
+        u32 num_beacon_per_rssi_average;
+        u8 rssi_filter_enable;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 send_data_null;
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_missed_beacon_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+} __packed;
+
+/* Beacon Filtering data structures */
+
+/* The above structure would be followed by multiple of below mentioned
+ * structure
+ */
+struct beacon_filter_ie {
+        u8 element_id;
+        u8 check_ie_presence;
+        u8 offset;
+        u8 value;
+        u8 bitmask;
+        u8 ref;
+};
+
+struct wcn36xx_hal_add_bcn_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 capability_info;
+        u16 capability_mask;
+        u16 beacon_interval;
+        u16 ie_num;
+        u8 bss_index;
+        u8 reserved;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 ie_Count;
+        u8 rem_ie_id[1];
+};
+
+#define WCN36XX_HAL_IPV4_ARP_REPLY_OFFLOAD                  0
+#define WCN36XX_HAL_IPV6_NEIGHBOR_DISCOVERY_OFFLOAD         1
+#define WCN36XX_HAL_IPV6_NS_OFFLOAD                         2
+#define WCN36XX_HAL_IPV6_ADDR_LEN                           16
+#define WCN36XX_HAL_OFFLOAD_DISABLE                         0
+#define WCN36XX_HAL_OFFLOAD_ENABLE                          1
+#define WCN36XX_HAL_OFFLOAD_BCAST_FILTER_ENABLE             0x2
+#define WCN36XX_HAL_OFFLOAD_ARP_AND_BCAST_FILTER_ENABLE \
+        (HAL_OFFLOAD_ENABLE|HAL_OFFLOAD_BCAST_FILTER_ENABLE)
+
+struct wcn36xx_hal_ns_offload_params {
+        u8 src_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 self_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        /* Only support 2 possible Network Advertisement IPv6 address */
+        u8 target_ipv6_addr1[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 target_ipv6_addr2[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        u8 self_addr[ETH_ALEN];
+        u8 src_ipv6_addr_valid:1;
+        u8 target_ipv6_addr1_valid:1;
+        u8 target_ipv6_addr2_valid:1;
+        u8 reserved1:5;
+
+        /* make it DWORD aligned */
+        u8 reserved2;
+
+        /* slot index for this offload */
+        u32 slot_index;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_req {
+        u8 offload_Type;
+
+        /* enable or disable */
+        u8 enable;
+
+        union {
+                u8 host_ipv4_addr[4];
+                u8 host_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        } u;
+};
+
+struct wcn36xx_hal_host_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_host_offload_req host_offload_params;
+        struct wcn36xx_hal_ns_offload_params ns_offload_params;
+};
+
+/* Packet Types. */
+#define WCN36XX_HAL_KEEP_ALIVE_NULL_PKT              1
+#define WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP     2
+
+/* Enable or disable keep alive */
+#define WCN36XX_HAL_KEEP_ALIVE_DISABLE   0
+#define WCN36XX_HAL_KEEP_ALIVE_ENABLE    1
+#define WCN36XX_KEEP_ALIVE_TIME_PERIOD   30 /* unit: s */
+
+/* Keep Alive request. */
+struct wcn36xx_hal_keep_alive_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 packet_type;
+        u32 time_period;
+        u8 host_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_addr[ETH_ALEN];
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_rssi_threshold_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        s8 threshold1:8;
+        s8 threshold2:8;
+        s8 threshold3:8;
+        u8 thres1_pos_notify:1;
+        u8 thres1_neg_notify:1;
+        u8 thres2_pos_notify:1;
+        u8 thres2_neg_notify:1;
+        u8 thres3_pos_notify:1;
+        u8 thres3_neg_notify:1;
+        u8 reserved10:2;
+};
+
+struct wcn36xx_hal_enter_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bk_delivery:1;
+        u8 be_delivery:1;
+        u8 vi_delivery:1;
+        u8 vo_delivery:1;
+        u8 bk_trigger:1;
+        u8 be_trigger:1;
+        u8 vi_trigger:1;
+        u8 vo_trigger:1;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+#define WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE 128
+#define WCN36XX_HAL_WOWL_BCAST_MAX_NUM_PATTERNS 16
+
+struct wcn36xx_hal_wowl_add_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID */
+        u8 id;
+
+        /* Pattern byte offset from beginning of the 802.11 packet to start
+         * of the wake-up pattern */
+        u8 byte_Offset;
+
+        /* Non-Zero Pattern size */
+        u8 size;
+
+        /* Pattern */
+        u8 pattern[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Non-zero pattern mask size */
+        u8 mask_size;
+
+        /* Pattern mask */
+        u8 mask[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern */
+        u8 extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern mask */
+        u8 mask_extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wow_del_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID of the wakeup pattern to be deleted */
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_enter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enables/disables magic packet filtering */
+        u8 magic_packet_enable;
+
+        /* Magic pattern */
+        u8 magic_pattern[ETH_ALEN];
+
+        /* Enables/disables packet pattern filtering in firmware. Enabling
+         * this flag enables broadcast pattern matching in Firmware. If
+         * unicast pattern matching is also desired,
+         * ucUcastPatternFilteringEnable flag must be set tot true as well
+         */
+        u8 pattern_filtering_enable;
+
+        /* Enables/disables unicast packet pattern filtering. This flag
+         * specifies whether we want to do pattern match on unicast packets
+         * as well and not just broadcast packets. This flag has no effect
+         * if the ucPatternFilteringEnable (main controlling flag) is set
+         * to false
+         */
+        u8 ucast_pattern_filtering_enable;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Channel Switch
+         * Action Frame.
+         */
+        u8 wow_channel_switch_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the
+         * Deauthentication Frame.
+         */
+        u8 wow_deauth_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Disassociation
+         * Frame.
+         */
+        u8 wow_disassoc_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it has missed consecutive
+         * beacons. This is a hardware register configuration (NOT a
+         * firmware configuration).
+         */
+        u8 wow_max_missed_beacons;
+
+        /* This configuration is valid only when magicPktEnable=1. This is
+         * a timeout value in units of microsec. It requests hardware to
+         * unconditionally wake up after it has stayed in WoWLAN mode for
+         * some time. Set 0 to disable this feature.
+         */
+        u8 wow_max_sleep;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAP-ID requests embedded in EAPOL frames and use this as a wake
+         * source.
+         */
+        u8 wow_eap_id_request_enable;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAPOL-4WAY requests and use this as a wake source.
+         */
+        u8 wow_eapol_4way_enable;
+
+        /* This configuration allows a host wakeup on an network scan
+         * offload match.
+         */
+        u8 wow_net_scan_offload_match;
+
+        /* This configuration allows a host wakeup on any GTK rekeying
+         * error.
+         */
+        u8 wow_gtk_rekey_error;
+
+        /* This configuration allows a host wakeup on BSS connection loss.
+         */
+        u8 wow_bss_connection_loss;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_get_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_get_roam_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA index */
+        u8 sta_idx;
+
+        /* Access Category */
+        u8 ac;
+
+        /* User Priority */
+        u8 up;
+
+        /* Service Interval */
+        u32 service_interval;
+
+        /* Suspend Interval */
+        u32 suspend_interval;
+
+        /* Delay Interval */
+        u32 delay_interval;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 set_mcst_bcst_filter_setting;
+        u8 set_mcst_bcst_filter;
+};
+
+struct wcn36xx_hal_enter_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_exit_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_enter_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rssi_notification_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 rssi_thres1_pos_cross:1;
+        u32 rssi_thres1_neg_cross:1;
+        u32 rssi_thres2_pos_cross:1;
+        u32 rssi_thres2_neg_cross:1;
+        u32 rssi_thres3_pos_cross:1;
+        u32 rssi_thres3_neg_cross:1;
+        u32 avg_rssi:8;
+        u32 reserved:18;
+
+};
+
+struct wcn36xx_hal_get_rssio_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        s8 rssi;
+
+};
+
+struct wcn36xx_hal_get_roam_rssi_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 sta_id;
+        s8 rssi;
+};
+
+struct wcn36xx_hal_wowl_enter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_add_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_del_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_keep_alive_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_rssi_thresh_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_max_tx_pwr_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSSID is needed to identify which session issued this request.
+         * As the request has power constraints, this should be applied
+         * only to that session */
+        u8 bssid[ETH_ALEN];
+
+        u8 self_addr[ETH_ALEN];
+
+        /* In request, power == MaxTx power to be used. */
+        u8 power;
+};
+
+struct set_max_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* power == tx power used for management frames */
+        u8 power;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+
+        u8 bss_index;
+};
+
+struct set_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct get_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta_id;
+};
+
+struct get_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+};
+
+struct set_p2p_gonoa_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 opp_ps;
+        u32 ct_window;
+        u8 count;
+        u32 duration;
+        u32 interval;
+        u32 single_noa_duration;
+        u8 ps_selection;
+};
+
+struct set_p2p_gonoa_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_sta_self_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_add_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Self STA Index */
+        u8 self_sta_index;
+
+        /* DPU Index (IGTK, PTK, GTK all same) */
+        u8 dpu_index;
+
+        /* DPU Signature */
+        u8 dpu_signature;
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct aggr_add_ts_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_idx;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS.
+         * This will carry the bitmap with the bit positions representing
+         * different AC.s */
+        u16 tspec_index;
+
+        /* Tspec info per AC To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec[WCN36XX_HAL_MAX_AC];
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct aggr_add_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status0;
+
+        /* FIXME PRIMA for future use for 11R */
+        u32 status1;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 is_apps_cpu_awake;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_dump_cmd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 arg1;
+        u32 arg2;
+        u32 arg3;
+        u32 arg4;
+        u32 arg5;
+} __packed;
+
+struct wcn36xx_hal_dump_cmd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Length of the responce message */
+        u32 rsp_length;
+
+        /* FIXME: Currently considering the the responce will be less than
+         * 100bytes */
+        u8 rsp_buffer[DUMPCMD_RSP_BUFFER];
+} __packed;
+
+#define WLAN_COEX_IND_DATA_SIZE (4)
+#define WLAN_COEX_IND_TYPE_DISABLE_HB_MONITOR (0)
+#define WLAN_COEX_IND_TYPE_ENABLE_HB_MONITOR (1)
+
+struct coex_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Coex Indication Type */
+        u32 type;
+
+        /* Coex Indication Data */
+        u32 data[WLAN_COEX_IND_DATA_SIZE];
+};
+
+struct wcn36xx_hal_tx_compl_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Tx Complete Indication Success or Failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_wlan_host_suspend_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 configured_mcst_bcst_filter_setting;
+        u32 active_session_count;
+};
+
+struct wcn36xx_hal_wlan_exclude_unencrpted_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 dot11_exclude_unencrypted;
+        u8 bssid[ETH_ALEN];
+};
+
+struct noa_attr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 index;
+        u8 opp_ps_flag;
+        u16 ctwin;
+
+        u16 noa1_interval_count;
+        u16 bss_index;
+        u32 noa1_duration;
+        u32 noa1_interval;
+        u32 noa1_starttime;
+
+        u16 noa2_interval_count;
+        u16 reserved2;
+        u32 noa2_duration;
+        u32 noa2_interval;
+        u32 noa2_start_time;
+
+        u32 status;
+};
+
+struct noa_start_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        u32 bss_index;
+};
+
+struct wcn36xx_hal_wlan_host_resume_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 configured_mcst_bcst_filter_setting;
+};
+
+struct wcn36xx_hal_host_resume_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_del_ba_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 sta_idx;
+
+        /* Peer MAC Address, whose BA session has timed out */
+        u8 peer_addr[ETH_ALEN];
+
+        /* TID for which a BA session timeout is being triggered */
+        u8 ba_tid;
+
+        /* DELBA direction
+         * 1 - Originator
+         * 0 - Recipient
+         */
+        u8 direction;
+
+        u32 reason_code;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+};
+
+/* PNO Messages */
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS  26
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX  60
+
+/* Maximum numbers of networks supported by PNO */
+#define WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS  16
+
+/* The number of scan time intervals that can be programmed into PNO */
+#define WCN36XX_HAL_PNO_MAX_SCAN_TIMERS    10
+
+/* Maximum size of the probe template */
+#define WCN36XX_HAL_PNO_MAX_PROBE_SIZE     450
+
+/* Type of PNO enabling:
+ *
+ * Immediate - scanning will start immediately and PNO procedure will be
+ * repeated based on timer
+ *
+ * Suspend - scanning will start at suspend
+ *
+ * Resume - scanning will start on system resume
+ */
+enum pno_mode {
+        PNO_MODE_IMMEDIATE,
+        PNO_MODE_ON_SUSPEND,
+        PNO_MODE_ON_RESUME,
+        PNO_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Authentication type */
+enum auth_type {
+        AUTH_TYPE_ANY = 0,
+        AUTH_TYPE_OPEN_SYSTEM = 1,
+
+        /* Upper layer authentication types */
+        AUTH_TYPE_WPA = 2,
+        AUTH_TYPE_WPA_PSK = 3,
+
+        AUTH_TYPE_RSN = 4,
+        AUTH_TYPE_RSN_PSK = 5,
+        AUTH_TYPE_FT_RSN = 6,
+        AUTH_TYPE_FT_RSN_PSK = 7,
+        AUTH_TYPE_WAPI_WAI_CERTIFICATE = 8,
+        AUTH_TYPE_WAPI_WAI_PSK = 9,
+
+        AUTH_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type */
+enum ed_type {
+        ED_ANY = 0,
+        ED_NONE = 1,
+        ED_WEP = 2,
+        ED_TKIP = 3,
+        ED_CCMP = 4,
+        ED_WPI = 5,
+
+        ED_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* SSID broadcast  type */
+enum ssid_bcast_type {
+        BCAST_UNKNOWN = 0,
+        BCAST_NORMAL = 1,
+        BCAST_HIDDEN = 2,
+
+        BCAST_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+struct scan_timer {
+        /* How much it should wait */
+        u32 value;
+
+        /* How many times it should repeat that wait value 0 - keep using
+         * this timer until PNO is disabled */
+        u32 repeat;
+
+        /* e.g: 2 3 4 0 - it will wait 2s between consecutive scans for 3
+         * times - after that it will wait 4s between consecutive scans
+         * until disabled */
+};
+
+/* The network parameters to be sent to the PNO algorithm */
+struct scan_timers_type {
+        /* set to 0 if you wish for PNO to use its default telescopic timer */
+        u8 count;
+
+        /* A set value represents the amount of time that PNO will wait
+         * between two consecutive scan procedures If the desired is for a
+         * uniform timer that fires always at the exact same interval - one
+         * single value is to be set If there is a desire for a more
+         * complex - telescopic like timer multiple values can be set -
+         * once PNO reaches the end of the array it will continue scanning
+         * at intervals presented by the last value */
+        struct scan_timer values[WCN36XX_HAL_PNO_MAX_SCAN_TIMERS];
+};
+
+/* Preferred network list request */
+struct set_pref_netw_list_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type_new {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* SSID broadcast type, normal, hidden or unknown */
+        enum ssid_bcast_type bcast_network_type;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+/* Preferred network list request new */
+struct set_pref_netw_list_req_new {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type_new networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* Preferred network list response */
+struct set_pref_netw_list_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request - just to indicate that PNO has
+         * acknowledged the request and will start scanning */
+        u32 status;
+};
+
+/* Preferred network found indication */
+struct pref_netw_found_ind {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Network that was found with the highest RSSI */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Indicates the RSSI */
+        u8 rssi;
+};
+
+/* RSSI Filter request */
+struct set_rssi_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* RSSI Threshold */
+        u8 rssi_threshold;
+};
+
+/* Set RSSI filter resp */
+struct set_rssi_filter_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_req {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+} __packed;
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct update_scan_params_req_ex {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_set_tx_per_tracking_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* 0: disable, 1:enable */
+        u8 tx_per_tracking_enable;
+
+        /* Check period, unit is sec. */
+        u8 tx_per_tracking_period;
+
+        /* (Fail TX packet)/(Total TX packet) ratio, the unit is 10%. */
+        u8 tx_per_tracking_ratio;
+
+        /* A watermark of check number, once the tx packet exceed this
+         * number, we do the check, default is 5 */
+        u32 tx_per_tracking_watermark;
+};
+
+struct wcn36xx_hal_set_tx_per_tracking_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+};
+
+struct tx_per_hit_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+/* Packet Filtering Definitions Begin */
+#define    WCN36XX_HAL_PROTOCOL_DATA_LEN                  8
+#define    WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS        240
+#define    WCN36XX_HAL_MAX_NUM_FILTERS                   20
+#define    WCN36XX_HAL_MAX_CMP_PER_FILTER                10
+
+enum wcn36xx_hal_receive_packet_filter_type {
+        HAL_RCV_FILTER_TYPE_INVALID,
+        HAL_RCV_FILTER_TYPE_FILTER_PKT,
+        HAL_RCV_FILTER_TYPE_BUFFER_PKT,
+        HAL_RCV_FILTER_TYPE_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_protocol_type {
+        HAL_FILTER_PROTO_TYPE_INVALID,
+        HAL_FILTER_PROTO_TYPE_MAC,
+        HAL_FILTER_PROTO_TYPE_ARP,
+        HAL_FILTER_PROTO_TYPE_IPV4,
+        HAL_FILTER_PROTO_TYPE_IPV6,
+        HAL_FILTER_PROTO_TYPE_UDP,
+        HAL_FILTER_PROTO_TYPE_MAX
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_cmp_flag_type {
+        HAL_FILTER_CMP_TYPE_INVALID,
+        HAL_FILTER_CMP_TYPE_EQUAL,
+        HAL_FILTER_CMP_TYPE_MASK_EQUAL,
+        HAL_FILTER_CMP_TYPE_NOT_EQUAL,
+        HAL_FILTER_CMP_TYPE_MAX
+};
+
+struct wcn36xx_hal_rcv_pkt_filter_params {
+        u8 protocol_layer;
+        u8 cmp_flag;
+
+        /* Length of the data to compare */
+        u16 data_length;
+
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        /* Reserved field */
+        u8 reserved;
+
+        /* Data to compare */
+        u8 compare_data[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+
+        /* Mask to be applied on the received packet data before compare */
+        u8 data_mask[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+};
+
+struct wcn36xx_hal_sessionized_rcv_pkt_filter_cfg_type {
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coleasce_time;
+        u8 bss_index;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_set_rcv_pkt_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coalesce_time;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_rcv_flt_mc_addr_list_type {
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        u32 mc_addr_count;
+        u8 mc_addr[ETH_ALEN][WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_set_pkt_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt {
+        u8 id;
+        u32 match_cnt;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        u32 match_count;
+        struct wcn36xx_hal_rcv_flt_pkt_match_cnt
+                matches[WCN36XX_HAL_MAX_NUM_FILTERS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_param {
+        /* only valid for response message */
+        u32 status;
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_mc_addr_list_type mc_addr_list;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+        u8 bss_index;
+};
+
+/* Packet Filtering Definitions End */
+
+struct wcn36xx_hal_set_power_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*  Ignore DTIM */
+        u32 ignore_dtim;
+
+        /* DTIM Period */
+        u32 dtim_period;
+
+        /* Listen Interval */
+        u32 listen_interval;
+
+        /* Broadcast Multicast Filter  */
+        u32 bcast_mcast_filter;
+
+        /* Beacon Early Termination */
+        u32 enable_bet;
+
+        /* Beacon Early Termination Interval */
+        u32 bet_interval;
+} __packed;
+
+struct wcn36xx_hal_set_power_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+/* Capability bitmap exchange definitions and macros starts */
+
+enum place_holder_in_cap_bitmap {
+        MCC = 0,
+        P2P = 1,
+        DOT11AC = 2,
+        SLM_SESSIONIZATION = 3,
+        DOT11AC_OPMODE = 4,
+        SAP32STA = 5,
+        TDLS = 6,
+        P2P_GO_NOA_DECOUPLE_INIT_SCAN = 7,
+        WLANACTIVE_OFFLOAD = 8,
+        BEACON_OFFLOAD = 9,
+        SCAN_OFFLOAD = 10,
+        ROAM_OFFLOAD = 11,
+        BCN_MISS_OFFLOAD = 12,
+        STA_POWERSAVE = 13,
+        STA_ADVANCED_PWRSAVE = 14,
+        AP_UAPSD = 15,
+        AP_DFS = 16,
+        BLOCKACK = 17,
+        PHY_ERR = 18,
+        BCN_FILTER = 19,
+        RTT = 20,
+        RATECTRL = 21,
+        WOW = 22,
+        MAX_FEATURE_SUPPORTED = 128,
+};
+
+struct wcn36xx_hal_feat_caps_msg {
+
+        struct wcn36xx_hal_msg_header header;
+
+        u32 feat_caps[4];
+} __packed;
+
+/* status codes to help debug rekey failures */
+enum gtk_rekey_status {
+        WCN36XX_HAL_GTK_REKEY_STATUS_SUCCESS = 0,
+
+        /* rekey detected, but not handled */
+        WCN36XX_HAL_GTK_REKEY_STATUS_NOT_HANDLED = 1,
+
+        /* MIC check error on M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MIC_ERROR = 2,
+
+        /* decryption error on M1  */
+        WCN36XX_HAL_GTK_REKEY_STATUS_DECRYPT_ERROR = 3,
+
+        /* M1 replay detected */
+        WCN36XX_HAL_GTK_REKEY_STATUS_REPLAY_ERROR = 4,
+
+        /* missing GTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_KDE = 5,
+
+        /* missing iGTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_IGTK_KDE = 6,
+
+        /* key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_INSTALL_ERROR = 7,
+
+        /* iGTK key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_IGTK_INSTALL_ERROR = 8,
+
+        /* GTK rekey M2 response TX error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_RESP_TX_ERROR = 9,
+
+        /* non-specific general error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_GEN_ERROR = 255
+};
+
+/* wake reason types */
+enum wake_reason_type {
+        WCN36XX_HAL_WAKE_REASON_NONE = 0,
+
+        /* magic packet match */
+        WCN36XX_HAL_WAKE_REASON_MAGIC_PACKET = 1,
+
+        /* host defined pattern match */
+        WCN36XX_HAL_WAKE_REASON_PATTERN_MATCH = 2,
+
+        /* EAP-ID frame detected */
+        WCN36XX_HAL_WAKE_REASON_EAPID_PACKET = 3,
+
+        /* start of EAPOL 4-way handshake detected */
+        WCN36XX_HAL_WAKE_REASON_EAPOL4WAY_PACKET = 4,
+
+        /* network scan offload match */
+        WCN36XX_HAL_WAKE_REASON_NETSCAN_OFFL_MATCH = 5,
+
+        /* GTK rekey status wakeup (see status) */
+        WCN36XX_HAL_WAKE_REASON_GTK_REKEY_STATUS = 6,
+
+        /* BSS connection lost */
+        WCN36XX_HAL_WAKE_REASON_BSS_CONN_LOST = 7,
+};
+
+/*
+  Wake Packet which is saved at tWakeReasonParams.DataStart
+  This data is sent for any wake reasons that involve a packet-based wakeup :
+
+  WCN36XX_HAL_WAKE_REASON_TYPE_MAGIC_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_PATTERN_MATCH
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPID_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPOL4WAY_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_GTK_REKEY_STATUS
+
+  The information is provided to the host for auditing and debug purposes
+
+*/
+
+/* Wake reason indication */
+struct wcn36xx_hal_wake_reason_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* see tWakeReasonType */
+        u32 reason;
+
+        /* argument specific to the reason type */
+        u32 reason_arg;
+
+        /* length of optional data stored in this message, in case HAL
+         * truncates the data (i.e. data packets) this length will be less
+         * than the actual length */
+        u32 stored_data_len;
+
+        /* actual length of data */
+        u32 actual_data_len;
+
+        /* variable length start of data (length == storedDataLen) see
+         * specific wake type */
+        u8 data_start[1];
+
+        u32 bss_index:8;
+        u32 reserved:24;
+};
+
+#define WCN36XX_HAL_GTK_KEK_BYTES 16
+#define WCN36XX_HAL_GTK_KCK_BYTES 16
+
+#define WCN36XX_HAL_GTK_OFFLOAD_FLAGS_DISABLE (1 << 0)
+
+#define GTK_SET_BSS_KEY_TAG  0x1234AA55
+
+struct wcn36xx_hal_gtk_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* optional flags */
+        u32 flags;
+
+        /* Key confirmation key */
+        u8 kck[WCN36XX_HAL_GTK_KCK_BYTES];
+
+        /* key encryption key */
+        u8 kek[WCN36XX_HAL_GTK_KEK_BYTES];
+
+        /* replay counter */
+        u64 key_replay_counter;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* last rekey status when the rekey was offloaded */
+        u32 last_rekey_status;
+
+        /* current replay counter value */
+        u64 key_replay_counter;
+
+        /* total rekey attempts */
+        u32 total_rekey_count;
+
+        /* successful GTK rekeys */
+        u32 gtk_rekey_count;
+
+        /* successful iGTK rekeys */
+        u32 igtk_rekey_count;
+
+        u8 bss_index;
+};
+
+struct dhcp_info {
+        /* Indicates the device mode which indicates about the DHCP activity */
+        u8 device_mode;
+
+        u8 addr[ETH_ALEN];
+};
+
+struct dhcp_ind_status {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/*
+ *   Thermal Mitigation mode of operation.
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_0 - Based on AMPDU disabling aggregation
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_1 - Based on AMPDU disabling aggregation
+ *  and reducing transmit power
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_2 - Not supported */
+enum wcn36xx_hal_thermal_mitigation_mode_type {
+        HAL_THERMAL_MITIGATION_MODE_INVALID = -1,
+        HAL_THERMAL_MITIGATION_MODE_0,
+        HAL_THERMAL_MITIGATION_MODE_1,
+        HAL_THERMAL_MITIGATION_MODE_2,
+        HAL_THERMAL_MITIGATION_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/*
+ *   Thermal Mitigation level.
+ * Note the levels are incremental i.e WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 =
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 +
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 - lowest level of thermal mitigation.
+ * This level indicates normal mode of operation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1 - 1st level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 - 2nd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_3 - 3rd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_4 - 4th level of thermal mitigation
+ */
+enum wcn36xx_hal_thermal_mitigation_level_type {
+        HAL_THERMAL_MITIGATION_LEVEL_INVALID = -1,
+        HAL_THERMAL_MITIGATION_LEVEL_0,
+        HAL_THERMAL_MITIGATION_LEVEL_1,
+        HAL_THERMAL_MITIGATION_LEVEL_2,
+        HAL_THERMAL_MITIGATION_LEVEL_3,
+        HAL_THERMAL_MITIGATION_LEVEL_4,
+        HAL_THERMAL_MITIGATION_LEVEL_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/* WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ */
+struct set_thermal_mitigation_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Thermal Mitigation Operation Mode */
+        enum wcn36xx_hal_thermal_mitigation_mode_type mode;
+
+        /* Thermal Mitigation Level */
+        enum wcn36xx_hal_thermal_mitigation_level_type level;
+};
+
+struct set_thermal_mitigation_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Per STA Class B Statistics. Class B statistics are STA TX/RX stats
+ * provided to FW from Host via periodic messages */
+struct stats_class_b_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Duration over which this stats was collected */
+        u32 duration;
+
+        /* Per STA Stats */
+
+        /* TX stats */
+        u32 tx_bytes_pushed;
+        u32 tx_packets_pushed;
+
+        /* RX stats */
+        u32 rx_bytes_rcvd;
+        u32 rx_packets_rcvd;
+        u32 rx_time_total;
+};
+
+#endif /* _HAL_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
new file mode 100644
index 000000000000..7839b31e4826
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -0,0 +1,1036 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include "wcn36xx.h"
+
+unsigned int wcn36xx_dbg_mask;
+module_param_named(debug_mask, wcn36xx_dbg_mask, uint, 0644);
+MODULE_PARM_DESC(debug_mask, "Debugging mask");
+
+#define CHAN2G(_freq, _idx) { \
+        .band = IEEE80211_BAND_2GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+#define CHAN5G(_freq, _idx) { \
+        .band = IEEE80211_BAND_5GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+/* The wcn firmware expects channel values to matching
+ * their mnemonic values. So use these for .hw_value. */
+static struct ieee80211_channel wcn_2ghz_channels[] = {
+        CHAN2G(2412, 1), /* Channel 1 */
+        CHAN2G(2417, 2), /* Channel 2 */
+        CHAN2G(2422, 3), /* Channel 3 */
+        CHAN2G(2427, 4), /* Channel 4 */
+        CHAN2G(2432, 5), /* Channel 5 */
+        CHAN2G(2437, 6), /* Channel 6 */
+        CHAN2G(2442, 7), /* Channel 7 */
+        CHAN2G(2447, 8), /* Channel 8 */
+        CHAN2G(2452, 9), /* Channel 9 */
+        CHAN2G(2457, 10), /* Channel 10 */
+        CHAN2G(2462, 11), /* Channel 11 */
+        CHAN2G(2467, 12), /* Channel 12 */
+        CHAN2G(2472, 13), /* Channel 13 */
+        CHAN2G(2484, 14)  /* Channel 14 */
+
+};
+
+static struct ieee80211_channel wcn_5ghz_channels[] = {
+        CHAN5G(5180, 36),
+        CHAN5G(5200, 40),
+        CHAN5G(5220, 44),
+        CHAN5G(5240, 48),
+        CHAN5G(5260, 52),
+        CHAN5G(5280, 56),
+        CHAN5G(5300, 60),
+        CHAN5G(5320, 64),
+        CHAN5G(5500, 100),
+        CHAN5G(5520, 104),
+        CHAN5G(5540, 108),
+        CHAN5G(5560, 112),
+        CHAN5G(5580, 116),
+        CHAN5G(5600, 120),
+        CHAN5G(5620, 124),
+        CHAN5G(5640, 128),
+        CHAN5G(5660, 132),
+        CHAN5G(5700, 140),
+        CHAN5G(5745, 149),
+        CHAN5G(5765, 153),
+        CHAN5G(5785, 157),
+        CHAN5G(5805, 161),
+        CHAN5G(5825, 165)
+};
+
+#define RATE(_bitrate, _hw_rate, _flags) { \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate),                   \
+        .hw_value_short = (_hw_rate)  \
+}
+
+static struct ieee80211_rate wcn_2ghz_rates[] = {
+        RATE(10, HW_RATE_INDEX_1MBPS, 0),
+        RATE(20, HW_RATE_INDEX_2MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, HW_RATE_INDEX_5_5MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, HW_RATE_INDEX_11MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_rate wcn_5ghz_rates[] = {
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_supported_band wcn_band_2ghz = {
+        .channels       = wcn_2ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_2ghz_channels),
+        .bitrates       = wcn_2ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_2ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+static struct ieee80211_supported_band wcn_band_5ghz = {
+        .channels       = wcn_5ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_5ghz_channels),
+        .bitrates       = wcn_5ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_5ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT |
+                        IEEE80211_HT_CAP_SGI_40 |
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+#ifdef CONFIG_PM
+
+static const struct wiphy_wowlan_support wowlan_support = {
+        .flags = WIPHY_WOWLAN_ANY
+};
+
+#endif
+
+static inline u8 get_sta_index(struct ieee80211_vif *vif,
+                               struct wcn36xx_sta *sta_priv)
+{
+        return NL80211_IFTYPE_STATION == vif->type ?
+               sta_priv->bss_sta_index :
+               sta_priv->sta_index;
+}
+
+static int wcn36xx_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+        int ret;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac start\n");
+
+        /* SMD initialization */
+        ret = wcn36xx_smd_open(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to open smd channel: %d\n", ret);
+                goto out_err;
+        }
+
+        /* Allocate memory pools for Mgmt BD headers and Data BD headers */
+        ret = wcn36xx_dxe_allocate_mem_pools(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE mempool: %d\n", ret);
+                goto out_smd_close;
+        }
+
+        ret = wcn36xx_dxe_alloc_ctl_blks(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE ctl blocks: %d\n", ret);
+                goto out_free_dxe_pool;
+        }
+
+        wcn->hal_buf = kmalloc(WCN36XX_HAL_BUF_SIZE, GFP_KERNEL);
+        if (!wcn->hal_buf) {
+                wcn36xx_err("Failed to allocate smd buf\n");
+                ret = -ENOMEM;
+                goto out_free_dxe_ctl;
+        }
+
+        ret = wcn36xx_smd_load_nv(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to push NV to chip\n");
+                goto out_free_smd_buf;
+        }
+
+        ret = wcn36xx_smd_start(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to start chip\n");
+                goto out_free_smd_buf;
+        }
+
+        /* DMA channel initialization */
+        ret = wcn36xx_dxe_init(wcn);
+        if (ret) {
+                wcn36xx_err("DXE init failed\n");
+                goto out_smd_stop;
+        }
+
+        wcn36xx_debugfs_init(wcn);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_feature_caps_exchange(wcn);
+                if (ret)
+                        wcn36xx_warn("Exchange feature caps failed\n");
+        }
+        INIT_LIST_HEAD(&wcn->vif_list);
+        return 0;
+
+out_smd_stop:
+        wcn36xx_smd_stop(wcn);
+out_free_smd_buf:
+        kfree(wcn->hal_buf);
+out_free_dxe_pool:
+        wcn36xx_dxe_free_mem_pools(wcn);
+out_free_dxe_ctl:
+        wcn36xx_dxe_free_ctl_blks(wcn);
+out_smd_close:
+        wcn36xx_smd_close(wcn);
+out_err:
+        return ret;
+}
+
+static void wcn36xx_stop(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac stop\n");
+
+        wcn36xx_debugfs_exit(wcn);
+        wcn36xx_smd_stop(wcn);
+        wcn36xx_dxe_deinit(wcn);
+        wcn36xx_smd_close(wcn);
+
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_dxe_free_ctl_blks(wcn);
+
+        kfree(wcn->hal_buf);
+}
+
+static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                int ch = WCN36XX_HW_CHANNEL(wcn);
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
+                            ch);
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        vif = container_of((void *)tmp,
+                                           struct ieee80211_vif,
+                                           drv_priv);
+                        wcn36xx_smd_switch_channel(wcn, vif, ch);
+                }
+        }
+
+        return 0;
+}
+
+#define WCN36XX_SUPPORTED_FILTERS (0)
+
+static void wcn36xx_configure_filter(struct ieee80211_hw *hw,
+                                     unsigned int changed,
+                                     unsigned int *total, u64 multicast)
+{
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac configure filter\n");
+
+        *total &= WCN36XX_SUPPORTED_FILTERS;
+}
+
+static void wcn36xx_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        if (control->sta)
+                sta_priv = (struct wcn36xx_sta *)control->sta->drv_priv;
+
+        if (wcn36xx_start_tx(wcn, sta_priv, skb))
+                ieee80211_free_txskb(wcn->hw, skb);
+}
+
+static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct ieee80211_key_conf *key_conf)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = vif_priv->sta;
+        int ret = 0;
+        u8 key[WLAN_MAX_KEY_LEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac80211 set key\n");
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "Key: cmd=0x%x algo:0x%x, id:%d, len:%d flags 0x%x\n",
+                    cmd, key_conf->cipher, key_conf->keyidx,
+                    key_conf->keylen, key_conf->flags);
+        wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "KEY: ",
+                         key_conf->key,
+                         key_conf->keylen);
+
+        switch (key_conf->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_CCMP;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_TKIP;
+                break;
+        default:
+                wcn36xx_err("Unsupported key type 0x%x\n",
+                              key_conf->cipher);
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        switch (cmd) {
+        case SET_KEY:
+                if (WCN36XX_HAL_ED_TKIP == vif_priv->encrypt_type) {
+                        /*
+                         * Supplicant is sending key in the wrong order:
+                         * Temporal Key (16 b) - TX MIC (8 b) - RX MIC (8 b)
+                         * but HW expects it to be in the order as described in
+                         * IEEE 802.11 spec (see chapter 11.7) like this:
+                         * Temporal Key (16 b) - RX MIC (8 b) - TX MIC (8 b)
+                         */
+                        memcpy(key, key_conf->key, 16);
+                        memcpy(key + 16, key_conf->key + 24, 8);
+                        memcpy(key + 24, key_conf->key + 16, 8);
+                } else {
+                        memcpy(key, key_conf->key, key_conf->keylen);
+                }
+
+                if (IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags) {
+                        sta_priv->is_data_encrypted = true;
+                        /* Reconfigure bss with encrypt_type */
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_smd_config_bss(wcn,
+                                                       vif,
+                                                       sta,
+                                                       sta->addr,
+                                                       true);
+
+                        wcn36xx_smd_set_stakey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key,
+                                get_sta_index(vif, sta_priv));
+                } else {
+                        wcn36xx_smd_set_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key);
+                        if ((WLAN_CIPHER_SUITE_WEP40 == key_conf->cipher) ||
+                            (WLAN_CIPHER_SUITE_WEP104 == key_conf->cipher)) {
+                                sta_priv->is_data_encrypted = true;
+                                wcn36xx_smd_set_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        key_conf->keylen,
+                                        key,
+                                        get_sta_index(vif, sta_priv));
+                        }
+                }
+                break;
+        case DISABLE_KEY:
+                if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {
+                        wcn36xx_smd_remove_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx);
+                } else {
+                        sta_priv->is_data_encrypted = false;
+                        /* do not remove key if disassociated */
+                        if (sta_priv->aid)
+                                wcn36xx_smd_remove_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        get_sta_index(vif, sta_priv));
+                }
+                break;
+        default:
+                wcn36xx_err("Unsupported key cmd 0x%x\n", cmd);
+                ret = -EOPNOTSUPP;
+                goto out;
+                break;
+        }
+
+out:
+        return ret;
+}
+
+static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN);
+        wcn36xx_smd_start_scan(wcn);
+}
+
+static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_end_scan(wcn);
+        wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN);
+}
+
+static void wcn36xx_update_allowed_rates(struct ieee80211_sta *sta,
+                                         enum ieee80211_band band)
+{
+        int i, size;
+        u16 *rates_table;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        u32 rates = sta->supp_rates[band];
+
+        memset(&sta_priv->supported_rates, 0,
+                sizeof(sta_priv->supported_rates));
+        sta_priv->supported_rates.op_rate_mode = STA_11n;
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.dsss_rates);
+        rates_table = sta_priv->supported_rates.dsss_rates;
+        if (band == IEEE80211_BAND_2GHZ) {
+                for (i = 0; i < size; i++) {
+                        if (rates & 0x01) {
+                                rates_table[i] = wcn_2ghz_rates[i].hw_value;
+                                rates = rates >> 1;
+                        }
+                }
+        }
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.ofdm_rates);
+        rates_table = sta_priv->supported_rates.ofdm_rates;
+        for (i = 0; i < size; i++) {
+                if (rates & 0x01) {
+                        rates_table[i] = wcn_5ghz_rates[i].hw_value;
+                        rates = rates >> 1;
+                }
+        }
+
+        if (sta->ht_cap.ht_supported) {
+                BUILD_BUG_ON(sizeof(sta->ht_cap.mcs.rx_mask) >
+                        sizeof(sta_priv->supported_rates.supported_mcs_set));
+                memcpy(sta_priv->supported_rates.supported_mcs_set,
+                       sta->ht_cap.mcs.rx_mask,
+                       sizeof(sta->ht_cap.mcs.rx_mask));
+        }
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates)
+{
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES] = {
+                HW_RATE_INDEX_6MBPS,
+                HW_RATE_INDEX_9MBPS,
+                HW_RATE_INDEX_12MBPS,
+                HW_RATE_INDEX_18MBPS,
+                HW_RATE_INDEX_24MBPS,
+                HW_RATE_INDEX_36MBPS,
+                HW_RATE_INDEX_48MBPS,
+                HW_RATE_INDEX_54MBPS
+        };
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES] = {
+                HW_RATE_INDEX_1MBPS,
+                HW_RATE_INDEX_2MBPS,
+                HW_RATE_INDEX_5_5MBPS,
+                HW_RATE_INDEX_11MBPS
+        };
+
+        rates->op_rate_mode = STA_11n;
+        memcpy(rates->dsss_rates, dsss_rates,
+                sizeof(*dsss_rates) * WCN36XX_HAL_NUM_DSSS_RATES);
+        memcpy(rates->ofdm_rates, ofdm_rates,
+                sizeof(*ofdm_rates) * WCN36XX_HAL_NUM_OFDM_RATES);
+        rates->supported_mcs_set[0] = 0xFF;
+}
+static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct sk_buff *skb = NULL;
+        u16 tim_off, tim_len;
+        enum wcn36xx_hal_link_state link_state;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss info changed vif %p changed 0x%08x\n",
+                    vif, changed);
+
+        if (changed & BSS_CHANGED_BEACON_INFO) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed dtim period %d\n",
+                            bss_conf->dtim_period);
+
+                vif_priv->dtim_period = bss_conf->dtim_period;
+        }
+
+        if (changed & BSS_CHANGED_PS) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss PS set %d\n",
+                            bss_conf->ps);
+                if (bss_conf->ps) {
+                        wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                } else {
+                        wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
+                            bss_conf->bssid);
+
+                if (!is_zero_ether_addr(bss_conf->bssid)) {
+                        vif_priv->is_joining = true;
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_join(wcn, bss_conf->bssid,
+                                         vif->addr, WCN36XX_HW_CHANNEL(wcn));
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               bss_conf->bssid, false);
+                } else {
+                        vif_priv->is_joining = false;
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_SSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed ssid\n");
+                wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "ssid ",
+                                 bss_conf->ssid, bss_conf->ssid_len);
+
+                vif_priv->ssid.length = bss_conf->ssid_len;
+                memcpy(&vif_priv->ssid.ssid,
+                       bss_conf->ssid,
+                       bss_conf->ssid_len);
+        }
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                vif_priv->is_joining = false;
+                if (bss_conf->assoc) {
+                        struct ieee80211_sta *sta;
+                        struct wcn36xx_sta *sta_priv;
+
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "mac assoc bss %pM vif %pM AID=%d\n",
+                                     bss_conf->bssid,
+                                     vif->addr,
+                                     bss_conf->aid);
+
+                        rcu_read_lock();
+                        sta = ieee80211_find_sta(vif, bss_conf->bssid);
+                        if (!sta) {
+                                wcn36xx_err("sta %pM is not found\n",
+                                              bss_conf->bssid);
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+                        wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+
+                        wcn36xx_smd_set_link_st(wcn, bss_conf->bssid,
+                                vif->addr,
+                                WCN36XX_HAL_LINK_POSTASSOC_STATE);
+                        wcn36xx_smd_config_bss(wcn, vif, sta,
+                                               bss_conf->bssid,
+                                               true);
+                        sta_priv->aid = bss_conf->aid;
+                        /*
+                         * config_sta must be called from  because this is the
+                         * place where AID is available.
+                         */
+                        wcn36xx_smd_config_sta(wcn, vif, sta);
+                        rcu_read_unlock();
+                } else {
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "disassociated bss %pM vif %pM AID=%d\n",
+                                    bss_conf->bssid,
+                                    vif->addr,
+                                    bss_conf->aid);
+                        wcn36xx_smd_set_link_st(wcn,
+                                                bss_conf->bssid,
+                                                vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                }
+        }
+
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed ap probe resp\n");
+                skb = ieee80211_proberesp_get(hw, vif);
+                if (!skb) {
+                        wcn36xx_err("failed to alloc probereq skb\n");
+                        goto out;
+                }
+
+                wcn36xx_smd_update_proberesp_tmpl(wcn, vif, skb);
+                dev_kfree_skb(skb);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed beacon enabled %d\n",
+                            bss_conf->enable_beacon);
+
+                if (bss_conf->enable_beacon) {
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               vif->addr, false);
+                        skb = ieee80211_beacon_get_tim(hw, vif, &tim_off,
+                                                       &tim_len);
+                        if (!skb) {
+                                wcn36xx_err("failed to alloc beacon skb\n");
+                                goto out;
+                        }
+                        wcn36xx_smd_send_beacon(wcn, vif, skb, tim_off, 0);
+                        dev_kfree_skb(skb);
+
+                        if (vif->type == NL80211_IFTYPE_ADHOC ||
+                            vif->type == NL80211_IFTYPE_MESH_POINT)
+                                link_state = WCN36XX_HAL_LINK_IBSS_STATE;
+                        else
+                                link_state = WCN36XX_HAL_LINK_AP_STATE;
+
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                link_state);
+                } else {
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+out:
+        return;
+}
+
+/* this is required when using IEEE80211_HW_HAS_RATE_CONTROL */
+static int wcn36xx_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac set RTS threshold %d\n", value);
+
+        wcn36xx_smd_update_cfg(wcn, WCN36XX_HAL_CFG_RTS_THRESHOLD, value);
+        return 0;
+}
+
+static void wcn36xx_remove_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac remove interface vif %p\n", vif);
+
+        list_del(&vif_priv->list);
+        wcn36xx_smd_delete_sta_self(wcn, vif->addr);
+}
+
+static int wcn36xx_add_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac add interface vif %p type %d\n",
+                    vif, vif->type);
+
+        if (!(NL80211_IFTYPE_STATION == vif->type ||
+              NL80211_IFTYPE_AP == vif->type ||
+              NL80211_IFTYPE_ADHOC == vif->type ||
+              NL80211_IFTYPE_MESH_POINT == vif->type)) {
+                wcn36xx_warn("Unsupported interface type requested: %d\n",
+                             vif->type);
+                return -EOPNOTSUPP;
+        }
+
+        list_add(&vif_priv->list, &wcn->vif_list);
+        wcn36xx_smd_add_sta_self(wcn, vif);
+
+        return 0;
+}
+
+static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
+                    vif, sta->addr);
+
+        vif_priv->sta = sta_priv;
+        sta_priv->vif = vif_priv;
+        /*
+         * For STA mode HW will be configured on BSS_CHANGED_ASSOC because
+         * at this stage AID is not available yet.
+         */
+        if (NL80211_IFTYPE_STATION != vif->type) {
+                wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+                sta_priv->aid = sta->aid;
+                wcn36xx_smd_config_sta(wcn, vif, sta);
+        }
+        return 0;
+}
+
+static int wcn36xx_sta_remove(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta remove vif %p sta %pM index %d\n",
+                    vif, sta->addr, sta_priv->sta_index);
+
+        wcn36xx_smd_delete_sta(wcn, sta_priv->sta_index);
+        vif_priv->sta = NULL;
+        sta_priv->vif = NULL;
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int wcn36xx_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wow)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac suspend\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, true);
+        return 0;
+}
+
+static int wcn36xx_resume(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac resume\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, false);
+        return 0;
+}
+
+#endif
+
+static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    enum ieee80211_ampdu_mlme_action action,
+                    struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                    u8 buf_size)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac ampdu action action %d tid %d\n",
+                    action, tid);
+
+        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                sta_priv->tid = tid;
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 0,
+                        get_sta_index(vif, sta_priv));
+                wcn36xx_smd_add_ba(wcn);
+                wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+                break;
+        case IEEE80211_AMPDU_RX_STOP:
+                wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_START:
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
+                        get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        default:
+                wcn36xx_err("Unknown AMPDU action\n");
+        }
+
+        return 0;
+}
+
+static const struct ieee80211_ops wcn36xx_ops = {
+        .start                  = wcn36xx_start,
+        .stop                   = wcn36xx_stop,
+        .add_interface          = wcn36xx_add_interface,
+        .remove_interface       = wcn36xx_remove_interface,
+#ifdef CONFIG_PM
+        .suspend                = wcn36xx_suspend,
+        .resume                 = wcn36xx_resume,
+#endif
+        .config                 = wcn36xx_config,
+        .configure_filter       = wcn36xx_configure_filter,
+        .tx                     = wcn36xx_tx,
+        .set_key                = wcn36xx_set_key,
+        .sw_scan_start          = wcn36xx_sw_scan_start,
+        .sw_scan_complete       = wcn36xx_sw_scan_complete,
+        .bss_info_changed       = wcn36xx_bss_info_changed,
+        .set_rts_threshold      = wcn36xx_set_rts_threshold,
+        .sta_add                = wcn36xx_sta_add,
+        .sta_remove             = wcn36xx_sta_remove,
+        .ampdu_action           = wcn36xx_ampdu_action,
+};
+
+static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
+{
+        int ret = 0;
+
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+        };
+
+        wcn->hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_CONNECTION_MONITOR |
+                IEEE80211_HW_AMPDU_AGGREGATION |
+                IEEE80211_HW_TIMING_BEACON_ONLY;
+
+        wcn->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        wcn->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wcn_band_2ghz;
+        wcn->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wcn_band_5ghz;
+
+        wcn->hw->wiphy->cipher_suites = cipher_suites;
+        wcn->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+        wcn->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+#ifdef CONFIG_PM
+        wcn->hw->wiphy->wowlan = &wowlan_support;
+#endif
+
+        wcn->hw->max_listen_interval = 200;
+
+        wcn->hw->queues = 4;
+
+        SET_IEEE80211_DEV(wcn->hw, wcn->dev);
+
+        wcn->hw->sta_data_size = sizeof(struct wcn36xx_sta);
+        wcn->hw->vif_data_size = sizeof(struct wcn36xx_vif);
+
+        return ret;
+}
+
+static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
+                                          struct platform_device *pdev)
+{
+        struct resource *res;
+        /* Set TX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlantx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get tx_irq\n");
+                return -ENOENT;
+        }
+        wcn->tx_irq = res->start;
+
+        /* Set RX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlanrx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get rx_irq\n");
+                return -ENOENT;
+        }
+        wcn->rx_irq = res->start;
+
+        /* Map the memory */
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                                 "wcnss_mmio");
+        if (!res) {
+                wcn36xx_err("failed to get mmio\n");
+                return -ENOENT;
+        }
+        wcn->mmio = ioremap(res->start, resource_size(res));
+        if (!wcn->mmio) {
+                wcn36xx_err("failed to map io memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static int wcn36xx_probe(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw;
+        struct wcn36xx *wcn;
+        int ret;
+        u8 addr[ETH_ALEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform probe\n");
+
+        hw = ieee80211_alloc_hw(sizeof(struct wcn36xx), &wcn36xx_ops);
+        if (!hw) {
+                wcn36xx_err("failed to alloc hw\n");
+                ret = -ENOMEM;
+                goto out_err;
+        }
+        platform_set_drvdata(pdev, hw);
+        wcn = hw->priv;
+        wcn->hw = hw;
+        wcn->dev = &pdev->dev;
+        wcn->ctrl_ops = pdev->dev.platform_data;
+
+        mutex_init(&wcn->hal_mutex);
+
+        if (!wcn->ctrl_ops->get_hw_mac(addr)) {
+                wcn36xx_info("mac address: %pM\n", addr);
+                SET_IEEE80211_PERM_ADDR(wcn->hw, addr);
+        }
+
+        ret = wcn36xx_platform_get_resources(wcn, pdev);
+        if (ret)
+                goto out_wq;
+
+        wcn36xx_init_ieee80211(wcn);
+        ret = ieee80211_register_hw(wcn->hw);
+        if (ret)
+                goto out_unmap;
+
+        return 0;
+
+out_unmap:
+        iounmap(wcn->mmio);
+out_wq:
+        ieee80211_free_hw(hw);
+out_err:
+        return ret;
+}
+static int wcn36xx_remove(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
+
+        mutex_destroy(&wcn->hal_mutex);
+
+        ieee80211_unregister_hw(hw);
+        iounmap(wcn->mmio);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+static const struct platform_device_id wcn36xx_platform_id_table[] = {
+        {
+                .name = "wcn36xx",
+                .driver_data = 0
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(platform, wcn36xx_platform_id_table);
+
+static struct platform_driver wcn36xx_driver = {
+        .probe      = wcn36xx_probe,
+        .remove     = wcn36xx_remove,
+        .driver         = {
+                .name   = "wcn36xx",
+                .owner  = THIS_MODULE,
+        },
+        .id_table    = wcn36xx_platform_id_table,
+};
+
+static int __init wcn36xx_init(void)
+{
+        platform_driver_register(&wcn36xx_driver);
+        return 0;
+}
+module_init(wcn36xx_init);
+
+static void __exit wcn36xx_exit(void)
+{
+        platform_driver_unregister(&wcn36xx_driver);
+}
+module_exit(wcn36xx_exit);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Eugene Krasnikov k.eugene.e@gmail.com");
+MODULE_FIRMWARE(WLAN_NV_FILE);
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c
new file mode 100644
index 000000000000..28b515c81b0e
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "wcn36xx.h"
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif)
+{
+        int ret = 0;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        /* TODO: Make sure the TX chain clean */
+        ret = wcn36xx_smd_enter_bmps(wcn, vif);
+        if (!ret) {
+                wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");
+                vif_priv->pw_state = WCN36XX_BMPS;
+        } else {
+                /*
+                 * One of the reasons why HW will not enter BMPS is because
+                 * driver is trying to enter bmps before first beacon was
+                 * received just after auth complete
+                 */
+                wcn36xx_err("Can not enter BMPS!\n");
+        }
+        return ret;
+}
+
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif)
+{
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (WCN36XX_BMPS != vif_priv->pw_state) {
+                wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
+                return -EINVAL;
+        }
+        wcn36xx_smd_exit_bmps(wcn, vif);
+        vif_priv->pw_state = WCN36XX_FULL_POWER;
+        return 0;
+}
+
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif)
+{
+        wcn36xx_dbg(WCN36XX_DBG_PMC, "%s\n", __func__);
+        return wcn36xx_smd_keep_alive_req(wcn, vif,
+                                          WCN36XX_HAL_KEEP_ALIVE_NULL_PKT);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.h b/drivers/net/wireless/ath/wcn36xx/pmc.h
new file mode 100644
index 000000000000..f72ed68b5a07
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_PMC_H_
+#define _WCN36XX_PMC_H_
+
+struct wcn36xx;
+
+enum wcn36xx_power_state {
+        WCN36XX_FULL_POWER,
+        WCN36XX_BMPS
+};
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif);
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif);
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif);
+#endif  /* _WCN36XX_PMC_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
new file mode 100644
index 000000000000..f8c3a10510c2
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -0,0 +1,2126 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/bitops.h>
+#include "smd.h"
+
+static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
+{
+        struct wcn36xx_hal_cfg *entry;
+        u32 *val;
+
+        if (*len + sizeof(*entry) + sizeof(u32) >= WCN36XX_HAL_BUF_SIZE) {
+                wcn36xx_err("Not enough room for TLV entry\n");
+                return -ENOMEM;
+        }
+
+        entry = (struct wcn36xx_hal_cfg *) (wcn->hal_buf + *len);
+        entry->id = id;
+        entry->len = sizeof(u32);
+        entry->pad_bytes = 0;
+        entry->reserve = 0;
+
+        val = (u32 *) (entry + 1);
+        *val = value;
+
+        *len += sizeof(*entry) + sizeof(u32);
+
+        return 0;
+}
+
+static void wcn36xx_smd_set_bss_nw_type(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (IEEE80211_BAND_5GHZ == WCN36XX_BAND(wcn))
+                bss_params->nw_type = WCN36XX_HAL_11A_NW_TYPE;
+        else if (sta && sta->ht_cap.ht_supported)
+                bss_params->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+        else if (sta && (sta->supp_rates[IEEE80211_BAND_2GHZ] & 0x7f))
+                bss_params->nw_type = WCN36XX_HAL_11G_NW_TYPE;
+        else
+                bss_params->nw_type = WCN36XX_HAL_11B_NW_TYPE;
+}
+
+static inline u8 is_cap_supported(unsigned long caps, unsigned long flag)
+{
+        return caps & flag ? 1 : 0;
+}
+static void wcn36xx_smd_set_bss_ht_params(struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (sta && sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                bss_params->ht = sta->ht_cap.ht_supported;
+                bss_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                bss_params->lsig_tx_op_protection_full_support =
+                        is_cap_supported(caps,
+                                         IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                bss_params->ht_oper_mode = vif->bss_conf.ht_operation_mode;
+                bss_params->lln_non_gf_coexist =
+                        !!(vif->bss_conf.ht_operation_mode &
+                           IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+                /* IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT */
+                bss_params->dual_cts_protection = 0;
+                /* IEEE80211_HT_OP_MODE_PROTECTION_20MHZ */
+                bss_params->ht20_coexist = 0;
+        }
+}
+
+static void wcn36xx_smd_set_sta_ht_params(struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        if (sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                sta_params->ht_capable = sta->ht_cap.ht_supported;
+                sta_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                sta_params->lsig_txop_protection = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                sta_params->max_ampdu_size = sta->ht_cap.ampdu_factor;
+                sta_params->max_ampdu_density = sta->ht_cap.ampdu_density;
+                sta_params->max_amsdu_size = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_MAX_AMSDU);
+                sta_params->sgi_20Mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_20);
+                sta_params->sgi_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_40);
+                sta_params->green_field_capable = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_GRN_FLD);
+                sta_params->delayed_ba_support = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DELAY_BA);
+                sta_params->dsss_cck_mode_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DSSSCCK40);
+        }
+}
+
+static void wcn36xx_smd_set_sta_params(struct wcn36xx *wcn,
+                struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *priv_sta = NULL;
+        if (vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_MESH_POINT) {
+                sta_params->type = 1;
+                sta_params->sta_index = 0xFF;
+        } else {
+                sta_params->type = 0;
+                sta_params->sta_index = 1;
+        }
+
+        sta_params->listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        /*
+         * In STA mode ieee80211_sta contains bssid and ieee80211_vif
+         * contains our mac address. In  AP mode we are bssid so vif
+         * contains bssid and ieee80211_sta contains mac.
+         */
+        if (NL80211_IFTYPE_STATION == vif->type)
+                memcpy(&sta_params->mac, vif->addr, ETH_ALEN);
+        else
+                memcpy(&sta_params->bssid, vif->addr, ETH_ALEN);
+
+        sta_params->encrypt_type = priv_vif->encrypt_type;
+        sta_params->short_preamble_supported =
+                !(WCN36XX_FLAGS(wcn) &
+                  IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE);
+
+        sta_params->rifs_mode = 0;
+        sta_params->rmf = 0;
+        sta_params->action = 0;
+        sta_params->uapsd = 0;
+        sta_params->mimo_ps = WCN36XX_HAL_HT_MIMO_PS_STATIC;
+        sta_params->max_ampdu_duration = 0;
+        sta_params->bssid_index = priv_vif->bss_index;
+        sta_params->p2p = 0;
+
+        if (sta) {
+                priv_sta = (struct wcn36xx_sta *)sta->drv_priv;
+                if (NL80211_IFTYPE_STATION == vif->type)
+                        memcpy(&sta_params->bssid, sta->addr, ETH_ALEN);
+                else
+                        memcpy(&sta_params->mac, sta->addr, ETH_ALEN);
+                sta_params->wmm_enabled = sta->wme;
+                sta_params->max_sp_len = sta->max_sp;
+                sta_params->aid = priv_sta->aid;
+                wcn36xx_smd_set_sta_ht_params(sta, sta_params);
+                memcpy(&sta_params->supported_rates, &priv_sta->supported_rates,
+                        sizeof(priv_sta->supported_rates));
+        } else {
+                wcn36xx_set_default_rates(&sta_params->supported_rates);
+        }
+}
+
+static int wcn36xx_smd_send_and_wait(struct wcn36xx *wcn, size_t len)
+{
+        int ret = 0;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "HAL >>> ", wcn->hal_buf, len);
+
+        init_completion(&wcn->hal_rsp_compl);
+        ret = wcn->ctrl_ops->tx(wcn->hal_buf, len);
+        if (ret) {
+                wcn36xx_err("HAL TX failed\n");
+                goto out;
+        }
+        if (wait_for_completion_timeout(&wcn->hal_rsp_compl,
+                msecs_to_jiffies(HAL_MSG_TIMEOUT)) <= 0) {
+                wcn36xx_err("Timeout while waiting SMD response\n");
+                ret = -ETIME;
+                goto out;
+        }
+out:
+        return ret;
+}
+
+#define INIT_HAL_MSG(msg_body, type) \
+        do {                                                            \
+                memset(&msg_body, 0, sizeof(msg_body));                 \
+                msg_body.header.msg_type = type;                        \
+                msg_body.header.msg_version = WCN36XX_HAL_MSG_VERSION0; \
+                msg_body.header.len = sizeof(msg_body);                 \
+        } while (0)                                                     \
+
+#define PREPARE_HAL_BUF(send_buf, msg_body) \
+        do {                                                    \
+                memset(send_buf, 0, msg_body.header.len);       \
+                memcpy(send_buf, &msg_body, sizeof(msg_body));  \
+        } while (0)                                             \
+
+static int wcn36xx_smd_rsp_status_check(void *buf, size_t len)
+{
+        struct wcn36xx_fw_msg_status_rsp *rsp;
+
+        if (len < sizeof(struct wcn36xx_hal_msg_header) +
+            sizeof(struct wcn36xx_fw_msg_status_rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_fw_msg_status_rsp *)
+                (buf + sizeof(struct wcn36xx_hal_msg_header));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status)
+                return rsp->status;
+
+        return 0;
+}
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn)
+{
+        const struct firmware *nv;
+        struct nv_data *nv_d;
+        struct wcn36xx_hal_nv_img_download_req_msg msg_body;
+        int fw_bytes_left;
+        int ret;
+        u16 fm_offset = 0;
+
+        ret = request_firmware(&nv, WLAN_NV_FILE, wcn->dev);
+        if (ret) {
+                wcn36xx_err("Failed to load nv file %s: %d\n",
+                              WLAN_NV_FILE, ret);
+                goto out_free_nv;
+        }
+
+        nv_d = (struct nv_data *)nv->data;
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DOWNLOAD_NV_REQ);
+
+        msg_body.header.len += WCN36XX_NV_FRAGMENT_SIZE;
+
+        msg_body.frag_number = 0;
+        /* hal_buf must be protected with  mutex */
+        mutex_lock(&wcn->hal_mutex);
+
+        do {
+                fw_bytes_left = nv->size - fm_offset - 4;
+                if (fw_bytes_left > WCN36XX_NV_FRAGMENT_SIZE) {
+                        msg_body.last_fragment = 0;
+                        msg_body.nv_img_buffer_size = WCN36XX_NV_FRAGMENT_SIZE;
+                } else {
+                        msg_body.last_fragment = 1;
+                        msg_body.nv_img_buffer_size = fw_bytes_left;
+
+                        /* Do not forget update general message len */
+                        msg_body.header.len = sizeof(msg_body) + fw_bytes_left;
+
+                }
+
+                /* Add load NV request message header */
+                memcpy(wcn->hal_buf, &msg_body, sizeof(msg_body));
+
+                /* Add NV body itself */
+                memcpy(wcn->hal_buf + sizeof(msg_body),
+                       &nv_d->table + fm_offset,
+                       msg_body.nv_img_buffer_size);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+                if (ret)
+                        goto out_unlock;
+                ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf,
+                                                   wcn->hal_rsp_len);
+                if (ret) {
+                        wcn36xx_err("hal_load_nv response failed err=%d\n",
+                                    ret);
+                        goto out_unlock;
+                }
+                msg_body.frag_number++;
+                fm_offset += WCN36XX_NV_FRAGMENT_SIZE;
+
+        } while (msg_body.last_fragment != 1);
+
+out_unlock:
+        mutex_unlock(&wcn->hal_mutex);
+out_free_nv:
+        release_firmware(nv);
+
+        return ret;
+}
+
+static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_mac_start_rsp_msg *rsp;
+
+        if (len < sizeof(*rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_mac_start_rsp_msg *)buf;
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->start_rsp_params.status)
+                return -EIO;
+
+        memcpy(wcn->crm_version, rsp->start_rsp_params.crm_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+        memcpy(wcn->wlan_version, rsp->start_rsp_params.wlan_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+
+        /* null terminate the strings, just in case */
+        wcn->crm_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+        wcn->wlan_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+
+        wcn->fw_revision = rsp->start_rsp_params.version.revision;
+        wcn->fw_version = rsp->start_rsp_params.version.version;
+        wcn->fw_minor = rsp->start_rsp_params.version.minor;
+        wcn->fw_major = rsp->start_rsp_params.version.major;
+
+        wcn36xx_info("firmware WLAN version '%s' and CRM version '%s'\n",
+                     wcn->wlan_version, wcn->crm_version);
+
+        wcn36xx_info("firmware API %u.%u.%u.%u, %u stations, %u bssids\n",
+                     wcn->fw_major, wcn->fw_minor,
+                     wcn->fw_version, wcn->fw_revision,
+                     rsp->start_rsp_params.stations,
+                     rsp->start_rsp_params.bssids);
+
+        return 0;
+}
+
+int wcn36xx_smd_start(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
+
+        msg_body.params.type = DRIVER_TYPE_PRODUCTION;
+        msg_body.params.len = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
+                    msg_body.params.type);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start failed\n");
+                goto out;
+        }
+
+        ret = wcn36xx_smd_start_rsp(wcn, wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start response failed err=%d\n", ret);
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_stop(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_stop_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_STOP_REQ);
+
+        msg_body.stop_req_params.reason = HAL_STOP_TYPE_RF_KILL;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_stop failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_stop response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_init_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_INIT_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal init scan mode %d\n", msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_init_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_init_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_start_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_end_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_END_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal end scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_end_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_end_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_finish_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FINISH_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal finish scan mode %d\n",
+                    msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_finish_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_finish_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_switch_channel_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_switch_channel_rsp_msg *rsp;
+        int ret = 0;
+
+        ret = wcn36xx_smd_rsp_status_check(buf, len);
+        if (ret)
+                return ret;
+        rsp = (struct wcn36xx_hal_switch_channel_rsp_msg *)buf;
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "channel switched to: %d, status: %d\n",
+                    rsp->channel_number, rsp->status);
+        return ret;
+}
+
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch)
+{
+        struct wcn36xx_hal_switch_channel_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CH_SWITCH_REQ);
+
+        msg_body.channel_number = (u8)ch;
+        msg_body.tx_mgmt_power = 0xbf;
+        msg_body.max_tx_power = 0xbf;
+        memcpy(msg_body.self_sta_mac_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_switch_channel failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_switch_channel_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_switch_channel response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_update_scan_params_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_update_scan_params_resp *rsp;
+
+        rsp = (struct wcn36xx_hal_update_scan_params_resp *)buf;
+
+        /* Remove the PNO version bit */
+        rsp->status &= (~(WCN36XX_FW_MSG_PNO_VERSION_MASK));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status) {
+                wcn36xx_warn("error response from update scan\n");
+                return rsp->status;
+        }
+
+        return 0;
+}
+
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_update_scan_params_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ);
+
+        msg_body.dot11d_enabled = 0;
+        msg_body.dot11d_resolved = 0;
+        msg_body.channel_count = 26;
+        msg_body.active_min_ch_time = 60;
+        msg_body.active_max_ch_time = 120;
+        msg_body.passive_min_ch_time = 60;
+        msg_body.passive_max_ch_time = 110;
+        msg_body.state = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update scan params channel_count %d\n",
+                    msg_body.channel_count);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_scan_params failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_update_scan_params_rsp(wcn->hal_buf,
+                                                 wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_scan_params response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_add_sta_self_rsp(struct wcn36xx *wcn,
+                                        struct ieee80211_vif *vif,
+                                        void *buf,
+                                        size_t len)
+{
+        struct wcn36xx_hal_add_sta_self_rsp_msg *rsp;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_add_sta_self_rsp_msg *)buf;
+
+        if (rsp->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal add sta self failure: %d\n",
+                             rsp->status);
+                return rsp->status;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self status %d self_sta_index %d dpu_index %d\n",
+                    rsp->status, rsp->self_sta_index, rsp->dpu_index);
+
+        priv_vif->self_sta_index = rsp->self_sta_index;
+        priv_vif->self_dpu_desc_index = rsp->dpu_index;
+
+        return 0;
+}
+
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_add_sta_self_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self self_addr %pM status %d\n",
+                    msg_body.self_addr, msg_body.status);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_add_sta_self_rsp(wcn,
+                                           vif,
+                                           wcn->hal_buf,
+                                           wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_sta_self response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr)
+{
+        struct wcn36xx_hal_del_sta_self_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta_self response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_delete_sta_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_STA_REQ);
+
+        msg_body.sta_index = sta_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal delete sta sta_index %d\n",
+                    msg_body.sta_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_join_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_join_rsp_msg *rsp;
+
+        if (wcn36xx_smd_rsp_status_check(buf, len))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_join_rsp_msg *)buf;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal rsp join status %d tx_mgmt_power %d\n",
+                    rsp->status, rsp->tx_mgmt_power);
+
+        return 0;
+}
+
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch)
+{
+        struct wcn36xx_hal_join_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_JOIN_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_sta_mac_addr, vif, ETH_ALEN);
+        msg_body.channel = ch;
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
+        else
+                msg_body.secondary_channel_offset =
+                        PHY_SINGLE_CHANNEL_CENTERED;
+
+        msg_body.link_state = WCN36XX_HAL_LINK_PREASSOC_STATE;
+
+        msg_body.max_tx_power = 0xbf;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal join req bssid %pM self_sta_mac_addr %pM channel %d link_state %d\n",
+                    msg_body.bssid, msg_body.self_sta_mac_addr,
+                    msg_body.channel, msg_body.link_state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_join failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_join_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_join response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state)
+{
+        struct wcn36xx_hal_set_link_state_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_LINK_ST_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_mac_addr, sta_mac, ETH_ALEN);
+        msg_body.state = state;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal set link state bssid %pM self_mac_addr %pM state %d\n",
+                    msg_body.bssid, msg_body.self_mac_addr, msg_body.state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_link_st failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_link_st response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static void wcn36xx_smd_convert_sta_to_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_sta_params *orig,
+                        struct wcn36xx_hal_config_sta_params_v1 *v1)
+{
+        /* convert orig to v1 format */
+        memcpy(&v1->bssid, orig->bssid, ETH_ALEN);
+        memcpy(&v1->mac, orig->mac, ETH_ALEN);
+        v1->aid = orig->aid;
+        v1->type = orig->type;
+        v1->listen_interval = orig->listen_interval;
+        v1->ht_capable = orig->ht_capable;
+
+        v1->max_ampdu_size = orig->max_ampdu_size;
+        v1->max_ampdu_density = orig->max_ampdu_density;
+        v1->sgi_40mhz = orig->sgi_40mhz;
+        v1->sgi_20Mhz = orig->sgi_20Mhz;
+
+        memcpy(&v1->supported_rates, &orig->supported_rates,
+               sizeof(orig->supported_rates));
+        v1->sta_index = orig->sta_index;
+}
+
+static int wcn36xx_smd_config_sta_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_sta *sta,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_sta_rsp_msg *rsp;
+        struct config_sta_rsp_params *params;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_sta_rsp_msg *)buf;
+        params = &rsp->params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config sta response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        sta_priv->sta_index = params->sta_index;
+        sta_priv->dpu_desc_index = params->dpu_index;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta rsp status %d sta_index %d bssid_index %d p2p %d\n",
+                    params->status, params->sta_index, params->bssid_index,
+                    params->p2p);
+
+        return 0;
+}
+
+static int wcn36xx_smd_config_sta_v1(struct wcn36xx *wcn,
+                     const struct wcn36xx_hal_config_sta_req_msg *orig)
+{
+        struct wcn36xx_hal_config_sta_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &msg_body.sta_params;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->sta_params,
+                                      &msg_body.sta_params);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta v1 action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                    sta->action, sta->sta_index, sta->bssid_index,
+                    sta->bssid, sta->type, sta->mac, sta->aid);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx_hal_config_sta_req_msg msg;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        sta_params = &msg.sta_params;
+
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_sta_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                wcn36xx_dbg(WCN36XX_DBG_HAL,
+                            "hal config sta action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                            sta_params->action, sta_params->sta_index,
+                            sta_params->bssid_index, sta_params->bssid,
+                            sta_params->type, sta_params->mac, sta_params->aid);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_sta_rsp(wcn,
+                                         sta,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_bss_req_msg *orig)
+{
+        struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        /* convert orig to v1 */
+        memcpy(&msg_body.bss_params.bssid,
+               &orig->bss_params.bssid, ETH_ALEN);
+        memcpy(&msg_body.bss_params.self_mac_addr,
+               &orig->bss_params.self_mac_addr, ETH_ALEN);
+
+        msg_body.bss_params.bss_type = orig->bss_params.bss_type;
+        msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
+        msg_body.bss_params.nw_type = orig->bss_params.nw_type;
+
+        msg_body.bss_params.short_slot_time_supported =
+                orig->bss_params.short_slot_time_supported;
+        msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
+        msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
+        msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
+        msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+        msg_body.bss_params.lln_non_gf_coexist =
+                orig->bss_params.lln_non_gf_coexist;
+
+        msg_body.bss_params.lsig_tx_op_protection_full_support =
+                orig->bss_params.lsig_tx_op_protection_full_support;
+        msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
+        msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
+        msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
+        msg_body.bss_params.tx_channel_width_set =
+                orig->bss_params.tx_channel_width_set;
+        msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
+        msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
+
+        msg_body.bss_params.reserved = orig->bss_params.reserved;
+
+        memcpy(&msg_body.bss_params.ssid,
+               &orig->bss_params.ssid,
+               sizeof(orig->bss_params.ssid));
+
+        msg_body.bss_params.action = orig->bss_params.action;
+        msg_body.bss_params.rateset = orig->bss_params.rateset;
+        msg_body.bss_params.ht = orig->bss_params.ht;
+        msg_body.bss_params.obss_prot_enabled =
+                orig->bss_params.obss_prot_enabled;
+        msg_body.bss_params.rmf = orig->bss_params.rmf;
+        msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+        msg_body.bss_params.dual_cts_protection =
+                orig->bss_params.dual_cts_protection;
+
+        msg_body.bss_params.max_probe_resp_retry_limit =
+                orig->bss_params.max_probe_resp_retry_limit;
+        msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+        msg_body.bss_params.proxy_probe_resp =
+                orig->bss_params.proxy_probe_resp;
+        msg_body.bss_params.edca_params_valid =
+                orig->bss_params.edca_params_valid;
+
+        memcpy(&msg_body.bss_params.acbe,
+               &orig->bss_params.acbe,
+               sizeof(orig->bss_params.acbe));
+        memcpy(&msg_body.bss_params.acbk,
+               &orig->bss_params.acbk,
+               sizeof(orig->bss_params.acbk));
+        memcpy(&msg_body.bss_params.acvi,
+               &orig->bss_params.acvi,
+               sizeof(orig->bss_params.acvi));
+        memcpy(&msg_body.bss_params.acvo,
+               &orig->bss_params.acvo,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.ext_set_sta_key_param_valid =
+                orig->bss_params.ext_set_sta_key_param_valid;
+
+        memcpy(&msg_body.bss_params.ext_set_sta_key_param,
+               &orig->bss_params.ext_set_sta_key_param,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.wcn36xx_hal_persona =
+                orig->bss_params.wcn36xx_hal_persona;
+        msg_body.bss_params.spectrum_mgt_enable =
+                orig->bss_params.spectrum_mgt_enable;
+        msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+        msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
+                                      &msg_body.bss_params.sta);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta->bssid, sta->action, sta->sta_index,
+                    sta->bssid_index, sta->aid, sta->type, sta->mac);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+
+static int wcn36xx_smd_config_bss_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_bss_rsp_msg *rsp;
+        struct wcn36xx_hal_config_bss_rsp_params *params;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_bss_rsp_msg *)buf;
+        params = &rsp->bss_rsp_params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config bss response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss rsp status %d bss_idx %d dpu_desc_index %d"
+                    " sta_idx %d self_idx %d bcast_idx %d mac %pM"
+                    " power %d ucast_dpu_signature %d\n",
+                    params->status, params->bss_index, params->dpu_desc_index,
+                    params->bss_sta_index, params->bss_self_sta_index,
+                    params->bss_bcast_sta_idx, params->mac,
+                    params->tx_mgmt_power, params->ucast_dpu_signature);
+
+        priv_vif->bss_index = params->bss_index;
+
+        if (priv_vif->sta) {
+                priv_vif->sta->bss_sta_index =  params->bss_sta_index;
+                priv_vif->sta->bss_dpu_desc_index = params->dpu_desc_index;
+        }
+
+        priv_vif->ucast_dpu_signature = params->ucast_dpu_signature;
+
+        return 0;
+}
+
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update)
+{
+        struct wcn36xx_hal_config_bss_req_msg msg;
+        struct wcn36xx_hal_config_bss_params *bss;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        bss = &msg.bss_params;
+        sta_params = &bss->sta;
+
+        WARN_ON(is_zero_ether_addr(bssid));
+
+        memcpy(&bss->bssid, bssid, ETH_ALEN);
+
+        memcpy(bss->self_mac_addr, vif->addr, ETH_ALEN);
+
+        if (vif->type == NL80211_IFTYPE_STATION) {
+                bss->bss_type = WCN36XX_HAL_INFRASTRUCTURE_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_MODE;
+        } else if (vif->type == NL80211_IFTYPE_AP) {
+                bss->bss_type = WCN36XX_HAL_INFRA_AP_MODE;
+
+                /* AP */
+                bss->oper_mode = 0;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_SAP_MODE;
+        } else if (vif->type == NL80211_IFTYPE_ADHOC ||
+                   vif->type == NL80211_IFTYPE_MESH_POINT) {
+                bss->bss_type = WCN36XX_HAL_IBSS_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+        } else {
+                wcn36xx_warn("Unknown type for bss config: %d\n", vif->type);
+        }
+
+        if (vif->type == NL80211_IFTYPE_STATION)
+                wcn36xx_smd_set_bss_nw_type(wcn, sta, bss);
+        else
+                bss->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+
+        bss->short_slot_time_supported = vif->bss_conf.use_short_slot;
+        bss->lla_coexist = 0;
+        bss->llb_coexist = 0;
+        bss->llg_coexist = 0;
+        bss->rifs_mode = 0;
+        bss->beacon_interval = vif->bss_conf.beacon_int;
+        bss->dtim_period = vif_priv->dtim_period;
+
+        wcn36xx_smd_set_bss_ht_params(vif, sta, bss);
+
+        bss->oper_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+        else
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+
+        bss->reserved = 0;
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        /* wcn->ssid is only valid in AP and IBSS mode */
+        bss->ssid.length = vif_priv->ssid.length;
+        memcpy(bss->ssid.ssid, vif_priv->ssid.ssid, vif_priv->ssid.length);
+
+        bss->obss_prot_enabled = 0;
+        bss->rmf = 0;
+        bss->max_probe_resp_retry_limit = 0;
+        bss->hidden_ssid = vif->bss_conf.hidden_ssid;
+        bss->proxy_probe_resp = 0;
+        bss->edca_params_valid = 0;
+
+        /* FIXME: set acbe, acbk, acvi and acvo */
+
+        bss->ext_set_sta_key_param_valid = 0;
+
+        /* FIXME: set ext_set_sta_key_param */
+
+        bss->spectrum_mgt_enable = 0;
+        bss->tx_mgmt_power = 0;
+        bss->max_tx_power = WCN36XX_MAX_POWER(wcn);
+
+        bss->action = update;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta_params->bssid, sta_params->action,
+                    sta_params->sta_index, sta_params->bssid_index,
+                    sta_params->aid, sta_params->type,
+                    sta_params->mac);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_bss_rsp(wcn,
+                                         vif,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_delete_bss_req_msg msg_body;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_BSS_REQ);
+
+        msg_body.bss_index = priv_vif->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal delete bss %d\n", msg_body.bss_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off)
+{
+        struct wcn36xx_hal_send_beacon_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SEND_BEACON_REQ);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.beacon_length = skb_beacon->len + 6;
+
+        if (BEACON_TEMPLATE_SIZE > msg_body.beacon_length) {
+                memcpy(&msg_body.beacon, &skb_beacon->len, sizeof(u32));
+                memcpy(&(msg_body.beacon[4]), skb_beacon->data,
+                       skb_beacon->len);
+        } else {
+                wcn36xx_err("Beacon is to big: beacon size=%d\n",
+                              msg_body.beacon_length);
+                return -ENOMEM;
+        }
+        memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.tim_ie_offset = tim_off+4;
+        msg_body.p2p_ie_offset = p2p_off;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal send beacon beacon_length %d\n",
+                    msg_body.beacon_length);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_send_beacon failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_send_beacon response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb)
+{
+        struct wcn36xx_hal_send_probe_resp_req_msg msg;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ);
+
+        if (skb->len > BEACON_TEMPLATE_SIZE) {
+                wcn36xx_warn("probe response template is too big: %d\n",
+                             skb->len);
+                return -E2BIG;
+        }
+
+        msg.probe_resp_template_len = skb->len;
+        memcpy(&msg.probe_resp_template, skb->data, skb->len);
+
+        memcpy(msg.bssid, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update probe rsp len %d bssid %pM\n",
+                    msg.probe_resp_template_len, msg.bssid);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_proberesp_tmpl failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_proberesp_tmpl response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index)
+{
+        struct wcn36xx_hal_set_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_STAKEY_REQ);
+
+        msg_body.set_sta_key_params.sta_index = sta_index;
+        msg_body.set_sta_key_params.enc_type = enc_type;
+
+        msg_body.set_sta_key_params.key[0].id = keyidx;
+        msg_body.set_sta_key_params.key[0].unicast = 1;
+        msg_body.set_sta_key_params.key[0].direction = WCN36XX_HAL_TX_RX;
+        msg_body.set_sta_key_params.key[0].pae_role = 0;
+        msg_body.set_sta_key_params.key[0].length = keylen;
+        memcpy(msg_body.set_sta_key_params.key[0].key, key, keylen);
+        msg_body.set_sta_key_params.single_tid_rc = 1;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key)
+{
+        struct wcn36xx_hal_set_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.num_keys = 1;
+        msg_body.keys[0].id = keyidx;
+        msg_body.keys[0].unicast = 0;
+        msg_body.keys[0].direction = WCN36XX_HAL_RX_ONLY;
+        msg_body.keys[0].pae_role = 0;
+        msg_body.keys[0].length = keylen;
+        memcpy(msg_body.keys[0].key, key, keylen);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index)
+{
+        struct wcn36xx_hal_remove_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_STAKEY_REQ);
+
+        msg_body.sta_idx = sta_index;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx)
+{
+        struct wcn36xx_hal_remove_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ENTER_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+        msg_body.tbtt = vif->bss_conf.sync_tsf;
+        msg_body.dtim_period = vif_priv->dtim_period;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_enter_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_enter_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_EXIT_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim)
+{
+        struct wcn36xx_hal_set_power_params_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_POWER_PARAMS_REQ);
+
+        /*
+         * When host is down ignore every second dtim
+         */
+        if (ignore_dtim) {
+                msg_body.ignore_dtim = 1;
+                msg_body.dtim_period = 2;
+        }
+        msg_body.listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_power_params failed\n");
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+/* Notice: This function should be called after associated, or else it
+ * will be invalid
+ */
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type)
+{
+        struct wcn36xx_hal_keep_alive_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_KEEP_ALIVE_REQ);
+
+        if (packet_type == WCN36XX_HAL_KEEP_ALIVE_NULL_PKT) {
+                msg_body.bss_index = vif_priv->bss_index;
+                msg_body.packet_type = WCN36XX_HAL_KEEP_ALIVE_NULL_PKT;
+                msg_body.time_period = WCN36XX_KEEP_ALIVE_TIME_PERIOD;
+        } else if (packet_type == WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP) {
+                /* TODO: it also support ARP response type */
+        } else {
+                wcn36xx_warn("unknow keep alive packet type %d\n", packet_type);
+                return -EINVAL;
+        }
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5)
+{
+        struct wcn36xx_hal_dump_cmd_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DUMP_COMMAND_REQ);
+
+        msg_body.arg1 = arg1;
+        msg_body.arg2 = arg2;
+        msg_body.arg3 = arg3;
+        msg_body.arg4 = arg4;
+        msg_body.arg5 = arg5;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_dump_cmd failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_dump_cmd response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static inline void set_feat_caps(u32 *bitmap,
+                                 enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] |= (1 << bit_idx);
+}
+
+static inline int get_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+        int ret = 0;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return -EINVAL;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        ret = (bitmap[arr_idx] & (1 << bit_idx)) ? 1 : 0;
+        return ret;
+}
+
+static inline void clear_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] &= ~(1 << bit_idx);
+}
+
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_feat_caps_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ);
+
+        set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_feature_caps_exchange failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_feature_caps_exchange response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index)
+{
+        struct wcn36xx_hal_add_ba_session_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_SESSION_REQ);
+
+        msg_body.sta_index = sta_index;
+        memcpy(&msg_body.mac_addr, sta->addr, ETH_ALEN);
+        msg_body.dialog_token = 0x10;
+        msg_body.tid = tid;
+
+        /* Immediate BA because Delayed BA is not supported */
+        msg_body.policy = 1;
+        msg_body.buffer_size = WCN36XX_AGGR_BUFFER_SIZE;
+        msg_body.timeout = 0;
+        if (ssn)
+                msg_body.ssn = *ssn;
+        msg_body.direction = direction;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba_session failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba_session response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_add_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.win_size = WCN36XX_AGGR_BUFFER_SIZE;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index)
+{
+        struct wcn36xx_hal_del_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_BA_REQ);
+
+        msg_body.sta_index = sta_index;
+        msg_body.tid = tid;
+        msg_body.direction = 0;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_del_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_del_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_trigger_ba_req_msg msg_body;
+        struct wcn36xx_hal_trigget_ba_req_candidate *candidate;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_TRIGGER_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.candidate_cnt = 1;
+        msg_body.header.len += sizeof(*candidate);
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        candidate = (struct wcn36xx_hal_trigget_ba_req_candidate *)
+                (wcn->hal_buf + sizeof(msg_body));
+        candidate->sta_index = sta_index;
+        candidate->tid_bitmap = 1;
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_trigger_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_trigger_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_tx_compl_ind(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_tx_compl_ind_msg *rsp = buf;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Bad TX complete indication\n");
+                return -EIO;
+        }
+
+        wcn36xx_dxe_tx_ack_ind(wcn, rsp->status);
+
+        return 0;
+}
+
+static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
+                                         void *buf,
+                                         size_t len)
+{
+        struct wcn36xx_hal_missed_beacon_ind_msg *rsp = buf;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        /* Old FW does not have bss index */
+        if (wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    tmp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                }
+                return 0;
+        }
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted missed beacon indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (tmp->bss_index == rsp->bss_index) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    rsp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("BSS index %d not found\n", rsp->bss_index);
+        return -ENOENT;
+}
+
+static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn,
+                                              void *buf,
+                                              size_t len)
+{
+        struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
+        struct wcn36xx_vif *tmp;
+        struct ieee80211_sta *sta = NULL;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted delete sta indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (sta && (tmp->sta->sta_index == rsp->sta_id)) {
+                        sta = container_of((void *)tmp->sta,
+                                                 struct ieee80211_sta,
+                                                 drv_priv);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                                    "delete station indication %pM index %d\n",
+                                    rsp->addr2,
+                                    rsp->sta_id);
+                        ieee80211_report_low_ack(sta, 0);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("STA with addr %pM and index %d not found\n",
+                     rsp->addr2,
+                     rsp->sta_id);
+        return -ENOENT;
+}
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value)
+{
+        struct wcn36xx_hal_update_cfg_req_msg msg_body, *body;
+        size_t len;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_CFG_REQ);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        body = (struct wcn36xx_hal_update_cfg_req_msg *) wcn->hal_buf;
+        len = msg_body.header.len;
+
+        put_cfg_tlv_u32(wcn, &len, cfg_id, value);
+        body->header.len = len;
+        body->len = len - sizeof(*body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_cfg failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_cfg response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_msg_header *msg_header = buf;
+        struct wcn36xx_hal_ind_msg *msg_ind;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len);
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_START_RSP:
+        case WCN36XX_HAL_CONFIG_STA_RSP:
+        case WCN36XX_HAL_CONFIG_BSS_RSP:
+        case WCN36XX_HAL_ADD_STA_SELF_RSP:
+        case WCN36XX_HAL_STOP_RSP:
+        case WCN36XX_HAL_DEL_STA_SELF_RSP:
+        case WCN36XX_HAL_DELETE_STA_RSP:
+        case WCN36XX_HAL_INIT_SCAN_RSP:
+        case WCN36XX_HAL_START_SCAN_RSP:
+        case WCN36XX_HAL_END_SCAN_RSP:
+        case WCN36XX_HAL_FINISH_SCAN_RSP:
+        case WCN36XX_HAL_DOWNLOAD_NV_RSP:
+        case WCN36XX_HAL_DELETE_BSS_RSP:
+        case WCN36XX_HAL_SEND_BEACON_RSP:
+        case WCN36XX_HAL_SET_LINK_ST_RSP:
+        case WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP:
+        case WCN36XX_HAL_SET_BSSKEY_RSP:
+        case WCN36XX_HAL_SET_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_BSSKEY_RSP:
+        case WCN36XX_HAL_ENTER_BMPS_RSP:
+        case WCN36XX_HAL_SET_POWER_PARAMS_RSP:
+        case WCN36XX_HAL_EXIT_BMPS_RSP:
+        case WCN36XX_HAL_KEEP_ALIVE_RSP:
+        case WCN36XX_HAL_DUMP_COMMAND_RSP:
+        case WCN36XX_HAL_ADD_BA_SESSION_RSP:
+        case WCN36XX_HAL_ADD_BA_RSP:
+        case WCN36XX_HAL_DEL_BA_RSP:
+        case WCN36XX_HAL_TRIGGER_BA_RSP:
+        case WCN36XX_HAL_UPDATE_CFG_RSP:
+        case WCN36XX_HAL_JOIN_RSP:
+        case WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP:
+        case WCN36XX_HAL_CH_SWITCH_RSP:
+        case WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP:
+                memcpy(wcn->hal_buf, buf, len);
+                wcn->hal_rsp_len = len;
+                complete(&wcn->hal_rsp_compl);
+                break;
+
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                mutex_lock(&wcn->hal_ind_mutex);
+                msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
+                msg_ind->msg_len = len;
+                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                memcpy(msg_ind->msg, buf, len);
+                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                mutex_unlock(&wcn->hal_ind_mutex);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+}
+static void wcn36xx_ind_smd_work(struct work_struct *work)
+{
+        struct wcn36xx *wcn =
+                container_of(work, struct wcn36xx, hal_ind_work);
+        struct wcn36xx_hal_msg_header *msg_header;
+        struct wcn36xx_hal_ind_msg *hal_ind_msg;
+
+        mutex_lock(&wcn->hal_ind_mutex);
+
+        hal_ind_msg = list_first_entry(&wcn->hal_ind_queue,
+                                       struct wcn36xx_hal_ind_msg,
+                                       list);
+
+        msg_header = (struct wcn36xx_hal_msg_header *)hal_ind_msg->msg;
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+                wcn36xx_smd_tx_compl_ind(wcn,
+                                         hal_ind_msg->msg,
+                                         hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+                wcn36xx_smd_missed_beacon_ind(wcn,
+                                              hal_ind_msg->msg,
+                                              hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                wcn36xx_smd_delete_sta_context_ind(wcn,
+                                                   hal_ind_msg->msg,
+                                                   hal_ind_msg->msg_len);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+        list_del(wcn->hal_ind_queue.next);
+        kfree(hal_ind_msg->msg);
+        kfree(hal_ind_msg);
+        mutex_unlock(&wcn->hal_ind_mutex);
+}
+int wcn36xx_smd_open(struct wcn36xx *wcn)
+{
+        int ret = 0;
+        wcn->hal_ind_wq = create_freezable_workqueue("wcn36xx_smd_ind");
+        if (!wcn->hal_ind_wq) {
+                wcn36xx_err("failed to allocate wq\n");
+                ret = -ENOMEM;
+                goto out;
+        }
+        INIT_WORK(&wcn->hal_ind_work, wcn36xx_ind_smd_work);
+        INIT_LIST_HEAD(&wcn->hal_ind_queue);
+        mutex_init(&wcn->hal_ind_mutex);
+
+        ret = wcn->ctrl_ops->open(wcn, wcn36xx_smd_rsp_process);
+        if (ret) {
+                wcn36xx_err("failed to open control channel\n");
+                goto free_wq;
+        }
+
+        return ret;
+
+free_wq:
+        destroy_workqueue(wcn->hal_ind_wq);
+out:
+        return ret;
+}
+
+void wcn36xx_smd_close(struct wcn36xx *wcn)
+{
+        wcn->ctrl_ops->close();
+        destroy_workqueue(wcn->hal_ind_wq);
+        mutex_destroy(&wcn->hal_ind_mutex);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.h b/drivers/net/wireless/ath/wcn36xx/smd.h
new file mode 100644
index 000000000000..e7c39019c6f1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _SMD_H_
+#define _SMD_H_
+
+#include "wcn36xx.h"
+
+/* Max shared size is 4k but we take less.*/
+#define WCN36XX_NV_FRAGMENT_SIZE                        3072
+
+#define WCN36XX_HAL_BUF_SIZE                            4096
+
+#define HAL_MSG_TIMEOUT 200
+#define WCN36XX_SMSM_WLAN_TX_ENABLE                     0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY                0x00000200
+/* The PNO version info be contained in the rsp msg */
+#define WCN36XX_FW_MSG_PNO_VERSION_MASK                 0x8000
+
+enum wcn36xx_fw_msg_result {
+        WCN36XX_FW_MSG_RESULT_SUCCESS                   = 0,
+        WCN36XX_FW_MSG_RESULT_SUCCESS_SYNC              = 1,
+
+        WCN36XX_FW_MSG_RESULT_MEM_FAIL                  = 5,
+};
+
+/******************************/
+/* SMD requests and responses */
+/******************************/
+struct wcn36xx_fw_msg_status_rsp {
+        u32     status;
+} __packed;
+
+struct wcn36xx_hal_ind_msg {
+        struct list_head list;
+        u8 *msg;
+        size_t msg_len;
+};
+
+struct wcn36xx;
+
+int wcn36xx_smd_open(struct wcn36xx *wcn);
+void wcn36xx_smd_close(struct wcn36xx *wcn);
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn);
+int wcn36xx_smd_start(struct wcn36xx *wcn);
+int wcn36xx_smd_stop(struct wcn36xx *wcn);
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn);
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr);
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index);
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch);
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state);
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update);
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta);
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off);
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch);
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb);
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index);
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key);
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index);
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx);
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim);
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type);
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5);
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn);
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index);
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn);
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index);
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index);
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value);
+#endif  /* _SMD_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
new file mode 100644
index 000000000000..b2b60e30caaf
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "txrx.h"
+
+static inline int get_rssi0(struct wcn36xx_rx_bd *bd)
+{
+        return 100 - ((bd->phy_stat0 >> 24) & 0xff);
+}
+
+int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
+{
+        struct ieee80211_rx_status status;
+        struct ieee80211_hdr *hdr;
+        struct wcn36xx_rx_bd *bd;
+        u16 fc, sn;
+
+        /*
+         * All fields must be 0, otherwise it can lead to
+         * unexpected consequences.
+         */
+        memset(&status, 0, sizeof(status));
+
+        bd = (struct wcn36xx_rx_bd *)skb->data;
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP,
+                         "BD   <<< ", (char *)bd,
+                         sizeof(struct wcn36xx_rx_bd));
+
+        skb_put(skb, bd->pdu.mpdu_header_off + bd->pdu.mpdu_len);
+        skb_pull(skb, bd->pdu.mpdu_header_off);
+
+        status.mactime = 10;
+        status.freq = WCN36XX_CENTER_FREQ(wcn);
+        status.band = WCN36XX_BAND(wcn);
+        status.signal = -get_rssi0(bd);
+        status.antenna = 1;
+        status.rate_idx = 1;
+        status.flag = 0;
+        status.rx_flags = 0;
+        status.flag |= RX_FLAG_IV_STRIPPED |
+                       RX_FLAG_MMIC_STRIPPED |
+                       RX_FLAG_DECRYPTED;
+
+        wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x status->vendor_radiotap_len=%x\n",
+                    status.flag,  status.vendor_radiotap_len);
+
+        memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = __le16_to_cpu(hdr->frame_control);
+        sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
+
+        if (ieee80211_is_beacon(hdr->frame_control)) {
+                wcn36xx_dbg(WCN36XX_DBG_BEACON, "beacon skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_BEACON_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        } else {
+                wcn36xx_dbg(WCN36XX_DBG_RX, "rx skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        }
+
+        ieee80211_rx_irqsafe(wcn->hw, skb);
+
+        return 0;
+}
+
+static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
+                               u32 mpdu_header_len,
+                               u32 len,
+                               u16 tid)
+{
+        bd->pdu.mpdu_header_len = mpdu_header_len;
+        bd->pdu.mpdu_header_off = sizeof(*bd);
+        bd->pdu.mpdu_data_off = bd->pdu.mpdu_header_len +
+                bd->pdu.mpdu_header_off;
+        bd->pdu.mpdu_len = len;
+        bd->pdu.tid = tid;
+}
+
+static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
+                                                  u8 *addr)
+{
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (memcmp(vif->addr, addr, ETH_ALEN) == 0)
+                                return vif_priv;
+        }
+        wcn36xx_warn("vif %pM not found\n", addr);
+        return NULL;
+}
+static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct wcn36xx_sta *sta_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *__vif_priv = NULL;
+        bd->bd_rate = WCN36XX_BD_RATE_DATA;
+
+        /*
+         * For not unicast frames mac80211 will not set sta pointer so use
+         * self_sta_index instead.
+         */
+        if (sta_priv) {
+                __vif_priv = sta_priv->vif;
+                vif = container_of((void *)__vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        bd->sta_index = sta_priv->bss_sta_index;
+                        bd->dpu_desc_idx = sta_priv->bss_dpu_desc_index;
+                } else if (vif->type == NL80211_IFTYPE_AP ||
+                           vif->type == NL80211_IFTYPE_ADHOC ||
+                           vif->type == NL80211_IFTYPE_MESH_POINT) {
+                        bd->sta_index = sta_priv->sta_index;
+                        bd->dpu_desc_idx = sta_priv->dpu_desc_index;
+                }
+        } else {
+                __vif_priv = get_vif_by_addr(wcn, hdr->addr2);
+                bd->sta_index = __vif_priv->self_sta_index;
+                bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        }
+
+        bd->dpu_sign = __vif_priv->ucast_dpu_signature;
+
+        if (ieee80211_is_nullfunc(hdr->frame_control) ||
+           (sta_priv && !sta_priv->is_data_encrypted))
+                bd->dpu_ne = 1;
+
+        if (bcast) {
+                bd->ub = 1;
+                bd->ack_policy = 1;
+        }
+        *vif_priv = __vif_priv;
+}
+
+static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct wcn36xx_vif *__vif_priv =
+                get_vif_by_addr(wcn, hdr->addr2);
+        bd->sta_index = __vif_priv->self_sta_index;
+        bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        bd->dpu_ne = 1;
+
+        /* default rate for unicast */
+        if (ieee80211_is_mgmt(hdr->frame_control))
+                bd->bd_rate = (WCN36XX_BAND(wcn) == IEEE80211_BAND_5GHZ) ?
+                        WCN36XX_BD_RATE_CTRL :
+                        WCN36XX_BD_RATE_MGMT;
+        else if (ieee80211_is_ctl(hdr->frame_control))
+                bd->bd_rate = WCN36XX_BD_RATE_CTRL;
+        else
+                wcn36xx_warn("frame control type unknown\n");
+
+        /*
+         * In joining state trick hardware that probe is sent as
+         * unicast even if address is broadcast.
+         */
+        if (__vif_priv->is_joining &&
+            ieee80211_is_probe_req(hdr->frame_control))
+                bcast = false;
+
+        if (bcast) {
+                /* broadcast */
+                bd->ub = 1;
+                /* No ack needed not unicast */
+                bd->ack_policy = 1;
+                bd->queue_id = WCN36XX_TX_B_WQ_ID;
+        } else
+                bd->queue_id = WCN36XX_TX_U_WQ_ID;
+        *vif_priv = __vif_priv;
+}
+
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        unsigned long flags;
+        bool is_low = ieee80211_is_data(hdr->frame_control);
+        bool bcast = is_broadcast_ether_addr(hdr->addr1) ||
+                is_multicast_ether_addr(hdr->addr1);
+        struct wcn36xx_tx_bd *bd = wcn36xx_dxe_get_next_bd(wcn, is_low);
+
+        if (!bd) {
+                /*
+                 * TX DXE are used in pairs. One for the BD and one for the
+                 * actual frame. The BD DXE's has a preallocated buffer while
+                 * the skb ones does not. If this isn't true something is really
+                 * wierd. TODO: Recover from this situation
+                 */
+
+                wcn36xx_err("bd address may not be NULL for BD DXE\n");
+                return -EINVAL;
+        }
+
+        memset(bd, 0, sizeof(*bd));
+
+        wcn36xx_dbg(WCN36XX_DBG_TX,
+                    "tx skb %p len %d fc %04x sn %d %s %s\n",
+                    skb, skb->len, __le16_to_cpu(hdr->frame_control),
+                    IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl)),
+                    is_low ? "low" : "high", bcast ? "bcast" : "ucast");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_TX_DUMP, "", skb->data, skb->len);
+
+        bd->dpu_rf = WCN36XX_BMU_WQ_TX;
+
+        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        if (bd->tx_comp) {
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
+                spin_lock_irqsave(&wcn->dxe_lock, flags);
+                if (wcn->tx_ack_skb) {
+                        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+                        wcn36xx_warn("tx_ack_skb already set\n");
+                        return -EINVAL;
+                }
+
+                wcn->tx_ack_skb = skb;
+                spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+                /* Only one at a time is supported by fw. Stop the TX queues
+                 * until the ack status gets back.
+                 *
+                 * TODO: Add watchdog in case FW does not answer
+                 */
+                ieee80211_stop_queues(wcn->hw);
+        }
+
+        /* Data frames served first*/
+        if (is_low) {
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+        } else {
+                /* MGMT and CTRL frames are handeld here*/
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
+        }
+
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        bd->tx_bd_sign = 0xbdbdbdbd;
+
+        return wcn36xx_dxe_tx_frame(wcn, vif_priv, skb, is_low);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
new file mode 100644
index 000000000000..bbfbcf808c77
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _TXRX_H_
+#define _TXRX_H_
+
+#include <linux/etherdevice.h>
+#include "wcn36xx.h"
+
+/* TODO describe all properties */
+#define WCN36XX_802_11_HEADER_LEN       24
+#define WCN36XX_BMU_WQ_TX               25
+#define WCN36XX_TID                     7
+/* broadcast wq ID */
+#define WCN36XX_TX_B_WQ_ID              0xA
+#define WCN36XX_TX_U_WQ_ID              0x9
+/* bd_rate */
+#define WCN36XX_BD_RATE_DATA 0
+#define WCN36XX_BD_RATE_MGMT 2
+#define WCN36XX_BD_RATE_CTRL 3
+
+struct wcn36xx_pdu {
+        u32     dpu_fb:8;
+        u32     adu_fb:8;
+        u32     pdu_id:16;
+
+        /* 0x04*/
+        u32     tail_pdu_idx:16;
+        u32     head_pdu_idx:16;
+
+        /* 0x08*/
+        u32     pdu_count:7;
+        u32     mpdu_data_off:9;
+        u32     mpdu_header_off:8;
+        u32     mpdu_header_len:8;
+
+        /* 0x0c*/
+        u32     reserved4:8;
+        u32     tid:4;
+        u32     reserved3:4;
+        u32     mpdu_len:16;
+};
+
+struct wcn36xx_rx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     rx_key_id:3;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     uma_bypass:1;
+        u32     csr11:1;
+        u32     reserved0:1;
+        u32     scan_learn:1;
+        u32     rx_ch:4;
+        u32     rtsf:1;
+        u32     bsf:1;
+        u32     a2hf:1;
+        u32     st_auf:1;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     addr3:8;
+        u32     addr2:8;
+        u32     addr1:8;
+        u32     dpu_desc_idx:8;
+
+        /* 0x18*/
+        u32     rxp_flags:23;
+        u32     rate_id:9;
+
+        u32     phy_stat0;
+        u32     phy_stat1;
+
+        /* 0x24 */
+        u32     rx_times;
+
+        u32     pmi_cmd[6];
+
+        /* 0x40 */
+        u32     reserved7:4;
+        u32     reorder_slot_id:6;
+        u32     reorder_fwd_id:6;
+        u32     reserved6:12;
+        u32     reorder_code:4;
+
+        /* 0x44 */
+        u32     exp_seq_num:12;
+        u32     cur_seq_num:12;
+        u32     fr_type_subtype:8;
+
+        /* 0x48 */
+        u32     msdu_size:16;
+        u32     sub_fr_id:4;
+        u32     proc_order:4;
+        u32     reserved9:4;
+        u32     aef:1;
+        u32     lsf:1;
+        u32     esf:1;
+        u32     asf:1;
+};
+
+struct wcn36xx_tx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     fw_tx_comp:1;
+        u32     tx_comp:1;
+        u32     reserved1:1;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     reserved0:12;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     reserved5:7;
+        u32     queue_id:5;
+        u32     bd_rate:2;
+        u32     ack_policy:2;
+        u32     sta_index:8;
+        u32     dpu_desc_idx:8;
+
+        u32     tx_bd_sign;
+        u32     reserved6;
+        u32     dxe_start_time;
+        u32     dxe_end_time;
+
+        /*u32   tcp_udp_start_off:10;
+        u32     header_cks:16;
+        u32     reserved7:6;*/
+};
+
+struct wcn36xx_sta;
+struct wcn36xx;
+
+int  wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb);
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb);
+
+#endif  /* _TXRX_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
new file mode 100644
index 000000000000..58b63833e8e7
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_H_
+#define _WCN36XX_H_
+
+#include <linux/completion.h>
+#include <linux/printk.h>
+#include <linux/spinlock.h>
+#include <net/mac80211.h>
+
+#include "hal.h"
+#include "smd.h"
+#include "txrx.h"
+#include "dxe.h"
+#include "pmc.h"
+#include "debug.h"
+
+#define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
+#define WCN36XX_AGGR_BUFFER_SIZE 64
+
+extern unsigned int wcn36xx_dbg_mask;
+
+enum wcn36xx_debug_mask {
+        WCN36XX_DBG_DXE         = 0x00000001,
+        WCN36XX_DBG_DXE_DUMP    = 0x00000002,
+        WCN36XX_DBG_SMD         = 0x00000004,
+        WCN36XX_DBG_SMD_DUMP    = 0x00000008,
+        WCN36XX_DBG_RX          = 0x00000010,
+        WCN36XX_DBG_RX_DUMP     = 0x00000020,
+        WCN36XX_DBG_TX          = 0x00000040,
+        WCN36XX_DBG_TX_DUMP     = 0x00000080,
+        WCN36XX_DBG_HAL         = 0x00000100,
+        WCN36XX_DBG_HAL_DUMP    = 0x00000200,
+        WCN36XX_DBG_MAC         = 0x00000400,
+        WCN36XX_DBG_BEACON      = 0x00000800,
+        WCN36XX_DBG_BEACON_DUMP = 0x00001000,
+        WCN36XX_DBG_PMC         = 0x00002000,
+        WCN36XX_DBG_PMC_DUMP    = 0x00004000,
+        WCN36XX_DBG_ANY         = 0xffffffff,
+};
+
+#define wcn36xx_err(fmt, arg...)                                \
+        printk(KERN_ERR pr_fmt("ERROR " fmt), ##arg);
+
+#define wcn36xx_warn(fmt, arg...)                               \
+        printk(KERN_WARNING pr_fmt("WARNING " fmt), ##arg)
+
+#define wcn36xx_info(fmt, arg...)               \
+        printk(KERN_INFO pr_fmt(fmt), ##arg)
+
+#define wcn36xx_dbg(mask, fmt, arg...) do {                     \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                printk(KERN_DEBUG pr_fmt(fmt), ##arg);  \
+} while (0)
+
+#define wcn36xx_dbg_dump(mask, prefix_str, buf, len) do {       \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                print_hex_dump(KERN_DEBUG, pr_fmt(prefix_str),  \
+                               DUMP_PREFIX_OFFSET, 32, 1,       \
+                               buf, len, false);                \
+} while (0)
+
+#define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
+#define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
+#define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
+#define WCN36XX_LISTEN_INTERVAL(__wcn) (__wcn->hw->conf.listen_interval)
+#define WCN36XX_FLAGS(__wcn) (__wcn->hw->flags)
+#define WCN36XX_MAX_POWER(__wcn) (__wcn->hw->conf.chandef.chan->max_power)
+
+static inline void buff_to_be(u32 *buf, size_t len)
+{
+        int i;
+        for (i = 0; i < len; i++)
+                buf[i] = cpu_to_be32(buf[i]);
+}
+
+struct nv_data {
+        int     is_valid;
+        u8      table;
+};
+
+/* Interface for platform control path
+ *
+ * @open: hook must be called when wcn36xx wants to open control channel.
+ * @tx: sends a buffer.
+ */
+struct wcn36xx_platform_ctrl_ops {
+        int (*open)(void *drv_priv, void *rsp_cb);
+        void (*close)(void);
+        int (*tx)(char *buf, size_t len);
+        int (*get_hw_mac)(u8 *addr);
+        int (*smsm_change_state)(u32 clear_mask, u32 set_mask);
+};
+
+/**
+ * struct wcn36xx_vif - holds VIF related fields
+ *
+ * @bss_index: bss_index is initially set to 0xFF. bss_index is received from
+ * HW after first config_bss call and must be used in delete_bss and
+ * enter/exit_bmps.
+ */
+struct wcn36xx_vif {
+        struct list_head list;
+        struct wcn36xx_sta *sta;
+        u8 dtim_period;
+        enum ani_ed_type encrypt_type;
+        bool is_joining;
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Power management */
+        enum wcn36xx_power_state pw_state;
+
+        u8 bss_index;
+        u8 ucast_dpu_signature;
+        /* Returned from WCN36XX_HAL_ADD_STA_SELF_RSP */
+        u8 self_sta_index;
+        u8 self_dpu_desc_index;
+};
+
+/**
+ * struct wcn36xx_sta - holds STA related fields
+ *
+ * @tid: traffic ID that is used during AMPDU and in TX BD.
+ * @sta_index: STA index is returned from HW after config_sta call and is
+ * used in both SMD channel and TX BD.
+ * @dpu_desc_index: DPU descriptor index is returned from HW after config_sta
+ * call and is used in TX BD.
+ * @bss_sta_index: STA index is returned from HW after config_bss call and is
+ * used in both SMD channel and TX BD. See table bellow when it is used.
+ * @bss_dpu_desc_index: DPU descriptor index is returned from HW after
+ * config_bss call and is used in TX BD.
+ * ______________________________________________
+ * |              |     STA     |       AP      |
+ * |______________|_____________|_______________|
+ * |    TX BD     |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |all SMD calls |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |smd_delete_sta|  sta_index  |   sta_index   |
+ * |______________|_____________|_______________|
+ */
+struct wcn36xx_sta {
+        struct wcn36xx_vif *vif;
+        u16 aid;
+        u16 tid;
+        u8 sta_index;
+        u8 dpu_desc_index;
+        u8 bss_sta_index;
+        u8 bss_dpu_desc_index;
+        bool is_data_encrypted;
+        /* Rates */
+        struct wcn36xx_hal_supported_rates supported_rates;
+};
+struct wcn36xx_dxe_ch;
+struct wcn36xx {
+        struct ieee80211_hw     *hw;
+        struct device           *dev;
+        struct list_head        vif_list;
+
+        u8                      fw_revision;
+        u8                      fw_version;
+        u8                      fw_minor;
+        u8                      fw_major;
+
+        /* extra byte for the NULL termination */
+        u8                      crm_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+        u8                      wlan_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+
+        /* IRQs */
+        int                     tx_irq;
+        int                     rx_irq;
+        void __iomem            *mmio;
+
+        struct wcn36xx_platform_ctrl_ops *ctrl_ops;
+        /*
+         * smd_buf must be protected with smd_mutex to garantee
+         * that all messages are sent one after another
+         */
+        u8                      *hal_buf;
+        size_t                  hal_rsp_len;
+        struct mutex            hal_mutex;
+        struct completion       hal_rsp_compl;
+        struct workqueue_struct *hal_ind_wq;
+        struct work_struct      hal_ind_work;
+        struct mutex            hal_ind_mutex;
+        struct list_head        hal_ind_queue;
+
+        /* DXE channels */
+        struct wcn36xx_dxe_ch   dxe_tx_l_ch;    /* TX low */
+        struct wcn36xx_dxe_ch   dxe_tx_h_ch;    /* TX high */
+        struct wcn36xx_dxe_ch   dxe_rx_l_ch;    /* RX low */
+        struct wcn36xx_dxe_ch   dxe_rx_h_ch;    /* RX high */
+
+        /* For synchronization of DXE resources from BH, IRQ and WQ contexts */
+        spinlock_t      dxe_lock;
+        bool                    queues_stopped;
+
+        /* Memory pools */
+        struct wcn36xx_dxe_mem_pool mgmt_mem_pool;
+        struct wcn36xx_dxe_mem_pool data_mem_pool;
+
+        struct sk_buff          *tx_ack_skb;
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+        /* Debug file system entry */
+        struct wcn36xx_dfs_entry    dfs;
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+};
+
+static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
+                                         u8 major,
+                                         u8 minor,
+                                         u8 version,
+                                         u8 revision)
+{
+        return (wcn->fw_major == major &&
+                wcn->fw_minor == minor &&
+                wcn->fw_version == version &&
+                wcn->fw_revision == revision);
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
+
+#endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 61c302a6bdea..5b340769d5bb 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -316,8 +316,8 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         }
         conn.channel = ch - 1;
 
-        memcpy(conn.bssid, bss->bssid, 6);
-        memcpy(conn.dst_mac, bss->bssid, 6);
+        memcpy(conn.bssid, bss->bssid, ETH_ALEN);
+        memcpy(conn.dst_mac, bss->bssid, ETH_ALEN);
         /*
          * FW don't support scan after connection attempt
          */
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index eb1dc7ad80fb..eeceab39cda2 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -197,7 +197,6 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_iounmap(pdev, wil->csr);
         pci_release_region(pdev, 0);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index b827d51c30a3..a55ae6494c3b 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -844,18 +844,18 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
         if (priv->wep_is_on)
                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
         if (priv->operating_mode == IW_MODE_ADHOC) {
-                skb_copy_from_linear_data(skb, &header.addr1, 6);
-                memcpy(&header.addr2, dev->dev_addr, 6);
-                memcpy(&header.addr3, priv->BSSID, 6);
+                skb_copy_from_linear_data(skb, &header.addr1, ETH_ALEN);
+                memcpy(&header.addr2, dev->dev_addr, ETH_ALEN);
+                memcpy(&header.addr3, priv->BSSID, ETH_ALEN);
         } else {
                 frame_ctl |= IEEE80211_FCTL_TODS;
-                memcpy(&header.addr1, priv->CurrentBSSID, 6);
-                memcpy(&header.addr2, dev->dev_addr, 6);
-                skb_copy_from_linear_data(skb, &header.addr3, 6);
+                memcpy(&header.addr1, priv->CurrentBSSID, ETH_ALEN);
+                memcpy(&header.addr2, dev->dev_addr, ETH_ALEN);
+                skb_copy_from_linear_data(skb, &header.addr3, ETH_ALEN);
         }
 
         if (priv->use_wpa)
-                memcpy(&header.addr4, SNAP_RFC1024, 6);
+                memcpy(&header.addr4, SNAP_RFC1024, ETH_ALEN);
 
         header.frame_control = cpu_to_le16(frame_ctl);
         /* Copy the wireless header into the card */
@@ -929,11 +929,11 @@ static void fast_rx_path(struct atmel_private *priv,
                 }
         }
 
-        memcpy(skbp, header->addr1, 6); /* destination address */
+        memcpy(skbp, header->addr1, ETH_ALEN); /* destination address */
         if (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FROMDS)
-                memcpy(&skbp[6], header->addr3, 6);
+                memcpy(&skbp[ETH_ALEN], header->addr3, ETH_ALEN);
         else
-                memcpy(&skbp[6], header->addr2, 6); /* source address */
+                memcpy(&skbp[ETH_ALEN], header->addr2, ETH_ALEN); /* source address */
 
         skb->protocol = eth_type_trans(skb, priv->dev);
         skb->ip_summed = CHECKSUM_NONE;
@@ -969,14 +969,14 @@ static void frag_rx_path(struct atmel_private *priv,
                          u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
                          u8 frag_no, int more_frags)
 {
-        u8 mac4[6];
-        u8 source[6];
+        u8 mac4[ETH_ALEN];
+        u8 source[ETH_ALEN];
         struct sk_buff *skb;
 
         if (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FROMDS)
-                memcpy(source, header->addr3, 6);
+                memcpy(source, header->addr3, ETH_ALEN);
         else
-                memcpy(source, header->addr2, 6);
+                memcpy(source, header->addr2, ETH_ALEN);
 
         rx_packet_loc += 24; /* skip header */
 
@@ -984,9 +984,9 @@ static void frag_rx_path(struct atmel_private *priv,
                 msdu_size -= 4;
 
         if (frag_no == 0) { /* first fragment */
-                atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
-                msdu_size -= 6;
-                rx_packet_loc += 6;
+                atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, ETH_ALEN);
+                msdu_size -= ETH_ALEN;
+                rx_packet_loc += ETH_ALEN;
 
                 if (priv->do_rx_crc)
                         crc = crc32_le(crc, mac4, 6);
@@ -994,9 +994,9 @@ static void frag_rx_path(struct atmel_private *priv,
                 priv->frag_seq = seq_no;
                 priv->frag_no = 1;
                 priv->frag_len = msdu_size;
-                memcpy(priv->frag_source, source, 6);
-                memcpy(&priv->rx_buf[6], source, 6);
-                memcpy(priv->rx_buf, header->addr1, 6);
+                memcpy(priv->frag_source, source, ETH_ALEN);
+                memcpy(&priv->rx_buf[ETH_ALEN], source, ETH_ALEN);
+                memcpy(priv->rx_buf, header->addr1, ETH_ALEN);
 
                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
 
@@ -1006,13 +1006,13 @@ static void frag_rx_path(struct atmel_private *priv,
                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
                         if ((crc ^ 0xffffffff) != netcrc) {
                                 priv->dev->stats.rx_crc_errors++;
-                                memset(priv->frag_source, 0xff, 6);
+                                memset(priv->frag_source, 0xff, ETH_ALEN);
                         }
                 }
 
         } else if (priv->frag_no == frag_no &&
                    priv->frag_seq == seq_no &&
-                   memcmp(priv->frag_source, source, 6) == 0) {
+                   memcmp(priv->frag_source, source, ETH_ALEN) == 0) {
 
                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
                                    rx_packet_loc, msdu_size);
@@ -1024,7 +1024,7 @@ static void frag_rx_path(struct atmel_private *priv,
                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
                         if ((crc ^ 0xffffffff) != netcrc) {
                                 priv->dev->stats.rx_crc_errors++;
-                                memset(priv->frag_source, 0xff, 6);
+                                memset(priv->frag_source, 0xff, ETH_ALEN);
                                 more_frags = 1; /* don't send broken assembly */
                         }
                 }
@@ -1033,7 +1033,7 @@ static void frag_rx_path(struct atmel_private *priv,
                 priv->frag_no++;
 
                 if (!more_frags) { /* last one */
-                        memset(priv->frag_source, 0xff, 6);
+                        memset(priv->frag_source, 0xff, ETH_ALEN);
                         if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
                                 priv->dev->stats.rx_dropped++;
                         } else {
@@ -1129,7 +1129,7 @@ static void rx_done_irq(struct atmel_private *priv)
                         atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
 
                         /* we use the same buffer for frag reassembly and control packets */
-                        memset(priv->frag_source, 0xff, 6);
+                        memset(priv->frag_source, 0xff, ETH_ALEN);
 
                         if (priv->do_rx_crc) {
                                 /* last 4 octets is crc */
@@ -1557,7 +1557,7 @@ struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
         priv->last_qual = jiffies;
         priv->last_beacon_timestamp = 0;
         memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
-        memset(priv->BSSID, 0, 6);
+        memset(priv->BSSID, 0, ETH_ALEN);
         priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
         priv->station_was_associated = 0;
 
@@ -1718,7 +1718,7 @@ static int atmel_get_wap(struct net_device *dev,
                          char *extra)
 {
         struct atmel_private *priv = netdev_priv(dev);
-        memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
+        memcpy(awrq->sa_data, priv->CurrentBSSID, ETH_ALEN);
         awrq->sa_family = ARPHRD_ETHER;
 
         return 0;
@@ -2356,7 +2356,7 @@ static int atmel_get_scan(struct net_device *dev,
         for (i = 0; i < priv->BSS_list_entries; i++) {
                 iwe.cmd = SIOCGIWAP;
                 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-                memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
+                memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, ETH_ALEN);
                 current_ev = iwe_stream_add_event(info, current_ev,
                                                   extra + IW_SCAN_MAX_DATA,
                                                   &iwe, IW_EV_ADDR_LEN);
@@ -2760,7 +2760,7 @@ static void atmel_enter_state(struct atmel_private *priv, int new_state)
 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
 {
         struct {
-                u8 BSSID[6];
+                u8 BSSID[ETH_ALEN];
                 u8 SSID[MAX_SSID_LENGTH];
                 u8 scan_type;
                 u8 channel;
@@ -2771,7 +2771,7 @@ static void atmel_scan(struct atmel_private *priv, int specific_ssid)
                 u8 SSID_size;
         } cmd;
 
-        memset(cmd.BSSID, 0xff, 6);
+        memset(cmd.BSSID, 0xff, ETH_ALEN);
 
         if (priv->fast_scan) {
                 cmd.SSID_size = priv->SSID_size;
@@ -2816,7 +2816,7 @@ static void join(struct atmel_private *priv, int type)
 
         cmd.SSID_size = priv->SSID_size;
         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
-        memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
+        memcpy(cmd.BSSID, priv->CurrentBSSID, ETH_ALEN);
         cmd.channel = (priv->channel & 0x7f);
         cmd.BSS_type = type;
         cmd.timeout = cpu_to_le16(2000);
@@ -2837,7 +2837,7 @@ static void start(struct atmel_private *priv, int type)
 
         cmd.SSID_size = priv->SSID_size;
         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
-        memcpy(cmd.BSSID, priv->BSSID, 6);
+        memcpy(cmd.BSSID, priv->BSSID, ETH_ALEN);
         cmd.BSS_type = type;
         cmd.channel = (priv->channel & 0x7f);
 
@@ -2883,9 +2883,9 @@ static void send_authentication_request(struct atmel_private *priv, u16 system,
         header.frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
         header.duration_id = cpu_to_le16(0x8000);
         header.seq_ctrl = 0;
-        memcpy(header.addr1, priv->CurrentBSSID, 6);
-        memcpy(header.addr2, priv->dev->dev_addr, 6);
-        memcpy(header.addr3, priv->CurrentBSSID, 6);
+        memcpy(header.addr1, priv->CurrentBSSID, ETH_ALEN);
+        memcpy(header.addr2, priv->dev->dev_addr, ETH_ALEN);
+        memcpy(header.addr3, priv->CurrentBSSID, ETH_ALEN);
 
         if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
                 /* no WEP for authentication frames with TrSeqNo 1 */
@@ -2916,7 +2916,7 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
         struct ass_req_format {
                 __le16 capability;
                 __le16 listen_interval;
-                u8 ap[6]; /* nothing after here directly accessible */
+                u8 ap[ETH_ALEN]; /* nothing after here directly accessible */
                 u8 ssid_el_id;
                 u8 ssid_len;
                 u8 ssid[MAX_SSID_LENGTH];
@@ -2930,9 +2930,9 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
         header.duration_id = cpu_to_le16(0x8000);
         header.seq_ctrl = 0;
 
-        memcpy(header.addr1, priv->CurrentBSSID, 6);
-        memcpy(header.addr2, priv->dev->dev_addr, 6);
-        memcpy(header.addr3, priv->CurrentBSSID, 6);
+        memcpy(header.addr1, priv->CurrentBSSID, ETH_ALEN);
+        memcpy(header.addr2, priv->dev->dev_addr, ETH_ALEN);
+        memcpy(header.addr3, priv->CurrentBSSID, ETH_ALEN);
 
         body.capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
         if (priv->wep_is_on)
@@ -2944,7 +2944,7 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
 
         /* current AP address - only in reassoc frame */
         if (is_reassoc) {
-                memcpy(body.ap, priv->CurrentBSSID, 6);
+                memcpy(body.ap, priv->CurrentBSSID, ETH_ALEN);
                 ssid_el_p = &body.ssid_el_id;
                 bodysize = 18 + priv->SSID_size;
         } else {
@@ -3021,7 +3021,7 @@ static void store_bss_info(struct atmel_private *priv,
         int i, index;
 
         for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
-                if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0)
+                if (memcmp(bss, priv->BSSinfo[i].BSSID, ETH_ALEN) == 0)
                         index = i;
 
         /* If we process a probe and an entry from this BSS exists
@@ -3032,7 +3032,7 @@ static void store_bss_info(struct atmel_private *priv,
                 if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
                         return;
                 index = priv->BSS_list_entries++;
-                memcpy(priv->BSSinfo[index].BSSID, bss, 6);
+                memcpy(priv->BSSinfo[index].BSSID, bss, ETH_ALEN);
                 priv->BSSinfo[index].RSSI = rssi;
         } else {
                 if (rssi > priv->BSSinfo[index].RSSI)
@@ -3235,7 +3235,7 @@ static void atmel_join_bss(struct atmel_private *priv, int bss_index)
 {
         struct bss_info *bss =  &priv->BSSinfo[bss_index];
 
-        memcpy(priv->CurrentBSSID, bss->BSSID, 6);
+        memcpy(priv->CurrentBSSID, bss->BSSID, ETH_ALEN);
         memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
 
         /* The WPA stuff cares about the current AP address */
@@ -3767,7 +3767,7 @@ static int probe_atmel_card(struct net_device *dev)
                                 0x00, 0x04, 0x25, 0x00, 0x00, 0x00
                         };
                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
-                        memcpy(dev->dev_addr, default_mac, 6);
+                        memcpy(dev->dev_addr, default_mac, ETH_ALEN);
                 }
         }
 
@@ -3819,7 +3819,7 @@ static void build_wpa_mib(struct atmel_private *priv)
 
         struct { /* NB this is matched to the hardware, don't change. */
                 u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
-                u8 receiver_address[6];
+                u8 receiver_address[ETH_ALEN];
                 u8 wep_is_on;
                 u8 default_key; /* 0..3 */
                 u8 group_key;
@@ -3837,7 +3837,7 @@ static void build_wpa_mib(struct atmel_private *priv)
 
         mib.wep_is_on = priv->wep_is_on;
         mib.exclude_unencrypted = priv->exclude_unencrypted;
-        memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
+        memcpy(mib.receiver_address, priv->CurrentBSSID, ETH_ALEN);
 
         /* zero all the keys before adding in valid ones. */
         memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 8cb206a89083..4ae63f4ddfb2 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -278,7 +278,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
         else
                 txhdr->phy_rate = b43_plcp_get_ratecode_cck(rate);
         txhdr->mac_frame_ctl = wlhdr->frame_control;
-        memcpy(txhdr->tx_receiver, wlhdr->addr1, 6);
+        memcpy(txhdr->tx_receiver, wlhdr->addr1, ETH_ALEN);
 
         /* Calculate duration for fallback rate */
         if ((rate_fb == rate) ||
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index 849a28c80302..86588c9ff0f2 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -215,7 +215,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
         rate_fb_ofdm = b43legacy_is_ofdm_rate(rate_fb->hw_value);
 
         txhdr->mac_frame_ctl = wlhdr->frame_control;
-        memcpy(txhdr->tx_receiver, wlhdr->addr1, 6);
+        memcpy(txhdr->tx_receiver, wlhdr->addr1, ETH_ALEN);
 
         /* Calculate duration for fallback rate */
         if ((rate_fb->hw_value == rate) ||
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index c3462b75bd08..2a23bf2b904d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -34,6 +34,7 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 #include "sdio_host.h"
+#include "sdio_chip.h"
 #include "dhd_dbg.h"
 #include "dhd_bus.h"
 
@@ -41,13 +42,6 @@
 
 #define DMA_ALIGN_MASK  0x03
 
-#define SDIO_DEVICE_ID_BROADCOM_43143   43143
-#define SDIO_DEVICE_ID_BROADCOM_43241   0x4324
-#define SDIO_DEVICE_ID_BROADCOM_4329    0x4329
-#define SDIO_DEVICE_ID_BROADCOM_4330    0x4330
-#define SDIO_DEVICE_ID_BROADCOM_4334    0x4334
-#define SDIO_DEVICE_ID_BROADCOM_4335    0x4335
-
 #define SDIO_FUNC1_BLOCKSIZE            64
 #define SDIO_FUNC2_BLOCKSIZE            512
 
@@ -58,7 +52,8 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4335)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
+                     SDIO_DEVICE_ID_BROADCOM_4335_4339)},
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
@@ -466,7 +461,7 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
         brcmf_dbg(SDIO, "Enter\n");
 
-        brcmfmac_sdio_pdata = pdev->dev.platform_data;
+        brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
 
         if (brcmfmac_sdio_pdata->power_on)
                 brcmfmac_sdio_pdata->power_on();
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 2eb9e642c9bf..899a2ada5b82 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -97,8 +97,6 @@
 #define WLC_PHY_TYPE_LCN        8
 #define WLC_PHY_TYPE_NULL       0xf
 
-#define BRCMF_EVENTING_MASK_LEN 16
-
 #define TOE_TX_CSUM_OL          0x00000001
 #define TOE_RX_CSUM_OL          0x00000002
 
@@ -632,29 +630,29 @@ struct brcmf_skb_reorder_data {
         u8 *reorder;
 };
 
-extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
+int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 
 /* Return pointer to interface name */
-extern char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
+char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
 
 /* Query dongle */
-extern int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx,
-                                       uint cmd, void *buf, uint len);
-extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
-                                    void *buf, uint len);
+int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                               void *buf, uint len);
+int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                             void *buf, uint len);
 
 /* Remove any protocol-specific data header. */
-extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
-                               struct sk_buff *rxp);
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
+                        struct sk_buff *rxp);
 
-extern int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx,
-                                     s32 ifidx, char *name, u8 *mac_addr);
-extern void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
+int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
+                              char *name, u8 *mac_addr);
+void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
 void brcmf_txflowblock_if(struct brcmf_if *ifp,
                           enum brcmf_netif_stop_reason reason, bool state);
-extern u32 brcmf_get_chip_info(struct brcmf_if *ifp);
-extern void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
-                             bool success);
+u32 brcmf_get_chip_info(struct brcmf_if *ifp);
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+                      bool success);
 
 #endif                          /* _BRCMF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index 74156f84180c..a6eb09e5d46f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -132,35 +132,34 @@ struct pktq *brcmf_bus_gettxq(struct brcmf_bus *bus)
  * interface functions from common layer
  */
 
-extern bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
-                         struct sk_buff *pkt, int prec);
+bool brcmf_c_prec_enq(struct device *dev, struct pktq *q, struct sk_buff *pkt,
+                      int prec);
 
 /* Receive frame for delivery to OS.  Callee disposes of rxp. */
-extern void brcmf_rx_frames(struct device *dev, struct sk_buff_head *rxlist);
+void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
-extern int brcmf_attach(uint bus_hdrlen, struct device *dev);
+int brcmf_attach(uint bus_hdrlen, struct device *dev);
 /* Indication from bus module regarding removal/absence of dongle */
-extern void brcmf_detach(struct device *dev);
+void brcmf_detach(struct device *dev);
 /* Indication from bus module that dongle should be reset */
-extern void brcmf_dev_reset(struct device *dev);
+void brcmf_dev_reset(struct device *dev);
 /* Indication from bus module to change flow-control state */
-extern void brcmf_txflowblock(struct device *dev, bool state);
+void brcmf_txflowblock(struct device *dev, bool state);
 
 /* Notify the bus has transferred the tx packet to firmware */
-extern void brcmf_txcomplete(struct device *dev, struct sk_buff *txp,
-                             bool success);
+void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
-extern int brcmf_bus_start(struct device *dev);
+int brcmf_bus_start(struct device *dev);
 
 #ifdef CONFIG_BRCMFMAC_SDIO
-extern void brcmf_sdio_exit(void);
-extern void brcmf_sdio_init(void);
-extern void brcmf_sdio_register(void);
+void brcmf_sdio_exit(void);
+void brcmf_sdio_init(void);
+void brcmf_sdio_register(void);
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
-extern void brcmf_usb_exit(void);
-extern void brcmf_usb_register(void);
+void brcmf_usb_exit(void);
+void brcmf_usb_register(void);
 #endif
 
 #endif                          /* _BRCMF_BUS_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 40e7f854e10f..64e9cff241b9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -509,9 +509,8 @@ netif_rx:
         }
 }
 
-void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
 {
-        struct sk_buff *skb, *pnext;
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
@@ -519,29 +518,24 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
         u8 ifidx;
         int ret;
 
-        brcmf_dbg(DATA, "Enter: %s: count=%u\n", dev_name(dev),
-                  skb_queue_len(skb_list));
+        brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
 
-        skb_queue_walk_safe(skb_list, skb, pnext) {
-                skb_unlink(skb, skb_list);
-
-                /* process and remove protocol-specific header */
-                ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
-                ifp = drvr->iflist[ifidx];
-
-                if (ret || !ifp || !ifp->ndev) {
-                        if ((ret != -ENODATA) && ifp)
-                                ifp->stats.rx_errors++;
-                        brcmu_pkt_buf_free_skb(skb);
-                        continue;
-                }
+        /* process and remove protocol-specific header */
+        ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
+        ifp = drvr->iflist[ifidx];
 
-                rd = (struct brcmf_skb_reorder_data *)skb->cb;
-                if (rd->reorder)
-                        brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
-                else
-                        brcmf_netif_rx(ifp, skb);
+        if (ret || !ifp || !ifp->ndev) {
+                if ((ret != -ENODATA) && ifp)
+                        ifp->stats.rx_errors++;
+                brcmu_pkt_buf_free_skb(skb);
+                return;
         }
+
+        rd = (struct brcmf_skb_reorder_data *)skb->cb;
+        if (rd->reorder)
+                brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
+        else
+                brcmf_netif_rx(ifp, skb);
 }
 
 void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
index ef9179883748..53c6e710f2cb 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
@@ -22,21 +22,21 @@
  */
 
 /* Linkage, sets prot link and updates hdrlen in pub */
-extern int brcmf_proto_attach(struct brcmf_pub *drvr);
+int brcmf_proto_attach(struct brcmf_pub *drvr);
 
 /* Unlink, frees allocated protocol memory (including brcmf_proto) */
-extern void brcmf_proto_detach(struct brcmf_pub *drvr);
+void brcmf_proto_detach(struct brcmf_pub *drvr);
 
 /* Stop protocol: sync w/dongle state. */
-extern void brcmf_proto_stop(struct brcmf_pub *drvr);
+void brcmf_proto_stop(struct brcmf_pub *drvr);
 
 /* Add any protocol-specific data header.
  * Caller must reserve prot_hdrlen prepend space.
  */
-extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx, u8 offset,
-                                struct sk_buff *txp);
+void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx, u8 offset,
+                         struct sk_buff *txp);
 
 /* Sets dongle media info (drv_version, mac address). */
-extern int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
+int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
 
 #endif                          /* _BRCMF_PROTO_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 1aa75d5951b8..67f05db4b9b8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -275,11 +275,6 @@ struct rte_console {
 /* Flags for SDH calls */
 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 
-#define BRCMF_SDIO_FW_NAME      "brcm/brcmfmac-sdio.bin"
-#define BRCMF_SDIO_NV_NAME      "brcm/brcmfmac-sdio.txt"
-MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
-MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
-
 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
                                          * when idle
@@ -454,9 +449,6 @@ struct brcmf_sdio {
         struct work_struct datawork;
         atomic_t dpc_tskcnt;
 
-        const struct firmware *firmware;
-        u32 fw_ptr;
-
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
         bool sr_enabled; /* SaveRestore enabled */
@@ -493,6 +485,100 @@ enum brcmf_sdio_frmtype {
         BRCMF_SDIO_FT_SUB,
 };
 
+#define BCM43143_FIRMWARE_NAME          "brcm/brcmfmac43143-sdio.bin"
+#define BCM43143_NVRAM_NAME             "brcm/brcmfmac43143-sdio.txt"
+#define BCM43241B0_FIRMWARE_NAME        "brcm/brcmfmac43241b0-sdio.bin"
+#define BCM43241B0_NVRAM_NAME           "brcm/brcmfmac43241b0-sdio.txt"
+#define BCM43241B4_FIRMWARE_NAME        "brcm/brcmfmac43241b4-sdio.bin"
+#define BCM43241B4_NVRAM_NAME           "brcm/brcmfmac43241b4-sdio.txt"
+#define BCM4329_FIRMWARE_NAME           "brcm/brcmfmac4329-sdio.bin"
+#define BCM4329_NVRAM_NAME              "brcm/brcmfmac4329-sdio.txt"
+#define BCM4330_FIRMWARE_NAME           "brcm/brcmfmac4330-sdio.bin"
+#define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
+#define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
+#define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
+#define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
+#define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
+
+MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43241B0_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43241B0_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43241B4_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43241B4_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4329_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4329_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
+
+struct brcmf_firmware_names {
+        u32 chipid;
+        u32 revmsk;
+        const char *bin;
+        const char *nv;
+};
+
+enum brcmf_firmware_type {
+        BRCMF_FIRMWARE_BIN,
+        BRCMF_FIRMWARE_NVRAM
+};
+
+#define BRCMF_FIRMWARE_NVRAM(name) \
+        name ## _FIRMWARE_NAME, name ## _NVRAM_NAME
+
+static const struct brcmf_firmware_names brcmf_fwname_data[] = {
+        { BCM43143_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43143) },
+        { BCM43241_CHIP_ID, 0x0000001F, BRCMF_FIRMWARE_NVRAM(BCM43241B0) },
+        { BCM43241_CHIP_ID, 0xFFFFFFE0, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
+        { BCM4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
+        { BCM4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
+        { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
+        { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) }
+};
+
+
+static const struct firmware *brcmf_sdbrcm_get_fw(struct brcmf_sdio *bus,
+                                                  enum brcmf_firmware_type type)
+{
+        const struct firmware *fw;
+        const char *name;
+        int err, i;
+
+        for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
+                if (brcmf_fwname_data[i].chipid == bus->ci->chip &&
+                    brcmf_fwname_data[i].revmsk & BIT(bus->ci->chiprev)) {
+                        switch (type) {
+                        case BRCMF_FIRMWARE_BIN:
+                                name = brcmf_fwname_data[i].bin;
+                                break;
+                        case BRCMF_FIRMWARE_NVRAM:
+                                name = brcmf_fwname_data[i].nv;
+                                break;
+                        default:
+                                brcmf_err("invalid firmware type (%d)\n", type);
+                                return NULL;
+                        }
+                        goto found;
+                }
+        }
+        brcmf_err("Unknown chipid %d [%d]\n",
+                  bus->ci->chip, bus->ci->chiprev);
+        return NULL;
+
+found:
+        err = request_firmware(&fw, name, &bus->sdiodev->func[2]->dev);
+        if ((err) || (!fw)) {
+                brcmf_err("fail to request firmware %s (%d)\n", name, err);
+                return NULL;
+        }
+
+        return fw;
+}
+
 static void pkt_align(struct sk_buff *p, int len, int align)
 {
         uint datalign;
@@ -1406,13 +1492,12 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                            bus->glom.qlen, pfirst, pfirst->data,
                                            pfirst->len, pfirst->next,
                                            pfirst->prev);
+                        skb_unlink(pfirst, &bus->glom);
+                        brcmf_rx_frame(bus->sdiodev->dev, pfirst);
+                        bus->sdcnt.rxglompkts++;
                 }
-                /* sent any remaining packets up */
-                if (bus->glom.qlen)
-                        brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
 
                 bus->sdcnt.rxglomframes++;
-                bus->sdcnt.rxglompkts += bus->glom.qlen;
         }
         return num;
 }
@@ -1557,7 +1642,6 @@ static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 {
         struct sk_buff *pkt;            /* Packet for event or data frames */
-        struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
         int ret;                /* Return code from calls */
@@ -1759,9 +1843,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         continue;
                 }
 
-                skb_queue_head_init(&pktlist);
-                skb_queue_tail(&pktlist, pkt);
-                brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
+                brcmf_rx_frame(bus->sdiodev->dev, pkt);
         }
 
         rxcount = maxframes - rxleft;
@@ -1786,10 +1868,15 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
         return;
 }
 
+/**
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
 /* flag marking a dummy skb added for DMA alignment requirement */
-#define DUMMY_SKB_FLAG          0x10000
+#define ALIGN_SKB_FLAG          0x8000
 /* bit mask of data length chopped from the previous packet */
-#define DUMMY_SKB_CHOP_LEN_MASK 0xffff
+#define ALIGN_SKB_CHOP_LEN_MASK 0x7fff
+
 /**
  * brcmf_sdio_txpkt_prep - packet preparation for transmit
  * @bus: brcmf_sdio structure pointer
@@ -1854,7 +1941,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                 memcpy(pkt_new->data,
                        pkt_next->data + pkt_next->len - tail_chop,
                        tail_chop);
-                *(u32 *)(pkt_new->cb) = DUMMY_SKB_FLAG + tail_chop;
+                *(u32 *)(pkt_new->cb) = ALIGN_SKB_FLAG + tail_chop;
                 skb_trim(pkt_next, pkt_next->len - tail_chop);
                 __skb_queue_after(pktq, pkt_next, pkt_new);
         } else {
@@ -1908,8 +1995,8 @@ brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
 
         skb_queue_walk_safe(pktq, pkt_next, tmp) {
                 dummy_flags = *(u32 *)(pkt_next->cb);
-                if (dummy_flags & DUMMY_SKB_FLAG) {
-                        chop_len = dummy_flags & DUMMY_SKB_CHOP_LEN_MASK;
+                if (dummy_flags & ALIGN_SKB_FLAG) {
+                        chop_len = dummy_flags & ALIGN_SKB_CHOP_LEN_MASK;
                         if (chop_len) {
                                 pkt_prev = pkt_next->prev;
                                 memcpy(pkt_prev->data + pkt_prev->len,
@@ -3037,69 +3124,43 @@ static bool brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
         return true;
 }
 
-static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
-{
-        if (bus->firmware->size < bus->fw_ptr + len)
-                len = bus->firmware->size - bus->fw_ptr;
-
-        memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
-        bus->fw_ptr += len;
-        return len;
-}
-
 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
 {
+        const struct firmware *fw;
+        int err;
         int offset;
-        uint len;
-        u8 *memblock = NULL, *memptr;
-        int ret;
-        u8 idx;
-
-        brcmf_dbg(INFO, "Enter\n");
-
-        ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
-                               &bus->sdiodev->func[2]->dev);
-        if (ret) {
-                brcmf_err("Fail to request firmware %d\n", ret);
-                return ret;
-        }
-        bus->fw_ptr = 0;
-
-        memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
-        if (memblock == NULL) {
-                ret = -ENOMEM;
-                goto err;
-        }
-        if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
-                memptr += (BRCMF_SDALIGN -
-                           ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
-
-        offset = bus->ci->rambase;
-
-        /* Download image */
-        len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
-        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4);
-        if (BRCMF_MAX_CORENUM != idx)
-                memcpy(&bus->ci->rst_vec, memptr, sizeof(bus->ci->rst_vec));
-        while (len) {
-                ret = brcmf_sdio_ramrw(bus->sdiodev, true, offset, memptr, len);
-                if (ret) {
+        int address;
+        int len;
+
+        fw = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_BIN);
+        if (fw == NULL)
+                return -ENOENT;
+
+        if (brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4) !=
+            BRCMF_MAX_CORENUM)
+                memcpy(&bus->ci->rst_vec, fw->data, sizeof(bus->ci->rst_vec));
+
+        err = 0;
+        offset = 0;
+        address = bus->ci->rambase;
+        while (offset < fw->size) {
+                len = ((offset + MEMBLOCK) < fw->size) ? MEMBLOCK :
+                      fw->size - offset;
+                err = brcmf_sdio_ramrw(bus->sdiodev, true, address,
+                                       (u8 *)&fw->data[offset], len);
+                if (err) {
                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
-                                  ret, MEMBLOCK, offset);
-                        goto err;
+                                  err, len, address);
+                        goto failure;
                 }
-
-                offset += MEMBLOCK;
-                len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
+                offset += len;
+                address += len;
         }
 
-err:
-        kfree(memblock);
+failure:
+        release_firmware(fw);
 
-        release_firmware(bus->firmware);
-        bus->fw_ptr = 0;
-
-        return ret;
+        return err;
 }
 
 /*
@@ -3111,7 +3172,8 @@ err:
  * by two NULs.
 */
 
-static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
+static int brcmf_process_nvram_vars(struct brcmf_sdio *bus,
+                                    const struct firmware *nv)
 {
         char *varbuf;
         char *dp;
@@ -3120,12 +3182,12 @@ static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
         int ret = 0;
         uint buf_len, n, len;
 
-        len = bus->firmware->size;
+        len = nv->size;
         varbuf = vmalloc(len);
         if (!varbuf)
                 return -ENOMEM;
 
-        memcpy(varbuf, bus->firmware->data, len);
+        memcpy(varbuf, nv->data, len);
         dp = varbuf;
 
         findNewline = false;
@@ -3177,18 +3239,16 @@ err:
 
 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
 {
+        const struct firmware *nv;
         int ret;
 
-        ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
-                               &bus->sdiodev->func[2]->dev);
-        if (ret) {
-                brcmf_err("Fail to request nvram %d\n", ret);
-                return ret;
-        }
+        nv = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
+        if (nv == NULL)
+                return -ENOENT;
 
-        ret = brcmf_process_nvram_vars(bus);
+        ret = brcmf_process_nvram_vars(bus, nv);
 
-        release_firmware(bus->firmware);
+        release_firmware(nv);
 
         return ret;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index e679214b3c98..14bc24dc5bae 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -102,7 +102,8 @@ struct brcmf_event;
         BRCMF_ENUM_DEF(DCS_REQUEST, 73) \
         BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
         BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
-        BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
+        BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
+        BRCMF_ENUM_DEF(PSTA_PRIMARY_INTF_IND, 128)
 
 #define BRCMF_ENUM_DEF(id, val) \
         BRCMF_E_##id = (val),
@@ -114,6 +115,8 @@ enum brcmf_fweh_event_code {
 };
 #undef BRCMF_ENUM_DEF
 
+#define BRCMF_EVENTING_MASK_LEN         DIV_ROUND_UP(BRCMF_E_LAST, 8)
+
 /* flags field values in struct brcmf_event_msg */
 #define BRCMF_EVENT_MSG_LINK            0x01
 #define BRCMF_EVENT_MSG_FLUSHTXQ        0x02
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 82f9140f3d35..d0cd0bf95c5a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -168,6 +168,7 @@ enum brcmf_fws_skb_state {
 /**
  * struct brcmf_skbuff_cb - control buffer associated with skbuff.
  *
+ * @bus_flags: 2 bytes reserved for bus specific parameters
  * @if_flags: holds interface index and packet related flags.
  * @htod: host to device packet identifier (used in PKTTAG tlv).
  * @state: transmit state of the packet.
@@ -177,6 +178,7 @@ enum brcmf_fws_skb_state {
  * provides 48 bytes of storage so this structure should not exceed that.
  */
 struct brcmf_skbuff_cb {
+        u16 bus_flags;
         u16 if_flags;
         u32 htod;
         enum brcmf_fws_skb_state state;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index ca72177388b9..2096a14ef1fb 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -18,6 +18,7 @@
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/bcma/bcma.h>
 
@@ -136,6 +137,8 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev,
                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
@@ -154,6 +157,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
         bool ret;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
                                    NULL);
@@ -261,6 +266,8 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* if core is already in reset, just return */
         regdata = brcmf_sdio_regrl(sdiodev,
@@ -304,6 +311,8 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /*
          * Must do the disable sequence first to work for
@@ -368,6 +377,8 @@ brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* must disable first to work for arbitrary current core state */
         brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);
@@ -444,6 +455,9 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                                    NULL);
         ci->chip = regdata & CID_ID_MASK;
         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
+        if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
+            ci->chiprev >= 2)
+                ci->chip = BCM4339_CHIP_ID;
         ci->socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
 
         brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
@@ -541,6 +555,20 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                 ci->ramsize = 0xc0000;
                 ci->rambase = 0x180000;
                 break;
+        case BCM4339_CHIP_ID:
+                ci->c_inf[0].wrapbase = 0x18100000;
+                ci->c_inf[0].cib = 0x2e084411;
+                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                ci->c_inf[1].base = 0x18005000;
+                ci->c_inf[1].wrapbase = 0x18105000;
+                ci->c_inf[1].cib = 0x15004211;
+                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                ci->c_inf[2].base = 0x18002000;
+                ci->c_inf[2].wrapbase = 0x18102000;
+                ci->c_inf[2].cib = 0x04084411;
+                ci->ramsize = 0xc0000;
+                ci->rambase = 0x180000;
+                break;
         default:
                 brcmf_err("chipid 0x%x is not supported\n", ci->chip);
                 return -ENODEV;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index 83c041f1bf4a..507c61c991fa 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -54,6 +54,14 @@
 
 #define BRCMF_MAX_CORENUM       6
 
+/* SDIO device ID */
+#define SDIO_DEVICE_ID_BROADCOM_43143           43143
+#define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
+#define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
+#define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
+#define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
+#define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
+
 struct chip_core_info {
         u16 id;
         u16 rev;
@@ -215,17 +223,16 @@ struct sdpcmd_regs {
         u16 PAD[0x80];
 };
 
-extern int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
-                                  struct chip_info **ci_ptr, u32 regs);
-extern void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
-extern void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
-                                              struct chip_info *ci,
-                                              u32 drivestrength);
-extern u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
-extern void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
-                                           struct chip_info *ci);
-extern bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
-                                          struct chip_info *ci, char *nvram_dat,
-                                          uint nvram_sz);
+int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
+                           struct chip_info **ci_ptr, u32 regs);
+void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
+void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
+                                       struct chip_info *ci, u32 drivestrength);
+u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
+void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
+                                    struct chip_info *ci);
+bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
+                                   struct chip_info *ci, char *nvram_dat,
+                                   uint nvram_sz);
 
 #endif          /* _BRCMFMAC_SDIO_CHIP_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index 2b5407f002e5..c9b06b4e71f7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -181,18 +181,18 @@ struct brcmf_sdio_dev {
 };
 
 /* Register/deregister interrupt handler. */
-extern int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev);
-extern int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev);
 
 /* sdio device register access interface */
-extern u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-extern u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-extern void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                             u8 data, int *ret);
-extern void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                             u32 data, int *ret);
-extern int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                                   void *data, bool write);
+u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
+                      int *ret);
+void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
+                      int *ret);
+int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
+                            void *data, bool write);
 
 /* Buffer transfer to/from device (client) core via cmd53.
  *   fn:       function number
@@ -206,22 +206,17 @@ extern int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
  * Returns 0 or error code.
  * NOTE: Async operation is not currently supported.
  */
-extern int
-brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff_head *pktq);
-extern int
-brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, u8 *buf, uint nbytes);
-
-extern int
-brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff *pkt);
-extern int
-brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, u8 *buf, uint nbytes);
-extern int
-brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                        uint flags, struct sk_buff_head *pktq);
+int brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
+                          uint flags, struct sk_buff_head *pktq);
+int brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
+                          uint flags, u8 *buf, uint nbytes);
+
+int brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
+                          uint flags, struct sk_buff *pkt);
+int brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
+                          uint flags, u8 *buf, uint nbytes);
+int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
+                            uint flags, struct sk_buff_head *pktq);
 
 /* Flags bits */
 
@@ -237,46 +232,43 @@ brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
  *   nbytes:   number of bytes to transfer to/from buf
  * Returns 0 or error code.
  */
-extern int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw,
-                               u32 addr, u8 *buf, uint nbytes);
-extern int brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write,
-                            u32 address, u8 *data, uint size);
+int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw, u32 addr,
+                        u8 *buf, uint nbytes);
+int brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+                     u8 *data, uint size);
 
 /* Issue an abort to the specified function */
-extern int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
+int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
 
 /* platform specific/high level functions */
-extern int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
-extern int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev);
 
 /* attach, return handler on success, NULL if failed.
  *  The handler shall be provided by all subsequent calls. No local cache
  *  cfghdl points to the starting address of pci device mapped memory
  */
-extern int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev);
-extern void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev);
+void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev);
 
 /* read or write one byte using cmd52 */
-extern int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw,
-                                    uint fnc, uint addr, u8 *byte);
+int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw, uint fnc,
+                             uint addr, u8 *byte);
 
 /* read or write 2/4 bytes using cmd53 */
-extern int
-brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev,
-                         uint rw, uint fnc, uint addr,
-                         u32 *word, uint nbyte);
+int brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev, uint rw, uint fnc,
+                             uint addr, u32 *word, uint nbyte);
 
 /* Watchdog timer interface for pm ops */
-extern void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev,
-                                    bool enable);
+void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev, bool enable);
 
-extern void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev);
-extern void brcmf_sdbrcm_disconnect(void *ptr);
-extern void brcmf_sdbrcm_isr(void *arg);
+void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev);
+void brcmf_sdbrcm_disconnect(void *ptr);
+void brcmf_sdbrcm_isr(void *arg);
 
-extern void brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick);
+void brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick);
 
-extern void brcmf_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
-                                 wait_queue_head_t *wq);
-extern bool brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev);
+void brcmf_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
+                          wait_queue_head_t *wq);
+bool brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev);
 #endif                          /* _BRCM_SDH_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index f4aea47e0730..422f44c63175 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -435,7 +435,6 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
         struct brcmf_usbdev_info *devinfo = req->devinfo;
         struct sk_buff *skb;
-        struct sk_buff_head skbq;
 
         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
         brcmf_usb_del_fromq(devinfo, req);
@@ -450,10 +449,8 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         }
 
         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
-                skb_queue_head_init(&skbq);
-                skb_queue_tail(&skbq, skb);
                 skb_put(skb, urb->actual_length);
-                brcmf_rx_frames(devinfo->dev, &skbq);
+                brcmf_rx_frame(devinfo->dev, skb);
                 brcmf_usb_rx_refill(devinfo, req);
         } else {
                 brcmu_pkt_buf_free_skb(skb);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
index a8a267b5b87a..2d08c155c23b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
@@ -172,19 +172,19 @@ struct si_info {
 
 
 /* AMBA Interconnect exported externs */
-extern u32 ai_core_cflags(struct bcma_device *core, u32 mask, u32 val);
+u32 ai_core_cflags(struct bcma_device *core, u32 mask, u32 val);
 
 /* === exported functions === */
-extern struct si_pub *ai_attach(struct bcma_bus *pbus);
-extern void ai_detach(struct si_pub *sih);
-extern uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val);
-extern void ai_clkctl_init(struct si_pub *sih);
-extern u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih);
-extern bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode);
-extern bool ai_deviceremoved(struct si_pub *sih);
+struct si_pub *ai_attach(struct bcma_bus *pbus);
+void ai_detach(struct si_pub *sih);
+uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val);
+void ai_clkctl_init(struct si_pub *sih);
+u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih);
+bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode);
+bool ai_deviceremoved(struct si_pub *sih);
 
 /* Enable Ex-PA for 4313 */
-extern void ai_epa_4313war(struct si_pub *sih);
+void ai_epa_4313war(struct si_pub *sih);
 
 static inline u32 ai_get_cccaps(struct si_pub *sih)
 {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
index 73d01e586109..03bdcf29bd50 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
@@ -37,17 +37,17 @@ struct brcms_ampdu_session {
         u16 dma_len;
 };
 
-extern void brcms_c_ampdu_reset_session(struct brcms_ampdu_session *session,
-                                        struct brcms_c_info *wlc);
-extern int brcms_c_ampdu_add_frame(struct brcms_ampdu_session *session,
-                                   struct sk_buff *p);
-extern void brcms_c_ampdu_finalize(struct brcms_ampdu_session *session);
+void brcms_c_ampdu_reset_session(struct brcms_ampdu_session *session,
+                                 struct brcms_c_info *wlc);
+int brcms_c_ampdu_add_frame(struct brcms_ampdu_session *session,
+                            struct sk_buff *p);
+void brcms_c_ampdu_finalize(struct brcms_ampdu_session *session);
 
-extern struct ampdu_info *brcms_c_ampdu_attach(struct brcms_c_info *wlc);
-extern void brcms_c_ampdu_detach(struct ampdu_info *ampdu);
-extern void brcms_c_ampdu_dotxstatus(struct ampdu_info *ampdu, struct scb *scb,
-                                 struct sk_buff *p, struct tx_status *txs);
-extern void brcms_c_ampdu_macaddr_upd(struct brcms_c_info *wlc);
-extern void brcms_c_ampdu_shm_upd(struct ampdu_info *ampdu);
+struct ampdu_info *brcms_c_ampdu_attach(struct brcms_c_info *wlc);
+void brcms_c_ampdu_detach(struct ampdu_info *ampdu);
+void brcms_c_ampdu_dotxstatus(struct ampdu_info *ampdu, struct scb *scb,
+                              struct sk_buff *p, struct tx_status *txs);
+void brcms_c_ampdu_macaddr_upd(struct brcms_c_info *wlc);
+void brcms_c_ampdu_shm_upd(struct ampdu_info *ampdu);
 
 #endif                          /* _BRCM_AMPDU_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/antsel.h b/drivers/net/wireless/brcm80211/brcmsmac/antsel.h
index 97ea3881a8ec..a3d487ab1964 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/antsel.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/antsel.h
@@ -17,13 +17,11 @@
 #ifndef _BRCM_ANTSEL_H_
 #define _BRCM_ANTSEL_H_
 
-extern struct antsel_info *brcms_c_antsel_attach(struct brcms_c_info *wlc);
-extern void brcms_c_antsel_detach(struct antsel_info *asi);
-extern void brcms_c_antsel_init(struct antsel_info *asi);
-extern void brcms_c_antsel_antcfg_get(struct antsel_info *asi, bool usedef,
-                                  bool sel,
-                                  u8 id, u8 fbid, u8 *antcfg,
-                                  u8 *fbantcfg);
-extern u8 brcms_c_antsel_antsel2id(struct antsel_info *asi, u16 antsel);
+struct antsel_info *brcms_c_antsel_attach(struct brcms_c_info *wlc);
+void brcms_c_antsel_detach(struct antsel_info *asi);
+void brcms_c_antsel_init(struct antsel_info *asi);
+void brcms_c_antsel_antcfg_get(struct antsel_info *asi, bool usedef, bool sel,
+                               u8 id, u8 fbid, u8 *antcfg, u8 *fbantcfg);
+u8 brcms_c_antsel_antsel2id(struct antsel_info *asi, u16 antsel);
 
 #endif /* _BRCM_ANTSEL_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.h b/drivers/net/wireless/brcm80211/brcmsmac/channel.h
index 006483a0abe6..39dd3a5b2979 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.h
@@ -32,20 +32,16 @@
 
 #define BRCMS_DFS_EU (BRCMS_DFS_TPC | BRCMS_RADAR_TYPE_EU) /* Flag for DFS EU */
 
-extern struct brcms_cm_info *
-brcms_c_channel_mgr_attach(struct brcms_c_info *wlc);
+struct brcms_cm_info *brcms_c_channel_mgr_attach(struct brcms_c_info *wlc);
 
-extern void brcms_c_channel_mgr_detach(struct brcms_cm_info *wlc_cm);
+void brcms_c_channel_mgr_detach(struct brcms_cm_info *wlc_cm);
 
-extern bool brcms_c_valid_chanspec_db(struct brcms_cm_info *wlc_cm,
-                                      u16 chspec);
+bool brcms_c_valid_chanspec_db(struct brcms_cm_info *wlc_cm, u16 chspec);
 
-extern void brcms_c_channel_reg_limits(struct brcms_cm_info *wlc_cm,
-                                   u16 chanspec,
-                                   struct txpwr_limits *txpwr);
-extern void brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm,
-                                     u16 chanspec,
-                                     u8 local_constraint_qdbm);
-extern void brcms_c_regd_init(struct brcms_c_info *wlc);
+void brcms_c_channel_reg_limits(struct brcms_cm_info *wlc_cm, u16 chanspec,
+                                struct txpwr_limits *txpwr);
+void brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
+                                  u8 local_constraint_qdbm);
+void brcms_c_regd_init(struct brcms_c_info *wlc);
 
 #endif                          /* _WLC_CHANNEL_H */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 4090032e81a2..198053dfc310 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -88,26 +88,26 @@ struct brcms_info {
 };
 
 /* misc callbacks */
-extern void brcms_init(struct brcms_info *wl);
-extern uint brcms_reset(struct brcms_info *wl);
-extern void brcms_intrson(struct brcms_info *wl);
-extern u32 brcms_intrsoff(struct brcms_info *wl);
-extern void brcms_intrsrestore(struct brcms_info *wl, u32 macintmask);
-extern int brcms_up(struct brcms_info *wl);
-extern void brcms_down(struct brcms_info *wl);
-extern void brcms_txflowcontrol(struct brcms_info *wl, struct brcms_if *wlif,
-                                bool state, int prio);
-extern bool brcms_rfkill_set_hw_state(struct brcms_info *wl);
+void brcms_init(struct brcms_info *wl);
+uint brcms_reset(struct brcms_info *wl);
+void brcms_intrson(struct brcms_info *wl);
+u32 brcms_intrsoff(struct brcms_info *wl);
+void brcms_intrsrestore(struct brcms_info *wl, u32 macintmask);
+int brcms_up(struct brcms_info *wl);
+void brcms_down(struct brcms_info *wl);
+void brcms_txflowcontrol(struct brcms_info *wl, struct brcms_if *wlif,
+                         bool state, int prio);
+bool brcms_rfkill_set_hw_state(struct brcms_info *wl);
 
 /* timer functions */
-extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
-                                      void (*fn) (void *arg), void *arg,
-                                      const char *name);
-extern void brcms_free_timer(struct brcms_timer *timer);
-extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
-extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_dpc(unsigned long data);
-extern void brcms_timer(struct brcms_timer *t);
-extern void brcms_fatal_error(struct brcms_info *wl);
+struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
+                                     void (*fn) (void *arg), void *arg,
+                                     const char *name);
+void brcms_free_timer(struct brcms_timer *timer);
+void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
+bool brcms_del_timer(struct brcms_timer *timer);
+void brcms_dpc(unsigned long data);
+void brcms_timer(struct brcms_timer *t);
+void brcms_fatal_error(struct brcms_info *wl);
 
 #endif                          /* _BRCM_MAC80211_IF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 4608e0eb1493..8138f1cff4e5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1906,14 +1906,14 @@ static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_
 
         /* If macaddr exists, use it (Sromrev4, CIS, ...). */
         if (!is_zero_ether_addr(sprom->il0mac)) {
-                memcpy(etheraddr, sprom->il0mac, 6);
+                memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
                 return;
         }
 
         if (wlc_hw->_nbands > 1)
-                memcpy(etheraddr, sprom->et1mac, 6);
+                memcpy(etheraddr, sprom->et1mac, ETH_ALEN);
         else
-                memcpy(etheraddr, sprom->il0mac, 6);
+                memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
 }
 
 /* power both the pll and external oscillator on/off */
@@ -5695,7 +5695,7 @@ static bool brcms_c_chipmatch_pci(struct bcma_device *core)
                 return true;
         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
                 return true;
-        if (device == BCM4313_D11N2G_ID)
+        if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
                 return true;
         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
                 return true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.h b/drivers/net/wireless/brcm80211/brcmsmac/main.h
index b5d7a38b53fe..c4d135cff04a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
@@ -616,66 +616,54 @@ struct brcms_bss_cfg {
         struct brcms_bss_info *current_bss;
 };
 
-extern int brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo,
-                           struct sk_buff *p);
-extern int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
-                   uint *blocks);
-
-extern int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config);
-extern void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags);
-extern u16 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
-                                uint mac_len);
-extern u32 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc,
-                                             u32 rspec,
-                                             bool use_rspec, u16 mimo_ctlchbw);
-extern u16 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
-                                      u32 rts_rate,
-                                      u32 frame_rate,
-                                      u8 rts_preamble_type,
-                                      u8 frame_preamble_type, uint frame_len,
-                                      bool ba);
-extern void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
-                               struct ieee80211_sta *sta,
-                               void (*dma_callback_fn));
-extern void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend);
-extern int brcms_c_set_nmode(struct brcms_c_info *wlc);
-extern void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
-                                          u32 bcn_rate);
-extern void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw,
-                                     u8 antsel_type);
-extern void brcms_b_set_chanspec(struct brcms_hardware *wlc_hw,
-                                  u16 chanspec,
-                                  bool mute, struct txpwr_limits *txpwr);
-extern void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset,
-                              u16 v);
-extern u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset);
-extern void brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask,
-                        u16 val, int bands);
-extern void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags);
-extern void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val);
-extern void brcms_b_phy_reset(struct brcms_hardware *wlc_hw);
-extern void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw);
-extern void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw);
-extern void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
-                                        u32 override_bit);
-extern void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
-                                          u32 override_bit);
-extern void brcms_b_write_template_ram(struct brcms_hardware *wlc_hw,
-                                       int offset, int len, void *buf);
-extern u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate);
-extern void brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw,
-                                   uint offset, const void *buf, int len,
-                                   u32 sel);
-extern void brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset,
-                                     void *buf, int len, u32 sel);
-extern void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode);
-extern u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw);
-extern void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk);
-extern void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk);
-extern void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on);
-extern void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant);
-extern void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw,
-                                    u8 stf_mode);
-extern void brcms_c_init_scb(struct scb *scb);
+int brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p);
+int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
+                           uint *blocks);
+
+int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config);
+void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags);
+u16 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec, uint mac_len);
+u32 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
+                               bool use_rspec, u16 mimo_ctlchbw);
+u16 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
+                               u32 rts_rate, u32 frame_rate,
+                               u8 rts_preamble_type, u8 frame_preamble_type,
+                               uint frame_len, bool ba);
+void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
+                            struct ieee80211_sta *sta, void (*dma_callback_fn));
+void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend);
+int brcms_c_set_nmode(struct brcms_c_info *wlc);
+void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc, u32 bcn_rate);
+void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type);
+void brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
+                          bool mute, struct txpwr_limits *txpwr);
+void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v);
+u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset);
+void brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
+                 int bands);
+void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags);
+void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val);
+void brcms_b_phy_reset(struct brcms_hardware *wlc_hw);
+void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw);
+void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw);
+void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
+                                     u32 override_bit);
+void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
+                                       u32 override_bit);
+void brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset,
+                                int len, void *buf);
+u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate);
+void brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
+                           const void *buf, int len, u32 sel);
+void brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset,
+                             void *buf, int len, u32 sel);
+void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode);
+u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw);
+void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk);
+void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk);
+void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on);
+void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant);
+void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode);
+void brcms_c_init_scb(struct scb *scb);
 
 #endif                          /* _BRCM_MAIN_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_hal.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_hal.h
index e34a71e7d242..4d3734f48d9c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_hal.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_hal.h
@@ -179,121 +179,106 @@ struct shared_phy_params {
 };
 
 
-extern struct shared_phy *wlc_phy_shared_attach(struct shared_phy_params *shp);
-extern struct brcms_phy_pub *wlc_phy_attach(struct shared_phy *sh,
-                                            struct bcma_device *d11core,
-                                            int bandtype, struct wiphy *wiphy);
-extern void wlc_phy_detach(struct brcms_phy_pub *ppi);
-
-extern bool wlc_phy_get_phyversion(struct brcms_phy_pub *pih, u16 *phytype,
-                                   u16 *phyrev, u16 *radioid,
-                                   u16 *radiover);
-extern bool wlc_phy_get_encore(struct brcms_phy_pub *pih);
-extern u32 wlc_phy_get_coreflags(struct brcms_phy_pub *pih);
-
-extern void wlc_phy_hw_clk_state_upd(struct brcms_phy_pub *ppi, bool newstate);
-extern void wlc_phy_hw_state_upd(struct brcms_phy_pub *ppi, bool newstate);
-extern void wlc_phy_init(struct brcms_phy_pub *ppi, u16 chanspec);
-extern void wlc_phy_watchdog(struct brcms_phy_pub *ppi);
-extern int wlc_phy_down(struct brcms_phy_pub *ppi);
-extern u32 wlc_phy_clk_bwbits(struct brcms_phy_pub *pih);
-extern void wlc_phy_cal_init(struct brcms_phy_pub *ppi);
-extern void wlc_phy_antsel_init(struct brcms_phy_pub *ppi, bool lut_init);
-
-extern void wlc_phy_chanspec_set(struct brcms_phy_pub *ppi,
-                                 u16 chanspec);
-extern u16 wlc_phy_chanspec_get(struct brcms_phy_pub *ppi);
-extern void wlc_phy_chanspec_radio_set(struct brcms_phy_pub *ppi,
-                                       u16 newch);
-extern u16 wlc_phy_bw_state_get(struct brcms_phy_pub *ppi);
-extern void wlc_phy_bw_state_set(struct brcms_phy_pub *ppi, u16 bw);
-
-extern int wlc_phy_rssi_compute(struct brcms_phy_pub *pih,
-                                struct d11rxhdr *rxh);
-extern void wlc_phy_por_inform(struct brcms_phy_pub *ppi);
-extern void wlc_phy_noise_sample_intr(struct brcms_phy_pub *ppi);
-extern bool wlc_phy_bist_check_phy(struct brcms_phy_pub *ppi);
-
-extern void wlc_phy_set_deaf(struct brcms_phy_pub *ppi, bool user_flag);
-
-extern void wlc_phy_switch_radio(struct brcms_phy_pub *ppi, bool on);
-extern void wlc_phy_anacore(struct brcms_phy_pub *ppi, bool on);
-
-
-extern void wlc_phy_BSSinit(struct brcms_phy_pub *ppi, bool bonlyap, int rssi);
-
-extern void wlc_phy_chanspec_ch14_widefilter_set(struct brcms_phy_pub *ppi,
-                                                 bool wide_filter);
-extern void wlc_phy_chanspec_band_validch(struct brcms_phy_pub *ppi, uint band,
-                                          struct brcms_chanvec *channels);
-extern u16 wlc_phy_chanspec_band_firstch(struct brcms_phy_pub *ppi,
-                                         uint band);
-
-extern void wlc_phy_txpower_sromlimit(struct brcms_phy_pub *ppi, uint chan,
-                                      u8 *_min_, u8 *_max_, int rate);
-extern void wlc_phy_txpower_sromlimit_max_get(struct brcms_phy_pub *ppi,
-                                              uint chan, u8 *_max_, u8 *_min_);
-extern void wlc_phy_txpower_boardlimit_band(struct brcms_phy_pub *ppi,
-                                            uint band, s32 *, s32 *, u32 *);
-extern void wlc_phy_txpower_limit_set(struct brcms_phy_pub *ppi,
-                                      struct txpwr_limits *,
-                                      u16 chanspec);
-extern int wlc_phy_txpower_get(struct brcms_phy_pub *ppi, uint *qdbm,
-                               bool *override);
-extern int wlc_phy_txpower_set(struct brcms_phy_pub *ppi, uint qdbm,
-                               bool override);
-extern void wlc_phy_txpower_target_set(struct brcms_phy_pub *ppi,
-                                       struct txpwr_limits *);
-extern bool wlc_phy_txpower_hw_ctrl_get(struct brcms_phy_pub *ppi);
-extern void wlc_phy_txpower_hw_ctrl_set(struct brcms_phy_pub *ppi,
-                                        bool hwpwrctrl);
-extern u8 wlc_phy_txpower_get_target_min(struct brcms_phy_pub *ppi);
-extern u8 wlc_phy_txpower_get_target_max(struct brcms_phy_pub *ppi);
-extern bool wlc_phy_txpower_ipa_ison(struct brcms_phy_pub *pih);
-
-extern void wlc_phy_stf_chain_init(struct brcms_phy_pub *pih, u8 txchain,
-                                   u8 rxchain);
-extern void wlc_phy_stf_chain_set(struct brcms_phy_pub *pih, u8 txchain,
-                                  u8 rxchain);
-extern void wlc_phy_stf_chain_get(struct brcms_phy_pub *pih, u8 *txchain,
-                                  u8 *rxchain);
-extern u8 wlc_phy_stf_chain_active_get(struct brcms_phy_pub *pih);
-extern s8 wlc_phy_stf_ssmode_get(struct brcms_phy_pub *pih,
-                                 u16 chanspec);
-extern void wlc_phy_ldpc_override_set(struct brcms_phy_pub *ppi, bool val);
-
-extern void wlc_phy_cal_perical(struct brcms_phy_pub *ppi, u8 reason);
-extern void wlc_phy_noise_sample_request_external(struct brcms_phy_pub *ppi);
-extern void wlc_phy_edcrs_lock(struct brcms_phy_pub *pih, bool lock);
-extern void wlc_phy_cal_papd_recal(struct brcms_phy_pub *ppi);
-
-extern void wlc_phy_ant_rxdiv_set(struct brcms_phy_pub *ppi, u8 val);
-extern void wlc_phy_clear_tssi(struct brcms_phy_pub *ppi);
-extern void wlc_phy_hold_upd(struct brcms_phy_pub *ppi, u32 id, bool val);
-extern void wlc_phy_mute_upd(struct brcms_phy_pub *ppi, bool val, u32 flags);
-
-extern void wlc_phy_antsel_type_set(struct brcms_phy_pub *ppi, u8 antsel_type);
-
-extern void wlc_phy_txpower_get_current(struct brcms_phy_pub *ppi,
-                                        struct tx_power *power, uint channel);
-
-extern void wlc_phy_initcal_enable(struct brcms_phy_pub *pih, bool initcal);
-extern bool wlc_phy_test_ison(struct brcms_phy_pub *ppi);
-extern void wlc_phy_txpwr_percent_set(struct brcms_phy_pub *ppi,
-                                      u8 txpwr_percent);
-extern void wlc_phy_ofdm_rateset_war(struct brcms_phy_pub *pih, bool war);
-extern void wlc_phy_bf_preempt_enable(struct brcms_phy_pub *pih,
-                                      bool bf_preempt);
-extern void wlc_phy_machwcap_set(struct brcms_phy_pub *ppi, u32 machwcap);
-
-extern void wlc_phy_runbist_config(struct brcms_phy_pub *ppi, bool start_end);
-
-extern void wlc_phy_freqtrack_start(struct brcms_phy_pub *ppi);
-extern void wlc_phy_freqtrack_end(struct brcms_phy_pub *ppi);
-
-extern const u8 *wlc_phy_get_ofdm_rate_lookup(void);
-
-extern s8 wlc_phy_get_tx_power_offset_by_mcs(struct brcms_phy_pub *ppi,
-                                             u8 mcs_offset);
-extern s8 wlc_phy_get_tx_power_offset(struct brcms_phy_pub *ppi, u8 tbl_offset);
+struct shared_phy *wlc_phy_shared_attach(struct shared_phy_params *shp);
+struct brcms_phy_pub *wlc_phy_attach(struct shared_phy *sh,
+                                     struct bcma_device *d11core, int bandtype,
+                                     struct wiphy *wiphy);
+void wlc_phy_detach(struct brcms_phy_pub *ppi);
+
+bool wlc_phy_get_phyversion(struct brcms_phy_pub *pih, u16 *phytype,
+                            u16 *phyrev, u16 *radioid, u16 *radiover);
+bool wlc_phy_get_encore(struct brcms_phy_pub *pih);
+u32 wlc_phy_get_coreflags(struct brcms_phy_pub *pih);
+
+void wlc_phy_hw_clk_state_upd(struct brcms_phy_pub *ppi, bool newstate);
+void wlc_phy_hw_state_upd(struct brcms_phy_pub *ppi, bool newstate);
+void wlc_phy_init(struct brcms_phy_pub *ppi, u16 chanspec);
+void wlc_phy_watchdog(struct brcms_phy_pub *ppi);
+int wlc_phy_down(struct brcms_phy_pub *ppi);
+u32 wlc_phy_clk_bwbits(struct brcms_phy_pub *pih);
+void wlc_phy_cal_init(struct brcms_phy_pub *ppi);
+void wlc_phy_antsel_init(struct brcms_phy_pub *ppi, bool lut_init);
+
+void wlc_phy_chanspec_set(struct brcms_phy_pub *ppi, u16 chanspec);
+u16 wlc_phy_chanspec_get(struct brcms_phy_pub *ppi);
+void wlc_phy_chanspec_radio_set(struct brcms_phy_pub *ppi, u16 newch);
+u16 wlc_phy_bw_state_get(struct brcms_phy_pub *ppi);
+void wlc_phy_bw_state_set(struct brcms_phy_pub *ppi, u16 bw);
+
+int wlc_phy_rssi_compute(struct brcms_phy_pub *pih, struct d11rxhdr *rxh);
+void wlc_phy_por_inform(struct brcms_phy_pub *ppi);
+void wlc_phy_noise_sample_intr(struct brcms_phy_pub *ppi);
+bool wlc_phy_bist_check_phy(struct brcms_phy_pub *ppi);
+
+void wlc_phy_set_deaf(struct brcms_phy_pub *ppi, bool user_flag);
+
+void wlc_phy_switch_radio(struct brcms_phy_pub *ppi, bool on);
+void wlc_phy_anacore(struct brcms_phy_pub *ppi, bool on);
+
+
+void wlc_phy_BSSinit(struct brcms_phy_pub *ppi, bool bonlyap, int rssi);
+
+void wlc_phy_chanspec_ch14_widefilter_set(struct brcms_phy_pub *ppi,
+                                          bool wide_filter);
+void wlc_phy_chanspec_band_validch(struct brcms_phy_pub *ppi, uint band,
+                                   struct brcms_chanvec *channels);
+u16 wlc_phy_chanspec_band_firstch(struct brcms_phy_pub *ppi, uint band);
+
+void wlc_phy_txpower_sromlimit(struct brcms_phy_pub *ppi, uint chan, u8 *_min_,
+                               u8 *_max_, int rate);
+void wlc_phy_txpower_sromlimit_max_get(struct brcms_phy_pub *ppi, uint chan,
+                                       u8 *_max_, u8 *_min_);
+void wlc_phy_txpower_boardlimit_band(struct brcms_phy_pub *ppi, uint band,
+                                     s32 *, s32 *, u32 *);
+void wlc_phy_txpower_limit_set(struct brcms_phy_pub *ppi, struct txpwr_limits *,
+                               u16 chanspec);
+int wlc_phy_txpower_get(struct brcms_phy_pub *ppi, uint *qdbm, bool *override);
+int wlc_phy_txpower_set(struct brcms_phy_pub *ppi, uint qdbm, bool override);
+void wlc_phy_txpower_target_set(struct brcms_phy_pub *ppi,
+                                struct txpwr_limits *);
+bool wlc_phy_txpower_hw_ctrl_get(struct brcms_phy_pub *ppi);
+void wlc_phy_txpower_hw_ctrl_set(struct brcms_phy_pub *ppi, bool hwpwrctrl);
+u8 wlc_phy_txpower_get_target_min(struct brcms_phy_pub *ppi);
+u8 wlc_phy_txpower_get_target_max(struct brcms_phy_pub *ppi);
+bool wlc_phy_txpower_ipa_ison(struct brcms_phy_pub *pih);
+
+void wlc_phy_stf_chain_init(struct brcms_phy_pub *pih, u8 txchain, u8 rxchain);
+void wlc_phy_stf_chain_set(struct brcms_phy_pub *pih, u8 txchain, u8 rxchain);
+void wlc_phy_stf_chain_get(struct brcms_phy_pub *pih, u8 *txchain, u8 *rxchain);
+u8 wlc_phy_stf_chain_active_get(struct brcms_phy_pub *pih);
+s8 wlc_phy_stf_ssmode_get(struct brcms_phy_pub *pih, u16 chanspec);
+void wlc_phy_ldpc_override_set(struct brcms_phy_pub *ppi, bool val);
+
+void wlc_phy_cal_perical(struct brcms_phy_pub *ppi, u8 reason);
+void wlc_phy_noise_sample_request_external(struct brcms_phy_pub *ppi);
+void wlc_phy_edcrs_lock(struct brcms_phy_pub *pih, bool lock);
+void wlc_phy_cal_papd_recal(struct brcms_phy_pub *ppi);
+
+void wlc_phy_ant_rxdiv_set(struct brcms_phy_pub *ppi, u8 val);
+void wlc_phy_clear_tssi(struct brcms_phy_pub *ppi);
+void wlc_phy_hold_upd(struct brcms_phy_pub *ppi, u32 id, bool val);
+void wlc_phy_mute_upd(struct brcms_phy_pub *ppi, bool val, u32 flags);
+
+void wlc_phy_antsel_type_set(struct brcms_phy_pub *ppi, u8 antsel_type);
+
+void wlc_phy_txpower_get_current(struct brcms_phy_pub *ppi,
+                                 struct tx_power *power, uint channel);
+
+void wlc_phy_initcal_enable(struct brcms_phy_pub *pih, bool initcal);
+bool wlc_phy_test_ison(struct brcms_phy_pub *ppi);
+void wlc_phy_txpwr_percent_set(struct brcms_phy_pub *ppi, u8 txpwr_percent);
+void wlc_phy_ofdm_rateset_war(struct brcms_phy_pub *pih, bool war);
+void wlc_phy_bf_preempt_enable(struct brcms_phy_pub *pih, bool bf_preempt);
+void wlc_phy_machwcap_set(struct brcms_phy_pub *ppi, u32 machwcap);
+
+void wlc_phy_runbist_config(struct brcms_phy_pub *ppi, bool start_end);
+
+void wlc_phy_freqtrack_start(struct brcms_phy_pub *ppi);
+void wlc_phy_freqtrack_end(struct brcms_phy_pub *ppi);
+
+const u8 *wlc_phy_get_ofdm_rate_lookup(void);
+
+s8 wlc_phy_get_tx_power_offset_by_mcs(struct brcms_phy_pub *ppi,
+                                      u8 mcs_offset);
+s8 wlc_phy_get_tx_power_offset(struct brcms_phy_pub *ppi, u8 tbl_offset);
 #endif                          /* _BRCM_PHY_HAL_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
index 1dc767c31653..4960f7d26804 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
@@ -910,113 +910,103 @@ struct lcnphy_radio_regs {
         u8 do_init_g;
 };
 
-extern u16 read_phy_reg(struct brcms_phy *pi, u16 addr);
-extern void write_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
-extern void and_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
-extern void or_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
-extern void mod_phy_reg(struct brcms_phy *pi, u16 addr, u16 mask, u16 val);
-
-extern u16 read_radio_reg(struct brcms_phy *pi, u16 addr);
-extern void or_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
-extern void and_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
-extern void mod_radio_reg(struct brcms_phy *pi, u16 addr, u16 mask,
-                          u16 val);
-extern void xor_radio_reg(struct brcms_phy *pi, u16 addr, u16 mask);
-
-extern void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
-
-extern void wlc_phyreg_enter(struct brcms_phy_pub *pih);
-extern void wlc_phyreg_exit(struct brcms_phy_pub *pih);
-extern void wlc_radioreg_enter(struct brcms_phy_pub *pih);
-extern void wlc_radioreg_exit(struct brcms_phy_pub *pih);
-
-extern void wlc_phy_read_table(struct brcms_phy *pi,
-                               const struct phytbl_info *ptbl_info,
-                               u16 tblAddr, u16 tblDataHi,
-                               u16 tblDatalo);
-extern void wlc_phy_write_table(struct brcms_phy *pi,
-                                const struct phytbl_info *ptbl_info,
-                                u16 tblAddr, u16 tblDataHi, u16 tblDatalo);
-extern void wlc_phy_table_addr(struct brcms_phy *pi, uint tbl_id,
-                               uint tbl_offset, u16 tblAddr, u16 tblDataHi,
-                               u16 tblDataLo);
-extern void wlc_phy_table_data_write(struct brcms_phy *pi, uint width, u32 val);
-
-extern void write_phy_channel_reg(struct brcms_phy *pi, uint val);
-extern void wlc_phy_txpower_update_shm(struct brcms_phy *pi);
-
-extern u8 wlc_phy_nbits(s32 value);
-extern void wlc_phy_compute_dB(u32 *cmplx_pwr, s8 *p_dB, u8 core);
-
-extern uint wlc_phy_init_radio_regs_allbands(struct brcms_phy *pi,
-                                             struct radio_20xx_regs *radioregs);
-extern uint wlc_phy_init_radio_regs(struct brcms_phy *pi,
-                                    const struct radio_regs *radioregs,
-                                    u16 core_offset);
-
-extern void wlc_phy_txpower_ipa_upd(struct brcms_phy *pi);
-
-extern void wlc_phy_do_dummy_tx(struct brcms_phy *pi, bool ofdm, bool pa_on);
-extern void wlc_phy_papd_decode_epsilon(u32 epsilon, s32 *eps_real,
-                                        s32 *eps_imag);
-
-extern void wlc_phy_cal_perical_mphase_reset(struct brcms_phy *pi);
-extern void wlc_phy_cal_perical_mphase_restart(struct brcms_phy *pi);
-
-extern bool wlc_phy_attach_nphy(struct brcms_phy *pi);
-extern bool wlc_phy_attach_lcnphy(struct brcms_phy *pi);
-
-extern void wlc_phy_detach_lcnphy(struct brcms_phy *pi);
-
-extern void wlc_phy_init_nphy(struct brcms_phy *pi);
-extern void wlc_phy_init_lcnphy(struct brcms_phy *pi);
-
-extern void wlc_phy_cal_init_nphy(struct brcms_phy *pi);
-extern void wlc_phy_cal_init_lcnphy(struct brcms_phy *pi);
-
-extern void wlc_phy_chanspec_set_nphy(struct brcms_phy *pi,
-                                      u16 chanspec);
-extern void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi,
-                                        u16 chanspec);
-extern void wlc_phy_chanspec_set_fixup_lcnphy(struct brcms_phy *pi,
-                                              u16 chanspec);
-extern int wlc_phy_channel2freq(uint channel);
-extern int wlc_phy_chanspec_freq2bandrange_lpssn(uint);
-extern int wlc_phy_chanspec_bandrange_get(struct brcms_phy *, u16 chanspec);
-
-extern void wlc_lcnphy_set_tx_pwr_ctrl(struct brcms_phy *pi, u16 mode);
-extern s8 wlc_lcnphy_get_current_tx_pwr_idx(struct brcms_phy *pi);
-
-extern void wlc_phy_txpower_recalc_target_nphy(struct brcms_phy *pi);
-extern void wlc_lcnphy_txpower_recalc_target(struct brcms_phy *pi);
-extern void wlc_phy_txpower_recalc_target_lcnphy(struct brcms_phy *pi);
-
-extern void wlc_lcnphy_set_tx_pwr_by_index(struct brcms_phy *pi, int index);
-extern void wlc_lcnphy_tx_pu(struct brcms_phy *pi, bool bEnable);
-extern void wlc_lcnphy_stop_tx_tone(struct brcms_phy *pi);
-extern void wlc_lcnphy_start_tx_tone(struct brcms_phy *pi, s32 f_kHz,
-                                     u16 max_val, bool iqcalmode);
-
-extern void wlc_phy_txpower_sromlimit_get_nphy(struct brcms_phy *pi, uint chan,
-                                               u8 *max_pwr, u8 rate_id);
-extern void wlc_phy_ofdm_to_mcs_powers_nphy(u8 *power, u8 rate_mcs_start,
-                                            u8 rate_mcs_end,
-                                            u8 rate_ofdm_start);
-extern void wlc_phy_mcs_to_ofdm_powers_nphy(u8 *power,
-                                            u8 rate_ofdm_start,
-                                            u8 rate_ofdm_end,
-                                            u8 rate_mcs_start);
-
-extern u16 wlc_lcnphy_tempsense(struct brcms_phy *pi, bool mode);
-extern s16 wlc_lcnphy_tempsense_new(struct brcms_phy *pi, bool mode);
-extern s8 wlc_lcnphy_tempsense_degree(struct brcms_phy *pi, bool mode);
-extern s8 wlc_lcnphy_vbatsense(struct brcms_phy *pi, bool mode);
-extern void wlc_phy_carrier_suppress_lcnphy(struct brcms_phy *pi);
-extern void wlc_lcnphy_crsuprs(struct brcms_phy *pi, int channel);
-extern void wlc_lcnphy_epa_switch(struct brcms_phy *pi, bool mode);
-extern void wlc_2064_vco_cal(struct brcms_phy *pi);
-
-extern void wlc_phy_txpower_recalc_target(struct brcms_phy *pi);
+u16 read_phy_reg(struct brcms_phy *pi, u16 addr);
+void write_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
+void and_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
+void or_phy_reg(struct brcms_phy *pi, u16 addr, u16 val);
+void mod_phy_reg(struct brcms_phy *pi, u16 addr, u16 mask, u16 val);
+
+u16 read_radio_reg(struct brcms_phy *pi, u16 addr);
+void or_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
+void and_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
+void mod_radio_reg(struct brcms_phy *pi, u16 addr, u16 mask, u16 val);
+void xor_radio_reg(struct brcms_phy *pi, u16 addr, u16 mask);
+
+void write_radio_reg(struct brcms_phy *pi, u16 addr, u16 val);
+
+void wlc_phyreg_enter(struct brcms_phy_pub *pih);
+void wlc_phyreg_exit(struct brcms_phy_pub *pih);
+void wlc_radioreg_enter(struct brcms_phy_pub *pih);
+void wlc_radioreg_exit(struct brcms_phy_pub *pih);
+
+void wlc_phy_read_table(struct brcms_phy *pi,
+                        const struct phytbl_info *ptbl_info,
+                        u16 tblAddr, u16 tblDataHi, u16 tblDatalo);
+void wlc_phy_write_table(struct brcms_phy *pi,
+                         const struct phytbl_info *ptbl_info,
+                         u16 tblAddr, u16 tblDataHi, u16 tblDatalo);
+void wlc_phy_table_addr(struct brcms_phy *pi, uint tbl_id, uint tbl_offset,
+                        u16 tblAddr, u16 tblDataHi, u16 tblDataLo);
+void wlc_phy_table_data_write(struct brcms_phy *pi, uint width, u32 val);
+
+void write_phy_channel_reg(struct brcms_phy *pi, uint val);
+void wlc_phy_txpower_update_shm(struct brcms_phy *pi);
+
+u8 wlc_phy_nbits(s32 value);
+void wlc_phy_compute_dB(u32 *cmplx_pwr, s8 *p_dB, u8 core);
+
+uint wlc_phy_init_radio_regs_allbands(struct brcms_phy *pi,
+                                      struct radio_20xx_regs *radioregs);
+uint wlc_phy_init_radio_regs(struct brcms_phy *pi,
+                             const struct radio_regs *radioregs,
+                             u16 core_offset);
+
+void wlc_phy_txpower_ipa_upd(struct brcms_phy *pi);
+
+void wlc_phy_do_dummy_tx(struct brcms_phy *pi, bool ofdm, bool pa_on);
+void wlc_phy_papd_decode_epsilon(u32 epsilon, s32 *eps_real, s32 *eps_imag);
+
+void wlc_phy_cal_perical_mphase_reset(struct brcms_phy *pi);
+void wlc_phy_cal_perical_mphase_restart(struct brcms_phy *pi);
+
+bool wlc_phy_attach_nphy(struct brcms_phy *pi);
+bool wlc_phy_attach_lcnphy(struct brcms_phy *pi);
+
+void wlc_phy_detach_lcnphy(struct brcms_phy *pi);
+
+void wlc_phy_init_nphy(struct brcms_phy *pi);
+void wlc_phy_init_lcnphy(struct brcms_phy *pi);
+
+void wlc_phy_cal_init_nphy(struct brcms_phy *pi);
+void wlc_phy_cal_init_lcnphy(struct brcms_phy *pi);
+
+void wlc_phy_chanspec_set_nphy(struct brcms_phy *pi, u16 chanspec);
+void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec);
+void wlc_phy_chanspec_set_fixup_lcnphy(struct brcms_phy *pi, u16 chanspec);
+int wlc_phy_channel2freq(uint channel);
+int wlc_phy_chanspec_freq2bandrange_lpssn(uint);
+int wlc_phy_chanspec_bandrange_get(struct brcms_phy *, u16 chanspec);
+
+void wlc_lcnphy_set_tx_pwr_ctrl(struct brcms_phy *pi, u16 mode);
+s8 wlc_lcnphy_get_current_tx_pwr_idx(struct brcms_phy *pi);
+
+void wlc_phy_txpower_recalc_target_nphy(struct brcms_phy *pi);
+void wlc_lcnphy_txpower_recalc_target(struct brcms_phy *pi);
+void wlc_phy_txpower_recalc_target_lcnphy(struct brcms_phy *pi);
+
+void wlc_lcnphy_set_tx_pwr_by_index(struct brcms_phy *pi, int index);
+void wlc_lcnphy_tx_pu(struct brcms_phy *pi, bool bEnable);
+void wlc_lcnphy_stop_tx_tone(struct brcms_phy *pi);
+void wlc_lcnphy_start_tx_tone(struct brcms_phy *pi, s32 f_kHz, u16 max_val,
+                              bool iqcalmode);
+
+void wlc_phy_txpower_sromlimit_get_nphy(struct brcms_phy *pi, uint chan,
+                                        u8 *max_pwr, u8 rate_id);
+void wlc_phy_ofdm_to_mcs_powers_nphy(u8 *power, u8 rate_mcs_start,
+                                     u8 rate_mcs_end, u8 rate_ofdm_start);
+void wlc_phy_mcs_to_ofdm_powers_nphy(u8 *power, u8 rate_ofdm_start,
+                                     u8 rate_ofdm_end, u8 rate_mcs_start);
+
+u16 wlc_lcnphy_tempsense(struct brcms_phy *pi, bool mode);
+s16 wlc_lcnphy_tempsense_new(struct brcms_phy *pi, bool mode);
+s8 wlc_lcnphy_tempsense_degree(struct brcms_phy *pi, bool mode);
+s8 wlc_lcnphy_vbatsense(struct brcms_phy *pi, bool mode);
+void wlc_phy_carrier_suppress_lcnphy(struct brcms_phy *pi);
+void wlc_lcnphy_crsuprs(struct brcms_phy *pi, int channel);
+void wlc_lcnphy_epa_switch(struct brcms_phy *pi, bool mode);
+void wlc_2064_vco_cal(struct brcms_phy *pi);
+
+void wlc_phy_txpower_recalc_target(struct brcms_phy *pi);
 
 #define LCNPHY_TBL_ID_PAPDCOMPDELTATBL  0x18
 #define LCNPHY_TX_POWER_TABLE_SIZE      128
@@ -1030,26 +1020,24 @@ extern void wlc_phy_txpower_recalc_target(struct brcms_phy *pi);
 
 #define LCNPHY_TX_PWR_CTRL_TEMPBASED    0xE001
 
-extern void wlc_lcnphy_write_table(struct brcms_phy *pi,
-                                   const struct phytbl_info *pti);
-extern void wlc_lcnphy_read_table(struct brcms_phy *pi,
-                                  struct phytbl_info *pti);
-extern void wlc_lcnphy_set_tx_iqcc(struct brcms_phy *pi, u16 a, u16 b);
-extern void wlc_lcnphy_set_tx_locc(struct brcms_phy *pi, u16 didq);
-extern void wlc_lcnphy_get_tx_iqcc(struct brcms_phy *pi, u16 *a, u16 *b);
-extern u16 wlc_lcnphy_get_tx_locc(struct brcms_phy *pi);
-extern void wlc_lcnphy_get_radio_loft(struct brcms_phy *pi, u8 *ei0,
-                                      u8 *eq0, u8 *fi0, u8 *fq0);
-extern void wlc_lcnphy_calib_modes(struct brcms_phy *pi, uint mode);
-extern void wlc_lcnphy_deaf_mode(struct brcms_phy *pi, bool mode);
-extern bool wlc_phy_tpc_isenabled_lcnphy(struct brcms_phy *pi);
-extern void wlc_lcnphy_tx_pwr_update_npt(struct brcms_phy *pi);
-extern s32 wlc_lcnphy_tssi2dbm(s32 tssi, s32 a1, s32 b0, s32 b1);
-extern void wlc_lcnphy_get_tssi(struct brcms_phy *pi, s8 *ofdm_pwr,
-                                s8 *cck_pwr);
-extern void wlc_lcnphy_tx_power_adjustment(struct brcms_phy_pub *ppi);
-
-extern s32 wlc_lcnphy_rx_signal_power(struct brcms_phy *pi, s32 gain_index);
+void wlc_lcnphy_write_table(struct brcms_phy *pi,
+                            const struct phytbl_info *pti);
+void wlc_lcnphy_read_table(struct brcms_phy *pi, struct phytbl_info *pti);
+void wlc_lcnphy_set_tx_iqcc(struct brcms_phy *pi, u16 a, u16 b);
+void wlc_lcnphy_set_tx_locc(struct brcms_phy *pi, u16 didq);
+void wlc_lcnphy_get_tx_iqcc(struct brcms_phy *pi, u16 *a, u16 *b);
+u16 wlc_lcnphy_get_tx_locc(struct brcms_phy *pi);
+void wlc_lcnphy_get_radio_loft(struct brcms_phy *pi, u8 *ei0, u8 *eq0, u8 *fi0,
+                               u8 *fq0);
+void wlc_lcnphy_calib_modes(struct brcms_phy *pi, uint mode);
+void wlc_lcnphy_deaf_mode(struct brcms_phy *pi, bool mode);
+bool wlc_phy_tpc_isenabled_lcnphy(struct brcms_phy *pi);
+void wlc_lcnphy_tx_pwr_update_npt(struct brcms_phy *pi);
+s32 wlc_lcnphy_tssi2dbm(s32 tssi, s32 a1, s32 b0, s32 b1);
+void wlc_lcnphy_get_tssi(struct brcms_phy *pi, s8 *ofdm_pwr, s8 *cck_pwr);
+void wlc_lcnphy_tx_power_adjustment(struct brcms_phy_pub *ppi);
+
+s32 wlc_lcnphy_rx_signal_power(struct brcms_phy *pi, s32 gain_index);
 
 #define NPHY_MAX_HPVGA1_INDEX           10
 #define NPHY_DEF_HPVGA1_INDEXLIMIT      7
@@ -1060,9 +1048,8 @@ struct phy_iq_est {
         u32 q_pwr;
 };
 
-extern void wlc_phy_stay_in_carriersearch_nphy(struct brcms_phy *pi,
-                                               bool enable);
-extern void wlc_nphy_deaf_mode(struct brcms_phy *pi, bool mode);
+void wlc_phy_stay_in_carriersearch_nphy(struct brcms_phy *pi, bool enable);
+void wlc_nphy_deaf_mode(struct brcms_phy *pi, bool mode);
 
 #define wlc_phy_write_table_nphy(pi, pti) \
         wlc_phy_write_table(pi, pti, 0x72, 0x74, 0x73)
@@ -1076,10 +1063,10 @@ extern void wlc_nphy_deaf_mode(struct brcms_phy *pi, bool mode);
 #define wlc_nphy_table_data_write(pi, w, v) \
         wlc_phy_table_data_write((pi), (w), (v))
 
-extern void wlc_phy_table_read_nphy(struct brcms_phy *pi, u32, u32 l, u32 o,
-                                    u32 w, void *d);
-extern void wlc_phy_table_write_nphy(struct brcms_phy *pi, u32, u32, u32,
-                                     u32, const void *);
+void wlc_phy_table_read_nphy(struct brcms_phy *pi, u32, u32 l, u32 o, u32 w,
+                             void *d);
+void wlc_phy_table_write_nphy(struct brcms_phy *pi, u32, u32, u32, u32,
+                              const void *);
 
 #define PHY_IPA(pi) \
         ((pi->ipa2g_on && CHSPEC_IS2G(pi->radio_chanspec)) || \
@@ -1089,73 +1076,67 @@ extern void wlc_phy_table_write_nphy(struct brcms_phy *pi, u32, u32, u32,
         if (NREV_LT((pi)->pubpi.phy_rev, 3)) \
                 (void)bcma_read32(pi->d11core, D11REGOFFS(maccontrol))
 
-extern void wlc_phy_cal_perical_nphy_run(struct brcms_phy *pi, u8 caltype);
-extern void wlc_phy_aci_reset_nphy(struct brcms_phy *pi);
-extern void wlc_phy_pa_override_nphy(struct brcms_phy *pi, bool en);
-
-extern u8 wlc_phy_get_chan_freq_range_nphy(struct brcms_phy *pi, uint chan);
-extern void wlc_phy_switch_radio_nphy(struct brcms_phy *pi, bool on);
-
-extern void wlc_phy_stf_chain_upd_nphy(struct brcms_phy *pi);
-
-extern void wlc_phy_force_rfseq_nphy(struct brcms_phy *pi, u8 cmd);
-extern s16 wlc_phy_tempsense_nphy(struct brcms_phy *pi);
-
-extern u16 wlc_phy_classifier_nphy(struct brcms_phy *pi, u16 mask, u16 val);
-
-extern void wlc_phy_rx_iq_est_nphy(struct brcms_phy *pi, struct phy_iq_est *est,
-                                   u16 num_samps, u8 wait_time,
-                                   u8 wait_for_crs);
-
-extern void wlc_phy_rx_iq_coeffs_nphy(struct brcms_phy *pi, u8 write,
-                                      struct nphy_iq_comp *comp);
-extern void wlc_phy_aci_and_noise_reduction_nphy(struct brcms_phy *pi);
-
-extern void wlc_phy_rxcore_setstate_nphy(struct brcms_phy_pub *pih,
-                                         u8 rxcore_bitmask);
-extern u8 wlc_phy_rxcore_getstate_nphy(struct brcms_phy_pub *pih);
-
-extern void wlc_phy_txpwrctrl_enable_nphy(struct brcms_phy *pi, u8 ctrl_type);
-extern void wlc_phy_txpwr_fixpower_nphy(struct brcms_phy *pi);
-extern void wlc_phy_txpwr_apply_nphy(struct brcms_phy *pi);
-extern void wlc_phy_txpwr_papd_cal_nphy(struct brcms_phy *pi);
-extern u16 wlc_phy_txpwr_idx_get_nphy(struct brcms_phy *pi);
-
-extern struct nphy_txgains wlc_phy_get_tx_gain_nphy(struct brcms_phy *pi);
-extern int wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi,
-                                   struct nphy_txgains target_gain,
-                                   bool full, bool m);
-extern int wlc_phy_cal_rxiq_nphy(struct brcms_phy *pi,
-                                 struct nphy_txgains target_gain,
-                                 u8 type, bool d);
-extern void wlc_phy_txpwr_index_nphy(struct brcms_phy *pi, u8 core_mask,
-                                     s8 txpwrindex, bool res);
-extern void wlc_phy_rssisel_nphy(struct brcms_phy *pi, u8 core, u8 rssi_type);
-extern int wlc_phy_poll_rssi_nphy(struct brcms_phy *pi, u8 rssi_type,
-                                  s32 *rssi_buf, u8 nsamps);
-extern void wlc_phy_rssi_cal_nphy(struct brcms_phy *pi);
-extern int wlc_phy_aci_scan_nphy(struct brcms_phy *pi);
-extern void wlc_phy_cal_txgainctrl_nphy(struct brcms_phy *pi,
-                                        s32 dBm_targetpower, bool debug);
-extern int wlc_phy_tx_tone_nphy(struct brcms_phy *pi, u32 f_kHz, u16 max_val,
-                                u8 mode, u8, bool);
-extern void wlc_phy_stopplayback_nphy(struct brcms_phy *pi);
-extern void wlc_phy_est_tonepwr_nphy(struct brcms_phy *pi, s32 *qdBm_pwrbuf,
-                                     u8 num_samps);
-extern void wlc_phy_radio205x_vcocal_nphy(struct brcms_phy *pi);
-
-extern int wlc_phy_rssi_compute_nphy(struct brcms_phy *pi,
-                                     struct d11rxhdr *rxh);
+void wlc_phy_cal_perical_nphy_run(struct brcms_phy *pi, u8 caltype);
+void wlc_phy_aci_reset_nphy(struct brcms_phy *pi);
+void wlc_phy_pa_override_nphy(struct brcms_phy *pi, bool en);
+
+u8 wlc_phy_get_chan_freq_range_nphy(struct brcms_phy *pi, uint chan);
+void wlc_phy_switch_radio_nphy(struct brcms_phy *pi, bool on);
+
+void wlc_phy_stf_chain_upd_nphy(struct brcms_phy *pi);
+
+void wlc_phy_force_rfseq_nphy(struct brcms_phy *pi, u8 cmd);
+s16 wlc_phy_tempsense_nphy(struct brcms_phy *pi);
+
+u16 wlc_phy_classifier_nphy(struct brcms_phy *pi, u16 mask, u16 val);
+
+void wlc_phy_rx_iq_est_nphy(struct brcms_phy *pi, struct phy_iq_est *est,
+                            u16 num_samps, u8 wait_time, u8 wait_for_crs);
+
+void wlc_phy_rx_iq_coeffs_nphy(struct brcms_phy *pi, u8 write,
+                               struct nphy_iq_comp *comp);
+void wlc_phy_aci_and_noise_reduction_nphy(struct brcms_phy *pi);
+
+void wlc_phy_rxcore_setstate_nphy(struct brcms_phy_pub *pih, u8 rxcore_bitmask);
+u8 wlc_phy_rxcore_getstate_nphy(struct brcms_phy_pub *pih);
+
+void wlc_phy_txpwrctrl_enable_nphy(struct brcms_phy *pi, u8 ctrl_type);
+void wlc_phy_txpwr_fixpower_nphy(struct brcms_phy *pi);
+void wlc_phy_txpwr_apply_nphy(struct brcms_phy *pi);
+void wlc_phy_txpwr_papd_cal_nphy(struct brcms_phy *pi);
+u16 wlc_phy_txpwr_idx_get_nphy(struct brcms_phy *pi);
+
+struct nphy_txgains wlc_phy_get_tx_gain_nphy(struct brcms_phy *pi);
+int wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi,
+                            struct nphy_txgains target_gain, bool full, bool m);
+int wlc_phy_cal_rxiq_nphy(struct brcms_phy *pi, struct nphy_txgains target_gain,
+                          u8 type, bool d);
+void wlc_phy_txpwr_index_nphy(struct brcms_phy *pi, u8 core_mask,
+                              s8 txpwrindex, bool res);
+void wlc_phy_rssisel_nphy(struct brcms_phy *pi, u8 core, u8 rssi_type);
+int wlc_phy_poll_rssi_nphy(struct brcms_phy *pi, u8 rssi_type,
+                           s32 *rssi_buf, u8 nsamps);
+void wlc_phy_rssi_cal_nphy(struct brcms_phy *pi);
+int wlc_phy_aci_scan_nphy(struct brcms_phy *pi);
+void wlc_phy_cal_txgainctrl_nphy(struct brcms_phy *pi, s32 dBm_targetpower,
+                                 bool debug);
+int wlc_phy_tx_tone_nphy(struct brcms_phy *pi, u32 f_kHz, u16 max_val, u8 mode,
+                         u8, bool);
+void wlc_phy_stopplayback_nphy(struct brcms_phy *pi);
+void wlc_phy_est_tonepwr_nphy(struct brcms_phy *pi, s32 *qdBm_pwrbuf,
+                              u8 num_samps);
+void wlc_phy_radio205x_vcocal_nphy(struct brcms_phy *pi);
+
+int wlc_phy_rssi_compute_nphy(struct brcms_phy *pi, struct d11rxhdr *rxh);
 
 #define NPHY_TESTPATTERN_BPHY_EVM   0
 #define NPHY_TESTPATTERN_BPHY_RFCS  1
 
-extern void wlc_phy_nphy_tkip_rifs_war(struct brcms_phy *pi, u8 rifs);
+void wlc_phy_nphy_tkip_rifs_war(struct brcms_phy *pi, u8 rifs);
 
 void wlc_phy_get_pwrdet_offsets(struct brcms_phy *pi, s8 *cckoffset,
                                 s8 *ofdmoffset);
-extern s8 wlc_phy_upd_rssi_offset(struct brcms_phy *pi, s8 rssi,
-                                  u16 chanspec);
+s8 wlc_phy_upd_rssi_offset(struct brcms_phy *pi, s8 rssi, u16 chanspec);
 
-extern bool wlc_phy_n_txpower_ipa_ison(struct brcms_phy *pih);
+bool wlc_phy_n_txpower_ipa_ison(struct brcms_phy *pih);
 #endif                          /* _BRCM_PHY_INT_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h b/drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h
index 2c5b66b75970..dd8774717ade 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h
@@ -124,56 +124,49 @@
 
 struct brcms_phy;
 
-extern struct phy_shim_info *wlc_phy_shim_attach(struct brcms_hardware *wlc_hw,
-                                                 struct brcms_info *wl,
-                                                 struct brcms_c_info *wlc);
-extern void wlc_phy_shim_detach(struct phy_shim_info *physhim);
+struct phy_shim_info *wlc_phy_shim_attach(struct brcms_hardware *wlc_hw,
+                                          struct brcms_info *wl,
+                                          struct brcms_c_info *wlc);
+void wlc_phy_shim_detach(struct phy_shim_info *physhim);
 
 /* PHY to WL utility functions */
-extern struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
-                                            void (*fn) (struct brcms_phy *pi),
-                                            void *arg, const char *name);
-extern void wlapi_free_timer(struct wlapi_timer *t);
-extern void wlapi_add_timer(struct wlapi_timer *t, uint ms, int periodic);
-extern bool wlapi_del_timer(struct wlapi_timer *t);
-extern void wlapi_intrson(struct phy_shim_info *physhim);
-extern u32 wlapi_intrsoff(struct phy_shim_info *physhim);
-extern void wlapi_intrsrestore(struct phy_shim_info *physhim,
-                               u32 macintmask);
-
-extern void wlapi_bmac_write_shm(struct phy_shim_info *physhim, uint offset,
-                                 u16 v);
-extern u16 wlapi_bmac_read_shm(struct phy_shim_info *physhim, uint offset);
-extern void wlapi_bmac_mhf(struct phy_shim_info *physhim, u8 idx,
-                           u16 mask, u16 val, int bands);
-extern void wlapi_bmac_corereset(struct phy_shim_info *physhim, u32 flags);
-extern void wlapi_suspend_mac_and_wait(struct phy_shim_info *physhim);
-extern void wlapi_switch_macfreq(struct phy_shim_info *physhim, u8 spurmode);
-extern void wlapi_enable_mac(struct phy_shim_info *physhim);
-extern void wlapi_bmac_mctrl(struct phy_shim_info *physhim, u32 mask,
-                             u32 val);
-extern void wlapi_bmac_phy_reset(struct phy_shim_info *physhim);
-extern void wlapi_bmac_bw_set(struct phy_shim_info *physhim, u16 bw);
-extern void wlapi_bmac_phyclk_fgc(struct phy_shim_info *physhim, bool clk);
-extern void wlapi_bmac_macphyclk_set(struct phy_shim_info *physhim, bool clk);
-extern void wlapi_bmac_core_phypll_ctl(struct phy_shim_info *physhim, bool on);
-extern void wlapi_bmac_core_phypll_reset(struct phy_shim_info *physhim);
-extern void wlapi_bmac_ucode_wake_override_phyreg_set(struct phy_shim_info *
-                                                      physhim);
-extern void wlapi_bmac_ucode_wake_override_phyreg_clear(struct phy_shim_info *
-                                                        physhim);
-extern void wlapi_bmac_write_template_ram(struct phy_shim_info *physhim, int o,
-                                          int len, void *buf);
-extern u16 wlapi_bmac_rate_shm_offset(struct phy_shim_info *physhim,
-                                         u8 rate);
-extern void wlapi_ucode_sample_init(struct phy_shim_info *physhim);
-extern void wlapi_copyfrom_objmem(struct phy_shim_info *physhim, uint,
-                                  void *buf, int, u32 sel);
-extern void wlapi_copyto_objmem(struct phy_shim_info *physhim, uint,
-                                const void *buf, int, u32);
-
-extern void wlapi_high_update_phy_mode(struct phy_shim_info *physhim,
-                                       u32 phy_mode);
-extern u16 wlapi_bmac_get_txant(struct phy_shim_info *physhim);
+struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
+                                     void (*fn)(struct brcms_phy *pi),
+                                     void *arg, const char *name);
+void wlapi_free_timer(struct wlapi_timer *t);
+void wlapi_add_timer(struct wlapi_timer *t, uint ms, int periodic);
+bool wlapi_del_timer(struct wlapi_timer *t);
+void wlapi_intrson(struct phy_shim_info *physhim);
+u32 wlapi_intrsoff(struct phy_shim_info *physhim);
+void wlapi_intrsrestore(struct phy_shim_info *physhim, u32 macintmask);
+
+void wlapi_bmac_write_shm(struct phy_shim_info *physhim, uint offset, u16 v);
+u16 wlapi_bmac_read_shm(struct phy_shim_info *physhim, uint offset);
+void wlapi_bmac_mhf(struct phy_shim_info *physhim, u8 idx, u16 mask, u16 val,
+                    int bands);
+void wlapi_bmac_corereset(struct phy_shim_info *physhim, u32 flags);
+void wlapi_suspend_mac_and_wait(struct phy_shim_info *physhim);
+void wlapi_switch_macfreq(struct phy_shim_info *physhim, u8 spurmode);
+void wlapi_enable_mac(struct phy_shim_info *physhim);
+void wlapi_bmac_mctrl(struct phy_shim_info *physhim, u32 mask, u32 val);
+void wlapi_bmac_phy_reset(struct phy_shim_info *physhim);
+void wlapi_bmac_bw_set(struct phy_shim_info *physhim, u16 bw);
+void wlapi_bmac_phyclk_fgc(struct phy_shim_info *physhim, bool clk);
+void wlapi_bmac_macphyclk_set(struct phy_shim_info *physhim, bool clk);
+void wlapi_bmac_core_phypll_ctl(struct phy_shim_info *physhim, bool on);
+void wlapi_bmac_core_phypll_reset(struct phy_shim_info *physhim);
+void wlapi_bmac_ucode_wake_override_phyreg_set(struct phy_shim_info *physhim);
+void wlapi_bmac_ucode_wake_override_phyreg_clear(struct phy_shim_info *physhim);
+void wlapi_bmac_write_template_ram(struct phy_shim_info *physhim, int o,
+                                   int len, void *buf);
+u16 wlapi_bmac_rate_shm_offset(struct phy_shim_info *physhim, u8 rate);
+void wlapi_ucode_sample_init(struct phy_shim_info *physhim);
+void wlapi_copyfrom_objmem(struct phy_shim_info *physhim, uint, void *buf,
+                           int, u32 sel);
+void wlapi_copyto_objmem(struct phy_shim_info *physhim, uint, const void *buf,
+                         int, u32);
+
+void wlapi_high_update_phy_mode(struct phy_shim_info *physhim, u32 phy_mode);
+u16 wlapi_bmac_get_txant(struct phy_shim_info *physhim);
 
 #endif                          /* _BRCM_PHY_SHIM_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
index 20e2012d5a3a..a014bbc4f935 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pmu.h
@@ -20,7 +20,7 @@
 
 #include "types.h"
 
-extern u16 si_pmu_fast_pwrup_delay(struct si_pub *sih);
-extern u32 si_pmu_measure_alpclk(struct si_pub *sih);
+u16 si_pmu_fast_pwrup_delay(struct si_pub *sih);
+u32 si_pmu_measure_alpclk(struct si_pub *sih);
 
 #endif /* _BRCM_PMU_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index d36ea5e1cc49..4da38cb4f318 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -266,83 +266,76 @@ struct brcms_antselcfg {
 };
 
 /* common functions for every port */
-extern struct brcms_c_info *
-brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
-               bool piomode, uint *perr);
-extern uint brcms_c_detach(struct brcms_c_info *wlc);
-extern int brcms_c_up(struct brcms_c_info *wlc);
-extern uint brcms_c_down(struct brcms_c_info *wlc);
-
-extern bool brcms_c_chipmatch(struct bcma_device *core);
-extern void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx);
-extern void brcms_c_reset(struct brcms_c_info *wlc);
-
-extern void brcms_c_intrson(struct brcms_c_info *wlc);
-extern u32 brcms_c_intrsoff(struct brcms_c_info *wlc);
-extern void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask);
-extern bool brcms_c_intrsupd(struct brcms_c_info *wlc);
-extern bool brcms_c_isr(struct brcms_c_info *wlc);
-extern bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded);
-extern bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,
-                                     struct sk_buff *sdu,
-                                     struct ieee80211_hw *hw);
-extern bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid);
-extern void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx,
-                                   int val);
-extern int brcms_c_get_header_len(void);
-extern void brcms_c_set_addrmatch(struct brcms_c_info *wlc,
-                                  int match_reg_offset,
-                                  const u8 *addr);
-extern void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
-                              const struct ieee80211_tx_queue_params *arg,
-                              bool suspend);
-extern struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc);
-extern void brcms_c_ampdu_flush(struct brcms_c_info *wlc,
-                            struct ieee80211_sta *sta, u16 tid);
-extern void brcms_c_ampdu_tx_operational(struct brcms_c_info *wlc, u8 tid,
-                                         u8 ba_wsize, uint max_rx_ampdu_bytes);
-extern int brcms_c_module_register(struct brcms_pub *pub,
-                                   const char *name, struct brcms_info *hdl,
-                                   int (*down_fn)(void *handle));
-extern int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
-                                     struct brcms_info *hdl);
-extern void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc);
-extern void brcms_c_enable_mac(struct brcms_c_info *wlc);
-extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
-extern void brcms_c_scan_start(struct brcms_c_info *wlc);
-extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
-extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
-extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
-extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
+struct brcms_c_info *brcms_c_attach(struct brcms_info *wl,
+                                    struct bcma_device *core, uint unit,
+                                    bool piomode, uint *perr);
+uint brcms_c_detach(struct brcms_c_info *wlc);
+int brcms_c_up(struct brcms_c_info *wlc);
+uint brcms_c_down(struct brcms_c_info *wlc);
+
+bool brcms_c_chipmatch(struct bcma_device *core);
+void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx);
+void brcms_c_reset(struct brcms_c_info *wlc);
+
+void brcms_c_intrson(struct brcms_c_info *wlc);
+u32 brcms_c_intrsoff(struct brcms_c_info *wlc);
+void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask);
+bool brcms_c_intrsupd(struct brcms_c_info *wlc);
+bool brcms_c_isr(struct brcms_c_info *wlc);
+bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded);
+bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
+                              struct ieee80211_hw *hw);
+bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid);
+void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val);
+int brcms_c_get_header_len(void);
+void brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
+                           const u8 *addr);
+void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
+                           const struct ieee80211_tx_queue_params *arg,
+                           bool suspend);
+struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc);
+void brcms_c_ampdu_flush(struct brcms_c_info *wlc, struct ieee80211_sta *sta,
+                         u16 tid);
+void brcms_c_ampdu_tx_operational(struct brcms_c_info *wlc, u8 tid,
+                                  u8 ba_wsize, uint max_rx_ampdu_bytes);
+int brcms_c_module_register(struct brcms_pub *pub, const char *name,
+                            struct brcms_info *hdl,
+                            int (*down_fn)(void *handle));
+int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
+                              struct brcms_info *hdl);
+void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc);
+void brcms_c_enable_mac(struct brcms_c_info *wlc);
+void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
+void brcms_c_scan_start(struct brcms_c_info *wlc);
+void brcms_c_scan_stop(struct brcms_c_info *wlc);
+int brcms_c_get_curband(struct brcms_c_info *wlc);
+int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
+int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
+void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
                                  struct brcm_rateset *currs);
-extern int brcms_c_set_rateset(struct brcms_c_info *wlc,
-                                        struct brcm_rateset *rs);
-extern int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period);
-extern u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx);
-extern void brcms_c_set_shortslot_override(struct brcms_c_info *wlc,
+int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs);
+int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period);
+u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx);
+void brcms_c_set_shortslot_override(struct brcms_c_info *wlc,
                                     s8 sslot_override);
-extern void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc,
-                                        u8 interval);
-extern u64 brcms_c_tsf_get(struct brcms_c_info *wlc);
-extern void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf);
-extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
-extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
-extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
-extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
-extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
-extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
-extern void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr,
-                             const u8 *bssid, u8 *ssid, size_t ssid_len);
-extern void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr);
-extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
-extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
-                                   struct sk_buff *beacon, u16 tim_offset,
-                                   u16 dtim_period);
-extern void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
-                                       struct sk_buff *probe_resp);
-extern void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable);
-extern void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid,
-                             size_t ssid_len);
+void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval);
+u64 brcms_c_tsf_get(struct brcms_c_info *wlc);
+void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf);
+int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
+int brcms_c_get_tx_power(struct brcms_c_info *wlc);
+bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
+void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
+void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
+void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
+                      u8 *ssid, size_t ssid_len);
+void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr);
+void brcms_c_update_beacon(struct brcms_c_info *wlc);
+void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
+                            u16 tim_offset, u16 dtim_period);
+void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
+                                struct sk_buff *probe_resp);
+void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable);
+void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/rate.h b/drivers/net/wireless/brcm80211/brcmsmac/rate.h
index 980d578825cc..5bb88b78ed64 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/rate.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/rate.h
@@ -216,34 +216,30 @@ static inline u8 cck_phy2mac_rate(u8 signal)
 
 /* sanitize, and sort a rateset with the basic bit(s) preserved, validate
  * rateset */
-extern bool
-brcms_c_rate_hwrs_filter_sort_validate(struct brcms_c_rateset *rs,
-                                       const struct brcms_c_rateset *hw_rs,
-                                       bool check_brate, u8 txstreams);
+bool brcms_c_rate_hwrs_filter_sort_validate(struct brcms_c_rateset *rs,
+                                            const struct brcms_c_rateset *hw_rs,
+                                            bool check_brate, u8 txstreams);
 /* copy rateset src to dst as-is (no masking or sorting) */
-extern void brcms_c_rateset_copy(const struct brcms_c_rateset *src,
-                             struct brcms_c_rateset *dst);
+void brcms_c_rateset_copy(const struct brcms_c_rateset *src,
+                          struct brcms_c_rateset *dst);
 
 /* would be nice to have these documented ... */
-extern u32 brcms_c_compute_rspec(struct d11rxhdr *rxh, u8 *plcp);
-
-extern void brcms_c_rateset_filter(struct brcms_c_rateset *src,
-        struct brcms_c_rateset *dst, bool basic_only, u8 rates, uint xmask,
-        bool mcsallow);
-
-extern void
-brcms_c_rateset_default(struct brcms_c_rateset *rs_tgt,
-                        const struct brcms_c_rateset *rs_hw, uint phy_type,
-                        int bandtype, bool cck_only, uint rate_mask,
-                        bool mcsallow, u8 bw, u8 txstreams);
-
-extern s16 brcms_c_rate_legacy_phyctl(uint rate);
-
-extern void brcms_c_rateset_mcs_upd(struct brcms_c_rateset *rs, u8 txstreams);
-extern void brcms_c_rateset_mcs_clear(struct brcms_c_rateset *rateset);
-extern void brcms_c_rateset_mcs_build(struct brcms_c_rateset *rateset,
-                                      u8 txstreams);
-extern void brcms_c_rateset_bw_mcs_filter(struct brcms_c_rateset *rateset,
-                                          u8 bw);
+u32 brcms_c_compute_rspec(struct d11rxhdr *rxh, u8 *plcp);
+
+void brcms_c_rateset_filter(struct brcms_c_rateset *src,
+                            struct brcms_c_rateset *dst, bool basic_only,
+                            u8 rates, uint xmask, bool mcsallow);
+
+void brcms_c_rateset_default(struct brcms_c_rateset *rs_tgt,
+                             const struct brcms_c_rateset *rs_hw, uint phy_type,
+                             int bandtype, bool cck_only, uint rate_mask,
+                             bool mcsallow, u8 bw, u8 txstreams);
+
+s16 brcms_c_rate_legacy_phyctl(uint rate);
+
+void brcms_c_rateset_mcs_upd(struct brcms_c_rateset *rs, u8 txstreams);
+void brcms_c_rateset_mcs_clear(struct brcms_c_rateset *rateset);
+void brcms_c_rateset_mcs_build(struct brcms_c_rateset *rateset, u8 txstreams);
+void brcms_c_rateset_bw_mcs_filter(struct brcms_c_rateset *rateset, u8 bw);
 
 #endif                          /* _BRCM_RATE_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/stf.h b/drivers/net/wireless/brcm80211/brcmsmac/stf.h
index 19f6580f69be..ba9493009a33 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/stf.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/stf.h
@@ -19,24 +19,19 @@
 
 #include "types.h"
 
-extern int brcms_c_stf_attach(struct brcms_c_info *wlc);
-extern void brcms_c_stf_detach(struct brcms_c_info *wlc);
+int brcms_c_stf_attach(struct brcms_c_info *wlc);
+void brcms_c_stf_detach(struct brcms_c_info *wlc);
 
-extern void brcms_c_tempsense_upd(struct brcms_c_info *wlc);
-extern void brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc,
-                                        u16 *ss_algo_channel,
-                                        u16 chanspec);
-extern int brcms_c_stf_ss_update(struct brcms_c_info *wlc,
-                             struct brcms_band *band);
-extern void brcms_c_stf_phy_txant_upd(struct brcms_c_info *wlc);
-extern int brcms_c_stf_txchain_set(struct brcms_c_info *wlc, s32 int_val,
-                               bool force);
-extern bool brcms_c_stf_stbc_rx_set(struct brcms_c_info *wlc, s32 int_val);
-extern void brcms_c_stf_phy_txant_upd(struct brcms_c_info *wlc);
-extern void brcms_c_stf_phy_chain_calc(struct brcms_c_info *wlc);
-extern u16 brcms_c_stf_phytxchain_sel(struct brcms_c_info *wlc,
-                                      u32 rspec);
-extern u16 brcms_c_stf_d11hdrs_phyctl_txant(struct brcms_c_info *wlc,
-                                        u32 rspec);
+void brcms_c_tempsense_upd(struct brcms_c_info *wlc);
+void brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc,
+                                     u16 *ss_algo_channel, u16 chanspec);
+int brcms_c_stf_ss_update(struct brcms_c_info *wlc, struct brcms_band *band);
+void brcms_c_stf_phy_txant_upd(struct brcms_c_info *wlc);
+int brcms_c_stf_txchain_set(struct brcms_c_info *wlc, s32 int_val, bool force);
+bool brcms_c_stf_stbc_rx_set(struct brcms_c_info *wlc, s32 int_val);
+void brcms_c_stf_phy_txant_upd(struct brcms_c_info *wlc);
+void brcms_c_stf_phy_chain_calc(struct brcms_c_info *wlc);
+u16 brcms_c_stf_phytxchain_sel(struct brcms_c_info *wlc, u32 rspec);
+u16 brcms_c_stf_d11hdrs_phyctl_txant(struct brcms_c_info *wlc, u32 rspec);
 
 #endif                          /* _BRCM_STF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.h b/drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.h
index 18750a814b4f..c87dd89bcb78 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.h
@@ -43,16 +43,14 @@ struct brcms_ucode {
         u32 *bcm43xx_bomminor;
 };
 
-extern int
-brcms_ucode_data_init(struct brcms_info *wl, struct brcms_ucode *ucode);
+int brcms_ucode_data_init(struct brcms_info *wl, struct brcms_ucode *ucode);
 
-extern void brcms_ucode_data_free(struct brcms_ucode *ucode);
+void brcms_ucode_data_free(struct brcms_ucode *ucode);
 
-extern int brcms_ucode_init_buf(struct brcms_info *wl, void **pbuf,
-                                unsigned int idx);
-extern int brcms_ucode_init_uint(struct brcms_info *wl, size_t *n_bytes,
-                                 unsigned int idx);
-extern void brcms_ucode_free_buf(void *);
-extern int  brcms_check_firmwares(struct brcms_info *wl);
+int brcms_ucode_init_buf(struct brcms_info *wl, void **pbuf, unsigned int idx);
+int brcms_ucode_init_uint(struct brcms_info *wl, size_t *n_bytes,
+                          unsigned int idx);
+void brcms_ucode_free_buf(void *);
+int  brcms_check_firmwares(struct brcms_info *wl);
 
 #endif  /* _BRCM_UCODE_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index c1fe245bb07e..84113ea16f84 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -41,5 +41,6 @@
 #define BCM4331_CHIP_ID         0x4331
 #define BCM4334_CHIP_ID         0x4334
 #define BCM4335_CHIP_ID         0x4335
+#define BCM4339_CHIP_ID         0x4339
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_d11.h b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
index 92623f02b1c0..8660a2cba098 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_d11.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
@@ -140,6 +140,6 @@ struct brcmu_d11inf {
         void (*decchspec)(struct brcmu_chan *ch);
 };
 
-extern void brcmu_d11_attach(struct brcmu_d11inf *d11inf);
+void brcmu_d11_attach(struct brcmu_d11inf *d11inf);
 
 #endif  /* _BRCMU_CHANNELS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_utils.h b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
index 898cacb8d01d..8ba445b3fd72 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_utils.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
@@ -114,31 +114,29 @@ static inline struct sk_buff *pktq_ppeek_tail(struct pktq *pq, int prec)
         return skb_peek_tail(&pq->q[prec].skblist);
 }
 
-extern struct sk_buff *brcmu_pktq_penq(struct pktq *pq, int prec,
-                                 struct sk_buff *p);
-extern struct sk_buff *brcmu_pktq_penq_head(struct pktq *pq, int prec,
-                                      struct sk_buff *p);
-extern struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec);
-extern struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec);
-extern struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
-                                             bool (*match_fn)(struct sk_buff *p,
-                                                              void *arg),
-                                             void *arg);
+struct sk_buff *brcmu_pktq_penq(struct pktq *pq, int prec, struct sk_buff *p);
+struct sk_buff *brcmu_pktq_penq_head(struct pktq *pq, int prec,
+                                     struct sk_buff *p);
+struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec);
+struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec);
+struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
+                                      bool (*match_fn)(struct sk_buff *p,
+                                                       void *arg),
+                                      void *arg);
 
 /* packet primitives */
-extern struct sk_buff *brcmu_pkt_buf_get_skb(uint len);
-extern void brcmu_pkt_buf_free_skb(struct sk_buff *skb);
+struct sk_buff *brcmu_pkt_buf_get_skb(uint len);
+void brcmu_pkt_buf_free_skb(struct sk_buff *skb);
 
 /* Empty the queue at particular precedence level */
 /* callback function fn(pkt, arg) returns true if pkt belongs to if */
-extern void brcmu_pktq_pflush(struct pktq *pq, int prec,
-        bool dir, bool (*fn)(struct sk_buff *, void *), void *arg);
+void brcmu_pktq_pflush(struct pktq *pq, int prec, bool dir,
+                       bool (*fn)(struct sk_buff *, void *), void *arg);
 
 /* operations on a set of precedences in packet queue */
 
-extern int brcmu_pktq_mlen(struct pktq *pq, uint prec_bmp);
-extern struct sk_buff *brcmu_pktq_mdeq(struct pktq *pq, uint prec_bmp,
-        int *prec_out);
+int brcmu_pktq_mlen(struct pktq *pq, uint prec_bmp);
+struct sk_buff *brcmu_pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
 
 /* operations on packet queue as a whole */
 
@@ -167,11 +165,11 @@ static inline bool pktq_empty(struct pktq *pq)
         return pq->len == 0;
 }
 
-extern void brcmu_pktq_init(struct pktq *pq, int num_prec, int max_len);
+void brcmu_pktq_init(struct pktq *pq, int num_prec, int max_len);
 /* prec_out may be NULL if caller is not interested in return value */
-extern struct sk_buff *brcmu_pktq_peek_tail(struct pktq *pq, int *prec_out);
-extern void brcmu_pktq_flush(struct pktq *pq, bool dir,
-                bool (*fn)(struct sk_buff *, void *), void *arg);
+struct sk_buff *brcmu_pktq_peek_tail(struct pktq *pq, int *prec_out);
+void brcmu_pktq_flush(struct pktq *pq, bool dir,
+                      bool (*fn)(struct sk_buff *, void *), void *arg);
 
 /* externs */
 /* ip address */
@@ -204,13 +202,13 @@ static inline u16 brcmu_maskget16(u16 var, u16 mask, u8 shift)
 /* externs */
 /* format/print */
 #ifdef DEBUG
-extern void brcmu_prpkt(const char *msg, struct sk_buff *p0);
+void brcmu_prpkt(const char *msg, struct sk_buff *p0);
 #else
 #define brcmu_prpkt(a, b)
 #endif                          /* DEBUG */
 
 #ifdef DEBUG
-extern __printf(3, 4)
+__printf(3, 4)
 void brcmu_dbg_hex_dump(const void *data, size_t size, const char *fmt, ...);
 #else
 __printf(3, 4)
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index 755a0c8edfe1..40078f5f932e 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -365,7 +365,7 @@ static struct hwbus_ops cw1200_spi_hwbus_ops = {
 static int cw1200_spi_probe(struct spi_device *func)
 {
         const struct cw1200_platform_data_spi *plat_data =
-                func->dev.platform_data;
+                dev_get_platdata(&func->dev);
         struct hwbus_priv *self;
         int status;
 
@@ -443,7 +443,7 @@ static int cw1200_spi_disconnect(struct spi_device *func)
                 }
                 kfree(self);
         }
-        cw1200_spi_off(func->dev.platform_data);
+        cw1200_spi_off(dev_get_platdata(&func->dev));
 
         return 0;
 }
diff --git a/drivers/net/wireless/hostap/hostap_info.c b/drivers/net/wireless/hostap/hostap_info.c
index 970a48baaf80..de7c4ffec309 100644
--- a/drivers/net/wireless/hostap/hostap_info.c
+++ b/drivers/net/wireless/hostap/hostap_info.c
@@ -217,7 +217,7 @@ static void prism2_host_roaming(local_info_t *local)
                 }
         }
 
-        memcpy(req.bssid, selected->bssid, 6);
+        memcpy(req.bssid, selected->bssid, ETH_ALEN);
         req.channel = selected->chid;
         spin_unlock_irqrestore(&local->lock, flags);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6b823a1ab789..81903e33d5b1 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2698,7 +2698,7 @@ static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
 /* data's copy of the eeprom data                                 */
 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
 {
-        memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
+        memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], ETH_ALEN);
 }
 
 static void ipw_read_eeprom(struct ipw_priv *priv)
@@ -11885,7 +11885,6 @@ static int ipw_pci_probe(struct pci_dev *pdev,
         pci_release_regions(pdev);
       out_pci_disable_device:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
       out_free_libipw:
         free_libipw(priv->net_dev, 0);
       out:
@@ -11966,7 +11965,6 @@ static void ipw_pci_remove(struct pci_dev *pdev)
         iounmap(priv->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         /* wiphy_unregister needs to be here, before free_libipw */
         wiphy_unregister(priv->ieee->wdev.wiphy);
         kfree(priv->ieee->a_band.channels);
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index 6eede52ad8c0..5ce2f59d3378 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -950,66 +950,55 @@ static inline int libipw_is_cck_rate(u8 rate)
 }
 
 /* libipw.c */
-extern void free_libipw(struct net_device *dev, int monitor);
-extern struct net_device *alloc_libipw(int sizeof_priv, int monitor);
-extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
+void free_libipw(struct net_device *dev, int monitor);
+struct net_device *alloc_libipw(int sizeof_priv, int monitor);
+int libipw_change_mtu(struct net_device *dev, int new_mtu);
 
-extern void libipw_networks_age(struct libipw_device *ieee,
-                                   unsigned long age_secs);
+void libipw_networks_age(struct libipw_device *ieee, unsigned long age_secs);
 
-extern int libipw_set_encryption(struct libipw_device *ieee);
+int libipw_set_encryption(struct libipw_device *ieee);
 
 /* libipw_tx.c */
-extern netdev_tx_t libipw_xmit(struct sk_buff *skb,
-                               struct net_device *dev);
-extern void libipw_txb_free(struct libipw_txb *);
+netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev);
+void libipw_txb_free(struct libipw_txb *);
 
 /* libipw_rx.c */
-extern void libipw_rx_any(struct libipw_device *ieee,
-                     struct sk_buff *skb, struct libipw_rx_stats *stats);
-extern int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb,
-                        struct libipw_rx_stats *rx_stats);
+void libipw_rx_any(struct libipw_device *ieee, struct sk_buff *skb,
+                   struct libipw_rx_stats *stats);
+int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb,
+              struct libipw_rx_stats *rx_stats);
 /* make sure to set stats->len */
-extern void libipw_rx_mgt(struct libipw_device *ieee,
-                             struct libipw_hdr_4addr *header,
-                             struct libipw_rx_stats *stats);
-extern void libipw_network_reset(struct libipw_network *network);
+void libipw_rx_mgt(struct libipw_device *ieee, struct libipw_hdr_4addr *header,
+                   struct libipw_rx_stats *stats);
+void libipw_network_reset(struct libipw_network *network);
 
 /* libipw_geo.c */
-extern const struct libipw_geo *libipw_get_geo(struct libipw_device
-                                                     *ieee);
-extern void libipw_set_geo(struct libipw_device *ieee,
-                             const struct libipw_geo *geo);
-
-extern int libipw_is_valid_channel(struct libipw_device *ieee,
-                                      u8 channel);
-extern int libipw_channel_to_index(struct libipw_device *ieee,
-                                      u8 channel);
-extern u8 libipw_freq_to_channel(struct libipw_device *ieee, u32 freq);
-extern u8 libipw_get_channel_flags(struct libipw_device *ieee,
-                                      u8 channel);
-extern const struct libipw_channel *libipw_get_channel(struct
-                                                             libipw_device
-                                                             *ieee, u8 channel);
-extern u32 libipw_channel_to_freq(struct libipw_device * ieee,
-                                      u8 channel);
+const struct libipw_geo *libipw_get_geo(struct libipw_device *ieee);
+void libipw_set_geo(struct libipw_device *ieee, const struct libipw_geo *geo);
+
+int libipw_is_valid_channel(struct libipw_device *ieee, u8 channel);
+int libipw_channel_to_index(struct libipw_device *ieee, u8 channel);
+u8 libipw_freq_to_channel(struct libipw_device *ieee, u32 freq);
+u8 libipw_get_channel_flags(struct libipw_device *ieee, u8 channel);
+const struct libipw_channel *libipw_get_channel(struct libipw_device *ieee,
+                                                u8 channel);
+u32 libipw_channel_to_freq(struct libipw_device *ieee, u8 channel);
 
 /* libipw_wx.c */
-extern int libipw_wx_get_scan(struct libipw_device *ieee,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *key);
-extern int libipw_wx_set_encode(struct libipw_device *ieee,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *key);
-extern int libipw_wx_get_encode(struct libipw_device *ieee,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *key);
-extern int libipw_wx_set_encodeext(struct libipw_device *ieee,
-                                      struct iw_request_info *info,
-                                      union iwreq_data *wrqu, char *extra);
-extern int libipw_wx_get_encodeext(struct libipw_device *ieee,
-                                      struct iw_request_info *info,
-                                      union iwreq_data *wrqu, char *extra);
+int libipw_wx_get_scan(struct libipw_device *ieee, struct iw_request_info *info,
+                       union iwreq_data *wrqu, char *key);
+int libipw_wx_set_encode(struct libipw_device *ieee,
+                         struct iw_request_info *info, union iwreq_data *wrqu,
+                         char *key);
+int libipw_wx_get_encode(struct libipw_device *ieee,
+                         struct iw_request_info *info, union iwreq_data *wrqu,
+                         char *key);
+int libipw_wx_set_encodeext(struct libipw_device *ieee,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra);
+int libipw_wx_get_encodeext(struct libipw_device *ieee,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra);
 
 static inline void libipw_increment_scans(struct libipw_device *ieee)
 {
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 9581d07a4242..dea3b50d68b9 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3811,7 +3811,6 @@ out_iounmap:
 out_pci_release_regions:
         pci_release_regions(pdev);
 out_pci_disable_device:
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
 out_ieee80211_free_hw:
         ieee80211_free_hw(il->hw);
@@ -3888,7 +3887,6 @@ il3945_pci_remove(struct pci_dev *pdev)
         iounmap(il->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         il_free_channel_map(il);
         il_free_geos(il);
diff --git a/drivers/net/wireless/iwlegacy/3945.h b/drivers/net/wireless/iwlegacy/3945.h
index 9a8703def0ba..00030d43a194 100644
--- a/drivers/net/wireless/iwlegacy/3945.h
+++ b/drivers/net/wireless/iwlegacy/3945.h
@@ -189,15 +189,14 @@ struct il3945_ibss_seq {
  * for use by iwl-*.c
  *
  *****************************************************************************/
-extern int il3945_calc_db_from_ratio(int sig_ratio);
-extern void il3945_rx_replenish(void *data);
-extern void il3945_rx_queue_reset(struct il_priv *il, struct il_rx_queue *rxq);
-extern unsigned int il3945_fill_beacon_frame(struct il_priv *il,
-                                             struct ieee80211_hdr *hdr,
-                                             int left);
-extern int il3945_dump_nic_event_log(struct il_priv *il, bool full_log,
-                                     char **buf, bool display);
-extern void il3945_dump_nic_error_log(struct il_priv *il);
+int il3945_calc_db_from_ratio(int sig_ratio);
+void il3945_rx_replenish(void *data);
+void il3945_rx_queue_reset(struct il_priv *il, struct il_rx_queue *rxq);
+unsigned int il3945_fill_beacon_frame(struct il_priv *il,
+                                      struct ieee80211_hdr *hdr, int left);
+int il3945_dump_nic_event_log(struct il_priv *il, bool full_log, char **buf,
+                              bool display);
+void il3945_dump_nic_error_log(struct il_priv *il);
 
 /******************************************************************************
  *
@@ -215,39 +214,36 @@ extern void il3945_dump_nic_error_log(struct il_priv *il);
  * il3945_mac_     <-- mac80211 callback
  *
  ****************************************************************************/
-extern void il3945_hw_handler_setup(struct il_priv *il);
-extern void il3945_hw_setup_deferred_work(struct il_priv *il);
-extern void il3945_hw_cancel_deferred_work(struct il_priv *il);
-extern int il3945_hw_rxq_stop(struct il_priv *il);
-extern int il3945_hw_set_hw_params(struct il_priv *il);
-extern int il3945_hw_nic_init(struct il_priv *il);
-extern int il3945_hw_nic_stop_master(struct il_priv *il);
-extern void il3945_hw_txq_ctx_free(struct il_priv *il);
-extern void il3945_hw_txq_ctx_stop(struct il_priv *il);
-extern int il3945_hw_nic_reset(struct il_priv *il);
-extern int il3945_hw_txq_attach_buf_to_tfd(struct il_priv *il,
-                                           struct il_tx_queue *txq,
-                                           dma_addr_t addr, u16 len, u8 reset,
-                                           u8 pad);
-extern void il3945_hw_txq_free_tfd(struct il_priv *il, struct il_tx_queue *txq);
-extern int il3945_hw_get_temperature(struct il_priv *il);
-extern int il3945_hw_tx_queue_init(struct il_priv *il, struct il_tx_queue *txq);
-extern unsigned int il3945_hw_get_beacon_cmd(struct il_priv *il,
-                                             struct il3945_frame *frame,
-                                             u8 rate);
+void il3945_hw_handler_setup(struct il_priv *il);
+void il3945_hw_setup_deferred_work(struct il_priv *il);
+void il3945_hw_cancel_deferred_work(struct il_priv *il);
+int il3945_hw_rxq_stop(struct il_priv *il);
+int il3945_hw_set_hw_params(struct il_priv *il);
+int il3945_hw_nic_init(struct il_priv *il);
+int il3945_hw_nic_stop_master(struct il_priv *il);
+void il3945_hw_txq_ctx_free(struct il_priv *il);
+void il3945_hw_txq_ctx_stop(struct il_priv *il);
+int il3945_hw_nic_reset(struct il_priv *il);
+int il3945_hw_txq_attach_buf_to_tfd(struct il_priv *il, struct il_tx_queue *txq,
+                                    dma_addr_t addr, u16 len, u8 reset, u8 pad);
+void il3945_hw_txq_free_tfd(struct il_priv *il, struct il_tx_queue *txq);
+int il3945_hw_get_temperature(struct il_priv *il);
+int il3945_hw_tx_queue_init(struct il_priv *il, struct il_tx_queue *txq);
+unsigned int il3945_hw_get_beacon_cmd(struct il_priv *il,
+                                      struct il3945_frame *frame, u8 rate);
 void il3945_hw_build_tx_cmd_rate(struct il_priv *il, struct il_device_cmd *cmd,
                                  struct ieee80211_tx_info *info,
                                  struct ieee80211_hdr *hdr, int sta_id);
-extern int il3945_hw_reg_send_txpower(struct il_priv *il);
-extern int il3945_hw_reg_set_txpower(struct il_priv *il, s8 power);
-extern void il3945_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb);
+int il3945_hw_reg_send_txpower(struct il_priv *il);
+int il3945_hw_reg_set_txpower(struct il_priv *il, s8 power);
+void il3945_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb);
 void il3945_hdl_c_stats(struct il_priv *il, struct il_rx_buf *rxb);
-extern void il3945_disable_events(struct il_priv *il);
-extern int il4965_get_temperature(const struct il_priv *il);
-extern void il3945_post_associate(struct il_priv *il);
-extern void il3945_config_ap(struct il_priv *il);
+void il3945_disable_events(struct il_priv *il);
+int il4965_get_temperature(const struct il_priv *il);
+void il3945_post_associate(struct il_priv *il);
+void il3945_config_ap(struct il_priv *il);
 
-extern int il3945_commit_rxon(struct il_priv *il);
+int il3945_commit_rxon(struct il_priv *il);
 
 /**
  * il3945_hw_find_station - Find station id for a given BSSID
@@ -257,14 +253,14 @@ extern int il3945_commit_rxon(struct il_priv *il);
  * not yet been merged into a single common layer for managing the
  * station tables.
  */
-extern u8 il3945_hw_find_station(struct il_priv *il, const u8 * bssid);
+u8 il3945_hw_find_station(struct il_priv *il, const u8 *bssid);
 
-extern __le32 il3945_get_antenna_flags(const struct il_priv *il);
-extern int il3945_init_hw_rate_table(struct il_priv *il);
-extern void il3945_reg_txpower_periodic(struct il_priv *il);
-extern int il3945_txpower_set_from_eeprom(struct il_priv *il);
+__le32 il3945_get_antenna_flags(const struct il_priv *il);
+int il3945_init_hw_rate_table(struct il_priv *il);
+void il3945_reg_txpower_periodic(struct il_priv *il);
+int il3945_txpower_set_from_eeprom(struct il_priv *il);
 
-extern int il3945_rs_next_rate(struct il_priv *il, int rate);
+int il3945_rs_next_rate(struct il_priv *il, int rate);
 
 /* scanning */
 int il3945_request_scan(struct il_priv *il, struct ieee80211_vif *vif);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 5ab50a5b48b1..3982ab76f375 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6706,7 +6706,6 @@ out_free_eeprom:
 out_iounmap:
         iounmap(il->hw_base);
 out_pci_release_regions:
-        pci_set_drvdata(pdev, NULL);
         pci_release_regions(pdev);
 out_pci_disable_device:
         pci_disable_device(pdev);
@@ -6787,7 +6786,6 @@ il4965_pci_remove(struct pci_dev *pdev)
         iounmap(il->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         il4965_uninit_drv(il);
 
diff --git a/drivers/net/wireless/iwlegacy/4965.h b/drivers/net/wireless/iwlegacy/4965.h
index 1b15b0b2292b..337dfcf3bbde 100644
--- a/drivers/net/wireless/iwlegacy/4965.h
+++ b/drivers/net/wireless/iwlegacy/4965.h
@@ -272,7 +272,7 @@ il4965_hw_valid_rtc_data_addr(u32 addr)
         ((t) < IL_TX_POWER_TEMPERATURE_MIN || \
          (t) > IL_TX_POWER_TEMPERATURE_MAX)
 
-extern void il4965_temperature_calib(struct il_priv *il);
+void il4965_temperature_calib(struct il_priv *il);
 /********************* END TEMPERATURE ***************************************/
 
 /********************* START TXPOWER *****************************************/
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index 83f8ed8a5528..ad123d66ab6c 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -858,9 +858,9 @@ struct il_hw_params {
  * il4965_mac_     <-- mac80211 callback
  *
  ****************************************************************************/
-extern void il4965_update_chain_flags(struct il_priv *il);
+void il4965_update_chain_flags(struct il_priv *il);
 extern const u8 il_bcast_addr[ETH_ALEN];
-extern int il_queue_space(const struct il_queue *q);
+int il_queue_space(const struct il_queue *q);
 static inline int
 il_queue_used(const struct il_queue *q, int i)
 {
@@ -1727,7 +1727,7 @@ int il_alloc_txq_mem(struct il_priv *il);
 void il_free_txq_mem(struct il_priv *il);
 
 #ifdef CONFIG_IWLEGACY_DEBUGFS
-extern void il_update_stats(struct il_priv *il, bool is_tx, __le16 fc, u16 len);
+void il_update_stats(struct il_priv *il, bool is_tx, __le16 fc, u16 len);
 #else
 static inline void
 il_update_stats(struct il_priv *il, bool is_tx, __le16 fc, u16 len)
@@ -1760,12 +1760,12 @@ void il_chswitch_done(struct il_priv *il, bool is_success);
 /*****************************************************
 * TX
 ******************************************************/
-extern void il_txq_update_write_ptr(struct il_priv *il, struct il_tx_queue *txq);
-extern int il_tx_queue_init(struct il_priv *il, u32 txq_id);
-extern void il_tx_queue_reset(struct il_priv *il, u32 txq_id);
-extern void il_tx_queue_unmap(struct il_priv *il, int txq_id);
-extern void il_tx_queue_free(struct il_priv *il, int txq_id);
-extern void il_setup_watchdog(struct il_priv *il);
+void il_txq_update_write_ptr(struct il_priv *il, struct il_tx_queue *txq);
+int il_tx_queue_init(struct il_priv *il, u32 txq_id);
+void il_tx_queue_reset(struct il_priv *il, u32 txq_id);
+void il_tx_queue_unmap(struct il_priv *il, int txq_id);
+void il_tx_queue_free(struct il_priv *il, int txq_id);
+void il_setup_watchdog(struct il_priv *il);
 /*****************************************************
  * TX power
  ****************************************************/
@@ -1931,10 +1931,10 @@ il_is_ready_rf(struct il_priv *il)
         return il_is_ready(il);
 }
 
-extern void il_send_bt_config(struct il_priv *il);
-extern int il_send_stats_request(struct il_priv *il, u8 flags, bool clear);
-extern void il_apm_stop(struct il_priv *il);
-extern void _il_apm_stop(struct il_priv *il);
+void il_send_bt_config(struct il_priv *il);
+int il_send_stats_request(struct il_priv *il, u8 flags, bool clear);
+void il_apm_stop(struct il_priv *il);
+void _il_apm_stop(struct il_priv *il);
 
 int il_apm_init(struct il_priv *il);
 
@@ -1968,15 +1968,15 @@ void il_tx_cmd_protection(struct il_priv *il, struct ieee80211_tx_info *info,
 
 irqreturn_t il_isr(int irq, void *data);
 
-extern void il_set_bit(struct il_priv *p, u32 r, u32 m);
-extern void il_clear_bit(struct il_priv *p, u32 r, u32 m);
-extern bool _il_grab_nic_access(struct il_priv *il);
-extern int _il_poll_bit(struct il_priv *il, u32 addr, u32 bits, u32 mask, int timeout);
-extern int il_poll_bit(struct il_priv *il, u32 addr, u32 mask, int timeout);
-extern u32 il_rd_prph(struct il_priv *il, u32 reg);
-extern void il_wr_prph(struct il_priv *il, u32 addr, u32 val);
-extern u32 il_read_targ_mem(struct il_priv *il, u32 addr);
-extern void il_write_targ_mem(struct il_priv *il, u32 addr, u32 val);
+void il_set_bit(struct il_priv *p, u32 r, u32 m);
+void il_clear_bit(struct il_priv *p, u32 r, u32 m);
+bool _il_grab_nic_access(struct il_priv *il);
+int _il_poll_bit(struct il_priv *il, u32 addr, u32 bits, u32 mask, int timeout);
+int il_poll_bit(struct il_priv *il, u32 addr, u32 mask, int timeout);
+u32 il_rd_prph(struct il_priv *il, u32 reg);
+void il_wr_prph(struct il_priv *il, u32 addr, u32 val);
+u32 il_read_targ_mem(struct il_priv *il, u32 addr);
+void il_write_targ_mem(struct il_priv *il, u32 addr, u32 val);
 
 static inline void
 _il_write8(struct il_priv *il, u32 ofs, u8 val)
@@ -2868,13 +2868,13 @@ il4965_first_antenna(u8 mask)
  * The specific throughput table used is based on the type of network
  * the associated with, including A, B, G, and G w/ TGG protection
  */
-extern void il3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id);
+void il3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id);
 
 /* Initialize station's rate scaling information after adding station */
-extern void il4965_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta,
-                                u8 sta_id);
-extern void il3945_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta,
-                                u8 sta_id);
+void il4965_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta,
+                         u8 sta_id);
+void il3945_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta,
+                         u8 sta_id);
 
 /**
  * il_rate_control_register - Register the rate control algorithm callbacks
@@ -2886,8 +2886,8 @@ extern void il3945_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta,
  * ieee80211_register_hw
  *
  */
-extern int il4965_rate_control_register(void);
-extern int il3945_rate_control_register(void);
+int il4965_rate_control_register(void);
+int il3945_rate_control_register(void);
 
 /**
  * il_rate_control_unregister - Unregister the rate control callbacks
@@ -2895,11 +2895,11 @@ extern int il3945_rate_control_register(void);
  * This should be called after calling ieee80211_unregister_hw, but before
  * the driver is unloaded.
  */
-extern void il4965_rate_control_unregister(void);
-extern void il3945_rate_control_unregister(void);
+void il4965_rate_control_unregister(void);
+void il3945_rate_control_unregister(void);
 
-extern int il_power_update_mode(struct il_priv *il, bool force);
-extern void il_power_initialize(struct il_priv *il);
+int il_power_update_mode(struct il_priv *il, bool force);
+void il_power_initialize(struct il_priv *il);
 
 extern u32 il_debug_level;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index f2a86ffc3b4c..23d5f0275ce9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -397,7 +397,7 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
         return cpu_to_le32(flags|(u32)rate);
 }
 
-extern int iwl_alive_start(struct iwl_priv *priv);
+int iwl_alive_start(struct iwl_priv *priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 void iwl_print_rx_config_cmd(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index a79fdd137f95..7434d9edf3b7 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -270,7 +270,7 @@ struct iwl_sensitivity_ranges {
  * iwlXXXX_     <-- Hardware specific (implemented in iwl-XXXX.c for XXXX)
  *
  ****************************************************************************/
-extern void iwl_update_chain_flags(struct iwl_priv *priv);
+void iwl_update_chain_flags(struct iwl_priv *priv);
 extern const u8 iwl_bcast_addr[ETH_ALEN];
 
 #define IWL_OPERATION_MODE_AUTO     0
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.h b/drivers/net/wireless/iwlwifi/dvm/rs.h
index 5d83cab22d62..26fc550cd68c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.h
@@ -407,8 +407,8 @@ static inline u8 first_antenna(u8 mask)
 
 
 /* Initialize station's rate scaling information after adding station */
-extern void iwl_rs_rate_init(struct iwl_priv *priv,
-                             struct ieee80211_sta *sta, u8 sta_id);
+void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                      u8 sta_id);
 
 /**
  * iwl_rate_control_register - Register the rate control algorithm callbacks
@@ -420,7 +420,7 @@ extern void iwl_rs_rate_init(struct iwl_priv *priv,
  * ieee80211_register_hw
  *
  */
-extern int iwlagn_rate_control_register(void);
+int iwlagn_rate_control_register(void);
 
 /**
  * iwl_rate_control_unregister - Unregister the rate control callbacks
@@ -428,6 +428,6 @@ extern int iwlagn_rate_control_register(void);
  * This should be called after calling ieee80211_unregister_hw, but before
  * the driver is unloaded.
  */
-extern void iwlagn_rate_control_unregister(void);
+void iwlagn_rate_control_unregister(void);
 
 #endif /* __iwl_agn__rs__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 335cf1682902..465d40ee176f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -314,9 +314,8 @@ static inline u8 num_of_ant(u8 mask)
 }
 
 /* Initialize station's rate scaling information after adding station */
-extern void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm,
-                                 struct ieee80211_sta *sta,
-                                 enum ieee80211_band band);
+void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                          enum ieee80211_band band);
 
 /**
  * iwl_rate_control_register - Register the rate control algorithm callbacks
@@ -328,7 +327,7 @@ extern void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm,
  * ieee80211_register_hw
  *
  */
-extern int iwl_mvm_rate_control_register(void);
+int iwl_mvm_rate_control_register(void);
 
 /**
  * iwl_rate_control_unregister - Unregister the rate control callbacks
@@ -336,7 +335,7 @@ extern int iwl_mvm_rate_control_register(void);
  * This should be called after calling ieee80211_unregister_hw, but before
  * the driver is unloaded.
  */
-extern void iwl_mvm_rate_control_unregister(void);
+void iwl_mvm_rate_control_unregister(void);
 
 struct iwl_mvm_sta;
 
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 4bb6574f4073..5d39ec880d84 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1128,7 +1128,7 @@ static int if_spi_probe(struct spi_device *spi)
 {
         struct if_spi_card *card;
         struct lbs_private *priv = NULL;
-        struct libertas_spi_platform_data *pdata = spi->dev.platform_data;
+        struct libertas_spi_platform_data *pdata = dev_get_platdata(&spi->dev);
         int err = 0;
 
         lbs_deb_enter(LBS_DEB_SPI);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index a6c46f3b6e3a..e47f4e3012b8 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1048,7 +1048,7 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
         unsigned long cmd_flags;
         unsigned long scan_pending_q_flags;
-        uint16_t cancel_scan_cmd = false;
+        bool cancel_scan_cmd = false;
 
         if ((adapter->curr_cmd) &&
             (adapter->curr_cmd->wait_q_enabled)) {
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 37f873bb342f..4e4686e6ac09 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -621,7 +621,7 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
         int ret = 0;
         struct ieee_types_assoc_rsp *assoc_rsp;
         struct mwifiex_bssdescriptor *bss_desc;
-        u8 enable_data = true;
+        bool enable_data = true;
         u16 cap_info, status_code;
 
         assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index c2b91f566e05..9d7c9d354d34 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -882,7 +882,9 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         adapter->cmd_wait_q.status = 0;
         adapter->scan_wait_q_woken = false;
 
-        adapter->workqueue = create_workqueue("MWIFIEX_WORK_QUEUE");
+        adapter->workqueue =
+                alloc_workqueue("MWIFIEX_WORK_QUEUE",
+                                WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
         if (!adapter->workqueue)
                 goto err_kmalloc;
 
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 52da8ee7599a..33fa9432b241 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -93,7 +93,7 @@ static int mwifiex_pcie_suspend(struct device *dev)
         struct pci_dev *pdev = to_pci_dev(dev);
 
         if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                card = pci_get_drvdata(pdev);
                 if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
@@ -128,7 +128,7 @@ static int mwifiex_pcie_resume(struct device *dev)
         struct pci_dev *pdev = to_pci_dev(dev);
 
         if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                card = pci_get_drvdata(pdev);
                 if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
@@ -2037,7 +2037,7 @@ static irqreturn_t mwifiex_pcie_interrupt(int irq, void *context)
                 goto exit;
         }
 
-        card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+        card = pci_get_drvdata(pdev);
         if (!card || !card->adapter) {
                 pr_debug("info: %s: card=%p adapter=%p\n", __func__, card,
                          card ? card->adapter : NULL);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index c0268b597748..7d66018a2e33 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -327,7 +327,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct host_cmd_ds_802_11_hs_cfg_enh *hs_cfg = &cmd->params.opt_hs_cfg;
-        u16 hs_activate = false;
+        bool hs_activate = false;
 
         if (!hscfg_param)
                 /* New Activate command */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 95fa3599b407..5dd0ccc70b86 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -708,7 +708,7 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 {
         u8 *curr = (u8 *) &resp->params.get_wmm_status;
         uint16_t resp_len = le16_to_cpu(resp->size), tlv_len;
-        int valid = true;
+        bool valid = true;
 
         struct mwifiex_ie_types_data *tlv_hdr;
         struct mwifiex_ie_types_wmm_queue_status *tlv_wmm_qstatus;
diff --git a/drivers/net/wireless/mwifiex/wmm.h b/drivers/net/wireless/mwifiex/wmm.h
index 644d6e0c51cc..0f129d498fb1 100644
--- a/drivers/net/wireless/mwifiex/wmm.h
+++ b/drivers/net/wireless/mwifiex/wmm.h
@@ -83,11 +83,10 @@ mwifiex_wmm_is_ra_list_empty(struct list_head *ra_list_hhead)
 }
 
 void mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
-                                        struct sk_buff *skb);
+                                 struct sk_buff *skb);
 void mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra);
 void mwifiex_rotate_priolists(struct mwifiex_private *priv,
-                              struct mwifiex_ra_list_tbl *ra,
-                              int tid);
+                              struct mwifiex_ra_list_tbl *ra, int tid);
 
 int mwifiex_wmm_lists_empty(struct mwifiex_adapter *adapter);
 void mwifiex_wmm_process_tx(struct mwifiex_adapter *adapter);
@@ -95,21 +94,18 @@ int mwifiex_is_ralist_valid(struct mwifiex_private *priv,
                             struct mwifiex_ra_list_tbl *ra_list, int tid);
 
 u8 mwifiex_wmm_compute_drv_pkt_delay(struct mwifiex_private *priv,
-                                             const struct sk_buff *skb);
+                                     const struct sk_buff *skb);
 void mwifiex_wmm_init(struct mwifiex_adapter *adapter);
 
-extern u32 mwifiex_wmm_process_association_req(struct mwifiex_private *priv,
-                                                 u8 **assoc_buf,
-                                                 struct ieee_types_wmm_parameter
-                                                 *wmmie,
-                                                 struct ieee80211_ht_cap
-                                                 *htcap);
+u32 mwifiex_wmm_process_association_req(struct mwifiex_private *priv,
+                                        u8 **assoc_buf,
+                                        struct ieee_types_wmm_parameter *wmmie,
+                                        struct ieee80211_ht_cap *htcap);
 
 void mwifiex_wmm_setup_queue_priorities(struct mwifiex_private *priv,
-                                        struct ieee_types_wmm_parameter
-                                        *wmm_ie);
+                                        struct ieee_types_wmm_parameter *wmm_ie);
 void mwifiex_wmm_setup_ac_downgrade(struct mwifiex_private *priv);
-extern int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
-                                      const struct host_cmd_ds_command *resp);
+int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
+                               const struct host_cmd_ds_command *resp);
 
 #endif /* !_MWIFIEX_WMM_H_ */
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a3707fd4ef62..b953ad621e0b 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -6093,7 +6093,6 @@ err_iounmap:
         if (priv->sram != NULL)
                 pci_iounmap(pdev, priv->sram);
 
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
 
 err_free_reg:
@@ -6147,7 +6146,6 @@ static void mwl8k_remove(struct pci_dev *pdev)
 unmap:
         pci_iounmap(pdev, priv->regs);
         pci_iounmap(pdev, priv->sram);
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index 3bb936b9558c..eebd2be21ee9 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -182,23 +182,20 @@ extern int orinoco_debug;
 /* Exported prototypes                                              */
 /********************************************************************/
 
-extern struct orinoco_private *alloc_orinocodev(
-        int sizeof_card, struct device *device,
-        int (*hard_reset)(struct orinoco_private *),
-        int (*stop_fw)(struct orinoco_private *, int));
-extern void free_orinocodev(struct orinoco_private *priv);
-extern int orinoco_init(struct orinoco_private *priv);
-extern int orinoco_if_add(struct orinoco_private *priv,
-                          unsigned long base_addr,
-                          unsigned int irq,
-                          const struct net_device_ops *ops);
-extern void orinoco_if_del(struct orinoco_private *priv);
-extern int orinoco_up(struct orinoco_private *priv);
-extern void orinoco_down(struct orinoco_private *priv);
-extern irqreturn_t orinoco_interrupt(int irq, void *dev_id);
-
-extern void __orinoco_ev_info(struct net_device *dev, struct hermes *hw);
-extern void __orinoco_ev_rx(struct net_device *dev, struct hermes *hw);
+struct orinoco_private *alloc_orinocodev(int sizeof_card, struct device *device,
+                                         int (*hard_reset)(struct orinoco_private *),
+                                         int (*stop_fw)(struct orinoco_private *, int));
+void free_orinocodev(struct orinoco_private *priv);
+int orinoco_init(struct orinoco_private *priv);
+int orinoco_if_add(struct orinoco_private *priv, unsigned long base_addr,
+                   unsigned int irq, const struct net_device_ops *ops);
+void orinoco_if_del(struct orinoco_private *priv);
+int orinoco_up(struct orinoco_private *priv);
+void orinoco_down(struct orinoco_private *priv);
+irqreturn_t orinoco_interrupt(int irq, void *dev_id);
+
+void __orinoco_ev_info(struct net_device *dev, struct hermes *hw);
+void __orinoco_ev_rx(struct net_device *dev, struct hermes *hw);
 
 int orinoco_process_xmit_skb(struct sk_buff *skb,
                              struct net_device *dev,
diff --git a/drivers/net/wireless/orinoco/orinoco_nortel.c b/drivers/net/wireless/orinoco/orinoco_nortel.c
index d73fdf6185a2..ffb2469eb679 100644
--- a/drivers/net/wireless/orinoco/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco/orinoco_nortel.c
@@ -234,7 +234,6 @@ static int orinoco_nortel_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -265,7 +264,6 @@ static void orinoco_nortel_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->attr_io);
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index 677bf14eca84..5ae1191d2532 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -184,7 +184,6 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -205,7 +204,6 @@ static void orinoco_pci_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_release_regions(pdev);
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index 2559dbd6184b..bbd36d1676ff 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -273,7 +273,6 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -301,7 +300,6 @@ static void orinoco_plx_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->attr_io);
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 42afeeea2c40..04b08de5fd5d 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -170,7 +170,6 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -195,7 +194,6 @@ static void orinoco_tmd_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->bridge_io);
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 57e3af8ebb4b..f9a07b0d83ac 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -631,7 +631,6 @@ static int p54p_probe(struct pci_dev *pdev,
         iounmap(priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         p54_free_common(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 7fc46f26cf2b..de15171e2cd8 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -636,7 +636,7 @@ static int p54spi_probe(struct spi_device *spi)
         gpio_direction_input(p54spi_gpio_irq);
 
         ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
-                          p54spi_interrupt, IRQF_DISABLED, "p54spi",
+                          p54spi_interrupt, 0, "p54spi",
                           priv->spi);
         if (ret < 0) {
                 dev_err(&priv->spi->dev, "request_irq() failed");
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 1c22b81e6ef3..8863a6cb2388 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -183,7 +183,7 @@ prism54_update_stats(struct work_struct *work)
         data = r.ptr;
 
         /* copy this MAC to the bss */
-        memcpy(bss.address, data, 6);
+        memcpy(bss.address, data, ETH_ALEN);
         kfree(data);
 
         /* now ask for the corresponding bss */
@@ -531,7 +531,7 @@ prism54_set_wap(struct net_device *ndev, struct iw_request_info *info,
                 return -EINVAL;
 
         /* prepare the structure for the set object */
-        memcpy(&bssid[0], awrq->sa_data, 6);
+        memcpy(&bssid[0], awrq->sa_data, ETH_ALEN);
 
         /* set the bssid -- does this make sense when in AP mode? */
         rvalue = mgt_set_request(priv, DOT11_OID_BSSID, 0, &bssid);
@@ -550,7 +550,7 @@ prism54_get_wap(struct net_device *ndev, struct iw_request_info *info,
         int rvalue;
 
         rvalue = mgt_get_request(priv, DOT11_OID_BSSID, 0, NULL, &r);
-        memcpy(awrq->sa_data, r.ptr, 6);
+        memcpy(awrq->sa_data, r.ptr, ETH_ALEN);
         awrq->sa_family = ARPHRD_ETHER;
         kfree(r.ptr);
 
@@ -582,7 +582,7 @@ prism54_translate_bss(struct net_device *ndev, struct iw_request_info *info,
         size_t wpa_ie_len;
 
         /* The first entry must be the MAC address */
-        memcpy(iwe.u.ap_addr.sa_data, bss->address, 6);
+        memcpy(iwe.u.ap_addr.sa_data, bss->address, ETH_ALEN);
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
         iwe.cmd = SIOCGIWAP;
         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
@@ -2489,7 +2489,7 @@ prism54_set_mac_address(struct net_device *ndev, void *addr)
                               &((struct sockaddr *) addr)->sa_data);
         if (!ret)
                 memcpy(priv->ndev->dev_addr,
-                       &((struct sockaddr *) addr)->sa_data, 6);
+                       &((struct sockaddr *) addr)->sa_data, ETH_ALEN);
 
         return ret;
 }
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index 5970ff6f40cc..41a16d30c79c 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -837,7 +837,7 @@ islpci_setup(struct pci_dev *pdev)
         /* ndev->set_multicast_list = &islpci_set_multicast_list; */
         ndev->addr_len = ETH_ALEN;
         /* Get a non-zero dummy MAC address for nameif. Jean II */
-        memcpy(ndev->dev_addr, dummy_mac, 6);
+        memcpy(ndev->dev_addr, dummy_mac, ETH_ALEN);
 
         ndev->watchdog_timeo = ISLPCI_TX_TIMEOUT;
 
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index a01606b36e03..056af38e72e3 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -682,7 +682,7 @@ mgt_update_addr(islpci_private *priv)
                                      isl_oid[GEN_OID_MACADDRESS].size, &res);
 
         if ((ret == 0) && res && (res->header->operation != PIMFOR_OP_ERROR))
-                memcpy(priv->ndev->dev_addr, res->data, 6);
+                memcpy(priv->ndev->dev_addr, res->data, ETH_ALEN);
         else
                 ret = -EIO;
         if (res)
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 68dbbb9c6d12..a18b0051a745 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -219,6 +219,7 @@ config RT2X00_LIB_USB
 
 config RT2X00_LIB
         tristate
+        select AVERAGE
 
 config RT2X00_LIB_FIRMWARE
         boolean
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index fa33b5edf931..aab6b5e4f5dd 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -52,6 +52,7 @@
  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
  * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
  * RF5592 2.4G/5G 2T2R
+ * RF3070 2.4G 1T1R
  * RF5360 2.4G 1T1R
  * RF5370 2.4G 1T1R
  * RF5390 2.4G 1T1R
@@ -70,6 +71,7 @@
 #define RF3322                          0x000c
 #define RF3053                          0x000d
 #define RF5592                          0x000f
+#define RF3070                          0x3070
 #define RF3290                          0x3290
 #define RF5360                          0x5360
 #define RF5370                          0x5370
@@ -122,7 +124,7 @@
 /*
  * MAC_CSR0_3290: MAC_CSR0 for RT3290 to identity MAC version number.
  */
-#define MAC_CSR0_3290                           0x0000
+#define MAC_CSR0_3290                   0x0000
 
 /*
  * E2PROM_CSR: PCI EEPROM control register.
@@ -211,17 +213,17 @@
 /*
  * COEX_CFG_0
  */
-#define COEX_CFG0                       0x0040
+#define COEX_CFG0               0x0040
 #define COEX_CFG_ANT            FIELD32(0xff000000)
 /*
  * COEX_CFG_1
  */
-#define COEX_CFG1                       0x0044
+#define COEX_CFG1               0x0044
 
 /*
  * COEX_CFG_2
  */
-#define COEX_CFG2                       0x0048
+#define COEX_CFG2               0x0048
 #define BT_COEX_CFG1            FIELD32(0xff000000)
 #define BT_COEX_CFG0            FIELD32(0x00ff0000)
 #define WL_COEX_CFG1            FIELD32(0x0000ff00)
@@ -235,8 +237,8 @@
 #define PLL_RESERVED_INPUT2     FIELD32(0x0000ff00)
 #define PLL_CONTROL             FIELD32(0x00070000)
 #define PLL_LPF_R1              FIELD32(0x00080000)
-#define PLL_LPF_C1_CTRL FIELD32(0x00300000)
-#define PLL_LPF_C2_CTRL FIELD32(0x00c00000)
+#define PLL_LPF_C1_CTRL         FIELD32(0x00300000)
+#define PLL_LPF_C2_CTRL         FIELD32(0x00c00000)
 #define PLL_CP_CURRENT_CTRL     FIELD32(0x03000000)
 #define PLL_PFD_DELAY_CTRL      FIELD32(0x0c000000)
 #define PLL_LOCK_CTRL           FIELD32(0x70000000)
@@ -2164,7 +2166,7 @@ struct mac_iveiv_entry {
  */
 #define RFCSR6_R1                       FIELD8(0x03)
 #define RFCSR6_R2                       FIELD8(0x40)
-#define RFCSR6_TXDIV            FIELD8(0x0c)
+#define RFCSR6_TXDIV                    FIELD8(0x0c)
 /* bits for RF3053 */
 #define RFCSR6_VCO_IC                   FIELD8(0xc0)
 
@@ -2202,13 +2204,13 @@ struct mac_iveiv_entry {
  * RFCSR 12:
  */
 #define RFCSR12_TX_POWER                FIELD8(0x1f)
-#define RFCSR12_DR0                             FIELD8(0xe0)
+#define RFCSR12_DR0                     FIELD8(0xe0)
 
 /*
  * RFCSR 13:
  */
 #define RFCSR13_TX_POWER                FIELD8(0x1f)
-#define RFCSR13_DR0                             FIELD8(0xe0)
+#define RFCSR13_DR0                     FIELD8(0xe0)
 
 /*
  * RFCSR 15:
@@ -2226,7 +2228,7 @@ struct mac_iveiv_entry {
 #define RFCSR17_TXMIXER_GAIN            FIELD8(0x07)
 #define RFCSR17_TX_LO1_EN               FIELD8(0x08)
 #define RFCSR17_R                       FIELD8(0x20)
-#define RFCSR17_CODE                   FIELD8(0x7f)
+#define RFCSR17_CODE                    FIELD8(0x7f)
 
 /* RFCSR 18 */
 #define RFCSR18_XO_TUNE_BYPASS          FIELD8(0x40)
@@ -2449,7 +2451,7 @@ enum rt2800_eeprom_word {
  */
 #define EEPROM_NIC_CONF0_RXPATH         FIELD16(0x000f)
 #define EEPROM_NIC_CONF0_TXPATH         FIELD16(0x00f0)
-#define EEPROM_NIC_CONF0_RF_TYPE                FIELD16(0x0f00)
+#define EEPROM_NIC_CONF0_RF_TYPE        FIELD16(0x0f00)
 
 /*
  * EEPROM NIC Configuration 1
@@ -2471,18 +2473,18 @@ enum rt2800_eeprom_word {
  * DAC_TEST: 0: disable, 1: enable
  */
 #define EEPROM_NIC_CONF1_HW_RADIO               FIELD16(0x0001)
-#define EEPROM_NIC_CONF1_EXTERNAL_TX_ALC                FIELD16(0x0002)
-#define EEPROM_NIC_CONF1_EXTERNAL_LNA_2G                FIELD16(0x0004)
-#define EEPROM_NIC_CONF1_EXTERNAL_LNA_5G                FIELD16(0x0008)
+#define EEPROM_NIC_CONF1_EXTERNAL_TX_ALC        FIELD16(0x0002)
+#define EEPROM_NIC_CONF1_EXTERNAL_LNA_2G        FIELD16(0x0004)
+#define EEPROM_NIC_CONF1_EXTERNAL_LNA_5G        FIELD16(0x0008)
 #define EEPROM_NIC_CONF1_CARDBUS_ACCEL          FIELD16(0x0010)
 #define EEPROM_NIC_CONF1_BW40M_SB_2G            FIELD16(0x0020)
 #define EEPROM_NIC_CONF1_BW40M_SB_5G            FIELD16(0x0040)
 #define EEPROM_NIC_CONF1_WPS_PBC                FIELD16(0x0080)
 #define EEPROM_NIC_CONF1_BW40M_2G               FIELD16(0x0100)
 #define EEPROM_NIC_CONF1_BW40M_5G               FIELD16(0x0200)
-#define EEPROM_NIC_CONF1_BROADBAND_EXT_LNA              FIELD16(0x400)
+#define EEPROM_NIC_CONF1_BROADBAND_EXT_LNA      FIELD16(0x400)
 #define EEPROM_NIC_CONF1_ANT_DIVERSITY          FIELD16(0x1800)
-#define EEPROM_NIC_CONF1_INTERNAL_TX_ALC                FIELD16(0x2000)
+#define EEPROM_NIC_CONF1_INTERNAL_TX_ALC        FIELD16(0x2000)
 #define EEPROM_NIC_CONF1_BT_COEXIST             FIELD16(0x4000)
 #define EEPROM_NIC_CONF1_DAC_TEST               FIELD16(0x8000)
 
@@ -2521,9 +2523,9 @@ enum rt2800_eeprom_word {
  * TX_STREAM: 0: Reserved, 1: 1 Stream, 2: 2 Stream
  * CRYSTAL: 00: Reserved, 01: One crystal, 10: Two crystal, 11: Reserved
  */
-#define EEPROM_NIC_CONF2_RX_STREAM              FIELD16(0x000f)
-#define EEPROM_NIC_CONF2_TX_STREAM              FIELD16(0x00f0)
-#define EEPROM_NIC_CONF2_CRYSTAL                FIELD16(0x0600)
+#define EEPROM_NIC_CONF2_RX_STREAM      FIELD16(0x000f)
+#define EEPROM_NIC_CONF2_TX_STREAM      FIELD16(0x00f0)
+#define EEPROM_NIC_CONF2_CRYSTAL        FIELD16(0x0600)
 
 /*
  * EEPROM LNA
@@ -2790,7 +2792,7 @@ enum rt2800_eeprom_word {
 #define MCU_CURRENT                     0x36
 #define MCU_LED                         0x50
 #define MCU_LED_STRENGTH                0x51
-#define MCU_LED_AG_CONF         0x52
+#define MCU_LED_AG_CONF                 0x52
 #define MCU_LED_ACT_CONF                0x53
 #define MCU_LED_LED_POLARITY            0x54
 #define MCU_RADAR                       0x60
@@ -2799,7 +2801,7 @@ enum rt2800_eeprom_word {
 #define MCU_FREQ_OFFSET                 0x74
 #define MCU_BBP_SIGNAL                  0x80
 #define MCU_POWER_SAVE                  0x83
-#define MCU_BAND_SELECT         0x91
+#define MCU_BAND_SELECT                 0x91
 
 /*
  * MCU mailbox tokens
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 88ce656f96cd..aa8789423937 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -278,12 +278,9 @@ static const unsigned int rt2800_eeprom_map_ext[EEPROM_WORD_COUNT] = {
         [EEPROM_LNA]                    = 0x0026,
         [EEPROM_EXT_LNA2]               = 0x0027,
         [EEPROM_RSSI_BG]                = 0x0028,
-        [EEPROM_TXPOWER_DELTA]          = 0x0028, /* Overlaps with RSSI_BG */
         [EEPROM_RSSI_BG2]               = 0x0029,
-        [EEPROM_TXMIXER_GAIN_BG]        = 0x0029, /* Overlaps with RSSI_BG2 */
         [EEPROM_RSSI_A]                 = 0x002a,
         [EEPROM_RSSI_A2]                = 0x002b,
-        [EEPROM_TXMIXER_GAIN_A]         = 0x002b, /* Overlaps with RSSI_A2 */
         [EEPROM_TXPOWER_BG1]            = 0x0030,
         [EEPROM_TXPOWER_BG2]            = 0x0037,
         [EEPROM_EXT_TXPOWER_BG3]        = 0x003e,
@@ -1783,7 +1780,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
         rt2800_bbp_read(rt2x00dev, 3, &r3);
 
         if (rt2x00_rt(rt2x00dev, RT3572) &&
-            test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+            rt2x00_has_cap_bt_coexist(rt2x00dev))
                 rt2800_config_3572bt_ant(rt2x00dev);
 
         /*
@@ -1795,7 +1792,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
                 break;
         case 2:
                 if (rt2x00_rt(rt2x00dev, RT3572) &&
-                    test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+                    rt2x00_has_cap_bt_coexist(rt2x00dev))
                         rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 1);
                 else
                         rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
@@ -1825,7 +1822,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
                 break;
         case 2:
                 if (rt2x00_rt(rt2x00dev, RT3572) &&
-                    test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+                    rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                         rt2x00_set_field8(&r3, BBP3_RX_ADC, 1);
                         rt2x00_set_field8(&r3, BBP3_RX_ANTENNA,
                                 rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
@@ -2029,13 +2026,6 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
                           rt2x00dev->default_ant.tx_chain_num <= 2);
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-        msleep(1);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
         rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
@@ -2141,7 +2131,7 @@ static void rt2800_config_channel_rf3052(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 0);
         rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
         rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
-        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                 if (rf->channel <= 14) {
                         rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
                         rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
@@ -2674,7 +2664,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         if (rf->channel <= 14) {
                 int idx = rf->channel-1;
 
-                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                         if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
                                 /* r55/r59 value array of channel 1~14 */
                                 static const char r55_bt_rev[] = {0x83, 0x83,
@@ -3152,6 +3142,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         case RF3322:
                 rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
                 break;
+        case RF3070:
         case RF5360:
         case RF5370:
         case RF5372:
@@ -3166,7 +3157,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
         }
 
-        if (rt2x00_rf(rt2x00dev, RF3290) ||
+        if (rt2x00_rf(rt2x00dev, RF3070) ||
+            rt2x00_rf(rt2x00dev, RF3290) ||
             rt2x00_rf(rt2x00dev, RF3322) ||
             rt2x00_rf(rt2x00dev, RF5360) ||
             rt2x00_rf(rt2x00dev, RF5370) ||
@@ -3218,8 +3210,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         if (rf->channel <= 14) {
                 if (!rt2x00_rt(rt2x00dev, RT5390) &&
                     !rt2x00_rt(rt2x00dev, RT5392)) {
-                        if (test_bit(CAPABILITY_EXTERNAL_LNA_BG,
-                                     &rt2x00dev->cap_flags)) {
+                        if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                                 rt2800_bbp_write(rt2x00dev, 82, 0x62);
                                 rt2800_bbp_write(rt2x00dev, 75, 0x46);
                         } else {
@@ -3244,7 +3235,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 if (rt2x00_rt(rt2x00dev, RT3593))
                         rt2800_bbp_write(rt2x00dev, 83, 0x9a);
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev))
                         rt2800_bbp_write(rt2x00dev, 75, 0x46);
                 else
                         rt2800_bbp_write(rt2x00dev, 75, 0x50);
@@ -3280,7 +3271,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 /* Turn on primary PAs */
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN,
                                    rf->channel > 14);
-                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_bt_coexist(rt2x00dev))
                         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, 1);
                 else
                         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN,
@@ -3311,33 +3302,50 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
 
         rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
 
-        if (rt2x00_rt(rt2x00dev, RT3572))
+        if (rt2x00_rt(rt2x00dev, RT3572)) {
                 rt2800_rfcsr_write(rt2x00dev, 8, 0x80);
 
+                /* AGC init */
+                if (rf->channel <= 14)
+                        reg = 0x1c + (2 * rt2x00dev->lna_gain);
+                else
+                        reg = 0x22 + ((rt2x00dev->lna_gain * 5) / 3);
+
+                rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+        }
+
         if (rt2x00_rt(rt2x00dev, RT3593)) {
-                if (rt2x00_is_usb(rt2x00dev)) {
-                        rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
+                rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
 
-                        /* Band selection. GPIO #8 controls all paths */
+                /* Band selection */
+                if (rt2x00_is_usb(rt2x00dev) ||
+                    rt2x00_is_pcie(rt2x00dev)) {
+                        /* GPIO #8 controls all paths */
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR8, 0);
                         if (rf->channel <= 14)
                                 rt2x00_set_field32(&reg, GPIO_CTRL_VAL8, 1);
                         else
                                 rt2x00_set_field32(&reg, GPIO_CTRL_VAL8, 0);
+                }
 
+                /* LNA PE control. */
+                if (rt2x00_is_usb(rt2x00dev)) {
+                        /* GPIO #4 controls PE0 and PE1,
+                         * GPIO #7 controls PE2
+                         */
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR4, 0);
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR7, 0);
 
-                        /* LNA PE control.
-                        * GPIO #4 controls PE0 and PE1,
-                        * GPIO #7 controls PE2
-                        */
                         rt2x00_set_field32(&reg, GPIO_CTRL_VAL4, 1);
                         rt2x00_set_field32(&reg, GPIO_CTRL_VAL7, 1);
-
-                        rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
+                } else if (rt2x00_is_pcie(rt2x00dev)) {
+                        /* GPIO #4 controls PE0, PE1 and PE2 */
+                        rt2x00_set_field32(&reg, GPIO_CTRL_DIR4, 0);
+                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL4, 1);
                 }
 
+                rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
+
                 /* AGC init */
                 if (rf->channel <= 14)
                         reg = 0x1c + 2 * rt2x00dev->lna_gain;
@@ -3565,7 +3573,7 @@ static int rt2800_get_txpower_reg_delta(struct rt2x00_dev *rt2x00dev,
 {
         int delta;
 
-        if (test_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_power_limit(rt2x00dev))
                 return 0;
 
         /*
@@ -3594,7 +3602,7 @@ static u8 rt2800_compensate_txpower(struct rt2x00_dev *rt2x00dev, int is_rate_b,
         if (rt2x00_rt(rt2x00dev, RT3593))
                 return min_t(u8, txpower, 0xc);
 
-        if (test_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_power_limit(rt2x00dev)) {
                 /*
                  * Check if eirp txpower exceed txpower_limit.
                  * We use OFDM 6M as criterion and its eirp txpower
@@ -4264,6 +4272,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
                 break;
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF5360:
         case RF5370:
@@ -4405,6 +4414,7 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                     rt2x00_rt(rt2x00dev, RT3290) ||
                     rt2x00_rt(rt2x00dev, RT3390) ||
                     rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593) ||
                     rt2x00_rt(rt2x00dev, RT5390) ||
                     rt2x00_rt(rt2x00dev, RT5392) ||
                     rt2x00_rt(rt2x00dev, RT5592))
@@ -4412,8 +4422,8 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                 else
                         vgc = 0x2e + rt2x00dev->lna_gain;
         } else { /* 5GHZ band */
-                if (rt2x00_rt(rt2x00dev, RT3572))
-                        vgc = 0x22 + (rt2x00dev->lna_gain * 5) / 3;
+                if (rt2x00_rt(rt2x00dev, RT3593))
+                        vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
                 else if (rt2x00_rt(rt2x00dev, RT5592))
                         vgc = 0x24 + (2 * rt2x00dev->lna_gain);
                 else {
@@ -4431,11 +4441,17 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
                                   struct link_qual *qual, u8 vgc_level)
 {
         if (qual->vgc_level != vgc_level) {
-                if (rt2x00_rt(rt2x00dev, RT5592)) {
+                if (rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593)) {
+                        rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+                                                       vgc_level);
+                } else if (rt2x00_rt(rt2x00dev, RT5592)) {
                         rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
                         rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
-                } else
+                } else {
                         rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                }
+
                 qual->vgc_level = vgc_level;
                 qual->vgc_level_reg = vgc_level;
         }
@@ -4454,17 +4470,35 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
 
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
                 return;
-        /*
-         * When RSSI is better then -80 increase VGC level with 0x10, except
-         * for rt5592 chip.
+
+        /* When RSSI is better than a certain threshold, increase VGC
+         * with a chip specific value in order to improve the balance
+         * between sensibility and noise isolation.
          */
 
         vgc = rt2800_get_default_vgc(rt2x00dev);
 
-        if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
-                vgc += 0x20;
-        else if (qual->rssi > -80)
-                vgc += 0x10;
+        switch (rt2x00dev->chip.rt) {
+        case RT3572:
+        case RT3593:
+                if (qual->rssi > -65) {
+                        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ)
+                                vgc += 0x20;
+                        else
+                                vgc += 0x10;
+                }
+                break;
+
+        case RT5592:
+                if (qual->rssi > -65)
+                        vgc += 0x20;
+                break;
+
+        default:
+                if (qual->rssi > -80)
+                        vgc += 0x10;
+                break;
+        }
 
         rt2800_set_vgc(rt2x00dev, qual, vgc);
 }
@@ -5489,7 +5523,7 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
         ant = (div_mode == 3) ? 1 : 0;
 
         /* check if this is a Bluetooth combo card */
-        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                 u32 reg;
 
                 rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
@@ -5798,7 +5832,7 @@ static void rt2800_normal_mode_setup_3xxx(struct rt2x00_dev *rt2x00dev)
             rt2x00_rt_rev_lt(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3090, REV_RT3090E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E)) {
-                if (!test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (!rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
         }
 
@@ -5985,7 +6019,7 @@ static void rt2800_init_rfcsr_30xx(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
         rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
         rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
-        rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x03);
         rt2800_rfcsr_write(rt2x00dev, 29, 0x1f);
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -6441,7 +6475,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
 
-        rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
         rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
@@ -6479,7 +6513,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
         rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
-        rt2800_rfcsr_write(rt2x00dev, 59, 0x63);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x8f);
 
         rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
         if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
@@ -6499,7 +6533,6 @@ static void rt2800_init_rfcsr_5392(struct rt2x00_dev *rt2x00dev)
         rt2800_rf_init_calibration(rt2x00dev, 2);
 
         rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
-        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
         rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
         rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
@@ -6653,17 +6686,20 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
         u16 word;
 
         /*
-         * Initialize all registers.
+         * Initialize MAC registers.
          */
         if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
                      rt2800_init_registers(rt2x00dev)))
                 return -EIO;
 
+        /*
+         * Wait BBP/RF to wake up.
+         */
         if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
                 return -EIO;
 
         /*
-         * Send signal to firmware during boot time.
+         * Send signal during boot time to initialize firmware.
          */
         rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
@@ -6672,9 +6708,15 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
         rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
         msleep(1);
 
+        /*
+         * Make sure BBP is up and running.
+         */
         if (unlikely(rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EIO;
 
+        /*
+         * Initialize BBP/RF registers.
+         */
         rt2800_init_bbp(rt2x00dev);
         rt2800_init_rfcsr(rt2x00dev);
 
@@ -7021,6 +7063,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RF3022:
         case RF3052:
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF3320:
         case RF3322:
@@ -7203,7 +7246,7 @@ static const struct rf_channel rf_vals[] = {
 
 /*
  * RF value list for rt3xxx
- * Supports: 2.4 GHz (all) & 5.2 GHz (RF3052)
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF3052 & RF3053)
  */
 static const struct rf_channel rf_vals_3x[] = {
         {1,  241, 2, 2 },
@@ -7399,72 +7442,6 @@ static const struct rf_channel rf_vals_5592_xtal40[] = {
         {196, 83, 0, 12, 1},
 };
 
-static const struct rf_channel rf_vals_3053[] = {
-        /* Channel, N, R, K */
-        {1, 241, 2, 2},
-        {2, 241, 2, 7},
-        {3, 242, 2, 2},
-        {4, 242, 2, 7},
-        {5, 243, 2, 2},
-        {6, 243, 2, 7},
-        {7, 244, 2, 2},
-        {8, 244, 2, 7},
-        {9, 245, 2, 2},
-        {10, 245, 2, 7},
-        {11, 246, 2, 2},
-        {12, 246, 2, 7},
-        {13, 247, 2, 2},
-        {14, 248, 2, 4},
-
-        {36, 0x56, 0, 4},
-        {38, 0x56, 0, 6},
-        {40, 0x56, 0, 8},
-        {44, 0x57, 0, 0},
-        {46, 0x57, 0, 2},
-        {48, 0x57, 0, 4},
-        {52, 0x57, 0, 8},
-        {54, 0x57, 0, 10},
-        {56, 0x58, 0, 0},
-        {60, 0x58, 0, 4},
-        {62, 0x58, 0, 6},
-        {64, 0x58, 0, 8},
-
-        {100, 0x5B, 0, 8},
-        {102, 0x5B, 0, 10},
-        {104, 0x5C, 0, 0},
-        {108, 0x5C, 0, 4},
-        {110, 0x5C, 0, 6},
-        {112, 0x5C, 0, 8},
-
-        /* NOTE: Channel 114 has been removed intentionally.
-         * The EEPROM contains no TX power values for that,
-         * and it is disabled in the vendor driver as well.
-         */
-
-        {116, 0x5D, 0, 0},
-        {118, 0x5D, 0, 2},
-        {120, 0x5D, 0, 4},
-        {124, 0x5D, 0, 8},
-        {126, 0x5D, 0, 10},
-        {128, 0x5E, 0, 0},
-        {132, 0x5E, 0, 4},
-        {134, 0x5E, 0, 6},
-        {136, 0x5E, 0, 8},
-        {140, 0x5F, 0, 0},
-
-        {149, 0x5F, 0, 9},
-        {151, 0x5F, 0, 11},
-        {153, 0x60, 0, 1},
-        {157, 0x60, 0, 5},
-        {159, 0x60, 0, 7},
-        {161, 0x60, 0, 9},
-        {165, 0x61, 0, 1},
-        {167, 0x61, 0, 3},
-        {169, 0x61, 0, 5},
-        {171, 0x61, 0, 7},
-        {173, 0x61, 0, 9},
-};
-
 static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
@@ -7543,6 +7520,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF2020) ||
                    rt2x00_rf(rt2x00dev, RF3021) ||
                    rt2x00_rf(rt2x00dev, RF3022) ||
+                   rt2x00_rf(rt2x00dev, RF3070) ||
                    rt2x00_rf(rt2x00dev, RF3290) ||
                    rt2x00_rf(rt2x00dev, RF3320) ||
                    rt2x00_rf(rt2x00dev, RF3322) ||
@@ -7553,14 +7531,11 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF5392)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_3x;
-        } else if (rt2x00_rf(rt2x00dev, RF3052)) {
+        } else if (rt2x00_rf(rt2x00dev, RF3052) ||
+                   rt2x00_rf(rt2x00dev, RF3053)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_3x);
                 spec->channels = rf_vals_3x;
-        } else if (rt2x00_rf(rt2x00dev, RF3053)) {
-                spec->supported_bands |= SUPPORT_BAND_5GHZ;
-                spec->num_channels = ARRAY_SIZE(rf_vals_3053);
-                spec->channels = rf_vals_3053;
         } else if (rt2x00_rf(rt2x00dev, RF5592)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
 
@@ -7671,6 +7646,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         case RF3320:
         case RF3052:
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF5360:
         case RF5370:
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 96961b9a395c..96677ce55da4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1176,6 +1176,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Linksys */
         { USB_DEVICE(0x13b1, 0x002f) },
         { USB_DEVICE(0x1737, 0x0079) },
+        /* Logitec */
+        { USB_DEVICE(0x0789, 0x0170) },
         /* Ralink */
         { USB_DEVICE(0x148f, 0x3572) },
         /* Sitecom */
@@ -1199,6 +1201,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x1103) },
         /* Cameo */
         { USB_DEVICE(0x148f, 0xf301) },
+        /* D-Link */
+        { USB_DEVICE(0x2001, 0x3c1f) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7733) },
         /* Hawking */
@@ -1212,6 +1216,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0789, 0x016b) },
         /* NETGEAR */
         { USB_DEVICE(0x0846, 0x9012) },
+        { USB_DEVICE(0x0846, 0x9013) },
         { USB_DEVICE(0x0846, 0x9019) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xed19) },
@@ -1220,6 +1225,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x0067) },
         { USB_DEVICE(0x0df6, 0x006a) },
+        { USB_DEVICE(0x0df6, 0x006e) },
         /* ZyXEL */
         { USB_DEVICE(0x0586, 0x3421) },
 #endif
@@ -1236,6 +1242,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x2001, 0x3c1c) },
         { USB_DEVICE(0x2001, 0x3c1d) },
         { USB_DEVICE(0x2001, 0x3c1e) },
+        { USB_DEVICE(0x2001, 0x3c20) },
+        { USB_DEVICE(0x2001, 0x3c22) },
+        { USB_DEVICE(0x2001, 0x3c23) },
         /* LG innotek */
         { USB_DEVICE(0x043e, 0x7a22) },
         { USB_DEVICE(0x043e, 0x7a42) },
@@ -1258,12 +1267,17 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x043e, 0x7a32) },
         /* AVM GmbH */
         { USB_DEVICE(0x057c, 0x8501) },
-        /* D-Link DWA-160-B2 */
+        /* Buffalo */
+        { USB_DEVICE(0x0411, 0x0241) },
+        /* D-Link */
         { USB_DEVICE(0x2001, 0x3c1a) },
+        { USB_DEVICE(0x2001, 0x3c21) },
         /* Proware */
         { USB_DEVICE(0x043e, 0x7a13) },
         /* Ralink */
         { USB_DEVICE(0x148f, 0x5572) },
+        /* TRENDnet */
+        { USB_DEVICE(0x20f4, 0x724a) },
 #endif
 #ifdef CONFIG_RT2800USB_UNKNOWN
         /*
@@ -1333,6 +1347,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1d4d, 0x0010) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xab24) },
+        { USB_DEVICE(0x2019, 0xab29) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6259) },
         /* RadioShack */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index fe4c572db52c..e4ba2ce0f212 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -39,6 +39,7 @@
 #include <linux/input-polldev.h>
 #include <linux/kfifo.h>
 #include <linux/hrtimer.h>
+#include <linux/average.h>
 
 #include <net/mac80211.h>
 
@@ -138,17 +139,6 @@
 #define SHORT_EIFS              ( SIFS + SHORT_DIFS + \
                                   GET_DURATION(IEEE80211_HEADER + ACK_SIZE, 10) )
 
-/*
- * Structure for average calculation
- * The avg field contains the actual average value,
- * but avg_weight is internally used during calculations
- * to prevent rounding errors.
- */
-struct avg_val {
-        int avg;
-        int avg_weight;
-};
-
 enum rt2x00_chip_intf {
         RT2X00_CHIP_INTF_PCI,
         RT2X00_CHIP_INTF_PCIE,
@@ -297,7 +287,7 @@ struct link_ant {
          * Similar to the avg_rssi in the link_qual structure
          * this value is updated by using the walking average.
          */
-        struct avg_val rssi_ant;
+        struct ewma rssi_ant;
 };
 
 /*
@@ -326,7 +316,7 @@ struct link {
         /*
          * Currently active average RSSI value
          */
-        struct avg_val avg_rssi;
+        struct ewma avg_rssi;
 
         /*
          * Work structure for scheduling periodic link tuning.
@@ -1179,6 +1169,93 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
         return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_SOC);
 }
 
+/* Helpers for capability flags */
+
+static inline bool
+rt2x00_has_cap_flag(struct rt2x00_dev *rt2x00dev,
+                    enum rt2x00_capability_flags cap_flag)
+{
+        return test_bit(cap_flag, &rt2x00dev->cap_flags);
+}
+
+static inline bool
+rt2x00_has_cap_hw_crypto(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_HW_CRYPTO);
+}
+
+static inline bool
+rt2x00_has_cap_power_limit(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_POWER_LIMIT);
+}
+
+static inline bool
+rt2x00_has_cap_control_filters(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_CONTROL_FILTERS);
+}
+
+static inline bool
+rt2x00_has_cap_control_filter_pspoll(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_CONTROL_FILTER_PSPOLL);
+}
+
+static inline bool
+rt2x00_has_cap_pre_tbtt_interrupt(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_PRE_TBTT_INTERRUPT);
+}
+
+static inline bool
+rt2x00_has_cap_link_tuning(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_LINK_TUNING);
+}
+
+static inline bool
+rt2x00_has_cap_frame_type(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_FRAME_TYPE);
+}
+
+static inline bool
+rt2x00_has_cap_rf_sequence(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_RF_SEQUENCE);
+}
+
+static inline bool
+rt2x00_has_cap_external_lna_a(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_LNA_A);
+}
+
+static inline bool
+rt2x00_has_cap_external_lna_bg(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_LNA_BG);
+}
+
+static inline bool
+rt2x00_has_cap_double_antenna(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_DOUBLE_ANTENNA);
+}
+
+static inline bool
+rt2x00_has_cap_bt_coexist(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_BT_COEXIST);
+}
+
+static inline bool
+rt2x00_has_cap_vco_recalibration(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_VCO_RECALIBRATION);
+}
+
 /**
  * rt2x00queue_map_txskb - Map a skb into DMA for TX purposes.
  * @entry: Pointer to &struct queue_entry
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index 1ca4c7ffc189..3db0d99d9da7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -52,7 +52,7 @@ void rt2x00crypto_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags) || !hw_key)
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev) || !hw_key)
                 return;
 
         __set_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags);
@@ -80,7 +80,7 @@ unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_key_conf *key = tx_info->control.hw_key;
         unsigned int overhead = 0;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags) || !key)
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev) || !key)
                 return overhead;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index fe7a7f63a9ed..7f7baae5ae02 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -750,7 +750,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
                                 intf, &rt2x00debug_fop_queue_stats);
 
 #ifdef CONFIG_RT2X00_LIB_CRYPTO
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev))
                 intf->crypto_stats_entry =
                     debugfs_create_file("crypto", S_IRUGO, intf->queue_folder,
                                         intf, &rt2x00debug_fop_crypto_stats);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 712eea9d398f..080b1fcae5fa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -88,7 +88,7 @@ int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00queue_start_queues(rt2x00dev);
         rt2x00link_start_tuner(rt2x00dev);
         rt2x00link_start_agc(rt2x00dev);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 rt2x00link_start_vcocal(rt2x00dev);
 
         /*
@@ -113,7 +113,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
          * Stop all queues
          */
         rt2x00link_stop_agc(rt2x00dev);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 rt2x00link_stop_vcocal(rt2x00dev);
         rt2x00link_stop_tuner(rt2x00dev);
         rt2x00queue_stop_queues(rt2x00dev);
@@ -234,7 +234,7 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
          * here as they will fetch the next beacon directly prior to
          * transmission.
          */
-        if (test_bit(CAPABILITY_PRE_TBTT_INTERRUPT, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_pre_tbtt_interrupt(rt2x00dev))
                 return;
 
         /* fetch next beacon */
@@ -358,7 +358,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * mac80211 will expect the same data to be present it the
          * frame as it was passed to us.
          */
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev))
                 rt2x00crypto_tx_insert_iv(entry->skb, header_length);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 8368aab86f28..c2b3b6629188 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -35,50 +35,28 @@
  */
 #define DEFAULT_RSSI            -128
 
-/*
- * Helper struct and macro to work with moving/walking averages.
- * When adding a value to the average value the following calculation
- * is needed:
- *
- *        avg_rssi = ((avg_rssi * 7) + rssi) / 8;
- *
- * The advantage of this approach is that we only need 1 variable
- * to store the average in (No need for a count and a total).
- * But more importantly, normal average values will over time
- * move less and less towards newly added values this results
- * that with link tuning, the device can have a very good RSSI
- * for a few minutes but when the device is moved away from the AP
- * the average will not decrease fast enough to compensate.
- * The walking average compensates this and will move towards
- * the new values correctly allowing a effective link tuning,
- * the speed of the average moving towards other values depends
- * on the value for the number of samples. The higher the number
- * of samples, the slower the average will move.
- * We use two variables to keep track of the average value to
- * compensate for the rounding errors. This can be a significant
- * error (>5dBm) if the factor is too low.
- */
-#define AVG_SAMPLES     8
-#define AVG_FACTOR      1000
-#define MOVING_AVERAGE(__avg, __val) \
-({ \
-        struct avg_val __new; \
-        __new.avg_weight = \
-            (__avg).avg_weight  ? \
-                ((((__avg).avg_weight * ((AVG_SAMPLES) - 1)) + \
-                  ((__val) * (AVG_FACTOR))) / \
-                 (AVG_SAMPLES)) : \
-                ((__val) * (AVG_FACTOR)); \
-        __new.avg = __new.avg_weight / (AVG_FACTOR); \
-        __new; \
-})
+/* Constants for EWMA calculations. */
+#define RT2X00_EWMA_FACTOR      1024
+#define RT2X00_EWMA_WEIGHT      8
+
+static inline int rt2x00link_get_avg_rssi(struct ewma *ewma)
+{
+        unsigned long avg;
+
+        avg = ewma_read(ewma);
+        if (avg)
+                return -avg;
+
+        return DEFAULT_RSSI;
+}
 
 static int rt2x00link_antenna_get_link_rssi(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
 
-        if (ant->rssi_ant.avg && rt2x00dev->link.qual.rx_success)
-                return ant->rssi_ant.avg;
+        if (rt2x00dev->link.qual.rx_success)
+                return rt2x00link_get_avg_rssi(&ant->rssi_ant);
+
         return DEFAULT_RSSI;
 }
 
@@ -100,8 +78,8 @@ static void rt2x00link_antenna_update_rssi_history(struct rt2x00_dev *rt2x00dev,
 
 static void rt2x00link_antenna_reset(struct rt2x00_dev *rt2x00dev)
 {
-        rt2x00dev->link.ant.rssi_ant.avg = 0;
-        rt2x00dev->link.ant.rssi_ant.avg_weight = 0;
+        ewma_init(&rt2x00dev->link.ant.rssi_ant, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 }
 
 static void rt2x00lib_antenna_diversity_sample(struct rt2x00_dev *rt2x00dev)
@@ -249,12 +227,12 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update global RSSI
          */
-        link->avg_rssi = MOVING_AVERAGE(link->avg_rssi, rxdesc->rssi);
+        ewma_add(&link->avg_rssi, -rxdesc->rssi);
 
         /*
          * Update antenna RSSI
          */
-        ant->rssi_ant = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi);
+        ewma_add(&ant->rssi_ant, -rxdesc->rssi);
 }
 
 void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
@@ -309,6 +287,8 @@ void rt2x00link_reset_tuner(struct rt2x00_dev *rt2x00dev, bool antenna)
          */
         rt2x00dev->link.count = 0;
         memset(qual, 0, sizeof(*qual));
+        ewma_init(&rt2x00dev->link.avg_rssi, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 
         /*
          * Restore the VGC level as stored in the registers,
@@ -363,17 +343,17 @@ static void rt2x00link_tuner(struct work_struct *work)
          * collect the RSSI data we could use this. Otherwise we
          * must fallback to the default RSSI value.
          */
-        if (!link->avg_rssi.avg || !qual->rx_success)
+        if (!qual->rx_success)
                 qual->rssi = DEFAULT_RSSI;
         else
-                qual->rssi = link->avg_rssi.avg;
+                qual->rssi = rt2x00link_get_avg_rssi(&link->avg_rssi);
 
         /*
          * Check if link tuning is supported by the hardware, some hardware
          * do not support link tuning at all, while other devices can disable
          * the feature from the EEPROM.
          */
-        if (test_bit(CAPABILITY_LINK_TUNING, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_link_tuning(rt2x00dev))
                 rt2x00dev->ops->lib->link_tuner(rt2x00dev, qual, link->count);
 
         /*
@@ -513,7 +493,7 @@ static void rt2x00link_vcocal(struct work_struct *work)
 void rt2x00link_register(struct rt2x00_dev *rt2x00dev)
 {
         INIT_DELAYED_WORK(&rt2x00dev->link.agc_work, rt2x00link_agc);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 INIT_DELAYED_WORK(&rt2x00dev->link.vco_work, rt2x00link_vcocal);
         INIT_DELAYED_WORK(&rt2x00dev->link.watchdog_work, rt2x00link_watchdog);
         INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00link_tuner);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index f883802f3505..51f17cfb93f9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -382,11 +382,11 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
          * of different types, but has no a separate filter for PS Poll frames,
          * FIF_CONTROL flag implies FIF_PSPOLL.
          */
-        if (!test_bit(CAPABILITY_CONTROL_FILTERS, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_control_filters(rt2x00dev)) {
                 if (*total_flags & FIF_CONTROL || *total_flags & FIF_PSPOLL)
                         *total_flags |= FIF_CONTROL | FIF_PSPOLL;
         }
-        if (!test_bit(CAPABILITY_CONTROL_FILTER_PSPOLL, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_control_filter_pspoll(rt2x00dev)) {
                 if (*total_flags & FIF_CONTROL)
                         *total_flags |= FIF_PSPOLL;
         }
@@ -469,7 +469,7 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
                 return 0;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev))
                 return -EOPNOTSUPP;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index dc49e525ae5e..25da20e7e1f3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -119,7 +119,7 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
         rt2x00dev->irq = pci_dev->irq;
-        rt2x00dev->name = pci_name(pci_dev);
+        rt2x00dev->name = ops->name;
 
         if (pci_is_pcie(pci_dev))
                 rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 6c8a33b6ee22..50590b1420a5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -61,7 +61,7 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
          * at least 8 bytes bytes available in headroom for IV/EIV
          * and 8 bytes for ICV data as tailroon.
          */
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev)) {
                 head_size += 8;
                 tail_size += 8;
         }
@@ -1033,38 +1033,21 @@ EXPORT_SYMBOL_GPL(rt2x00queue_stop_queue);
 
 void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
 {
-        bool started;
         bool tx_queue =
                 (queue->qid == QID_AC_VO) ||
                 (queue->qid == QID_AC_VI) ||
                 (queue->qid == QID_AC_BE) ||
                 (queue->qid == QID_AC_BK);
 
-        mutex_lock(&queue->status_lock);
 
         /*
-         * If the queue has been started, we must stop it temporarily
-         * to prevent any new frames to be queued on the device. If
-         * we are not dropping the pending frames, the queue must
-         * only be stopped in the software and not the hardware,
-         * otherwise the queue will never become empty on its own.
+         * If we are not supposed to drop any pending
+         * frames, this means we must force a start (=kick)
+         * to the queue to make sure the hardware will
+         * start transmitting.
          */
-        started = test_bit(QUEUE_STARTED, &queue->flags);
-        if (started) {
-                /*
-                 * Pause the queue
-                 */
-                rt2x00queue_pause_queue(queue);
-
-                /*
-                 * If we are not supposed to drop any pending
-                 * frames, this means we must force a start (=kick)
-                 * to the queue to make sure the hardware will
-                 * start transmitting.
-                 */
-                if (!drop && tx_queue)
-                        queue->rt2x00dev->ops->lib->kick_queue(queue);
-        }
+        if (!drop && tx_queue)
+                queue->rt2x00dev->ops->lib->kick_queue(queue);
 
         /*
          * Check if driver supports flushing, if that is the case we can
@@ -1080,14 +1063,6 @@ void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
         if (unlikely(!rt2x00queue_empty(queue)))
                 rt2x00_warn(queue->rt2x00dev, "Queue %d failed to flush\n",
                             queue->qid);
-
-        /*
-         * Restore the queue to the previous status
-         */
-        if (started)
-                rt2x00queue_unpause_queue(queue);
-
-        mutex_unlock(&queue->status_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_flush_queue);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 88289873c0cf..4e121627925d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -523,7 +523,9 @@ static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
         rt2x00_warn(queue->rt2x00dev, "TX queue %d DMA timed out, invoke forced forced reset\n",
                     queue->qid);
 
+        rt2x00queue_stop_queue(queue);
         rt2x00queue_flush_queue(queue, true);
+        rt2x00queue_start_queue(queue);
 }
 
 static int rt2x00usb_dma_timeout(struct data_queue *queue)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 54d3ddfc9888..a5b69cb49012 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -685,7 +685,7 @@ static void rt61pci_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
 
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF2529));
         rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
-                          !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags));
+                          !rt2x00_has_cap_frame_type(rt2x00dev));
 
         /*
          * Configure the RX antenna.
@@ -813,10 +813,10 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_a(rt2x00dev);
         } else {
                 sel = antenna_sel_bg;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_bg(rt2x00dev);
         }
 
         for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
@@ -836,7 +836,7 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
         else if (rt2x00_rf(rt2x00dev, RF2527))
                 rt61pci_config_antenna_2x(rt2x00dev, ant);
         else if (rt2x00_rf(rt2x00dev, RF2529)) {
-                if (test_bit(CAPABILITY_DOUBLE_ANTENNA, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_double_antenna(rt2x00dev))
                         rt61pci_config_antenna_2x(rt2x00dev, ant);
                 else
                         rt61pci_config_antenna_2529(rt2x00dev, ant);
@@ -850,13 +850,13 @@ static void rt61pci_config_lna_gain(struct rt2x00_dev *rt2x00dev,
         short lna_gain = 0;
 
         if (libconf->conf->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG, &eeprom);
                 lna_gain -= rt2x00_get_field16(eeprom, EEPROM_RSSI_OFFSET_BG_1);
         } else {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_A, &eeprom);
@@ -1054,14 +1054,14 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev,
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
         } else {
                 low_bound = 0x20;
                 up_bound = 0x40;
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
@@ -2578,7 +2578,7 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * eeprom word.
          */
         if (rt2x00_rf(rt2x00dev, RF2529) &&
-            !test_bit(CAPABILITY_DOUBLE_ANTENNA, &rt2x00dev->cap_flags)) {
+            !rt2x00_has_cap_double_antenna(rt2x00dev)) {
                 rt2x00dev->default_ant.rx =
                     ANTENNA_A + rt2x00_get_field16(eeprom, EEPROM_NIC_RX_FIXED);
                 rt2x00dev->default_ant.tx =
@@ -2793,7 +2793,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_bands = SUPPORT_BAND_2GHZ;
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
-        if (!test_bit(CAPABILITY_RF_SEQUENCE, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_rf_sequence(rt2x00dev)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_noseq;
         } else {
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 1d3880e09a13..1baf9c896dcd 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -595,8 +595,8 @@ static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         switch (ant->rx) {
         case ANTENNA_HW_DIVERSITY:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
-                temp = !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags)
-                       && (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ);
+                temp = !rt2x00_has_cap_frame_type(rt2x00dev) &&
+                       (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, temp);
                 break;
         case ANTENNA_A:
@@ -636,7 +636,7 @@ static void rt73usb_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
 
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, 0);
         rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
-                          !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags));
+                          !rt2x00_has_cap_frame_type(rt2x00dev));
 
         /*
          * Configure the RX antenna.
@@ -709,10 +709,10 @@ static void rt73usb_config_ant(struct rt2x00_dev *rt2x00dev,
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_a(rt2x00dev);
         } else {
                 sel = antenna_sel_bg;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_bg(rt2x00dev);
         }
 
         for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
@@ -740,7 +740,7 @@ static void rt73usb_config_lna_gain(struct rt2x00_dev *rt2x00dev,
         short lna_gain = 0;
 
         if (libconf->conf->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG, &eeprom);
@@ -930,7 +930,7 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev,
                 low_bound = 0x28;
                 up_bound = 0x48;
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
@@ -946,7 +946,7 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev,
                         up_bound = 0x1c;
                 }
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                         low_bound += 0x14;
                         up_bound += 0x10;
                 }
@@ -1661,7 +1661,7 @@ static int rt73usb_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
         }
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         if (lna == 3 || lna == 2)
                                 offset += 10;
                 } else {
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index fc207b268e4f..a91506b12a62 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -1122,7 +1122,6 @@ static int rtl8180_probe(struct pci_dev *pdev,
         iounmap(priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 8bb4a9a01a18..9a78e3daf742 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1613,6 +1613,35 @@ err_free:
 }
 EXPORT_SYMBOL(rtl_send_smps_action);
 
+void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        enum io_type iotype;
+
+        if (!is_hal_stop(rtlhal)) {
+                switch (operation) {
+                case SCAN_OPT_BACKUP:
+                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                case SCAN_OPT_RESTORE:
+                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "Unknown Scan Backup operation.\n");
+                        break;
+                }
+        }
+}
+EXPORT_SYMBOL(rtl_phy_scan_operation_backup);
+
 /* There seem to be issues in mac80211 regarding when del ba frames can be
  * received. As a work around, we make a fake del_ba if we receive a ba_req;
  * however, rx_agg was opened to let mac80211 release some ba related
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 0e5fe0902daf..0cd07420777a 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -114,7 +114,6 @@ void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 
 void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb);
-void rtl_watch_dog_timer_callback(unsigned long data);
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
@@ -153,5 +152,6 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
 struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
                                 u8 *sa, u8 *bssid, u16 tid);
+void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/cam.h b/drivers/net/wireless/rtlwifi/cam.h
index 35e00086a520..0105e6c1901e 100644
--- a/drivers/net/wireless/rtlwifi/cam.h
+++ b/drivers/net/wireless/rtlwifi/cam.h
@@ -41,12 +41,12 @@
 #define CAM_CONFIG_USEDK                                1
 #define CAM_CONFIG_NO_USEDK                             0
 
-extern void rtl_cam_reset_all_entry(struct ieee80211_hw *hw);
-extern u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
-                        u32 ul_key_id, u32 ul_entry_idx, u32 ul_enc_alg,
-                        u32 ul_default_key, u8 *key_content);
+void rtl_cam_reset_all_entry(struct ieee80211_hw *hw);
+u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+                         u32 ul_key_id, u32 ul_entry_idx, u32 ul_enc_alg,
+                         u32 ul_default_key, u8 *key_content);
 int rtl_cam_delete_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
-                        u32 ul_key_id);
+                             u32 ul_key_id);
 void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index);
 void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index);
 void rtl_cam_reset_sec_info(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 733b7ce7f0e2..210ce7cd94d8 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -115,7 +115,7 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
         mutex_lock(&rtlpriv->locks.conf_mutex);
 
         mac->link_state = MAC80211_NOLINK;
-        memset(mac->bssid, 0, 6);
+        memset(mac->bssid, 0, ETH_ALEN);
         mac->vendor = PEER_UNKNOWN;
 
         /*reset sec info */
@@ -280,7 +280,7 @@ static void rtl_op_remove_interface(struct ieee80211_hw *hw,
         mac->p2p = 0;
         mac->vif = NULL;
         mac->link_state = MAC80211_NOLINK;
-        memset(mac->bssid, 0, 6);
+        memset(mac->bssid, 0, ETH_ALEN);
         mac->vendor = PEER_UNKNOWN;
         mac->opmode = NL80211_IFTYPE_UNSPECIFIED;
         rtlpriv->cfg->ops->set_network_type(hw, mac->opmode);
@@ -721,7 +721,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                         mac->link_state = MAC80211_LINKED;
                         mac->cnt_after_linked = 0;
                         mac->assoc_id = bss_conf->aid;
-                        memcpy(mac->bssid, bss_conf->bssid, 6);
+                        memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN);
 
                         if (rtlpriv->cfg->ops->linked_set_reg)
                                 rtlpriv->cfg->ops->linked_set_reg(hw);
@@ -750,7 +750,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                         if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
                                 rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
                         mac->link_state = MAC80211_NOLINK;
-                        memset(mac->bssid, 0, 6);
+                        memset(mac->bssid, 0, ETH_ALEN);
                         mac->vendor = PEER_UNKNOWN;
 
                         if (rtlpriv->dm.supp_phymode_switch) {
@@ -826,7 +826,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                          bss_conf->bssid);
 
                 mac->vendor = PEER_UNKNOWN;
-                memcpy(mac->bssid, bss_conf->bssid, 6);
+                memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN);
                 rtlpriv->cfg->ops->set_network_type(hw, vif->type);
 
                 rcu_read_lock();
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 838a1ed3f194..ae13fb94b2e8 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -1203,20 +1203,18 @@ static void efuse_power_switch(struct ieee80211_hw *hw, u8 write, u8 pwrstate)
 
 static u16 efuse_get_current_size(struct ieee80211_hw *hw)
 {
-        int continual = true;
         u16 efuse_addr = 0;
         u8 hworden;
         u8 efuse_data, word_cnts;
 
-        while (continual && efuse_one_byte_read(hw, efuse_addr, &efuse_data)
-               && (efuse_addr < EFUSE_MAX_SIZE)) {
-                if (efuse_data != 0xFF) {
-                        hworden = efuse_data & 0x0F;
-                        word_cnts = efuse_calculate_word_cnts(hworden);
-                        efuse_addr = efuse_addr + (word_cnts * 2) + 1;
-                } else {
-                        continual = false;
-                }
+        while (efuse_one_byte_read(hw, efuse_addr, &efuse_data) &&
+               efuse_addr < EFUSE_MAX_SIZE) {
+                if (efuse_data == 0xFF)
+                        break;
+
+                hworden = efuse_data & 0x0F;
+                word_cnts = efuse_calculate_word_cnts(hworden);
+                efuse_addr = efuse_addr + (word_cnts * 2) + 1;
         }
 
         return efuse_addr;
diff --git a/drivers/net/wireless/rtlwifi/efuse.h b/drivers/net/wireless/rtlwifi/efuse.h
index 395a326acfb4..1663b3afd41e 100644
--- a/drivers/net/wireless/rtlwifi/efuse.h
+++ b/drivers/net/wireless/rtlwifi/efuse.h
@@ -104,20 +104,19 @@ struct efuse_priv {
         u8 tx_power_g[14];
 };
 
-extern void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf);
-extern void efuse_initialize(struct ieee80211_hw *hw);
-extern u8 efuse_read_1byte(struct ieee80211_hw *hw, u16 address);
-extern void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value);
-extern void read_efuse(struct ieee80211_hw *hw, u16 _offset,
-                       u16 _size_byte, u8 *pbuf);
-extern void efuse_shadow_read(struct ieee80211_hw *hw, u8 type,
-                              u16 offset, u32 *value);
-extern void efuse_shadow_write(struct ieee80211_hw *hw, u8 type,
-                               u16 offset, u32 value);
-extern bool efuse_shadow_update(struct ieee80211_hw *hw);
-extern bool efuse_shadow_update_chk(struct ieee80211_hw *hw);
-extern void rtl_efuse_shadow_map_update(struct ieee80211_hw *hw);
-extern void efuse_force_write_vendor_Id(struct ieee80211_hw *hw);
-extern void efuse_re_pg_section(struct ieee80211_hw *hw, u8 section_idx);
+void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf);
+void efuse_initialize(struct ieee80211_hw *hw);
+u8 efuse_read_1byte(struct ieee80211_hw *hw, u16 address);
+void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value);
+void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf);
+void efuse_shadow_read(struct ieee80211_hw *hw, u8 type, u16 offset,
+                       u32 *value);
+void efuse_shadow_write(struct ieee80211_hw *hw, u8 type, u16 offset,
+                        u32 value);
+bool efuse_shadow_update(struct ieee80211_hw *hw);
+bool efuse_shadow_update_chk(struct ieee80211_hw *hw);
+void rtl_efuse_shadow_map_update(struct ieee80211_hw *hw);
+void efuse_force_write_vendor_Id(struct ieee80211_hw *hw);
+void efuse_re_pg_section(struct ieee80211_hw *hw, u8 section_idx);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 703f839af6ca..0f494444bcd1 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -736,7 +736,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
 
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
         int index = rtlpci->rx_ring[rx_queue_idx].idx;
@@ -2009,7 +2008,6 @@ fail2:
 fail1:
         if (hw)
                 ieee80211_free_hw(hw);
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
 
         return err;
@@ -2064,8 +2062,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
 
         rtl_pci_disable_aspm(hw);
 
-        pci_set_drvdata(pdev, NULL);
-
         ieee80211_free_hw(hw);
 }
 EXPORT_SYMBOL(rtl_pci_disconnect);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
index b68cae3024fc..e06971be7df7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -143,6 +143,7 @@ static void _rtl88ee_set_fw_clock_on(struct ieee80211_hw *hw,
                 } else {
                         rtlhal->fw_clk_change_in_progress = false;
                         spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                        break;
                 }
         }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
index e655c0473225..d67f9c731cc4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
@@ -1136,34 +1136,6 @@ void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel)
                                            &bw40_pwr[0], channel);
 }
 
-void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation.\n");
-                        break;
-                }
-        }
-}
-
 void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
index f1acd6d27e44..89f0f1ef1465 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
@@ -200,37 +200,35 @@ enum _ANT_DIV_TYPE {
         CGCS_RX_SW_ANTDIV               = 0x05,
 };
 
-extern u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw,
-                                   u32 regaddr, u32 bitmask);
-extern void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
-                                  u32 regaddr, u32 bitmask, u32 data);
-extern u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
-                                   enum radio_path rfpath, u32 regaddr,
-                                   u32 bitmask);
-extern void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
-                                  enum radio_path rfpath, u32 regaddr,
-                                  u32 bitmask, u32 data);
-extern bool rtl88e_phy_mac_config(struct ieee80211_hw *hw);
-extern bool rtl88e_phy_bb_config(struct ieee80211_hw *hw);
-extern bool rtl88e_phy_rf_config(struct ieee80211_hw *hw);
-extern void rtl88e_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-extern void rtl88e_phy_get_txpower_level(struct ieee80211_hw *hw,
-                                         long *powerlevel);
-extern void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
-extern void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
-extern void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
-extern void rtl88e_phy_set_bw_mode(struct ieee80211_hw *hw,
-                                   enum nl80211_channel_type ch_type);
-extern void rtl88e_phy_sw_chnl_callback(struct ieee80211_hw *hw);
-extern u8 rtl88e_phy_sw_chnl(struct ieee80211_hw *hw);
-extern void rtl88e_phy_iq_calibrate(struct ieee80211_hw *hw, bool b_recovery);
+u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw,
+                            u32 regaddr, u32 bitmask);
+void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
+                           u32 regaddr, u32 bitmask, u32 data);
+u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
+                            enum radio_path rfpath, u32 regaddr,
+                            u32 bitmask);
+void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
+                           enum radio_path rfpath, u32 regaddr,
+                           u32 bitmask, u32 data);
+bool rtl88e_phy_mac_config(struct ieee80211_hw *hw);
+bool rtl88e_phy_bb_config(struct ieee80211_hw *hw);
+bool rtl88e_phy_rf_config(struct ieee80211_hw *hw);
+void rtl88e_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
+void rtl88e_phy_get_txpower_level(struct ieee80211_hw *hw,
+                                  long *powerlevel);
+void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
+void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
+void rtl88e_phy_set_bw_mode(struct ieee80211_hw *hw,
+                            enum nl80211_channel_type ch_type);
+void rtl88e_phy_sw_chnl_callback(struct ieee80211_hw *hw);
+u8 rtl88e_phy_sw_chnl(struct ieee80211_hw *hw);
+void rtl88e_phy_iq_calibrate(struct ieee80211_hw *hw, bool b_recovery);
 void rtl88e_phy_lc_calibrate(struct ieee80211_hw *hw);
 void rtl88e_phy_set_rfpath_switch(struct ieee80211_hw *hw, bool bmain);
 bool rtl88e_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
                                           enum radio_path rfpath);
 bool rtl88e_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
-extern bool rtl88e_phy_set_rf_power_state(struct ieee80211_hw *hw,
-                                          enum rf_pwrstate rfpwr_state);
+bool rtl88e_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                   enum rf_pwrstate rfpwr_state);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
index c254693a1e6a..347af1e4f438 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -244,7 +245,7 @@ static struct rtl_hal_ops rtl8188ee_hal_ops = {
         .set_bw_mode = rtl88e_phy_set_bw_mode,
         .switch_channel = rtl88e_phy_sw_chnl,
         .dm_watchdog = rtl88e_dm_watchdog,
-        .scan_operation_backup = rtl88e_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl88e_phy_set_rf_power_state,
         .led_control = rtl88ee_led_control,
         .set_desc = rtl88ee_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 68685a898257..aece6c9cccf1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -478,7 +478,6 @@ bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = status->signal; */
         rx_status->signal = status->recvsignalpower + 10;
-        /*rx_status->noise = -status->noise; */
         if (status->packet_report_type == TX_REPORT2) {
                 status->macid_valid_entry[0] =
                          GET_RX_RPT2_DESC_MACID_VALID_1(pdesc);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index d2d57a27a7c1..e9caa5d4cff0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -541,29 +541,6 @@ EXPORT_SYMBOL(rtl92c_dm_write_dig);
 
 static void rtl92c_dm_pwdb_monitor(struct ieee80211_hw *hw)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        long tmpentry_max_pwdb = 0, tmpentry_min_pwdb = 0xff;
-
-        u8 h2c_parameter[3] = { 0 };
-
-        return;
-
-        if (tmpentry_max_pwdb != 0) {
-                rtlpriv->dm.entry_max_undec_sm_pwdb = tmpentry_max_pwdb;
-        } else {
-                rtlpriv->dm.entry_max_undec_sm_pwdb = 0;
-        }
-
-        if (tmpentry_min_pwdb != 0xff) {
-                rtlpriv->dm.entry_min_undec_sm_pwdb = tmpentry_min_pwdb;
-        } else {
-                rtlpriv->dm.entry_min_undec_sm_pwdb = 0;
-        }
-
-        h2c_parameter[2] = (u8) (rtlpriv->dm.undec_sm_pwdb & 0xFF);
-        h2c_parameter[0] = 0;
-
-        rtl92c_fill_h2c_cmd(hw, H2C_RSSI_REPORT, 3, h2c_parameter);
 }
 
 void rtl92c_dm_init_edca_turbo(struct ieee80211_hw *hw)
@@ -673,7 +650,7 @@ static void rtl92c_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
         s8 cck_index = 0;
         int i;
         bool is2t = IS_92C_SERIAL(rtlhal->version);
-        s8 txpwr_level[2] = {0, 0};
+        s8 txpwr_level[3] = {0, 0, 0};
         u8 ofdm_min_index = 6, rf;
 
         rtlpriv->dm.txpower_trackinginit = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 246e5352f2e1..0c0e78263a66 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -592,36 +592,6 @@ long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(_rtl92c_phy_txpwr_idx_to_dbm);
 
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation\n");
-                        break;
-                }
-        }
-}
-EXPORT_SYMBOL(rtl92c_phy_scan_operation_backup);
-
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
                             enum nl80211_channel_type ch_type)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
index cec10d696492..e79dabe9ba1d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                false
 #define HIGHPOWER_RADIOA_ARRAYLEN       22
 
-#define IQK_ADDA_REG_NUM                16
 #define MAX_TOLERANCE                   5
-#define IQK_DELAY_TIME                  1
 
 #define APK_BB_REG_NUM                  5
 #define APK_AFE_REG_NUM                 16
@@ -205,8 +203,6 @@ void rtl92c_phy_get_txpower_level(struct ieee80211_hw *hw,
 void rtl92c_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
 bool rtl92c_phy_update_txpower_dbm(struct ieee80211_hw *hw,
                                           long power_indbm);
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
                                    enum nl80211_channel_type ch_type);
 void rtl92c_phy_sw_chnl_callback(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 3cfa1bb0f476..fa24de43ce79 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -152,8 +152,6 @@ enum version_8192c {
 #define IS_VENDOR_UMC_A_CUT(version)    ((IS_CHIP_VENDOR_UMC(version)) ? \
         ((GET_CVID_CUT_VERSION(version)) ? false : true) : false)
 #define IS_CHIP_VER_B(version)  ((version & CHIP_VER_B) ? true : false)
-#define IS_VENDOR_UMC_A_CUT(version)    ((IS_CHIP_VENDOR_UMC(version)) ? \
-        ((GET_CVID_CUT_VERSION(version)) ? false : true) : false)
 #define IS_92C_SERIAL(version)  ((version & CHIP_92C_BITMASK) ? true : false)
 #define IS_CHIP_VENDOR_UMC(version)             \
         ((version & CHIP_VENDOR_UMC) ? true : false)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
index d5e3b704f930..94486cca4000 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                false
 #define HIGHPOWER_RADIOA_ARRAYLEN       22
 
-#define IQK_ADDA_REG_NUM                16
 #define MAX_TOLERANCE                   5
-#define IQK_DELAY_TIME                  1
 
 #define APK_BB_REG_NUM                  5
 #define APK_AFE_REG_NUM                 16
@@ -188,36 +186,29 @@ struct tx_power_struct {
 };
 
 bool rtl92c_phy_bb_config(struct ieee80211_hw *hw);
-u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw,
-                                   u32 regaddr, u32 bitmask);
-void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
-                                  u32 regaddr, u32 bitmask, u32 data);
-u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
-                                   enum radio_path rfpath, u32 regaddr,
-                                   u32 bitmask);
-extern void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
-                                   enum radio_path rfpath, u32 regaddr,
-                                   u32 bitmask, u32 data);
+u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask);
+void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
+                           u32 data);
+u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+                            u32 regaddr, u32 bitmask);
+void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+                            u32 regaddr, u32 bitmask, u32 data);
 bool rtl92c_phy_mac_config(struct ieee80211_hw *hw);
 bool rtl92ce_phy_bb_config(struct ieee80211_hw *hw);
 bool rtl92c_phy_rf_config(struct ieee80211_hw *hw);
 bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
-                                                 enum radio_path rfpath);
+                                          enum radio_path rfpath);
 void rtl92c_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-void rtl92c_phy_get_txpower_level(struct ieee80211_hw *hw,
-                                         long *powerlevel);
+void rtl92c_phy_get_txpower_level(struct ieee80211_hw *hw, long *powerlevel);
 void rtl92c_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
 bool rtl92c_phy_update_txpower_dbm(struct ieee80211_hw *hw,
                                           long power_indbm);
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
-                                   enum nl80211_channel_type ch_type);
+                            enum nl80211_channel_type ch_type);
 void rtl92c_phy_sw_chnl_callback(struct ieee80211_hw *hw);
 u8 rtl92c_phy_sw_chnl(struct ieee80211_hw *hw);
 void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool b_recovery);
-void rtl92c_phy_set_beacon_hw_reg(struct ieee80211_hw *hw,
-                                         u16 beaconinterval);
+void rtl92c_phy_set_beacon_hw_reg(struct ieee80211_hw *hw, u16 beaconinterval);
 void rtl92c_phy_ap_calibrate(struct ieee80211_hw *hw, char delta);
 void rtl92c_phy_lc_calibrate(struct ieee80211_hw *hw);
 void _rtl92ce_phy_lc_calibrate(struct ieee80211_hw *hw, bool is2t);
@@ -225,28 +216,25 @@ void rtl92c_phy_set_rfpath_switch(struct ieee80211_hw *hw, bool bmain);
 bool rtl92c_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
                                           enum radio_path rfpath);
 bool rtl8192_phy_check_is_legal_rfpath(struct ieee80211_hw *hw,
-                                              u32 rfpath);
-bool rtl92c_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
+                                       u32 rfpath);
 bool rtl92ce_phy_set_rf_power_state(struct ieee80211_hw *hw,
-                                          enum rf_pwrstate rfpwr_state);
+                                    enum rf_pwrstate rfpwr_state);
 void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
 bool rtl92c_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
 void rtl92c_phy_set_io(struct ieee80211_hw *hw);
 void rtl92c_bb_block_on(struct ieee80211_hw *hw);
-u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw,
-                                      enum radio_path rfpath, u32 offset);
+u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
+                               u32 offset);
 u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
-                                         enum radio_path rfpath, u32 offset);
+                                  enum radio_path rfpath, u32 offset);
 u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
 void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
-                                        enum radio_path rfpath, u32 offset,
-                                        u32 data);
+                                 enum radio_path rfpath, u32 offset, u32 data);
 void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
-                                           enum radio_path rfpath, u32 offset,
-                                           u32 data);
+                                    enum radio_path rfpath, u32 offset,
+                                    u32 data);
 void _rtl92c_store_pwrIndex_diffrate_offset(struct ieee80211_hw *hw,
-                                                   u32 regaddr, u32 bitmask,
-                                                   u32 data);
+                                            u32 regaddr, u32 bitmask, u32 data);
 bool _rtl92ce_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
 void _rtl92c_phy_init_bb_rf_register_definition(struct ieee80211_hw *hw);
 bool _rtl92c_phy_bb8192c_config_parafile(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
index bd4aef74c056..8922ecb47ad2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
@@ -560,7 +560,6 @@
 #define EEPROM_DEFAULT_TXPOWERLEVEL             0x22
 #define EEPROM_DEFAULT_HT40_2SDIFF              0x0
 #define EEPROM_DEFAULT_HT20_DIFF                2
-#define EEPROM_DEFAULT_LEGACYHTTXPOWERDIFF      0x3
 #define EEPROM_DEFAULT_HT40_PWRMAXOFFSET        0
 #define EEPROM_DEFAULT_HT20_PWRMAXOFFSET        0
 
@@ -639,17 +638,8 @@
 
 #define EEPROM_TXPWR_GROUP                      0x6F
 
-#define EEPROM_TSSI_A                           0x76
-#define EEPROM_TSSI_B                           0x77
-#define EEPROM_THERMAL_METER                    0x78
-
 #define EEPROM_CHANNELPLAN                      0x75
 
-#define RF_OPTION1                              0x79
-#define RF_OPTION2                              0x7A
-#define RF_OPTION3                              0x7B
-#define RF_OPTION4                              0x7C
-
 #define STOPBECON                               BIT(6)
 #define STOPHIGHT                               BIT(5)
 #define STOPMGT                                 BIT(4)
@@ -689,13 +679,6 @@
 #define RSV_CTRL                                0x001C
 #define RD_CTRL                                 0x0524
 
-#define REG_USB_INFO                            0xFE17
-#define REG_USB_SPECIAL_OPTION                  0xFE55
-
-#define REG_USB_DMA_AGG_TO                      0xFE5B
-#define REG_USB_AGG_TO                          0xFE5C
-#define REG_USB_AGG_TH                          0xFE5D
-
 #define REG_USB_VID                             0xFE60
 #define REG_USB_PID                             0xFE62
 #define REG_USB_OPTIONAL                        0xFE64
@@ -1196,9 +1179,6 @@
 #define POLLING_LLT_THRESHOLD                   20
 #define POLLING_READY_TIMEOUT_COUNT             1000
 
-#define MAX_MSS_DENSITY_2T                      0x13
-#define MAX_MSS_DENSITY_1T                      0x0A
-
 #define EPROM_CMD_OPERATING_MODE_MASK   ((1<<7)|(1<<6))
 #define EPROM_CMD_CONFIG                        0x3
 #define EPROM_CMD_LOAD                          1
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/rf.h b/drivers/net/wireless/rtlwifi/rtl8192ce/rf.h
index 6c8d56efceae..d8fe68b389d2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/rf.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/rf.h
@@ -34,11 +34,10 @@
 #define RF6052_MAX_REG                  0x3F
 #define RF6052_MAX_PATH                 2
 
-extern void rtl92ce_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw,
-                                             u8 bandwidth);
-extern void rtl92ce_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
-                                               u8 *ppowerlevel);
-extern void rtl92ce_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
-                                                u8 *ppowerlevel, u8 channel);
-extern bool rtl92ce_phy_rf6052_config(struct ieee80211_hw *hw);
+void rtl92ce_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw, u8 bandwidth);
+void rtl92ce_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                        u8 *ppowerlevel);
+void rtl92ce_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                         u8 *ppowerlevel, u8 channel);
+bool rtl92ce_phy_rf6052_config(struct ieee80211_hw *hw);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 14203561b6ee..b790320d2030 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -219,7 +220,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .set_bw_mode = rtl92c_phy_set_bw_mode,
         .switch_channel = rtl92c_phy_sw_chnl,
         .dm_watchdog = rtl92c_dm_watchdog,
-        .scan_operation_backup = rtl92c_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92c_phy_set_rf_power_state,
         .led_control = rtl92ce_led_control,
         .set_desc = rtl92ce_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 6ad23b413eb3..52abf0a862fa 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -420,7 +420,6 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->recvsignalpower + 10;
-        /*rx_status->noise = -stats->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index da4f587199ee..393685390f3e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -32,6 +32,7 @@
 #include "../usb.h"
 #include "../ps.h"
 #include "../cam.h"
+#include "../stats.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -738,16 +739,6 @@ static u8 _rtl92c_evm_db_to_percentage(char value)
         return ret_val;
 }
 
-static long _rtl92c_translate_todbm(struct ieee80211_hw *hw,
-                                     u8 signal_strength_index)
-{
-        long signal_power;
-
-        signal_power = (long)((signal_strength_index + 1) >> 1);
-        signal_power -= 95;
-        return signal_power;
-}
-
 static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
                 long currsig)
 {
@@ -913,180 +904,6 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                           (hw, total_rssi /= rf_rx_num));
 }
 
-static void _rtl92c_process_ui_rssi(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 rfpath;
-        u32 last_rssi, tmpval;
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                rtlpriv->stats.rssi_calculate_cnt++;
-                if (rtlpriv->stats.ui_rssi.total_num++ >=
-                    PHY_RSSI_SLID_WIN_MAX) {
-                        rtlpriv->stats.ui_rssi.total_num =
-                            PHY_RSSI_SLID_WIN_MAX;
-                        last_rssi =
-                            rtlpriv->stats.ui_rssi.elements[rtlpriv->
-                                                           stats.ui_rssi.index];
-                        rtlpriv->stats.ui_rssi.total_val -= last_rssi;
-                }
-                rtlpriv->stats.ui_rssi.total_val += pstats->signalstrength;
-                rtlpriv->stats.ui_rssi.elements[rtlpriv->stats.ui_rssi.
-                                        index++] = pstats->signalstrength;
-                if (rtlpriv->stats.ui_rssi.index >= PHY_RSSI_SLID_WIN_MAX)
-                        rtlpriv->stats.ui_rssi.index = 0;
-                tmpval = rtlpriv->stats.ui_rssi.total_val /
-                    rtlpriv->stats.ui_rssi.total_num;
-                rtlpriv->stats.signal_strength =
-                    _rtl92c_translate_todbm(hw, (u8) tmpval);
-                pstats->rssi = rtlpriv->stats.signal_strength;
-        }
-        if (!pstats->is_cck && pstats->packet_toself) {
-                for (rfpath = RF90_PATH_A; rfpath < rtlphy->num_total_rfpath;
-                     rfpath++) {
-                        if (!rtl8192_phy_check_is_legal_rfpath(hw, rfpath))
-                                continue;
-                        if (rtlpriv->stats.rx_rssi_percentage[rfpath] == 0) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    pstats->rx_mimo_signalstrength[rfpath];
-                        }
-                        if (pstats->rx_mimo_signalstrength[rfpath] >
-                            rtlpriv->stats.rx_rssi_percentage[rfpath]) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    rtlpriv->stats.rx_rssi_percentage[rfpath] +
-                                    1;
-                        } else {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-                        }
-                }
-        }
-}
-
-static void _rtl92c_update_rxsignalstatistics(struct ieee80211_hw *hw,
-                                               struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        int weighting = 0;
-
-        if (rtlpriv->stats.recv_signal_power == 0)
-                rtlpriv->stats.recv_signal_power = pstats->recvsignalpower;
-        if (pstats->recvsignalpower > rtlpriv->stats.recv_signal_power)
-                weighting = 5;
-        else if (pstats->recvsignalpower < rtlpriv->stats.recv_signal_power)
-                weighting = (-5);
-        rtlpriv->stats.recv_signal_power =
-            (rtlpriv->stats.recv_signal_power * 5 +
-             pstats->recvsignalpower + weighting) / 6;
-}
-
-static void _rtl92c_process_pwdb(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        long undec_sm_pwdb = 0;
-
-        if (mac->opmode == NL80211_IFTYPE_ADHOC) {
-                return;
-        } else {
-                undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
-        }
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                if (undec_sm_pwdb < 0)
-                        undec_sm_pwdb = pstats->rx_pwdb_all;
-                if (pstats->rx_pwdb_all > (u32) undec_sm_pwdb) {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-                        undec_sm_pwdb += 1;
-                } else {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-                }
-                rtlpriv->dm.undec_sm_pwdb = undec_sm_pwdb;
-                _rtl92c_update_rxsignalstatistics(hw, pstats);
-        }
-}
-
-static void _rtl92c_process_LINK_Q(struct ieee80211_hw *hw,
-                                             struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 last_evm = 0, n_stream, tmpval;
-
-        if (pstats->signalquality != 0) {
-                if (pstats->packet_toself || pstats->packet_beacon) {
-                        if (rtlpriv->stats.LINK_Q.total_num++ >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX) {
-                                rtlpriv->stats.LINK_Q.total_num =
-                                    PHY_LINKQUALITY_SLID_WIN_MAX;
-                                last_evm =
-                                    rtlpriv->stats.LINK_Q.elements
-                                    [rtlpriv->stats.LINK_Q.index];
-                                rtlpriv->stats.LINK_Q.total_val -=
-                                    last_evm;
-                        }
-                        rtlpriv->stats.LINK_Q.total_val +=
-                            pstats->signalquality;
-                        rtlpriv->stats.LINK_Q.elements
-                           [rtlpriv->stats.LINK_Q.index++] =
-                            pstats->signalquality;
-                        if (rtlpriv->stats.LINK_Q.index >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX)
-                                rtlpriv->stats.LINK_Q.index = 0;
-                        tmpval = rtlpriv->stats.LINK_Q.total_val /
-                            rtlpriv->stats.LINK_Q.total_num;
-                        rtlpriv->stats.signal_quality = tmpval;
-                        rtlpriv->stats.last_sigstrength_inpercent = tmpval;
-                        for (n_stream = 0; n_stream < 2;
-                             n_stream++) {
-                                if (pstats->RX_SIGQ[n_stream] != -1) {
-                                        if (!rtlpriv->stats.RX_EVM[n_stream]) {
-                                                rtlpriv->stats.RX_EVM[n_stream]
-                                                 = pstats->RX_SIGQ[n_stream];
-                                        }
-                                        rtlpriv->stats.RX_EVM[n_stream] =
-                                            ((rtlpriv->stats.RX_EVM
-                                            [n_stream] *
-                                            (RX_SMOOTH_FACTOR - 1)) +
-                                            (pstats->RX_SIGQ
-                                            [n_stream] * 1)) /
-                                            (RX_SMOOTH_FACTOR);
-                                }
-                        }
-                }
-        } else {
-                ;
-        }
-}
-
-static void _rtl92c_process_phyinfo(struct ieee80211_hw *hw,
-                                     u8 *buffer,
-                                     struct rtl_stats *pcurrent_stats)
-{
-        if (!pcurrent_stats->packet_matchbssid &&
-            !pcurrent_stats->packet_beacon)
-                return;
-        _rtl92c_process_ui_rssi(hw, pcurrent_stats);
-        _rtl92c_process_pwdb(hw, pcurrent_stats);
-        _rtl92c_process_LINK_Q(hw, pcurrent_stats);
-}
-
 void rtl92c_translate_rx_signal_stuff(struct ieee80211_hw *hw,
                                                struct sk_buff *skb,
                                                struct rtl_stats *pstats,
@@ -1123,5 +940,5 @@ void rtl92c_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         _rtl92c_query_rxphystatus(hw, pstats, pdesc, p_drvinfo,
                                    packet_matchbssid, packet_toself,
                                    packet_beacon);
-        _rtl92c_process_phyinfo(hw, tmp_buf, pstats);
+        rtl_process_phyinfo(hw, tmp_buf, pstats);
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.h b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.h
index 090fd33a158d..11b439d6b671 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.h
@@ -34,15 +34,14 @@
 #define RF6052_MAX_REG                  0x3F
 #define RF6052_MAX_PATH                 2
 
-extern void rtl92cu_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw,
-                                            u8 bandwidth);
-extern void rtl92c_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
-                                              u8 *ppowerlevel);
-extern void rtl92c_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
-                                               u8 *ppowerlevel, u8 channel);
+void rtl92cu_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw, u8 bandwidth);
+void rtl92c_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                       u8 *ppowerlevel);
+void rtl92c_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                        u8 *ppowerlevel, u8 channel);
 bool rtl92cu_phy_rf6052_config(struct ieee80211_hw *hw);
 bool rtl92cu_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
-                                          enum radio_path rfpath);
+                                           enum radio_path rfpath);
 void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
                                         u8 *ppowerlevel);
 void rtl92cu_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 2bd598526217..9936de716ad5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -31,6 +31,7 @@
 #include "../core.h"
 #include "../usb.h"
 #include "../efuse.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -117,7 +118,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .set_bw_mode = rtl92c_phy_set_bw_mode,
         .switch_channel = rtl92c_phy_sw_chnl,
         .dm_watchdog = rtl92c_dm_watchdog,
-        .scan_operation_backup = rtl92c_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92cu_phy_set_rf_power_state,
         .led_control = rtl92cu_led_control,
         .enable_hw_sec = rtl92cu_enable_hw_security_config,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 5a060e537fbe..25e50ffc44ec 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -350,7 +350,6 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         }
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
         return true;
 }
 
@@ -365,7 +364,6 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         u8 *rxdesc;
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
         struct rx_fwinfo_92c *p_drvinfo;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index f700f7a614b2..7908e1c85819 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -840,9 +840,9 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
         bool internal_pa = false;
         long ele_a = 0, ele_d, temp_cck, val_x, value32;
         long val_y, ele_c = 0;
-        u8 ofdm_index[2];
+        u8 ofdm_index[3];
         s8 cck_index = 0;
-        u8 ofdm_index_old[2] = {0, 0};
+        u8 ofdm_index_old[3] = {0, 0, 0};
         s8 cck_index_old = 0;
         u8 index;
         int i;
@@ -1118,6 +1118,10 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
                                  val_x, val_y, ele_a, ele_c, ele_d,
                                  val_x, val_y);
 
+                        if (cck_index >= CCK_TABLE_SIZE)
+                                cck_index = CCK_TABLE_SIZE - 1;
+                        if (cck_index < 0)
+                                cck_index = 0;
                         if (rtlhal->current_bandtype == BAND_ON_2_4G) {
                                 /* Adjust CCK according to IQK result */
                                 if (!rtlpriv->dm.cck_inch14) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 7dd8f6de0550..c4a7db9135d6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1194,25 +1194,7 @@ void rtl92d_linked_set_reg(struct ieee80211_hw *hw)
  * mac80211 will send pkt when scan */
 void rtl92de_set_qos(struct ieee80211_hw *hw, int aci)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
         rtl92d_dm_init_edca_turbo(hw);
-        return;
-        switch (aci) {
-        case AC1_BK:
-                rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM, 0xa44f);
-                break;
-        case AC0_BE:
-                break;
-        case AC2_VI:
-                rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM, 0x5e4322);
-                break;
-        case AC3_VO:
-                rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM, 0x2f3222);
-                break;
-        default:
-                RT_ASSERT(false, "invalid aci: %d !\n", aci);
-                break;
-        }
 }
 
 void rtl92de_enable_interrupt(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.h b/drivers/net/wireless/rtlwifi/rtl8192de/hw.h
index 7c9f7a2f1e42..1bc7b1a96d4a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.h
@@ -55,10 +55,9 @@ void rtl92de_set_key(struct ieee80211_hw *hw, u32 key_index,
                      u8 *p_macaddr, bool is_group, u8 enc_algo,
                      bool is_wepkey, bool clear_all);
 
-extern void rtl92de_write_dword_dbi(struct ieee80211_hw *hw, u16 offset,
-                                    u32 value, u8 direct);
-extern u32 rtl92de_read_dword_dbi(struct ieee80211_hw *hw, u16 offset,
-                                  u8 direct);
+void rtl92de_write_dword_dbi(struct ieee80211_hw *hw, u16 offset, u32 value,
+                             u8 direct);
+u32 rtl92de_read_dword_dbi(struct ieee80211_hw *hw, u16 offset, u8 direct);
 void rtl92de_suspend(struct ieee80211_hw *hw);
 void rtl92de_resume(struct ieee80211_hw *hw);
 void rtl92d_linked_set_reg(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 840bac5fa2f8..13196cc4b1d3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -1022,34 +1022,6 @@ void rtl92d_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel)
         rtl92d_phy_rf6052_set_ofdm_txpower(hw, &ofdmpowerlevel[0], channel);
 }
 
-void rtl92d_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        rtlhal->current_bandtypebackup =
-                                                 rtlhal->current_bandtype;
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation\n");
-                        break;
-                }
-        }
-}
-
 void rtl92d_phy_set_bw_mode(struct ieee80211_hw *hw,
                             enum nl80211_channel_type ch_type)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.h b/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
index f074952bf25c..48d5c6835b6a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                        false
 #define HIGHPOWER_RADIOA_ARRAYLEN               22
 
-#define IQK_ADDA_REG_NUM                        16
 #define MAX_TOLERANCE                           5
-#define IQK_DELAY_TIME                          1
 
 #define APK_BB_REG_NUM                          5
 #define APK_AFE_REG_NUM                         16
@@ -127,34 +125,32 @@ static inline void rtl92d_release_cckandrw_pagea_ctl(struct ieee80211_hw *hw,
                         *flag);
 }
 
-extern u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw,
-                                   u32 regaddr, u32 bitmask);
-extern void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
-                                  u32 regaddr, u32 bitmask, u32 data);
-extern u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
-                                   enum radio_path rfpath, u32 regaddr,
-                                   u32 bitmask);
-extern void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw,
-                                  enum radio_path rfpath, u32 regaddr,
-                                  u32 bitmask, u32 data);
-extern bool rtl92d_phy_mac_config(struct ieee80211_hw *hw);
-extern bool rtl92d_phy_bb_config(struct ieee80211_hw *hw);
-extern bool rtl92d_phy_rf_config(struct ieee80211_hw *hw);
-extern bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
-                                                 enum radio_path rfpath);
-extern void rtl92d_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-extern void rtl92d_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
-extern void rtl92d_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
-extern void rtl92d_phy_set_bw_mode(struct ieee80211_hw *hw,
-                                   enum nl80211_channel_type ch_type);
-extern u8 rtl92d_phy_sw_chnl(struct ieee80211_hw *hw);
+u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw,
+                            u32 regaddr, u32 bitmask);
+void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
+                           u32 regaddr, u32 bitmask, u32 data);
+u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
+                            enum radio_path rfpath, u32 regaddr,
+                            u32 bitmask);
+void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw,
+                           enum radio_path rfpath, u32 regaddr,
+                           u32 bitmask, u32 data);
+bool rtl92d_phy_mac_config(struct ieee80211_hw *hw);
+bool rtl92d_phy_bb_config(struct ieee80211_hw *hw);
+bool rtl92d_phy_rf_config(struct ieee80211_hw *hw);
+bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
+                                          enum radio_path rfpath);
+void rtl92d_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
+void rtl92d_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
+void rtl92d_phy_set_bw_mode(struct ieee80211_hw *hw,
+                            enum nl80211_channel_type ch_type);
+u8 rtl92d_phy_sw_chnl(struct ieee80211_hw *hw);
 bool rtl92d_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
                                           enum rf_content content,
                                           enum radio_path rfpath);
 bool rtl92d_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
-extern bool rtl92d_phy_set_rf_power_state(struct ieee80211_hw *hw,
-                                          enum rf_pwrstate rfpwr_state);
+bool rtl92d_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                   enum rf_pwrstate rfpwr_state);
 
 void rtl92d_phy_config_macphymode(struct ieee80211_hw *hw);
 void rtl92d_phy_config_macphymode_info(struct ieee80211_hw *hw);
@@ -173,6 +169,5 @@ void rtl92d_acquire_cckandrw_pagea_ctl(struct ieee80211_hw *hw,
                                        unsigned long *flag);
 u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl);
 void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel);
-void rtl92d_phy_iq_calibrate(struct ieee80211_hw *hw);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/rf.h b/drivers/net/wireless/rtlwifi/rtl8192de/rf.h
index 0fe1a48593e8..7303d12c266f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/rf.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/rf.h
@@ -30,15 +30,13 @@
 #ifndef __RTL92D_RF_H__
 #define __RTL92D_RF_H__
 
-extern void rtl92d_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw,
-                                            u8 bandwidth);
-extern void rtl92d_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
-                                              u8 *ppowerlevel);
-extern void rtl92d_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
-                                               u8 *ppowerlevel, u8 channel);
-extern bool rtl92d_phy_rf6052_config(struct ieee80211_hw *hw);
-extern bool rtl92d_phy_enable_anotherphy(struct ieee80211_hw *hw, bool bmac0);
-extern void rtl92d_phy_powerdown_anotherphy(struct ieee80211_hw *hw,
-                                            bool bmac0);
+void rtl92d_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw, u8 bandwidth);
+void rtl92d_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                       u8 *ppowerlevel);
+void rtl92d_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                        u8 *ppowerlevel, u8 channel);
+bool rtl92d_phy_rf6052_config(struct ieee80211_hw *hw);
+bool rtl92d_phy_enable_anotherphy(struct ieee80211_hw *hw, bool bmac0);
+void rtl92d_phy_powerdown_anotherphy(struct ieee80211_hw *hw, bool bmac0);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index c18c04bf0c13..edab5a5351b5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -236,7 +237,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .set_bw_mode = rtl92d_phy_set_bw_mode,
         .switch_channel = rtl92d_phy_sw_chnl,
         .dm_watchdog = rtl92d_dm_watchdog,
-        .scan_operation_backup = rtl92d_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92d_phy_set_rf_power_state,
         .led_control = rtl92de_led_control,
         .set_desc = rtl92de_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index b8ec718a0fab..945ddecf90c9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -526,7 +526,6 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
         }
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
         return true;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/reg.h b/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
index 84d1181795b8..c81c83591940 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
@@ -425,14 +425,9 @@
 #define EXT_IMEM_CODE_DONE                      BIT(2)
 #define IMEM_CHK_RPT                            BIT(1)
 #define IMEM_CODE_DONE                          BIT(0)
-#define IMEM_CODE_DONE                          BIT(0)
-#define IMEM_CHK_RPT                            BIT(1)
 #define EMEM_CODE_DONE                          BIT(2)
 #define EMEM_CHK_RPT                            BIT(3)
-#define DMEM_CODE_DONE                          BIT(4)
 #define IMEM_RDY                                BIT(5)
-#define BASECHG                                 BIT(6)
-#define FWRDY                                   BIT(7)
 #define LOAD_FW_READY                           (IMEM_CODE_DONE | \
                                                 IMEM_CHK_RPT | \
                                                 EMEM_CODE_DONE | \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index c7095118de6e..222d2e792ca6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -330,7 +330,6 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
 
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
index eafbb18dd48e..5d318a85eda4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
@@ -934,35 +934,6 @@ static long _phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
         return pwrout_dbm;
 }
 
-void rtl8723ae_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation.\n");
-                        break;
-                }
-        }
-}
-
 void rtl8723ae_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
index e7a59eba351a..007ebdbbe108 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
@@ -183,42 +183,40 @@ struct tx_power_struct {
         u32 mcs_original_offset[4][16];
 };
 
-extern u32 rtl8723ae_phy_query_bb_reg(struct ieee80211_hw *hw,
-                                      u32 regaddr, u32 bitmask);
-extern void rtl8723ae_phy_set_bb_reg(struct ieee80211_hw *hw,
-                                     u32 regaddr, u32 bitmask, u32 data);
-extern u32 rtl8723ae_phy_query_rf_reg(struct ieee80211_hw *hw,
-                                      enum radio_path rfpath, u32 regaddr,
-                                      u32 bitmask);
-extern void rtl8723ae_phy_set_rf_reg(struct ieee80211_hw *hw,
-                                     enum radio_path rfpath, u32 regaddr,
-                                     u32 bitmask, u32 data);
-extern bool rtl8723ae_phy_mac_config(struct ieee80211_hw *hw);
-extern bool rtl8723ae_phy_bb_config(struct ieee80211_hw *hw);
-extern bool rtl8723ae_phy_rf_config(struct ieee80211_hw *hw);
-extern bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
-                                                 enum radio_path rfpath);
-extern void rtl8723ae_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-extern void rtl8723ae_phy_get_txpower_level(struct ieee80211_hw *hw,
-                                            long *powerlevel);
-extern void rtl8723ae_phy_set_txpower_level(struct ieee80211_hw *hw,
-                                            u8 channel);
-extern bool rtl8723ae_phy_update_txpower_dbm(struct ieee80211_hw *hw,
-                                             long power_indbm);
-extern void rtl8723ae_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                                u8 operation);
-extern void rtl8723ae_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
-extern void rtl8723ae_phy_set_bw_mode(struct ieee80211_hw *hw,
-                                      enum nl80211_channel_type ch_type);
-extern void rtl8723ae_phy_sw_chnl_callback(struct ieee80211_hw *hw);
-extern u8 rtl8723ae_phy_sw_chnl(struct ieee80211_hw *hw);
-extern void rtl8723ae_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+u32 rtl8723ae_phy_query_bb_reg(struct ieee80211_hw *hw,
+                               u32 regaddr, u32 bitmask);
+void rtl8723ae_phy_set_bb_reg(struct ieee80211_hw *hw,
+                              u32 regaddr, u32 bitmask, u32 data);
+u32 rtl8723ae_phy_query_rf_reg(struct ieee80211_hw *hw,
+                               enum radio_path rfpath, u32 regaddr,
+                               u32 bitmask);
+void rtl8723ae_phy_set_rf_reg(struct ieee80211_hw *hw,
+                              enum radio_path rfpath, u32 regaddr,
+                              u32 bitmask, u32 data);
+bool rtl8723ae_phy_mac_config(struct ieee80211_hw *hw);
+bool rtl8723ae_phy_bb_config(struct ieee80211_hw *hw);
+bool rtl8723ae_phy_rf_config(struct ieee80211_hw *hw);
+bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
+                                          enum radio_path rfpath);
+void rtl8723ae_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
+void rtl8723ae_phy_get_txpower_level(struct ieee80211_hw *hw,
+                                     long *powerlevel);
+void rtl8723ae_phy_set_txpower_level(struct ieee80211_hw *hw,
+                                     u8 channel);
+bool rtl8723ae_phy_update_txpower_dbm(struct ieee80211_hw *hw,
+                                      long power_indbm);
+void rtl8723ae_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
+void rtl8723ae_phy_set_bw_mode(struct ieee80211_hw *hw,
+                               enum nl80211_channel_type ch_type);
+void rtl8723ae_phy_sw_chnl_callback(struct ieee80211_hw *hw);
+u8 rtl8723ae_phy_sw_chnl(struct ieee80211_hw *hw);
+void rtl8723ae_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
 void rtl8723ae_phy_lc_calibrate(struct ieee80211_hw *hw);
 void rtl8723ae_phy_set_rfpath_switch(struct ieee80211_hw *hw, bool bmain);
 bool rtl8723ae_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
                                              enum radio_path rfpath);
 bool rtl8723ae_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
-extern bool rtl8723ae_phy_set_rf_power_state(struct ieee80211_hw *hw,
-                                             enum rf_pwrstate rfpwr_state);
+bool rtl8723ae_phy_set_rf_power_state(struct ieee80211_hw *hw,
+                                      enum rf_pwrstate rfpwr_state);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/rf.h b/drivers/net/wireless/rtlwifi/rtl8723ae/rf.h
index d0f9dd79abea..57f1933ee663 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/rf.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/rf.h
@@ -32,12 +32,11 @@
 
 #define RF6052_MAX_TX_PWR               0x3F
 
-extern void rtl8723ae_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw,
-                                            u8 bandwidth);
-extern void rtl8723ae_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
-                                              u8 *ppowerlevel);
-extern void rtl8723ae_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
-                                               u8 *ppowerlevel, u8 channel);
-extern bool rtl8723ae_phy_rf6052_config(struct ieee80211_hw *hw);
+void rtl8723ae_phy_rf6052_set_bandwidth(struct ieee80211_hw *hw, u8 bandwidth);
+void rtl8723ae_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+                                          u8 *ppowerlevel);
+void rtl8723ae_phy_rf6052_set_ofdm_txpower(struct ieee80211_hw *hw,
+                                           u8 *ppowerlevel, u8 channel);
+bool rtl8723ae_phy_rf6052_config(struct ieee80211_hw *hw);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index d9ee2efffe5f..62b204faf773 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -33,6 +33,7 @@
 
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -220,7 +221,7 @@ static struct rtl_hal_ops rtl8723ae_hal_ops = {
         .set_bw_mode = rtl8723ae_phy_set_bw_mode,
         .switch_channel = rtl8723ae_phy_sw_chnl,
         .dm_watchdog = rtl8723ae_dm_watchdog,
-        .scan_operation_backup = rtl8723ae_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl8723ae_phy_set_rf_power_state,
         .led_control = rtl8723ae_led_control,
         .set_desc = rtl8723ae_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index bcd82a1020a5..50b7be3f3a60 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -359,7 +359,6 @@ bool rtl8723ae_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = status->signal; */
         rx_status->signal = status->recvsignalpower + 10;
-        /*rx_status->noise = -status->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index e56778cac9bf..6e2b5c5c83c8 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -455,7 +455,6 @@ static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
         struct ieee80211_rx_status rx_status = {0};
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
 
@@ -498,7 +497,6 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
         struct ieee80211_rx_status rx_status = {0};
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
 
@@ -582,12 +580,15 @@ static void _rtl_rx_work(unsigned long param)
 static unsigned int _rtl_rx_get_padding(struct ieee80211_hdr *hdr,
                                         unsigned int len)
 {
+#if NET_IP_ALIGN != 0
         unsigned int padding = 0;
+#endif
 
         /* make function no-op when possible */
         if (NET_IP_ALIGN == 0 || len < sizeof(*hdr))
                 return 0;
 
+#if NET_IP_ALIGN != 0
         /* alignment calculation as in lbtf_rx() / carl9170_rx_copy_data() */
         /* TODO: deduplicate common code, define helper function instead? */
 
@@ -608,6 +609,7 @@ static unsigned int _rtl_rx_get_padding(struct ieee80211_hdr *hdr,
                 padding ^= NET_IP_ALIGN;
 
         return padding;
+#endif
 }
 
 #define __RADIO_TAP_SIZE_RSV    32
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 703258742d28..d224dc3bb092 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -192,8 +192,6 @@ enum hardware_type {
 (IS_HARDWARE_TYPE_8192DE(rtlhal) || IS_HARDWARE_TYPE_8192DU(rtlhal))
 #define IS_HARDWARE_TYPE_8723(rtlhal)                   \
 (IS_HARDWARE_TYPE_8723E(rtlhal) || IS_HARDWARE_TYPE_8723U(rtlhal))
-#define IS_HARDWARE_TYPE_8723U(rtlhal)                  \
-        (rtlhal->hw_type == HARDWARE_TYPE_RTL8723U)
 
 #define RX_HAL_IS_CCK_RATE(_pdesc)\
         (_pdesc->rxmcs == DESC92_RATE1M ||              \
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index c7dc6feab2ff..1342f81e683d 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -243,7 +243,7 @@ static int wl1251_spi_probe(struct spi_device *spi)
         struct wl1251 *wl;
         int ret;
 
-        pdata = spi->dev.platform_data;
+        pdata = dev_get_platdata(&spi->dev);
         if (!pdata) {
                 wl1251_error("no platform data");
                 return -ENODEV;
diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index fd02060038de..2c3bd1bff3f6 100644
--- a/drivers/net/wireless/ti/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
@@ -424,8 +424,8 @@ void wl1251_disable_interrupts(struct wl1251 *wl);
 #define CHIP_ID_1271_PG10                  (0x4030101)
 #define CHIP_ID_1271_PG20                  (0x4030111)
 
-#define WL1251_FW_NAME "wl1251-fw.bin"
-#define WL1251_NVS_NAME "wl1251-nvs.bin"
+#define WL1251_FW_NAME "ti-connectivity/wl1251-fw.bin"
+#define WL1251_NVS_NAME "ti-connectivity/wl1251-nvs.bin"
 
 #define WL1251_POWER_ON_SLEEP 10 /* in milliseconds */
 
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 1c627da85083..591526b99154 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1704,7 +1704,7 @@ static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
 static int wl12xx_setup(struct wl1271 *wl)
 {
         struct wl12xx_priv *priv = wl->priv;
-        struct wlcore_platdev_data *pdev_data = wl->pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = dev_get_platdata(&wl->pdev->dev);
         struct wl12xx_platform_data *pdata = pdev_data->pdata;
 
         wl->rtable = wl12xx_rtable;
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 7aa0eb848c5a..d0daca1d23bc 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -623,6 +623,18 @@ static const int wl18xx_rtable[REG_TABLE_LEN] = {
         [REG_RAW_FW_STATUS_ADDR]        = WL18XX_FW_STATUS_ADDR,
 };
 
+static const struct wl18xx_clk_cfg wl18xx_clk_table_coex[NUM_CLOCK_CONFIGS] = {
+        [CLOCK_CONFIG_16_2_M]   = { 8,  121, 0, 0, false },
+        [CLOCK_CONFIG_16_368_M] = { 8,  120, 0, 0, false },
+        [CLOCK_CONFIG_16_8_M]   = { 8,  117, 0, 0, false },
+        [CLOCK_CONFIG_19_2_M]   = { 10, 128, 0, 0, false },
+        [CLOCK_CONFIG_26_M]     = { 11, 104, 0, 0, false },
+        [CLOCK_CONFIG_32_736_M] = { 8,  120, 0, 0, false },
+        [CLOCK_CONFIG_33_6_M]   = { 8,  117, 0, 0, false },
+        [CLOCK_CONFIG_38_468_M] = { 10, 128, 0, 0, false },
+        [CLOCK_CONFIG_52_M]     = { 11, 104, 0, 0, false },
+};
+
 static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
         [CLOCK_CONFIG_16_2_M]   = { 7,  104,  801, 4,  true },
         [CLOCK_CONFIG_16_368_M] = { 9,  132, 3751, 4,  true },
@@ -704,6 +716,23 @@ static int wl18xx_set_clk(struct wl1271 *wl)
                      wl18xx_clk_table[clk_freq].p, wl18xx_clk_table[clk_freq].q,
                      wl18xx_clk_table[clk_freq].swallow ? "swallow" : "spit");
 
+        /* coex PLL configuration */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_N,
+                                   wl18xx_clk_table_coex[clk_freq].n);
+        if (ret < 0)
+                goto out;
+
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_M,
+                                   wl18xx_clk_table_coex[clk_freq].m);
+        if (ret < 0)
+                goto out;
+
+        /* bypass the swallowing logic */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_SWALLOW_EN,
+                                   PLLSH_COEX_PLL_SWALLOW_EN_VAL1);
+        if (ret < 0)
+                goto out;
+
         ret = wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_N,
                                    wl18xx_clk_table[clk_freq].n);
         if (ret < 0)
@@ -745,6 +774,30 @@ static int wl18xx_set_clk(struct wl1271 *wl)
                                            PLLSH_WCS_PLL_SWALLOW_EN_VAL2);
         }
 
+        /* choose WCS PLL */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_SEL,
+                                   PLLSH_WL_PLL_SEL_WCS_PLL);
+        if (ret < 0)
+                goto out;
+
+        /* enable both PLLs */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_EN, PLLSH_WL_PLL_EN_VAL1);
+        if (ret < 0)
+                goto out;
+
+        udelay(1000);
+
+        /* disable coex PLL */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_EN, PLLSH_WL_PLL_EN_VAL2);
+        if (ret < 0)
+                goto out;
+
+        /* reset the swallowing logic */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_SWALLOW_EN,
+                                   PLLSH_COEX_PLL_SWALLOW_EN_VAL2);
+        if (ret < 0)
+                goto out;
+
 out:
         return ret;
 }
@@ -1175,16 +1228,48 @@ static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
         }
 }
 
+static const char *wl18xx_rdl_name(enum wl18xx_rdl_num rdl_num)
+{
+        switch (rdl_num) {
+        case RDL_1_HP:
+                return "183xH";
+        case RDL_2_SP:
+                return "183x or 180x";
+        case RDL_3_HP:
+                return "187xH";
+        case RDL_4_SP:
+                return "187x";
+        case RDL_5_SP:
+                return "RDL11 - Not Supported";
+        case RDL_6_SP:
+                return "180xD";
+        case RDL_7_SP:
+                return "RDL13 - Not Supported (1893Q)";
+        case RDL_8_SP:
+                return "18xxQ";
+        case RDL_NONE:
+                return "UNTRIMMED";
+        default:
+                return "UNKNOWN";
+        }
+}
+
 static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
 {
         u32 fuse;
-        s8 rom = 0, metal = 0, pg_ver = 0, rdl_ver = 0;
+        s8 rom = 0, metal = 0, pg_ver = 0, rdl_ver = 0, package_type = 0;
         int ret;
 
         ret = wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
         if (ret < 0)
                 goto out;
 
+        ret = wlcore_read32(wl, WL18XX_REG_FUSE_DATA_2_3, &fuse);
+        if (ret < 0)
+                goto out;
+
+        package_type = (fuse >> WL18XX_PACKAGE_TYPE_OFFSET) & 1;
+
         ret = wlcore_read32(wl, WL18XX_REG_FUSE_DATA_1_3, &fuse);
         if (ret < 0)
                 goto out;
@@ -1192,7 +1277,7 @@ static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
         pg_ver = (fuse & WL18XX_PG_VER_MASK) >> WL18XX_PG_VER_OFFSET;
         rom = (fuse & WL18XX_ROM_VER_MASK) >> WL18XX_ROM_VER_OFFSET;
 
-        if (rom <= 0xE)
+        if ((rom <= 0xE) && (package_type == WL18XX_PACKAGE_TYPE_WSP))
                 metal = (fuse & WL18XX_METAL_VER_MASK) >>
                         WL18XX_METAL_VER_OFFSET;
         else
@@ -1204,11 +1289,9 @@ static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
                 goto out;
 
         rdl_ver = (fuse & WL18XX_RDL_VER_MASK) >> WL18XX_RDL_VER_OFFSET;
-        if (rdl_ver > RDL_MAX)
-                rdl_ver = RDL_NONE;
 
-        wl1271_info("wl18xx HW: RDL %d, %s, PG %x.%x (ROM %x)",
-                    rdl_ver, rdl_names[rdl_ver], pg_ver, metal, rom);
+        wl1271_info("wl18xx HW: %s, PG %d.%d (ROM 0x%x)",
+                    wl18xx_rdl_name(rdl_ver), pg_ver, metal, rom);
 
         if (ver)
                 *ver = pg_ver;
diff --git a/drivers/net/wireless/ti/wl18xx/reg.h b/drivers/net/wireless/ti/wl18xx/reg.h
index 05dd8bad2746..a433a75f3cd7 100644
--- a/drivers/net/wireless/ti/wl18xx/reg.h
+++ b/drivers/net/wireless/ti/wl18xx/reg.h
@@ -114,6 +114,11 @@
 #define PLATFORM_DETECTION              0xA0E3E0
 #define OCS_EN                          0xA02080
 #define PRIMARY_CLK_DETECT              0xA020A6
+#define PLLSH_COEX_PLL_N                0xA02384
+#define PLLSH_COEX_PLL_M                0xA02382
+#define PLLSH_COEX_PLL_SWALLOW_EN       0xA0238E
+#define PLLSH_WL_PLL_SEL                0xA02398
+
 #define PLLSH_WCS_PLL_N                 0xA02362
 #define PLLSH_WCS_PLL_M                 0xA02360
 #define PLLSH_WCS_PLL_Q_FACTOR_CFG_1    0xA02364
@@ -128,19 +133,30 @@
 #define PLLSH_WCS_PLL_P_FACTOR_CFG_1_MASK       0xFFFF
 #define PLLSH_WCS_PLL_P_FACTOR_CFG_2_MASK       0x000F
 
+#define PLLSH_WL_PLL_EN_VAL1            0x7
+#define PLLSH_WL_PLL_EN_VAL2            0x2
+#define PLLSH_COEX_PLL_SWALLOW_EN_VAL1  0x2
+#define PLLSH_COEX_PLL_SWALLOW_EN_VAL2  0x11
+
 #define PLLSH_WCS_PLL_SWALLOW_EN_VAL1   0x1
 #define PLLSH_WCS_PLL_SWALLOW_EN_VAL2   0x12
 
+#define PLLSH_WL_PLL_SEL_WCS_PLL        0x0
+#define PLLSH_WL_PLL_SEL_COEX_PLL       0x1
+
 #define WL18XX_REG_FUSE_DATA_1_3        0xA0260C
 #define WL18XX_PG_VER_MASK              0x70
 #define WL18XX_PG_VER_OFFSET            4
-#define WL18XX_ROM_VER_MASK             0x3
-#define WL18XX_ROM_VER_OFFSET           0
+#define WL18XX_ROM_VER_MASK             0x3e00
+#define WL18XX_ROM_VER_OFFSET           9
 #define WL18XX_METAL_VER_MASK           0xC
 #define WL18XX_METAL_VER_OFFSET         2
 #define WL18XX_NEW_METAL_VER_MASK       0x180
 #define WL18XX_NEW_METAL_VER_OFFSET     7
 
+#define WL18XX_PACKAGE_TYPE_OFFSET      13
+#define WL18XX_PACKAGE_TYPE_WSP         0
+
 #define WL18XX_REG_FUSE_DATA_2_3        0xA02614
 #define WL18XX_RDL_VER_MASK             0x1f00
 #define WL18XX_RDL_VER_OFFSET           8
@@ -201,24 +217,21 @@ enum {
         NUM_BOARD_TYPES,
 };
 
-enum {
+enum wl18xx_rdl_num {
         RDL_NONE        = 0,
         RDL_1_HP        = 1,
         RDL_2_SP        = 2,
         RDL_3_HP        = 3,
         RDL_4_SP        = 4,
+        RDL_5_SP        = 0x11,
+        RDL_6_SP        = 0x12,
+        RDL_7_SP        = 0x13,
+        RDL_8_SP        = 0x14,
 
         _RDL_LAST,
         RDL_MAX = _RDL_LAST - 1,
 };
 
-static const char * const rdl_names[] = {
-        [RDL_NONE]      = "",
-        [RDL_1_HP]      = "1853 SISO",
-        [RDL_2_SP]      = "1857 MIMO",
-        [RDL_3_HP]      = "1893 SISO",
-        [RDL_4_SP]      = "1897 MIMO",
-};
 
 /* FPGA_SPARE_1 register - used to change the PHY ATPG clock at boot time */
 #define WL18XX_PHY_FPGA_SPARE_1         0x8093CA40
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index c9e060795d13..9e5416f8764d 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1126,6 +1126,8 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         u16 template_id_2_4 = wl->scan_templ_id_2_4;
         u16 template_id_5 = wl->scan_templ_id_5;
 
+        wl1271_debug(DEBUG_SCAN, "build probe request band %d", band);
+
         skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
                                      ie_len);
         if (!skb) {
@@ -1135,8 +1137,6 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         if (ie_len)
                 memcpy(skb_put(skb, ie_len), ie, ie_len);
 
-        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
-
         if (sched_scan &&
             (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL)) {
                 template_id_2_4 = wl->sched_scan_templ_id_2_4;
@@ -1172,7 +1172,7 @@ struct sk_buff *wl1271_cmd_build_ap_probe_req(struct wl1271 *wl,
         if (!skb)
                 goto out;
 
-        wl1271_dump(DEBUG_SCAN, "AP PROBE REQ: ", skb->data, skb->len);
+        wl1271_debug(DEBUG_SCAN, "set ap probe request template");
 
         rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[wlvif->band]);
         if (wlvif->band == IEEE80211_BAND_2GHZ)
@@ -1607,33 +1607,43 @@ out:
 
 static int wlcore_get_reg_conf_ch_idx(enum ieee80211_band band, u16 ch)
 {
-        int idx = -1;
-
+        /*
+         * map the given band/channel to the respective predefined
+         * bit expected by the fw
+         */
         switch (band) {
-        case IEEE80211_BAND_5GHZ:
-                if (ch >= 8 && ch <= 16)
-                        idx = ((ch-8)/4 + 18);
-                else if (ch >= 34 && ch <= 64)
-                        idx = ((ch-34)/2 + 3 + 18);
-                else if (ch >= 100 && ch <= 140)
-                        idx = ((ch-100)/4 + 15 + 18);
-                else if (ch >= 149 && ch <= 165)
-                        idx = ((ch-149)/4 + 26 + 18);
-                else
-                        idx = -1;
-                break;
         case IEEE80211_BAND_2GHZ:
+                /* channels 1..14 are mapped to 0..13 */
                 if (ch >= 1 && ch <= 14)
-                        idx = ch - 1;
-                else
-                        idx = -1;
+                        return ch - 1;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                switch (ch) {
+                case 8 ... 16:
+                        /* channels 8,12,16 are mapped to 18,19,20 */
+                        return 18 + (ch-8)/4;
+                case 34 ... 48:
+                        /* channels 34,36..48 are mapped to 21..28 */
+                        return 21 + (ch-34)/2;
+                case 52 ... 64:
+                        /* channels 52,56..64 are mapped to 29..32 */
+                        return 29 + (ch-52)/4;
+                case 100 ... 140:
+                        /* channels 100,104..140 are mapped to 33..43 */
+                        return 33 + (ch-100)/4;
+                case 149 ... 165:
+                        /* channels 149,153..165 are mapped to 44..48 */
+                        return 44 + (ch-149)/4;
+                default:
+                        break;
+                }
                 break;
         default:
-                wl1271_error("get reg conf ch idx - unknown band: %d",
-                             (int)band);
+                break;
         }
 
-        return idx;
+        wl1271_error("%s: unknown band/channel: %d/%d", __func__, band, ch);
+        return -1;
 }
 
 void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
@@ -1646,7 +1656,7 @@ void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
 
         ch_bit_idx = wlcore_get_reg_conf_ch_idx(band, channel);
 
-        if (ch_bit_idx > 0 && ch_bit_idx <= WL1271_MAX_CHANNELS)
+        if (ch_bit_idx >= 0 && ch_bit_idx <= WL1271_MAX_CHANNELS)
                 set_bit(ch_bit_idx, (long *)wl->reg_ch_conf_pending);
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 38995f90040d..bbdd10632373 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1062,7 +1062,8 @@ int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode)
         static const char* const PLT_MODE[] = {
                 "PLT_OFF",
                 "PLT_ON",
-                "PLT_FEM_DETECT"
+                "PLT_FEM_DETECT",
+                "PLT_CHIP_AWAKE"
         };
 
         int ret;
@@ -1088,9 +1089,11 @@ int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode)
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl->ops->plt_init(wl);
-                if (ret < 0)
-                        goto power_off;
+                if (plt_mode != PLT_CHIP_AWAKE) {
+                        ret = wl->ops->plt_init(wl);
+                        if (ret < 0)
+                                goto power_off;
+                }
 
                 wl->state = WLCORE_STATE_ON;
                 wl1271_notice("firmware booted in PLT mode %s (%s)",
@@ -2008,6 +2011,47 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static void wlcore_pending_auth_complete_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+        struct wl12xx_vif *wlvif;
+        unsigned long time_spare;
+        int ret;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wlvif = container_of(dwork, struct wl12xx_vif,
+                             pending_auth_complete_work);
+        wl = wlvif->wl;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        /*
+         * Make sure a second really passed since the last auth reply. Maybe
+         * a second auth reply arrived while we were stuck on the mutex.
+         * Check for a little less than the timeout to protect from scheduler
+         * irregularities.
+         */
+        time_spare = jiffies +
+                        msecs_to_jiffies(WLCORE_PEND_AUTH_ROC_TIMEOUT - 50);
+        if (!time_after(time_spare, wlvif->pending_auth_reply_time))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        /* cancel the ROC if active */
+        wlcore_update_inconn_sta(wl, wlvif, NULL, false);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static int wl12xx_allocate_rate_policy(struct wl1271 *wl, u8 *idx)
 {
         u8 policy = find_first_zero_bit(wl->rate_policies_map,
@@ -2159,6 +2203,8 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                           wlcore_channel_switch_work);
         INIT_DELAYED_WORK(&wlvif->connection_loss_work,
                           wlcore_connection_loss_work);
+        INIT_DELAYED_WORK(&wlvif->pending_auth_complete_work,
+                          wlcore_pending_auth_complete_work);
         INIT_LIST_HEAD(&wlvif->list);
 
         setup_timer(&wlvif->rx_streaming_timer, wl1271_rx_streaming_timer,
@@ -2376,6 +2422,11 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         int ret = 0;
         u8 role_type;
 
+        if (wl->plt) {
+                wl1271_error("Adding Interface not allowed while in PLT mode");
+                return -EBUSY;
+        }
+
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
@@ -2590,6 +2641,7 @@ unlock:
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
         cancel_delayed_work_sync(&wlvif->connection_loss_work);
         cancel_delayed_work_sync(&wlvif->channel_switch_work);
+        cancel_delayed_work_sync(&wlvif->pending_auth_complete_work);
 
         mutex_lock(&wl->mutex);
 }
@@ -2875,6 +2927,25 @@ static void wl1271_set_band_rate(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         wlvif->rate_set = wlvif->basic_rate_set;
 }
 
+static void wl1271_sta_handle_idle(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                   bool idle)
+{
+        bool cur_idle = !test_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+
+        if (idle == cur_idle)
+                return;
+
+        if (idle) {
+                clear_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+        } else {
+                /* The current firmware only supports sched_scan in idle */
+                if (wl->sched_vif == wlvif)
+                        wl->ops->sched_scan_stop(wl, wlvif);
+
+                set_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+        }
+}
+
 static int wl12xx_config_vif(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                              struct ieee80211_conf *conf, u32 changed)
 {
@@ -3969,6 +4040,13 @@ static void wl1271_bss_info_changed_ap(struct wl1271 *wl,
                         }
                 } else {
                         if (test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)) {
+                                /*
+                                 * AP might be in ROC in case we have just
+                                 * sent auth reply. handle it.
+                                 */
+                                if (test_bit(wlvif->role_id, wl->roc_map))
+                                        wl12xx_croc(wl, wlvif->role_id);
+
                                 ret = wl12xx_cmd_role_stop_ap(wl, wlvif);
                                 if (ret < 0)
                                         goto out;
@@ -4120,6 +4198,9 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 do_join = true;
         }
 
+        if (changed & BSS_CHANGED_IDLE && !is_ibss)
+                wl1271_sta_handle_idle(wl, wlvif, bss_conf->idle);
+
         if (changed & BSS_CHANGED_CQM) {
                 bool enable = false;
                 if (bss_conf->cqm_rssi_thold)
@@ -4656,29 +4737,49 @@ static void wlcore_roc_if_possible(struct wl1271 *wl,
         wl12xx_roc(wl, wlvif, wlvif->role_id, wlvif->band, wlvif->channel);
 }
 
-static void wlcore_update_inconn_sta(struct wl1271 *wl,
-                                     struct wl12xx_vif *wlvif,
-                                     struct wl1271_station *wl_sta,
-                                     bool in_connection)
+/*
+ * when wl_sta is NULL, we treat this call as if coming from a
+ * pending auth reply.
+ * wl->mutex must be taken and the FW must be awake when the call
+ * takes place.
+ */
+void wlcore_update_inconn_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              struct wl1271_station *wl_sta, bool in_conn)
 {
-        if (in_connection) {
-                if (WARN_ON(wl_sta->in_connection))
+        if (in_conn) {
+                if (WARN_ON(wl_sta && wl_sta->in_connection))
                         return;
-                wl_sta->in_connection = true;
-                if (!wlvif->inconn_count++)
+
+                if (!wlvif->ap_pending_auth_reply &&
+                    !wlvif->inconn_count)
                         wlcore_roc_if_possible(wl, wlvif);
+
+                if (wl_sta) {
+                        wl_sta->in_connection = true;
+                        wlvif->inconn_count++;
+                } else {
+                        wlvif->ap_pending_auth_reply = true;
+                }
         } else {
-                if (!wl_sta->in_connection)
+                if (wl_sta && !wl_sta->in_connection)
+                        return;
+
+                if (WARN_ON(!wl_sta && !wlvif->ap_pending_auth_reply))
                         return;
 
-                wl_sta->in_connection = false;
-                wlvif->inconn_count--;
-                if (WARN_ON(wlvif->inconn_count < 0))
+                if (WARN_ON(wl_sta && !wlvif->inconn_count))
                         return;
 
-                if (!wlvif->inconn_count)
-                        if (test_bit(wlvif->role_id, wl->roc_map))
-                                wl12xx_croc(wl, wlvif->role_id);
+                if (wl_sta) {
+                        wl_sta->in_connection = false;
+                        wlvif->inconn_count--;
+                } else {
+                        wlvif->ap_pending_auth_reply = false;
+                }
+
+                if (!wlvif->inconn_count && !wlvif->ap_pending_auth_reply &&
+                    test_bit(wlvif->role_id, wl->roc_map))
+                        wl12xx_croc(wl, wlvif->role_id);
         }
 }
 
@@ -5313,10 +5414,7 @@ static struct ieee80211_rate wl1271_rates_5ghz[] = {
 
 /* 5 GHz band channels for WL1273 */
 static struct ieee80211_channel wl1271_channels_5ghz[] = {
-        { .hw_value = 7, .center_freq = 5035, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 8, .center_freq = 5040, .max_power = WLCORE_MAX_TXPWR },
-        { .hw_value = 9, .center_freq = 5045, .max_power = WLCORE_MAX_TXPWR },
-        { .hw_value = 11, .center_freq = 5055, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 12, .center_freq = 5060, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 16, .center_freq = 5080, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 34, .center_freq = 5170, .max_power = WLCORE_MAX_TXPWR },
@@ -5896,14 +5994,20 @@ static const struct wiphy_wowlan_support wlcore_wowlan_support = {
 };
 #endif
 
+static irqreturn_t wlcore_hardirq(int irq, void *cookie)
+{
+        return IRQ_WAKE_THREAD;
+}
+
 static void wlcore_nvs_cb(const struct firmware *fw, void *context)
 {
         struct wl1271 *wl = context;
         struct platform_device *pdev = wl->pdev;
-        struct wlcore_platdev_data *pdev_data = pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = dev_get_platdata(&pdev->dev);
         struct wl12xx_platform_data *pdata = pdev_data->pdata;
         unsigned long irqflags;
         int ret;
+        irq_handler_t hardirq_fn = NULL;
 
         if (fw) {
                 wl->nvs = kmemdup(fw->data, fw->size, GFP_KERNEL);
@@ -5932,12 +6036,14 @@ static void wlcore_nvs_cb(const struct firmware *fw, void *context)
         wl->platform_quirks = pdata->platform_quirks;
         wl->if_ops = pdev_data->if_ops;
 
-        if (wl->platform_quirks & WL12XX_PLATFORM_QUIRK_EDGE_IRQ)
+        if (wl->platform_quirks & WL12XX_PLATFORM_QUIRK_EDGE_IRQ) {
                 irqflags = IRQF_TRIGGER_RISING;
-        else
+                hardirq_fn = wlcore_hardirq;
+        } else {
                 irqflags = IRQF_TRIGGER_HIGH | IRQF_ONESHOT;
+        }
 
-        ret = request_threaded_irq(wl->irq, NULL, wlcore_irq,
+        ret = request_threaded_irq(wl->irq, hardirq_fn, wlcore_irq,
                                    irqflags, pdev->name, wl);
         if (ret < 0) {
                 wl1271_error("request_irq() failed: %d", ret);
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 98066d40c2ad..26bfc365ba70 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -83,6 +83,10 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
         struct wl12xx_vif *wlvif;
         u32 timeout;
 
+        /* We do not enter elp sleep in PLT mode */
+        if (wl->plt)
+                return;
+
         if (wl->sleep_auth != WL1271_PSM_ELP)
                 return;
 
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index f407101e525b..13e743df2e31 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -174,17 +174,7 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                     /* if radar is set, we ignore the passive flag */
                     (radar ||
                      !!(flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive)) {
-                        wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
-                                     req_channels[i]->band,
-                                     req_channels[i]->center_freq);
-                        wl1271_debug(DEBUG_SCAN, "hw_value %d, flags %X",
-                                     req_channels[i]->hw_value,
-                                     req_channels[i]->flags);
-                        wl1271_debug(DEBUG_SCAN, "max_power %d",
-                                     req_channels[i]->max_power);
-                        wl1271_debug(DEBUG_SCAN, "min_dwell_time %d max dwell time %d",
-                                     min_dwell_time_active,
-                                     max_dwell_time_active);
+
 
                         if (flags & IEEE80211_CHAN_RADAR) {
                                 channels[j].flags |= SCAN_CHANNEL_FLAGS_DFS;
@@ -222,6 +212,17 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                                              *n_pactive_ch);
                         }
 
+                        wl1271_debug(DEBUG_SCAN, "freq %d, ch. %d, flags 0x%x, power %d, min/max_dwell %d/%d%s%s",
+                                     req_channels[i]->center_freq,
+                                     req_channels[i]->hw_value,
+                                     req_channels[i]->flags,
+                                     req_channels[i]->max_power,
+                                     min_dwell_time_active,
+                                     max_dwell_time_active,
+                                     flags & IEEE80211_CHAN_RADAR ?
+                                        ", DFS" : "",
+                                     flags & IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        ", PASSIVE" : "");
                         j++;
                 }
         }
@@ -364,7 +365,7 @@ wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
         struct cfg80211_ssid *ssids = req->ssids;
         int ret = 0, type, i, j, n_match_ssids = 0;
 
-        wl1271_debug(DEBUG_CMD, "cmd sched scan ssid list");
+        wl1271_debug((DEBUG_CMD | DEBUG_SCAN), "cmd sched scan ssid list");
 
         /* count the match sets that contain SSIDs */
         for (i = 0; i < req->n_match_sets; i++)
@@ -442,8 +443,6 @@ wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
                 }
         }
 
-        wl1271_dump(DEBUG_SCAN, "SSID_LIST: ", cmd, sizeof(*cmd));
-
         ret = wl1271_cmd_send(wl, CMD_CONNECTION_SCAN_SSID_CFG, cmd,
                               sizeof(*cmd), 0);
         if (ret < 0) {
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 1b0cd98e35f1..b2c018dccf18 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -335,7 +335,7 @@ static int wl1271_probe(struct spi_device *spi)
         if (!pdev_data)
                 goto out;
 
-        pdev_data->pdata = spi->dev.platform_data;
+        pdev_data->pdata = dev_get_platdata(&spi->dev);
         if (!pdev_data->pdata) {
                 dev_err(&spi->dev, "no platform data\n");
                 ret = -ENODEV;
diff --git a/drivers/net/wireless/ti/wlcore/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index 527590f2adfb..a3b7d950d8e9 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -297,7 +297,8 @@ static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
                 ret = wl1271_plt_stop(wl);
                 break;
         case PLT_ON:
-                ret = wl1271_plt_start(wl, PLT_ON);
+        case PLT_CHIP_AWAKE:
+                ret = wl1271_plt_start(wl, val);
                 break;
         case PLT_FEM_DETECT:
                 ret = wl1271_tm_detect_fem(wl, tb);
@@ -361,6 +362,7 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 {
         struct wl1271 *wl = hw->priv;
         struct nlattr *tb[WL1271_TM_ATTR_MAX + 1];
+        u32 nla_cmd;
         int err;
 
         err = nla_parse(tb, WL1271_TM_ATTR_MAX, data, len, wl1271_tm_policy);
@@ -370,7 +372,14 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         if (!tb[WL1271_TM_ATTR_CMD_ID])
                 return -EINVAL;
 
-        switch (nla_get_u32(tb[WL1271_TM_ATTR_CMD_ID])) {
+        nla_cmd = nla_get_u32(tb[WL1271_TM_ATTR_CMD_ID]);
+
+        /* Only SET_PLT_MODE is allowed in case of mode PLT_CHIP_AWAKE */
+        if (wl->plt_mode == PLT_CHIP_AWAKE &&
+            nla_cmd != WL1271_TM_CMD_SET_PLT_MODE)
+                return -EOPNOTSUPP;
+
+        switch (nla_cmd) {
         case WL1271_TM_CMD_TEST:
                 return wl1271_tm_cmd_test(wl, tb);
         case WL1271_TM_CMD_INTERROGATE:
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 7e93fe63a2c7..87cd707affa2 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -86,19 +86,34 @@ void wl1271_free_tx_id(struct wl1271 *wl, int id)
 EXPORT_SYMBOL(wl1271_free_tx_id);
 
 static void wl1271_tx_ap_update_inconnection_sta(struct wl1271 *wl,
+                                                 struct wl12xx_vif *wlvif,
                                                  struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
 
+        hdr = (struct ieee80211_hdr *)(skb->data +
+                                       sizeof(struct wl1271_tx_hw_descr));
+        if (!ieee80211_is_auth(hdr->frame_control))
+                return;
+
         /*
          * add the station to the known list before transmitting the
          * authentication response. this way it won't get de-authed by FW
          * when transmitting too soon.
          */
-        hdr = (struct ieee80211_hdr *)(skb->data +
-                                       sizeof(struct wl1271_tx_hw_descr));
-        if (ieee80211_is_auth(hdr->frame_control))
-                wl1271_acx_set_inconnection_sta(wl, hdr->addr1);
+        wl1271_acx_set_inconnection_sta(wl, hdr->addr1);
+
+        /*
+         * ROC for 1 second on the AP channel for completing the connection.
+         * Note the ROC will be continued by the update_sta_state callbacks
+         * once the station reaches the associated state.
+         */
+        wlcore_update_inconn_sta(wl, wlvif, NULL, true);
+        wlvif->pending_auth_reply_time = jiffies;
+        cancel_delayed_work(&wlvif->pending_auth_complete_work);
+        ieee80211_queue_delayed_work(wl->hw,
+                                &wlvif->pending_auth_complete_work,
+                                msecs_to_jiffies(WLCORE_PEND_AUTH_ROC_TIMEOUT));
 }
 
 static void wl1271_tx_regulate_link(struct wl1271 *wl,
@@ -386,7 +401,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) ||
                          (cipher == WLAN_CIPHER_SUITE_WEP104);
 
-                if (WARN_ON(is_wep && wlvif->default_key != idx)) {
+                if (WARN_ON(is_wep && wlvif && wlvif->default_key != idx)) {
                         ret = wl1271_set_default_wep_key(wl, wlvif, idx);
                         if (ret < 0)
                                 return ret;
@@ -404,7 +419,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         wl1271_tx_fill_hdr(wl, wlvif, skb, extra, info, hlid);
 
         if (!is_dummy && wlvif && wlvif->bss_type == BSS_TYPE_AP_BSS) {
-                wl1271_tx_ap_update_inconnection_sta(wl, skb);
+                wl1271_tx_ap_update_inconnection_sta(wl, wlvif, skb);
                 wl1271_tx_regulate_link(wl, wlvif, hlid);
         }
 
diff --git a/drivers/net/wireless/ti/wlcore/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 55aa4acf9105..35489c300da1 100644
--- a/drivers/net/wireless/ti/wlcore/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -56,6 +56,9 @@
 /* Used for management frames and dummy packets */
 #define WL1271_TID_MGMT 7
 
+/* stop a ROC for pending authentication reply after this time (ms) */
+#define WLCORE_PEND_AUTH_ROC_TIMEOUT     1000
+
 struct wl127x_tx_mem {
         /*
          * Number of extra memory blocks to allocate for this packet
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 0034979e97cb..54ce5d5e84db 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -481,6 +481,8 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                    struct ieee80211_sta *sta,
                    struct ieee80211_key_conf *key_conf);
 void wlcore_regdomain_config(struct wl1271 *wl);
+void wlcore_update_inconn_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              struct wl1271_station *wl_sta, bool in_conn);
 
 static inline void
 wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index e5e146435fe7..2a50e089b0e7 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -255,6 +255,7 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_CS_PROGRESS,
         WLVIF_FLAG_AP_PROBE_RESP_SET,
         WLVIF_FLAG_IN_USE,
+        WLVIF_FLAG_ACTIVE,
 };
 
 struct wl12xx_vif;
@@ -307,6 +308,7 @@ enum plt_mode {
         PLT_OFF = 0,
         PLT_ON = 1,
         PLT_FEM_DETECT = 2,
+        PLT_CHIP_AWAKE = 3
 };
 
 struct wl12xx_rx_filter_field {
@@ -456,6 +458,15 @@ struct wl12xx_vif {
          */
         int hw_queue_base;
 
+        /* do we have a pending auth reply? (and ROC) */
+        bool ap_pending_auth_reply;
+
+        /* time when we sent the pending auth reply */
+        unsigned long pending_auth_reply_time;
+
+        /* work for canceling ROC after pending auth reply */
+        struct delayed_work pending_auth_complete_work;
+
         /*
          * This struct must be last!
          * data that has to be saved acrossed reconfigs (e.g. recovery)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 5715318d6bab..55b8dec86233 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -87,9 +87,13 @@ struct pending_tx_info {
 struct xenvif_rx_meta {
         int id;
         int size;
+        int gso_type;
         int gso_size;
 };
 
+#define GSO_BIT(type) \
+        (1 << XEN_NETIF_GSO_TYPE_ ## type)
+
 /* Discriminate from any valid pending_idx value. */
 #define INVALID_PENDING_IDX 0xFFFF
 
@@ -150,10 +154,12 @@ struct xenvif {
         u8               fe_dev_addr[6];
 
         /* Frontend feature information. */
+        int gso_mask;
+        int gso_prefix_mask;
+
         u8 can_sg:1;
-        u8 gso:1;
-        u8 gso_prefix:1;
-        u8 csum:1;
+        u8 ip_csum:1;
+        u8 ipv6_csum:1;
 
         /* Internal feature information. */
         u8 can_queue:1;     /* can queue packets for receiver? */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 01bb854c7f62..e4aa26748f80 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -214,10 +214,14 @@ static netdev_features_t xenvif_fix_features(struct net_device *dev,
 
         if (!vif->can_sg)
                 features &= ~NETIF_F_SG;
-        if (!vif->gso && !vif->gso_prefix)
+        if (~(vif->gso_mask | vif->gso_prefix_mask) & GSO_BIT(TCPV4))
                 features &= ~NETIF_F_TSO;
-        if (!vif->csum)
+        if (~(vif->gso_mask | vif->gso_prefix_mask) & GSO_BIT(TCPV6))
+                features &= ~NETIF_F_TSO6;
+        if (!vif->ip_csum)
                 features &= ~NETIF_F_IP_CSUM;
+        if (!vif->ipv6_csum)
+                features &= ~NETIF_F_IPV6_CSUM;
 
         return features;
 }
@@ -306,7 +310,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->domid  = domid;
         vif->handle = handle;
         vif->can_sg = 1;
-        vif->csum = 1;
+        vif->ip_csum = 1;
         vif->dev = dev;
 
         vif->credit_bytes = vif->remaining_credit = ~0UL;
@@ -316,8 +320,10 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->credit_timeout.expires = jiffies;
 
         dev->netdev_ops = &xenvif_netdev_ops;
-        dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
-        dev->features = dev->hw_features;
+        dev->hw_features = NETIF_F_SG |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                NETIF_F_TSO | NETIF_F_TSO6;
+        dev->features = dev->hw_features | NETIF_F_RXCSUM;
         SET_ETHTOOL_OPS(dev, &xenvif_ethtool_ops);
 
         dev->tx_queue_len = XENVIF_QUEUE_LENGTH;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f3e591c611de..828fdab4f1a4 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -109,15 +109,12 @@ static inline unsigned long idx_to_kaddr(struct xenvif *vif,
         return (unsigned long)pfn_to_kaddr(idx_to_pfn(vif, idx));
 }
 
-/*
- * This is the amount of packet we copy rather than map, so that the
- * guest can't fiddle with the contents of the headers while we do
- * packet processing on them (netfilter, routing, etc).
+/* This is a miniumum size for the linear area to avoid lots of
+ * calls to __pskb_pull_tail() as we set up checksum offsets. The
+ * value 128 was chosen as it covers all IPv4 and most likely
+ * IPv6 headers.
  */
-#define PKT_PROT_LEN    (ETH_HLEN + \
-                         VLAN_HLEN + \
-                         sizeof(struct iphdr) + MAX_IPOPTLEN + \
-                         sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE)
+#define PKT_PROT_LEN 128
 
 static u16 frag_get_pending_idx(skb_frag_t *frag)
 {
@@ -145,7 +142,7 @@ static int max_required_rx_slots(struct xenvif *vif)
         int max = DIV_ROUND_UP(vif->dev->mtu, PAGE_SIZE);
 
         /* XXX FIXME: RX path dependent on MAX_SKB_FRAGS */
-        if (vif->can_sg || vif->gso || vif->gso_prefix)
+        if (vif->can_sg || vif->gso_mask || vif->gso_prefix_mask)
                 max += MAX_SKB_FRAGS + 1; /* extra_info + frags */
 
         return max;
@@ -317,6 +314,7 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif *vif,
         req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
 
         meta = npo->meta + npo->meta_prod++;
+        meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
         meta->gso_size = 0;
         meta->size = 0;
         meta->id = req->id;
@@ -339,6 +337,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
         struct gnttab_copy *copy_gop;
         struct xenvif_rx_meta *meta;
         unsigned long bytes;
+        int gso_type;
 
         /* Data must not cross a page boundary. */
         BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -397,7 +396,14 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                 }
 
                 /* Leave a gap for the GSO descriptor. */
-                if (*head && skb_shinfo(skb)->gso_size && !vif->gso_prefix)
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                else
+                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+
+                if (*head && ((1 << gso_type) & vif->gso_mask))
                         vif->rx.req_cons++;
 
                 *head = 0; /* There must be something in this buffer now. */
@@ -428,14 +434,28 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         unsigned char *data;
         int head = 1;
         int old_meta_prod;
+        int gso_type;
+        int gso_size;
 
         old_meta_prod = npo->meta_prod;
 
+        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                gso_size = skb_shinfo(skb)->gso_size;
+        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                gso_size = skb_shinfo(skb)->gso_size;
+        } else {
+                gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                gso_size = 0;
+        }
+
         /* Set up a GSO prefix descriptor, if necessary */
-        if (skb_shinfo(skb)->gso_size && vif->gso_prefix) {
+        if ((1 << skb_shinfo(skb)->gso_type) & vif->gso_prefix_mask) {
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
-                meta->gso_size = skb_shinfo(skb)->gso_size;
+                meta->gso_type = gso_type;
+                meta->gso_size = gso_size;
                 meta->size = 0;
                 meta->id = req->id;
         }
@@ -443,10 +463,13 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
         meta = npo->meta + npo->meta_prod++;
 
-        if (!vif->gso_prefix)
-                meta->gso_size = skb_shinfo(skb)->gso_size;
-        else
+        if ((1 << gso_type) & vif->gso_mask) {
+                meta->gso_type = gso_type;
+                meta->gso_size = gso_size;
+        } else {
+                meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                 meta->gso_size = 0;
+        }
 
         meta->size = 0;
         meta->id = req->id;
@@ -592,7 +615,8 @@ void xenvif_rx_action(struct xenvif *vif)
 
                 vif = netdev_priv(skb->dev);
 
-                if (vif->meta[npo.meta_cons].gso_size && vif->gso_prefix) {
+                if ((1 << vif->meta[npo.meta_cons].gso_type) &
+                    vif->gso_prefix_mask) {
                         resp = RING_GET_RESPONSE(&vif->rx,
                                                  vif->rx.rsp_prod_pvt++);
 
@@ -629,7 +653,8 @@ void xenvif_rx_action(struct xenvif *vif)
                                         vif->meta[npo.meta_cons].size,
                                         flags);
 
-                if (vif->meta[npo.meta_cons].gso_size && !vif->gso_prefix) {
+                if ((1 << vif->meta[npo.meta_cons].gso_type) &
+                    vif->gso_mask) {
                         struct xen_netif_extra_info *gso =
                                 (struct xen_netif_extra_info *)
                                 RING_GET_RESPONSE(&vif->rx,
@@ -637,8 +662,8 @@ void xenvif_rx_action(struct xenvif *vif)
 
                         resp->flags |= XEN_NETRXF_extra_info;
 
+                        gso->u.gso.type = vif->meta[npo.meta_cons].gso_type;
                         gso->u.gso.size = vif->meta[npo.meta_cons].gso_size;
-                        gso->u.gso.type = XEN_NETIF_GSO_TYPE_TCPV4;
                         gso->u.gso.pad = 0;
                         gso->u.gso.features = 0;
 
@@ -1101,15 +1126,20 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
                 return -EINVAL;
         }
 
-        /* Currently only TCPv4 S.O. is supported. */
-        if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
+        switch (gso->u.gso.type) {
+        case XEN_NETIF_GSO_TYPE_TCPV4:
+                skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+                break;
+        case XEN_NETIF_GSO_TYPE_TCPV6:
+                skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+                break;
+        default:
                 netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
                 xenvif_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
         skb_shinfo(skb)->gso_size = gso->u.gso.size;
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 
         /* Header must be checked, and gso_segs computed. */
         skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
@@ -1118,61 +1148,74 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
         return 0;
 }
 
-static int checksum_setup(struct xenvif *vif, struct sk_buff *skb)
+static inline void maybe_pull_tail(struct sk_buff *skb, unsigned int len)
+{
+        if (skb_is_nonlinear(skb) && skb_headlen(skb) < len) {
+                /* If we need to pullup then pullup to the max, so we
+                 * won't need to do it again.
+                 */
+                int target = min_t(int, skb->len, MAX_TCP_HEADER);
+                __pskb_pull_tail(skb, target - skb_headlen(skb));
+        }
+}
+
+static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
+                             int recalculate_partial_csum)
 {
-        struct iphdr *iph;
+        struct iphdr *iph = (void *)skb->data;
+        unsigned int header_size;
+        unsigned int off;
         int err = -EPROTO;
-        int recalculate_partial_csum = 0;
 
-        /*
-         * A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
-         * peers can fail to set NETRXF_csum_blank when sending a GSO
-         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
-         * recalculate the partial checksum.
-         */
-        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
-                vif->rx_gso_checksum_fixup++;
-                skb->ip_summed = CHECKSUM_PARTIAL;
-                recalculate_partial_csum = 1;
-        }
+        off = sizeof(struct iphdr);
 
-        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
-        if (skb->ip_summed != CHECKSUM_PARTIAL)
-                return 0;
+        header_size = skb->network_header + off + MAX_IPOPTLEN;
+        maybe_pull_tail(skb, header_size);
 
-        if (skb->protocol != htons(ETH_P_IP))
-                goto out;
+        off = iph->ihl * 4;
 
-        iph = (void *)skb->data;
         switch (iph->protocol) {
         case IPPROTO_TCP:
-                if (!skb_partial_csum_set(skb, 4 * iph->ihl,
+                if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct tcphdr, check)))
                         goto out;
 
                 if (recalculate_partial_csum) {
                         struct tcphdr *tcph = tcp_hdr(skb);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct tcphdr);
+                        maybe_pull_tail(skb, header_size);
+
                         tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - iph->ihl*4,
+                                                         skb->len - off,
                                                          IPPROTO_TCP, 0);
                 }
                 break;
         case IPPROTO_UDP:
-                if (!skb_partial_csum_set(skb, 4 * iph->ihl,
+                if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct udphdr, check)))
                         goto out;
 
                 if (recalculate_partial_csum) {
                         struct udphdr *udph = udp_hdr(skb);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct udphdr);
+                        maybe_pull_tail(skb, header_size);
+
                         udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - iph->ihl*4,
+                                                         skb->len - off,
                                                          IPPROTO_UDP, 0);
                 }
                 break;
         default:
                 if (net_ratelimit())
                         netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, dropping a protocol %d packet\n",
+                                   "Attempting to checksum a non-TCP/UDP packet, "
+                                   "dropping a protocol %d packet\n",
                                    iph->protocol);
                 goto out;
         }
@@ -1183,6 +1226,158 @@ out:
         return err;
 }
 
+static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
+                               int recalculate_partial_csum)
+{
+        int err = -EPROTO;
+        struct ipv6hdr *ipv6h = (void *)skb->data;
+        u8 nexthdr;
+        unsigned int header_size;
+        unsigned int off;
+        bool fragment;
+        bool done;
+
+        done = false;
+
+        off = sizeof(struct ipv6hdr);
+
+        header_size = skb->network_header + off;
+        maybe_pull_tail(skb, header_size);
+
+        nexthdr = ipv6h->nexthdr;
+
+        while ((off <= sizeof(struct ipv6hdr) + ntohs(ipv6h->payload_len)) &&
+               !done) {
+                switch (nexthdr) {
+                case IPPROTO_DSTOPTS:
+                case IPPROTO_HOPOPTS:
+                case IPPROTO_ROUTING: {
+                        struct ipv6_opt_hdr *hp = (void *)(skb->data + off);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct ipv6_opt_hdr);
+                        maybe_pull_tail(skb, header_size);
+
+                        nexthdr = hp->nexthdr;
+                        off += ipv6_optlen(hp);
+                        break;
+                }
+                case IPPROTO_AH: {
+                        struct ip_auth_hdr *hp = (void *)(skb->data + off);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct ip_auth_hdr);
+                        maybe_pull_tail(skb, header_size);
+
+                        nexthdr = hp->nexthdr;
+                        off += (hp->hdrlen+2)<<2;
+                        break;
+                }
+                case IPPROTO_FRAGMENT:
+                        fragment = true;
+                        /* fall through */
+                default:
+                        done = true;
+                        break;
+                }
+        }
+
+        if (!done) {
+                if (net_ratelimit())
+                        netdev_err(vif->dev, "Failed to parse packet header\n");
+                goto out;
+        }
+
+        if (fragment) {
+                if (net_ratelimit())
+                        netdev_err(vif->dev, "Packet is a fragment!\n");
+                goto out;
+        }
+
+        switch (nexthdr) {
+        case IPPROTO_TCP:
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct tcphdr, check)))
+                        goto out;
+
+                if (recalculate_partial_csum) {
+                        struct tcphdr *tcph = tcp_hdr(skb);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct tcphdr);
+                        maybe_pull_tail(skb, header_size);
+
+                        tcph->check = ~csum_ipv6_magic(&ipv6h->saddr,
+                                                       &ipv6h->daddr,
+                                                       skb->len - off,
+                                                       IPPROTO_TCP, 0);
+                }
+                break;
+        case IPPROTO_UDP:
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct udphdr, check)))
+                        goto out;
+
+                if (recalculate_partial_csum) {
+                        struct udphdr *udph = udp_hdr(skb);
+
+                        header_size = skb->network_header +
+                                off +
+                                sizeof(struct udphdr);
+                        maybe_pull_tail(skb, header_size);
+
+                        udph->check = ~csum_ipv6_magic(&ipv6h->saddr,
+                                                       &ipv6h->daddr,
+                                                       skb->len - off,
+                                                       IPPROTO_UDP, 0);
+                }
+                break;
+        default:
+                if (net_ratelimit())
+                        netdev_err(vif->dev,
+                                   "Attempting to checksum a non-TCP/UDP packet, "
+                                   "dropping a protocol %d packet\n",
+                                   nexthdr);
+                goto out;
+        }
+
+        err = 0;
+
+out:
+        return err;
+}
+
+static int checksum_setup(struct xenvif *vif, struct sk_buff *skb)
+{
+        int err = -EPROTO;
+        int recalculate_partial_csum = 0;
+
+        /* A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
+         * peers can fail to set NETRXF_csum_blank when sending a GSO
+         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
+         * recalculate the partial checksum.
+         */
+        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
+                vif->rx_gso_checksum_fixup++;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                recalculate_partial_csum = 1;
+        }
+
+        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        if (skb->protocol == htons(ETH_P_IP))
+                err = checksum_setup_ip(vif, skb, recalculate_partial_csum);
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                err = checksum_setup_ipv6(vif, skb, recalculate_partial_csum);
+
+        return err;
+}
+
 static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
 {
         unsigned long now = jiffies;
@@ -1428,12 +1623,7 @@ static int xenvif_tx_submit(struct xenvif *vif, int budget)
 
                 xenvif_fill_frags(vif, skb);
 
-                /*
-                 * If the initial fragment was < PKT_PROT_LEN then
-                 * pull through some bytes from the other fragments to
-                 * increase the linear region to PKT_PROT_LEN bytes.
-                 */
-                if (skb_headlen(skb) < PKT_PROT_LEN && skb_is_nonlinear(skb)) {
+                if (skb_is_nonlinear(skb) && skb_headlen(skb) < PKT_PROT_LEN) {
                         int target = min_t(int, skb->len, PKT_PROT_LEN);
                         __pskb_pull_tail(skb, target - skb_headlen(skb));
                 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 1b08d8798372..f0358992b04f 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -105,6 +105,22 @@ static int netback_probe(struct xenbus_device *dev,
                         goto abort_transaction;
                 }
 
+                err = xenbus_printf(xbt, dev->nodename, "feature-gso-tcpv6",
+                                    "%d", sg);
+                if (err) {
+                        message = "writing feature-gso-tcpv6";
+                        goto abort_transaction;
+                }
+
+                /* We support partial checksum setup for IPv6 packets */
+                err = xenbus_printf(xbt, dev->nodename,
+                                    "feature-ipv6-csum-offload",
+                                    "%d", 1);
+                if (err) {
+                        message = "writing feature-ipv6-csum-offload";
+                        goto abort_transaction;
+                }
+
                 /* We support rx-copy path. */
                 err = xenbus_printf(xbt, dev->nodename,
                                     "feature-rx-copy", "%d", 1);
@@ -561,20 +577,50 @@ static int connect_rings(struct backend_info *be)
                 val = 0;
         vif->can_sg = !!val;
 
+        vif->gso_mask = 0;
+        vif->gso_prefix_mask = 0;
+
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv4",
                          "%d", &val) < 0)
                 val = 0;
-        vif->gso = !!val;
+        if (val)
+                vif->gso_mask |= GSO_BIT(TCPV4);
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv4-prefix",
                          "%d", &val) < 0)
                 val = 0;
-        vif->gso_prefix = !!val;
+        if (val)
+                vif->gso_prefix_mask |= GSO_BIT(TCPV4);
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv6",
+                         "%d", &val) < 0)
+                val = 0;
+        if (val)
+                vif->gso_mask |= GSO_BIT(TCPV6);
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv6-prefix",
+                         "%d", &val) < 0)
+                val = 0;
+        if (val)
+                vif->gso_prefix_mask |= GSO_BIT(TCPV6);
+
+        if (vif->gso_mask & vif->gso_prefix_mask) {
+                xenbus_dev_fatal(dev, err,
+                                 "%s: gso and gso prefix flags are not "
+                                 "mutually exclusive",
+                                 dev->otherend);
+                return -EOPNOTSUPP;
+        }
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-no-csum-offload",
                          "%d", &val) < 0)
                 val = 0;
-        vif->csum = !val;
+        vif->ip_csum = !val;
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-ipv6-csum-offload",
+                         "%d", &val) < 0)
+                val = 0;
+        vif->ipv6_csum = !!val;
 
         /* Map the shared frame, irq etc. */
         err = xenvif_connect(vif, tx_ring_ref, rx_ring_ref,
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 36808bf25677..dd1011e55cb5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -952,7 +952,7 @@ static int handle_incoming_queue(struct net_device *dev,
                 u64_stats_update_end(&stats->syncp);
 
                 /* Pass it up. */
-                netif_receive_skb(skb);
+                napi_gro_receive(&np->napi, skb);
         }
 
         return packets_dropped;
@@ -1051,6 +1051,8 @@ err:
         if (work_done < budget) {
                 int more_to_do = 0;
 
+                napi_gro_flush(napi, false);
+
                 local_irq_save(flags);
 
                 RING_FINAL_CHECK_FOR_RESPONSES(&np->rx, more_to_do);