Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
authorLinus Torvalds <torvalds@linux-foundation.org>
Mon, 23 May 2011 16:12:26 +0000 (09:12 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 23 May 2011 16:12:26 +0000 (09:12 -0700)
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
  b43: fix comment typo reqest -> request
  Haavard Skinnemoen has left Atmel
  cris: typo in mach-fs Makefile
  Kconfig: fix copy/paste-ism for dell-wmi-aio driver
  doc: timers-howto: fix a typo ("unsgined")
  perf: Only include annotate.h once in tools/perf/util/ui/browsers/annotate.c
  md, raid5: Fix spelling error in comment ('Ofcourse' --> 'Of course').
  treewide: fix a few typos in comments
  regulator: change debug statement be consistent with the style of the rest
  Revert "arm: mach-u300/gpio: Fix mem_region resource size miscalculations"
  audit: acquire creds selectively to reduce atomic op overhead
  rtlwifi: don't touch with treewide double semicolon removal
  treewide: cleanup continuations and remove logging message whitespace
  ath9k_hw: don't touch with treewide double semicolon removal
  include/linux/leds-regulator.h: fix syntax in example code
  tty: fix typo in descripton of tty_termios_encode_baud_rate
  xtensa: remove obsolete BKL kernel option from defconfig
  m68k: fix comment typo 'occcured'
  arch:Kconfig.locks Remove unused config option.
  treewide: remove extra semicolons
  ...

30 files changed:
1  2 
Documentation/feature-removal-schedule.txt
MAINTAINERS
arch/ia64/hp/common/sba_iommu.c
arch/mips/include/asm/cpu.h
arch/mips/mm/c-r4k.c
arch/powerpc/kernel/kgdb.c
drivers/base/memory.c
drivers/firmware/efivars.c
drivers/md/raid5.c
drivers/net/atlx/atl1.c
drivers/net/macb.c
drivers/net/s2io.c
drivers/net/ucc_geth_ethtool.c
drivers/net/usb/usbnet.c
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
drivers/net/wireless/iwlwifi/iwl-agn-calib.c
drivers/net/wireless/iwlwifi/iwl-agn.c
drivers/net/wireless/rtlwifi/core.c
drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
drivers/scsi/be2iscsi/be_main.c
drivers/scsi/constants.c
drivers/scsi/esp_scsi.c
drivers/scsi/lpfc/lpfc_bsg.c
drivers/scsi/lpfc/lpfc_sli.c
drivers/scsi/qla2xxx/qla_isr.c
fs/partitions/ldm.c
lib/Kconfig.debug
lib/vsprintf.c
mm/page_alloc.c
security/selinux/selinuxfs.c

@@@ -35,6 -35,17 +35,6 @@@ Who: Luis R. Rodriguez <lrodriguez@athe
  
  ---------------------------
  
 -What: AR9170USB
 -When: 2.6.40
 -
 -Why:  This driver is deprecated and the firmware is no longer
 -      maintained. The replacement driver "carl9170" has been
 -      around for a while, so the devices are still supported.
 -
 -Who:  Christian Lamparter <chunkeey@googlemail.com>
 -
 ----------------------------
 -
  What: IRQF_SAMPLE_RANDOM
  Check:        IRQF_SAMPLE_RANDOM
  When: July 2009
@@@ -215,7 -226,7 +215,7 @@@ Who:       Zhang Rui <rui.zhang@intel.com
  What: CONFIG_ACPI_PROCFS_POWER
  When: 2.6.39
  Why:  sysfs I/F for ACPI power devices, including AC and Battery,
-         has been working in upstream kenrel since 2.6.24, Sep 2007.
+         has been working in upstream kernel since 2.6.24, Sep 2007.
        In 2.6.37, we make the sysfs I/F always built in and this option
        disabled by default.
        Remove this option and the ACPI power procfs interface in 2.6.39.
@@@ -394,6 -405,16 +394,6 @@@ Who:      anybody or Florian Mickler <flori
  
  ----------------------------
  
 -What: capifs
 -When: February 2011
 -Files:        drivers/isdn/capi/capifs.*
 -Why:  udev fully replaces this special file system that only contains CAPI
 -      NCCI TTY device nodes. User space (pppdcapiplugin) works without
 -      noticing the difference.
 -Who:  Jan Kiszka <jan.kiszka@web.de>
 -
 -----------------------------
 -
  What: KVM paravirt mmu host support
  When: January 2011
  Why:  The paravirt mmu host support is slower than non-paravirt mmu, both
@@@ -439,6 -460,14 +439,6 @@@ Who:      Thomas Gleixner <tglx@linutronix.d
  
  ----------------------------
  
 -What: The acpi_sleep=s4_nonvs command line option
 -When: 2.6.37
 -Files:        arch/x86/kernel/acpi/sleep.c
 -Why:  superseded by acpi_sleep=nonvs
 -Who:  Rafael J. Wysocki <rjw@sisk.pl>
 -
 -----------------------------
 -
  What:         PCI DMA unmap state API
  When: August 2012
  Why:  PCI DMA unmap state API (include/linux/pci-dma.h) was replaced
diff --combined MAINTAINERS
@@@ -405,8 -405,8 +405,8 @@@ S: Maintaine
  F:    sound/oss/aedsp16.c
  
  AFFS FILE SYSTEM
 -M:    Roman Zippel <zippel@linux-m68k.org>
 -S:    Maintained
 +L:    linux-fsdevel@vger.kernel.org
 +S:    Orphan
  F:    Documentation/filesystems/affs.txt
  F:    fs/affs/
  
@@@ -548,11 -548,10 +548,11 @@@ S:      Maintaine
  F:    sound/aoa/
  
  APM DRIVER
 -L:    linux-laptop@vger.kernel.org
 -S:    Orphan
 +M:    Jiri Kosina <jkosina@suse.cz>
 +S:    Odd fixes
  F:    arch/x86/kernel/apm_32.c
  F:    include/linux/apm_bios.h
 +F:    drivers/char/apm-emulation.c
  
  APPLE BCM5974 MULTITOUCH DRIVER
  M:    Henrik Rydberg <rydberg@euromail.se>
@@@ -730,7 -729,7 +730,7 @@@ ARM/EZX SMARTPHONES (A780, A910, A1200
  M:    Daniel Ribeiro <drwyrm@gmail.com>
  M:    Stefan Schmidt <stefan@openezx.org>
  M:    Harald Welte <laforge@openezx.org>
- L:    openezx-devel@lists.openezx.org (subscribers-only)
+ L:    openezx-devel@lists.openezx.org (moderated for non-subscribers)
  W:    http://www.openezx.org/
  S:    Maintained
  T:    topgit git://git.openezx.org/openezx.git
@@@ -1033,13 -1032,12 +1033,13 @@@ W:   http://www.fluff.org/ben/linux
  S:    Maintained
  F:    arch/arm/mach-s3c64xx/
  
 -ARM/S5P ARM ARCHITECTURES
 +ARM/S5P EXYNOS ARM ARCHITECTURES
  M:    Kukjin Kim <kgene.kim@samsung.com>
  L:    linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
  L:    linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
  S:    Maintained
  F:    arch/arm/mach-s5p*/
 +F:    arch/arm/mach-exynos*/
  
  ARM/SAMSUNG MOBILE MACHINE SUPPORT
  M:    Kyungmin Park <kyungmin.park@samsung.com>
@@@ -1233,6 -1231,13 +1233,6 @@@ W:     http://wireless.kernel.org/en/users/
  S:    Supported
  F:    drivers/net/wireless/ath/ath9k/
  
 -ATHEROS AR9170 WIRELESS DRIVER
 -M:    Christian Lamparter <chunkeey@web.de>
 -L:    linux-wireless@vger.kernel.org
 -W:    http://wireless.kernel.org/en/users/Drivers/ar9170
 -S:    Obsolete
 -F:    drivers/net/wireless/ath/ar9170/
 -
  CARL9170 LINUX COMMUNITY WIRELESS DRIVER
  M:    Christian Lamparter <chunkeey@googlemail.com>
  L:    linux-wireless@vger.kernel.org
@@@ -2803,23 -2808,42 +2803,23 @@@ GPIO SUBSYSTE
  M:    Grant Likely <grant.likely@secretlab.ca>
  S:    Maintained
  T:    git git://git.secretlab.ca/git/linux-2.6.git
 -F:    Documentation/gpio/gpio.txt
 +F:    Documentation/gpio.txt
  F:    drivers/gpio/
  F:    include/linux/gpio*
  
 +GRE DEMULTIPLEXER DRIVER
 +M:    Dmitry Kozlov <xeb@mail.ru>
 +L:    netdev@vger.kernel.org
 +S:    Maintained
 +F:    net/ipv4/gre.c
 +F:    include/net/gre.h
 +
  GRETH 10/100/1G Ethernet MAC device driver
  M:    Kristoffer Glembo <kristoffer@gaisler.com>
  L:    netdev@vger.kernel.org
  S:    Maintained
  F:    drivers/net/greth*
  
 -HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
 -M:    Frank Seidel <frank@f-seidel.de>
 -L:    platform-driver-x86@vger.kernel.org
 -W:    http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
 -S:    Maintained
 -F:    drivers/platform/x86/hdaps.c
 -
 -HWPOISON MEMORY FAILURE HANDLING
 -M:    Andi Kleen <andi@firstfloor.org>
 -L:    linux-mm@kvack.org
 -T:    git git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6.git hwpoison
 -S:    Maintained
 -F:    mm/memory-failure.c
 -F:    mm/hwpoison-inject.c
 -
 -HYPERVISOR VIRTUAL CONSOLE DRIVER
 -L:    linuxppc-dev@lists.ozlabs.org
 -S:    Odd Fixes
 -F:    drivers/tty/hvc/
 -
 -iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
 -M:    Peter Jones <pjones@redhat.com>
 -M:    Konrad Rzeszutek Wilk <konrad@kernel.org>
 -S:    Maintained
 -F:    drivers/firmware/iscsi_ibft*
 -
  GSPCA FINEPIX SUBDRIVER
  M:    Frank Zago <frank@zago.net>
  L:    linux-media@vger.kernel.org
@@@ -2870,26 -2894,6 +2870,26 @@@ T:    git git://git.kernel.org/pub/scm/lin
  S:    Maintained
  F:    drivers/media/video/gspca/
  
 +HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
 +M:    Frank Seidel <frank@f-seidel.de>
 +L:    platform-driver-x86@vger.kernel.org
 +W:    http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
 +S:    Maintained
 +F:    drivers/platform/x86/hdaps.c
 +
 +HWPOISON MEMORY FAILURE HANDLING
 +M:    Andi Kleen <andi@firstfloor.org>
 +L:    linux-mm@kvack.org
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6.git hwpoison
 +S:    Maintained
 +F:    mm/memory-failure.c
 +F:    mm/hwpoison-inject.c
 +
 +HYPERVISOR VIRTUAL CONSOLE DRIVER
 +L:    linuxppc-dev@lists.ozlabs.org
 +S:    Odd Fixes
 +F:    drivers/tty/hvc/
 +
  HARDWARE MONITORING
  M:    Jean Delvare <khali@linux-fr.org>
  M:    Guenter Roeck <guenter.roeck@ericsson.com>
@@@ -2940,8 -2944,8 +2940,8 @@@ F:      drivers/block/cciss
  F:    include/linux/cciss_ioctl.h
  
  HFS FILESYSTEM
 -M:    Roman Zippel <zippel@linux-m68k.org>
 -S:    Maintained
 +L:    linux-fsdevel@vger.kernel.org
 +S:    Orphan
  F:    Documentation/filesystems/hfs.txt
  F:    fs/hfs/
  
@@@ -3357,12 -3361,6 +3357,12 @@@ F:    Documentation/wimax/README.i2400
  F:    drivers/net/wimax/i2400m/
  F:    include/linux/wimax/i2400m.h
  
 +INTEL WIRELESS 3945ABG/BG, 4965AGN (iwlegacy)
 +M:    Stanislaw Gruszka <sgruszka@redhat.com>
 +L:    linux-wireless@vger.kernel.org
 +S:    Supported
 +F:    drivers/net/wireless/iwlegacy/
 +
  INTEL WIRELESS WIFI LINK (iwlwifi)
  M:    Wey-Yi Guy <wey-yi.w.guy@intel.com>
  M:    Intel Linux Wireless <ilw@linux.intel.com>
@@@ -3479,12 -3477,6 +3479,12 @@@ F:    Documentation/isapnp.tx
  F:    drivers/pnp/isapnp/
  F:    include/linux/isapnp.h
  
 +iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
 +M:    Peter Jones <pjones@redhat.com>
 +M:    Konrad Rzeszutek Wilk <konrad@kernel.org>
 +S:    Maintained
 +F:    drivers/firmware/iscsi_ibft*
 +
  ISCSI
  M:    Mike Christie <michaelc@cs.wisc.edu>
  L:    open-iscsi@googlegroups.com
@@@ -3814,7 -3806,7 +3814,7 @@@ M:      Rusty Russell <rusty@rustcorp.com.au
  L:    lguest@lists.ozlabs.org
  W:    http://lguest.ozlabs.org/
  S:    Odd Fixes
 -F:    Documentation/lguest/
 +F:    Documentation/virtual/lguest/
  F:    arch/x86/lguest/
  F:    drivers/lguest/
  F:    include/linux/lguest*.h
@@@ -4001,6 -3993,7 +4001,6 @@@ F:      arch/m32r
  
  M68K ARCHITECTURE
  M:    Geert Uytterhoeven <geert@linux-m68k.org>
 -M:    Roman Zippel <zippel@linux-m68k.org>
  L:    linux-m68k@lists.linux-m68k.org
  W:    http://www.linux-m68k.org/
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k.git
@@@ -4270,13 -4263,6 +4270,13 @@@ M:    Tim Hockin <thockin@hockin.org
  S:    Maintained
  F:    drivers/net/natsemi.c
  
 +NATIVE INSTRUMENTS USB SOUND INTERFACE DRIVER
 +M:    Daniel Mack <zonque@gmail.com>
 +S:    Maintained
 +L:    alsa-devel@alsa-project.org
 +W:    http://www.native-instruments.com
 +F:    sound/usb/caiaq/
 +
  NCP FILESYSTEM
  M:    Petr Vandrovec <petr@vandrovec.name>
  S:    Odd Fixes
@@@ -4392,7 -4378,6 +4392,7 @@@ S:      Maintaine
  F:    net/ipv4/
  F:    net/ipv6/
  F:    include/net/ip*
 +F:    arch/x86/net/*
  
  NETWORKING [LABELED] (NetLabel, CIPSO, Labeled IPsec, SECMARK)
  M:    Paul Moore <paul.moore@hp.com>
@@@ -5003,13 -4988,6 +5003,13 @@@ F:    Documentation/pps
  F:    drivers/pps/
  F:    include/linux/pps*.h
  
 +PPTP DRIVER
 +M:    Dmitry Kozlov <xeb@mail.ru>
 +L:    netdev@vger.kernel.org
 +S:    Maintained
 +F:    drivers/net/pptp.c
 +W:    http://sourceforge.net/projects/accel-pptp
 +
  PREEMPTIBLE KERNEL
  M:    Robert Love <rml@tech9.net>
  L:    kpreempt-tech@lists.sourceforge.net
@@@ -5439,7 -5417,6 +5439,7 @@@ F:      include/linux/timex.
  F:    kernel/time/clocksource.c
  F:    kernel/time/time*.c
  F:    kernel/time/ntp.c
 +F:    drivers/clocksource
  
  TLG2300 VIDEO4LINUX-2 DRIVER
  M:    Huang Shijie <shijie8@gmail.com>
@@@ -5620,9 -5597,9 +5620,9 @@@ F:      include/linux/ata.
  F:    include/linux/libata.h
  
  SERVER ENGINES 10Gbps iSCSI - BladeEngine 2 DRIVER
 -M:    Jayamohan Kallickal <jayamohank@serverengines.com>
 +M:    Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
  L:    linux-scsi@vger.kernel.org
 -W:    http://www.serverengines.com
 +W:    http://www.emulex.com
  S:    Supported
  F:    drivers/scsi/be2iscsi/
  
@@@ -5840,13 -5817,6 +5840,13 @@@ S:    Maintaine
  F:    drivers/ssb/
  F:    include/linux/ssb/
  
 +BROADCOM SPECIFIC AMBA DRIVER (BCMA)
 +M:    RafaÅ‚ MiÅ‚ecki <zajec5@gmail.com>
 +L:    linux-wireless@vger.kernel.org
 +S:    Maintained
 +F:    drivers/bcma/
 +F:    include/linux/bcma/
 +
  SONY VAIO CONTROL DEVICE DRIVER
  M:    Mattia Dongili <malattia@linux.it>
  L:    platform-driver-x86@vger.kernel.org
@@@ -5876,7 -5846,7 +5876,7 @@@ F:      include/sound
  F:    sound/
  
  SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
 -M:    Liam Girdwood <lrg@slimlogic.co.uk>
 +M:    Liam Girdwood <lrg@ti.com>
  M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound-2.6.git
  L:    alsa-devel@alsa-project.org (moderated for non-subscribers)
@@@ -6127,7 -6097,7 +6127,7 @@@ F:      drivers/mmc/host/tifm_sd.
  F:    include/linux/tifm.h
  
  TI TWL4030 SERIES SOC CODEC DRIVER
 -M:    Peter Ujfalusi <peter.ujfalusi@nokia.com>
 +M:    Peter Ujfalusi <peter.ujfalusi@ti.com>
  L:    alsa-devel@alsa-project.org (moderated for non-subscribers)
  S:    Maintained
  F:    sound/soc/codecs/twl4030*
@@@ -6230,6 -6200,7 +6230,7 @@@ TRIVIAL PATCHE
  M:    Jiri Kosina <trivial@kernel.org>
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial.git
  S:    Maintained
+ K:    ^Subject:.*(?i)trivial
  
  TTY LAYER
  M:    Greg Kroah-Hartman <gregkh@suse.de>
@@@ -6585,7 -6556,7 +6586,7 @@@ S:      Maintaine
  F:    drivers/usb/host/uhci*
  
  USB "USBNET" DRIVER FRAMEWORK
 -M:    David Brownell <dbrownell@users.sourceforge.net>
 +M:    Oliver Neukum <oneukum@suse.de>
  L:    netdev@vger.kernel.org
  W:    http://www.linux-usb.org/usbnet
  S:    Maintained
@@@ -6647,7 -6618,7 +6648,7 @@@ L:      user-mode-linux-devel@lists.sourcefo
  L:    user-mode-linux-user@lists.sourceforge.net
  W:    http://user-mode-linux.sourceforge.net
  S:    Maintained
 -F:    Documentation/uml/
 +F:    Documentation/virtual/uml/
  F:    arch/um/
  F:    fs/hostfs/
  F:    fs/hppfs/
@@@ -6771,7 -6742,7 +6772,7 @@@ F:      drivers/scsi/vmw_pvscsi.
  F:    drivers/scsi/vmw_pvscsi.h
  
  VOLTAGE AND CURRENT REGULATOR FRAMEWORK
 -M:    Liam Girdwood <lrg@slimlogic.co.uk>
 +M:    Liam Girdwood <lrg@ti.com>
  M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
  W:    http://opensource.wolfsonmicro.com/node/15
  W:    http://www.slimlogic.co.uk/?p=48
@@@ -6951,18 -6922,6 +6952,18 @@@ T:    git git://git.kernel.org/pub/scm/lin
  S:    Maintained
  F:    drivers/platform/x86
  
 +XEN HYPERVISOR INTERFACE
 +M:    Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
 +M:    Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 +L:    xen-devel@lists.xensource.com (moderated for non-subscribers)
 +L:    virtualization@lists.linux-foundation.org
 +S:    Supported
 +F:    arch/x86/xen/
 +F:    drivers/*/xen-*front.c
 +F:    drivers/xen/
 +F:    arch/x86/include/asm/xen/
 +F:    include/xen/
 +
  XEN NETWORK BACKEND DRIVER
  M:    Ian Campbell <ian.campbell@citrix.com>
  L:    xen-devel@lists.xensource.com (moderated for non-subscribers)
@@@ -6984,6 -6943,18 +6985,6 @@@ S:     Supporte
  F:    arch/x86/xen/*swiotlb*
  F:    drivers/xen/*swiotlb*
  
 -XEN HYPERVISOR INTERFACE
 -M:    Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
 -M:    Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 -L:    xen-devel@lists.xensource.com (moderated for non-subscribers)
 -L:    virtualization@lists.linux-foundation.org
 -S:    Supported
 -F:    arch/x86/xen/
 -F:    drivers/*/xen-*front.c
 -F:    drivers/xen/
 -F:    arch/x86/include/asm/xen/
 -F:    include/xen/
 -
  XFS FILESYSTEM
  P:    Silicon Graphics Inc
  M:    Alex Elder <aelder@sgi.com>
@@@ -7053,6 -7024,20 +7054,6 @@@ M:     "Maciej W. Rozycki" <macro@linux-mip
  S:    Maintained
  F:    drivers/tty/serial/zs.*
  
 -GRE DEMULTIPLEXER DRIVER
 -M:    Dmitry Kozlov <xeb@mail.ru>
 -L:    netdev@vger.kernel.org
 -S:    Maintained
 -F:    net/ipv4/gre.c
 -F:    include/net/gre.h
 -
 -PPTP DRIVER
 -M:    Dmitry Kozlov <xeb@mail.ru>
 -L:    netdev@vger.kernel.org
 -S:    Maintained
 -F:    drivers/net/pptp.c
 -W:    http://sourceforge.net/projects/accel-pptp
 -
  THE REST
  M:    Linus Torvalds <torvalds@linux-foundation.org>
  L:    linux-kernel@vger.kernel.org
@@@ -37,7 -37,6 +37,7 @@@
  #include <linux/crash_dump.h>
  #include <linux/iommu-helper.h>
  #include <linux/dma-mapping.h>
 +#include <linux/prefetch.h>
  
  #include <asm/delay.h>                /* ia64_get_itc() */
  #include <asm/io.h>
@@@ -1064,7 -1063,7 +1064,7 @@@ static void sba_unmap_page(struct devic
                /*
                ** Address does not fall w/in IOVA, must be bypassing
                */
-               DBG_BYPASS("sba_unmap_single_atttrs() bypass addr: 0x%lx\n",
+               DBG_BYPASS("sba_unmap_single_attrs() bypass addr: 0x%lx\n",
                           iova);
  
  #ifdef ENABLE_MARK_CLEAN
@@@ -2,7 -2,7 +2,7 @@@
   * cpu.h: Values of the PRId register used to match up
   *        various MIPS cpu types.
   *
-  * Copyright (C) 1996 David S. Miller (dm@engr.sgi.com)
+  * Copyright (C) 1996 David S. Miller (davem@davemloft.net)
   * Copyright (C) 2004  Maciej W. Rozycki
   */
  #ifndef _ASM_CPU_H
@@@ -33,7 -33,6 +33,7 @@@
  #define PRID_COMP_TOSHIBA     0x070000
  #define PRID_COMP_LSI         0x080000
  #define PRID_COMP_LEXRA               0x0b0000
 +#define PRID_COMP_NETLOGIC    0x0c0000
  #define PRID_COMP_CAVIUM      0x0d0000
  #define PRID_COMP_INGENIC     0xd00000
  
  
  #define PRID_IMP_JZRISC        0x0200
  
 +/*
 + * These are the PRID's for when 23:16 == PRID_COMP_NETLOGIC
 + */
 +#define PRID_IMP_NETLOGIC_XLR732      0x0000
 +#define PRID_IMP_NETLOGIC_XLR716      0x0200
 +#define PRID_IMP_NETLOGIC_XLR532      0x0900
 +#define PRID_IMP_NETLOGIC_XLR308      0x0600
 +#define PRID_IMP_NETLOGIC_XLR532C     0x0800
 +#define PRID_IMP_NETLOGIC_XLR516C     0x0a00
 +#define PRID_IMP_NETLOGIC_XLR508C     0x0b00
 +#define PRID_IMP_NETLOGIC_XLR308C     0x0f00
 +#define PRID_IMP_NETLOGIC_XLS608      0x8000
 +#define PRID_IMP_NETLOGIC_XLS408      0x8800
 +#define PRID_IMP_NETLOGIC_XLS404      0x8c00
 +#define PRID_IMP_NETLOGIC_XLS208      0x8e00
 +#define PRID_IMP_NETLOGIC_XLS204      0x8f00
 +#define PRID_IMP_NETLOGIC_XLS108      0xce00
 +#define PRID_IMP_NETLOGIC_XLS104      0xcf00
 +#define PRID_IMP_NETLOGIC_XLS616B     0x4000
 +#define PRID_IMP_NETLOGIC_XLS608B     0x4a00
 +#define PRID_IMP_NETLOGIC_XLS416B     0x4400
 +#define PRID_IMP_NETLOGIC_XLS412B     0x4c00
 +#define PRID_IMP_NETLOGIC_XLS408B     0x4e00
 +#define PRID_IMP_NETLOGIC_XLS404B     0x4f00
 +
  /*
   * Definitions for 7:0 on legacy processors
   */
@@@ -260,7 -234,6 +260,7 @@@ enum cpu_type_enum 
         */
        CPU_5KC, CPU_20KC, CPU_25KF, CPU_SB1, CPU_SB1A, CPU_LOONGSON2,
        CPU_CAVIUM_OCTEON, CPU_CAVIUM_OCTEON_PLUS, CPU_CAVIUM_OCTEON2,
 +      CPU_XLR,
  
        CPU_LAST
  };
diff --combined arch/mips/mm/c-r4k.c
@@@ -3,7 -3,7 +3,7 @@@
   * License.  See the file "COPYING" in the main directory of this archive
   * for more details.
   *
-  * Copyright (C) 1996 David S. Miller (dm@engr.sgi.com)
+  * Copyright (C) 1996 David S. Miller (davem@davemloft.net)
   * Copyright (C) 1997, 1998, 1999, 2000, 2001, 2002 Ralf Baechle (ralf@gnu.org)
   * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
   */
@@@ -1006,7 -1006,6 +1006,7 @@@ static void __cpuinit probe_pcache(void
        case CPU_25KF:
        case CPU_SB1:
        case CPU_SB1A:
 +      case CPU_XLR:
                c->dcache.flags |= MIPS_CACHE_PINDEX;
                break;
  
@@@ -1076,6 -1075,7 +1076,6 @@@ static int __cpuinit probe_scache(void
        unsigned long flags, addr, begin, end, pow2;
        unsigned int config = read_c0_config();
        struct cpuinfo_mips *c = &current_cpu_data;
 -      int tmp;
  
        if (config & CONF_SC)
                return 0;
  
        /* Now search for the wrap around point. */
        pow2 = (128 * 1024);
 -      tmp = 0;
        for (addr = begin + (128 * 1024); addr < end; addr = begin + pow2) {
                cache_op(Index_Load_Tag_SD, addr);
                __asm__ __volatile__("nop; nop; nop; nop;"); /* hazard... */
@@@ -109,7 -109,7 +109,7 @@@ static int kgdb_call_nmi_hook(struct pt
  #ifdef CONFIG_SMP
  void kgdb_roundup_cpus(unsigned long flags)
  {
 -      smp_send_debugger_break(MSG_ALL_BUT_SELF);
 +      smp_send_debugger_break();
  }
  #endif
  
@@@ -142,7 -142,7 +142,7 @@@ static int kgdb_singlestep(struct pt_re
                return 0;
  
        /*
-        * On Book E and perhaps other processsors, singlestep is handled on
+        * On Book E and perhaps other processors, singlestep is handled on
         * the critical exception stack.  This causes current_thread_info()
         * to fail, since it it locates the thread_info by masking off
         * the low bits of the current stack pointer.  We work around
diff --combined drivers/base/memory.c
@@@ -48,8 -48,7 +48,8 @@@ static const char *memory_uevent_name(s
        return MEMORY_CLASS_NAME;
  }
  
 -static int memory_uevent(struct kset *kset, struct kobject *obj, struct kobj_uevent_env *env)
 +static int memory_uevent(struct kset *kset, struct kobject *obj,
 +                      struct kobj_uevent_env *env)
  {
        int retval = 0;
  
@@@ -229,11 -228,10 +229,11 @@@ int memory_isolate_notify(unsigned lon
   * OK to have direct references to sparsemem variables in here.
   */
  static int
 -memory_section_action(unsigned long phys_index, unsigned long action)
 +memory_block_action(unsigned long phys_index, unsigned long action)
  {
        int i;
        unsigned long start_pfn, start_paddr;
 +      unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
        struct page *first_page;
        int ret;
  
         * that way.
         */
        if (action == MEM_ONLINE) {
 -              for (i = 0; i < PAGES_PER_SECTION; i++) {
 +              for (i = 0; i < nr_pages; i++) {
                        if (PageReserved(first_page+i))
                                continue;
  
        switch (action) {
                case MEM_ONLINE:
                        start_pfn = page_to_pfn(first_page);
 -                      ret = online_pages(start_pfn, PAGES_PER_SECTION);
 +                      ret = online_pages(start_pfn, nr_pages);
                        break;
                case MEM_OFFLINE:
                        start_paddr = page_to_pfn(first_page) << PAGE_SHIFT;
                        ret = remove_memory(start_paddr,
 -                                          PAGES_PER_SECTION << PAGE_SHIFT);
 +                                          nr_pages << PAGE_SHIFT);
                        break;
                default:
                        WARN(1, KERN_WARNING "%s(%ld, %ld) unknown action: "
  static int memory_block_change_state(struct memory_block *mem,
                unsigned long to_state, unsigned long from_state_req)
  {
 -      int i, ret = 0;
 +      int ret = 0;
  
        mutex_lock(&mem->state_mutex);
  
        if (to_state == MEM_OFFLINE)
                mem->state = MEM_GOING_OFFLINE;
  
 -      for (i = 0; i < sections_per_block; i++) {
 -              ret = memory_section_action(mem->start_section_nr + i,
 -                                          to_state);
 -              if (ret)
 -                      break;
 -      }
 -
 -      if (ret) {
 -              for (i = 0; i < sections_per_block; i++)
 -                      memory_section_action(mem->start_section_nr + i,
 -                                            from_state_req);
 +      ret = memory_block_action(mem->start_section_nr, to_state);
  
 +      if (ret)
                mem->state = from_state_req;
 -      else
 +      else
                mem->state = to_state;
  
  out:
@@@ -389,15 -396,14 +389,14 @@@ memory_probe_store(struct class *class
                ret = add_memory(nid, phys_addr,
                                 PAGES_PER_SECTION << PAGE_SHIFT);
                if (ret)
-                       break;
+                       goto out;
  
                phys_addr += MIN_MEMORY_BLOCK_SIZE;
        }
  
-       if (ret)
-               count = ret;
-       return count;
+       ret = count;
+ out:
+       return ret;
  }
  static CLASS_ATTR(probe, S_IWUSR, NULL, memory_probe_store);
  
@@@ -321,7 -321,7 +321,7 @@@ efivar_show_raw(struct efivar_entry *en
  
  /*
   * Generic read/write functions that call the specific functions of
-  * the atttributes...
+  * the attributes...
   */
  static ssize_t efivar_attr_show(struct kobject *kobj, struct attribute *attr,
                                char *buf)
@@@ -677,8 -677,8 +677,8 @@@ create_efivars_bin_attributes(struct ef
  
        return 0;
  out_free:
 -      kfree(efivars->new_var);
 -      efivars->new_var = NULL;
 +      kfree(efivars->del_var);
 +      efivars->del_var = NULL;
        kfree(efivars->new_var);
        efivars->new_var = NULL;
        return error;
@@@ -803,8 -803,6 +803,8 @@@ efivars_init(void
        ops.set_variable = efi.set_variable;
        ops.get_next_variable = efi.get_next_variable;
        error = register_efivars(&__efivars, &ops, efi_kobj);
 +      if (error)
 +              goto err_put;
  
        /* Don't forget the systab entry */
        error = sysfs_create_group(efi_kobj, &efi_subsys_attr_group);
                printk(KERN_ERR
                       "efivars: Sysfs attribute export failed with error %d.\n",
                       error);
 -              unregister_efivars(&__efivars);
 -              kobject_put(efi_kobj);
 +              goto err_unregister;
        }
  
 +      return 0;
 +
 +err_unregister:
 +      unregister_efivars(&__efivars);
 +err_put:
 +      kobject_put(efi_kobj);
        return error;
  }
  
  static void __exit
  efivars_exit(void)
  {
 -      unregister_efivars(&__efivars);
 -      kobject_put(efi_kobj);
 +      if (efi_enabled) {
 +              unregister_efivars(&__efivars);
 +              kobject_put(efi_kobj);
 +      }
  }
  
  module_init(efivars_init);
diff --combined drivers/md/raid5.c
@@@ -1700,25 -1700,27 +1700,25 @@@ static void error(mddev_t *mddev, mdk_r
        raid5_conf_t *conf = mddev->private;
        pr_debug("raid456: error called\n");
  
 -      if (!test_bit(Faulty, &rdev->flags)) {
 -              set_bit(MD_CHANGE_DEVS, &mddev->flags);
 -              if (test_and_clear_bit(In_sync, &rdev->flags)) {
 -                      unsigned long flags;
 -                      spin_lock_irqsave(&conf->device_lock, flags);
 -                      mddev->degraded++;
 -                      spin_unlock_irqrestore(&conf->device_lock, flags);
 -                      /*
 -                       * if recovery was running, make sure it aborts.
 -                       */
 -                      set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 -              }
 -              set_bit(Faulty, &rdev->flags);
 -              printk(KERN_ALERT
 -                     "md/raid:%s: Disk failure on %s, disabling device.\n"
 -                     "md/raid:%s: Operation continuing on %d devices.\n",
 -                     mdname(mddev),
 -                     bdevname(rdev->bdev, b),
 -                     mdname(mddev),
 -                     conf->raid_disks - mddev->degraded);
 +      if (test_and_clear_bit(In_sync, &rdev->flags)) {
 +              unsigned long flags;
 +              spin_lock_irqsave(&conf->device_lock, flags);
 +              mddev->degraded++;
 +              spin_unlock_irqrestore(&conf->device_lock, flags);
 +              /*
 +               * if recovery was running, make sure it aborts.
 +               */
 +              set_bit(MD_RECOVERY_INTR, &mddev->recovery);
        }
 +      set_bit(Faulty, &rdev->flags);
 +      set_bit(MD_CHANGE_DEVS, &mddev->flags);
 +      printk(KERN_ALERT
 +             "md/raid:%s: Disk failure on %s, disabling device.\n"
 +             "md/raid:%s: Operation continuing on %d devices.\n",
 +             mdname(mddev),
 +             bdevname(rdev->bdev, b),
 +             mdname(mddev),
 +             conf->raid_disks - mddev->degraded);
  }
  
  /*
@@@ -3958,7 -3960,7 +3958,7 @@@ static int make_request(mddev_t *mddev
                        /* spinlock is needed as reshape_progress may be
                         * 64bit on a 32bit platform, and so it might be
                         * possible to see a half-updated value
-                        * Ofcourse reshape_progress could change after
+                        * Of course reshape_progress could change after
                         * the lock is dropped, so once we get a reference
                         * to the stripe that we think it is, we will have
                         * to check again.
@@@ -5389,8 -5391,7 +5389,8 @@@ static int raid5_resize(mddev_t *mddev
                return -EINVAL;
        set_capacity(mddev->gendisk, mddev->array_sectors);
        revalidate_disk(mddev->gendisk);
 -      if (sectors > mddev->dev_sectors && mddev->recovery_cp == MaxSector) {
 +      if (sectors > mddev->dev_sectors &&
 +          mddev->recovery_cp > mddev->dev_sectors) {
                mddev->recovery_cp = mddev->dev_sectors;
                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
        }
diff --combined drivers/net/atlx/atl1.c
@@@ -83,8 -83,9 +83,9 @@@
  #include "atl1.h"
  
  #define ATLX_DRIVER_VERSION "2.1.3"
- MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
- Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
+ MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, "
+             "Chris Snook <csnook@redhat.com>, "
+             "Jay Cliburn <jcliburn@gmail.com>");
  MODULE_LICENSE("GPL");
  MODULE_VERSION(ATLX_DRIVER_VERSION);
  
@@@ -2074,6 -2075,9 +2075,6 @@@ static void atl1_intr_tx(struct atl1_ad
        cmb_tpd_next_to_clean = le16_to_cpu(adapter->cmb.cmb->tpd_cons_idx);
  
        while (cmb_tpd_next_to_clean != sw_tpd_next_to_clean) {
 -              struct tx_packet_desc *tpd;
 -
 -              tpd = ATL1_TPD_DESC(tpd_ring, sw_tpd_next_to_clean);
                buffer_info = &tpd_ring->buffer_info[sw_tpd_next_to_clean];
                if (buffer_info->dma) {
                        pci_unmap_page(adapter->pdev, buffer_info->dma,
@@@ -2569,7 -2573,7 +2570,7 @@@ static s32 atl1_up(struct atl1_adapter 
  {
        struct net_device *netdev = adapter->netdev;
        int err;
 -      int irq_flags = IRQF_SAMPLE_RANDOM;
 +      int irq_flags = 0;
  
        /* hardware has been reset, we need to reload some things */
        atlx_set_multi(netdev);
@@@ -2983,11 -2987,6 +2984,11 @@@ static int __devinit atl1_probe(struct 
        netdev->features |= NETIF_F_SG;
        netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
  
 +      netdev->hw_features = NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_TSO;
 +
 +      /* is this valid? see atl1_setup_mac_ctrl() */
 +      netdev->features |= NETIF_F_RXCSUM;
 +
        /*
         * patch for some L1 of old version,
         * the final version of L1 may not need these
@@@ -3231,13 -3230,13 +3232,13 @@@ static int atl1_get_settings(struct net
        if (netif_carrier_ok(adapter->netdev)) {
                u16 link_speed, link_duplex;
                atl1_get_speed_and_duplex(hw, &link_speed, &link_duplex);
 -              ecmd->speed = link_speed;
 +              ethtool_cmd_speed_set(ecmd, link_speed);
                if (link_duplex == FULL_DUPLEX)
                        ecmd->duplex = DUPLEX_FULL;
                else
                        ecmd->duplex = DUPLEX_HALF;
        } else {
 -              ecmd->speed = -1;
 +              ethtool_cmd_speed_set(ecmd, -1);
                ecmd->duplex = -1;
        }
        if (hw->media_type == MEDIA_TYPE_AUTO_SENSOR ||
@@@ -3268,8 -3267,7 +3269,8 @@@ static int atl1_set_settings(struct net
        if (ecmd->autoneg == AUTONEG_ENABLE)
                hw->media_type = MEDIA_TYPE_AUTO_SENSOR;
        else {
 -              if (ecmd->speed == SPEED_1000) {
 +              u32 speed = ethtool_cmd_speed(ecmd);
 +              if (speed == SPEED_1000) {
                        if (ecmd->duplex != DUPLEX_FULL) {
                                if (netif_msg_link(adapter))
                                        dev_warn(&adapter->pdev->dev,
                                goto exit_sset;
                        }
                        hw->media_type = MEDIA_TYPE_1000M_FULL;
 -              } else if (ecmd->speed == SPEED_100) {
 +              } else if (speed == SPEED_100) {
                        if (ecmd->duplex == DUPLEX_FULL)
                                hw->media_type = MEDIA_TYPE_100M_FULL;
                        else
@@@ -3598,6 -3596,12 +3599,6 @@@ static int atl1_set_pauseparam(struct n
        return 0;
  }
  
 -/* FIXME: is this right? -- CHS */
 -static u32 atl1_get_rx_csum(struct net_device *netdev)
 -{
 -      return 1;
 -}
 -
  static void atl1_get_strings(struct net_device *netdev, u32 stringset,
        u8 *data)
  {
@@@ -3665,9 -3669,13 +3666,9 @@@ static const struct ethtool_ops atl1_et
        .set_ringparam          = atl1_set_ringparam,
        .get_pauseparam         = atl1_get_pauseparam,
        .set_pauseparam         = atl1_set_pauseparam,
 -      .get_rx_csum            = atl1_get_rx_csum,
 -      .set_tx_csum            = ethtool_op_set_tx_hw_csum,
        .get_link               = ethtool_op_get_link,
 -      .set_sg                 = ethtool_op_set_sg,
        .get_strings            = atl1_get_strings,
        .nway_reset             = atl1_nway_reset,
        .get_ethtool_stats      = atl1_get_ethtool_stats,
        .get_sset_count         = atl1_get_sset_count,
 -      .set_tso                = ethtool_op_set_tso,
  };
diff --combined drivers/net/macb.c
@@@ -576,11 -576,6 +576,11 @@@ static irqreturn_t macb_interrupt(int i
                 * add that if/when we get our hands on a full-blown MII PHY.
                 */
  
 +              if (status & MACB_BIT(ISR_ROVR)) {
 +                      /* We missed at least one packet */
 +                      bp->hw_stats.rx_overruns++;
 +              }
 +
                if (status & MACB_BIT(HRESP)) {
                        /*
                         * TODO: Reset the hardware, and maybe move the printk
@@@ -1029,8 -1024,7 +1029,8 @@@ static struct net_device_stats *macb_ge
                                   hwstat->rx_jabbers +
                                   hwstat->rx_undersize_pkts +
                                   hwstat->rx_length_mismatch);
 -      nstat->rx_over_errors = hwstat->rx_resource_errors;
 +      nstat->rx_over_errors = hwstat->rx_resource_errors +
 +                                 hwstat->rx_overruns;
        nstat->rx_crc_errors = hwstat->rx_fcs_errors;
        nstat->rx_frame_errors = hwstat->rx_align_errors;
        nstat->rx_fifo_errors = hwstat->rx_overruns;
@@@ -1177,7 -1171,8 +1177,7 @@@ static int __init macb_probe(struct pla
        }
  
        dev->irq = platform_get_irq(pdev, 0);
 -      err = request_irq(dev->irq, macb_interrupt, IRQF_SAMPLE_RANDOM,
 -                        dev->name, dev);
 +      err = request_irq(dev->irq, macb_interrupt, 0, dev->name, dev);
        if (err) {
                printk(KERN_ERR
                       "%s: Unable to request IRQ %d (error %d)\n",
@@@ -1356,5 -1351,5 +1356,5 @@@ module_exit(macb_exit)
  
  MODULE_LICENSE("GPL");
  MODULE_DESCRIPTION("Atmel MACB Ethernet driver");
- MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
+ MODULE_AUTHOR("Haavard Skinnemoen (Atmel)");
  MODULE_ALIAS("platform:macb");
diff --combined drivers/net/s2io.c
@@@ -78,7 -78,6 +78,7 @@@
  #include <linux/uaccess.h>
  #include <linux/io.h>
  #include <linux/slab.h>
 +#include <linux/prefetch.h>
  #include <net/tcp.h>
  
  #include <asm/system.h>
@@@ -2245,12 -2244,13 +2245,12 @@@ static int verify_xena_quiescence(struc
  static void fix_mac_address(struct s2io_nic *sp)
  {
        struct XENA_dev_config __iomem *bar0 = sp->bar0;
 -      u64 val64;
        int i = 0;
  
        while (fix_mac[i] != END_SIGN) {
                writeq(fix_mac[i++], &bar0->gpio_control);
                udelay(10);
 -              val64 = readq(&bar0->gpio_control);
 +              (void) readq(&bar0->gpio_control);
        }
  }
  
@@@ -2727,6 -2727,7 +2727,6 @@@ static void free_rxd_blk(struct s2io_ni
        int j;
        struct sk_buff *skb;
        struct RxD_t *rxdp;
 -      struct buffAdd *ba;
        struct RxD1 *rxdp1;
        struct RxD3 *rxdp3;
        struct mac_info *mac_control = &sp->mac_control;
                        memset(rxdp, 0, sizeof(struct RxD1));
                } else if (sp->rxd_mode == RXD_MODE_3B) {
                        rxdp3 = (struct RxD3 *)rxdp;
 -                      ba = &mac_control->rings[ring_no].ba[blk][j];
                        pci_unmap_single(sp->pdev,
                                         (dma_addr_t)rxdp3->Buffer0_ptr,
                                         BUF0_LEN,
@@@ -5381,7 -5383,7 +5381,7 @@@ static int s2io_ethtool_sset(struct net
  {
        struct s2io_nic *sp = netdev_priv(dev);
        if ((info->autoneg == AUTONEG_ENABLE) ||
 -          (info->speed != SPEED_10000) ||
 +          (ethtool_cmd_speed(info) != SPEED_10000) ||
            (info->duplex != DUPLEX_FULL))
                return -EINVAL;
        else {
@@@ -5415,10 -5417,10 +5415,10 @@@ static int s2io_ethtool_gset(struct net
        info->transceiver = XCVR_EXTERNAL;
  
        if (netif_carrier_ok(sp->dev)) {
 -              info->speed = 10000;
 +              ethtool_cmd_speed_set(info, SPEED_10000);
                info->duplex = DUPLEX_FULL;
        } else {
 -              info->speed = -1;
 +              ethtool_cmd_speed_set(info, -1);
                info->duplex = -1;
        }
  
@@@ -5482,79 -5484,83 +5482,79 @@@ static void s2io_ethtool_gregs(struct n
        }
  }
  
 -/**
 - *  s2io_phy_id  - timer function that alternates adapter LED.
 - *  @data : address of the private member of the device structure, which
 - *  is a pointer to the s2io_nic structure, provided as an u32.
 - * Description: This is actually the timer function that alternates the
 - * adapter LED bit of the adapter control bit to set/reset every time on
 - * invocation. The timer is set for 1/2 a second, hence tha NIC blinks
 - *  once every second.
 +/*
 + *  s2io_set_led - control NIC led
   */
 -static void s2io_phy_id(unsigned long data)
 +static void s2io_set_led(struct s2io_nic *sp, bool on)
  {
 -      struct s2io_nic *sp = (struct s2io_nic *)data;
        struct XENA_dev_config __iomem *bar0 = sp->bar0;
 -      u64 val64 = 0;
 -      u16 subid;
 +      u16 subid = sp->pdev->subsystem_device;
 +      u64 val64;
  
 -      subid = sp->pdev->subsystem_device;
        if ((sp->device_type == XFRAME_II_DEVICE) ||
            ((subid & 0xFF) >= 0x07)) {
                val64 = readq(&bar0->gpio_control);
 -              val64 ^= GPIO_CTRL_GPIO_0;
 +              if (on)
 +                      val64 |= GPIO_CTRL_GPIO_0;
 +              else
 +                      val64 &= ~GPIO_CTRL_GPIO_0;
 +
                writeq(val64, &bar0->gpio_control);
        } else {
                val64 = readq(&bar0->adapter_control);
 -              val64 ^= ADAPTER_LED_ON;
 +              if (on)
 +                      val64 |= ADAPTER_LED_ON;
 +              else
 +                      val64 &= ~ADAPTER_LED_ON;
 +
                writeq(val64, &bar0->adapter_control);
        }
  
 -      mod_timer(&sp->id_timer, jiffies + HZ / 2);
  }
  
  /**
 - * s2io_ethtool_idnic - To physically identify the nic on the system.
 - * @sp : private member of the device structure, which is a pointer to the
 - * s2io_nic structure.
 - * @id : pointer to the structure with identification parameters given by
 - * ethtool.
 + * s2io_ethtool_set_led - To physically identify the nic on the system.
 + * @dev : network device
 + * @state: led setting
 + *
   * Description: Used to physically identify the NIC on the system.
   * The Link LED will blink for a time specified by the user for
   * identification.
   * NOTE: The Link has to be Up to be able to blink the LED. Hence
   * identification is possible only if it's link is up.
 - * Return value:
 - * int , returns 0 on success
   */
  
 -static int s2io_ethtool_idnic(struct net_device *dev, u32 data)
 +static int s2io_ethtool_set_led(struct net_device *dev,
 +                              enum ethtool_phys_id_state state)
  {
 -      u64 val64 = 0, last_gpio_ctrl_val;
        struct s2io_nic *sp = netdev_priv(dev);
        struct XENA_dev_config __iomem *bar0 = sp->bar0;
 -      u16 subid;
 +      u16 subid = sp->pdev->subsystem_device;
  
 -      subid = sp->pdev->subsystem_device;
 -      last_gpio_ctrl_val = readq(&bar0->gpio_control);
        if ((sp->device_type == XFRAME_I_DEVICE) && ((subid & 0xFF) < 0x07)) {
 -              val64 = readq(&bar0->adapter_control);
 +              u64 val64 = readq(&bar0->adapter_control);
                if (!(val64 & ADAPTER_CNTL_EN)) {
                        pr_err("Adapter Link down, cannot blink LED\n");
 -                      return -EFAULT;
 +                      return -EAGAIN;
                }
        }
 -      if (sp->id_timer.function == NULL) {
 -              init_timer(&sp->id_timer);
 -              sp->id_timer.function = s2io_phy_id;
 -              sp->id_timer.data = (unsigned long)sp;
 -      }
 -      mod_timer(&sp->id_timer, jiffies);
 -      if (data)
 -              msleep_interruptible(data * HZ);
 -      else
 -              msleep_interruptible(MAX_FLICKER_TIME);
 -      del_timer_sync(&sp->id_timer);
  
 -      if (CARDS_WITH_FAULTY_LINK_INDICATORS(sp->device_type, subid)) {
 -              writeq(last_gpio_ctrl_val, &bar0->gpio_control);
 -              last_gpio_ctrl_val = readq(&bar0->gpio_control);
 +      switch (state) {
 +      case ETHTOOL_ID_ACTIVE:
 +              sp->adapt_ctrl_org = readq(&bar0->gpio_control);
 +              return 1;       /* cycle on/off once per second */
 +
 +      case ETHTOOL_ID_ON:
 +              s2io_set_led(sp, true);
 +              break;
 +
 +      case ETHTOOL_ID_OFF:
 +              s2io_set_led(sp, false);
 +              break;
 +
 +      case ETHTOOL_ID_INACTIVE:
 +              if (CARDS_WITH_FAULTY_LINK_INDICATORS(sp->device_type, subid))
 +                      writeq(sp->adapt_ctrl_org, &bar0->gpio_control);
        }
  
        return 0;
@@@ -6619,6 -6625,25 +6619,6 @@@ static int s2io_ethtool_get_regs_len(st
  }
  
  
 -static u32 s2io_ethtool_get_rx_csum(struct net_device *dev)
 -{
 -      struct s2io_nic *sp = netdev_priv(dev);
 -
 -      return sp->rx_csum;
 -}
 -
 -static int s2io_ethtool_set_rx_csum(struct net_device *dev, u32 data)
 -{
 -      struct s2io_nic *sp = netdev_priv(dev);
 -
 -      if (data)
 -              sp->rx_csum = 1;
 -      else
 -              sp->rx_csum = 0;
 -
 -      return 0;
 -}
 -
  static int s2io_get_eeprom_len(struct net_device *dev)
  {
        return XENA_EEPROM_SPACE;
@@@ -6670,27 -6695,61 +6670,27 @@@ static void s2io_ethtool_get_strings(st
        }
  }
  
 -static int s2io_ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
 -{
 -      if (data)
 -              dev->features |= NETIF_F_IP_CSUM;
 -      else
 -              dev->features &= ~NETIF_F_IP_CSUM;
 -
 -      return 0;
 -}
 -
 -static u32 s2io_ethtool_op_get_tso(struct net_device *dev)
 -{
 -      return (dev->features & NETIF_F_TSO) != 0;
 -}
 -
 -static int s2io_ethtool_op_set_tso(struct net_device *dev, u32 data)
 -{
 -      if (data)
 -              dev->features |= (NETIF_F_TSO | NETIF_F_TSO6);
 -      else
 -              dev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
 -
 -      return 0;
 -}
 -
 -static int s2io_ethtool_set_flags(struct net_device *dev, u32 data)
 +static int s2io_set_features(struct net_device *dev, u32 features)
  {
        struct s2io_nic *sp = netdev_priv(dev);
 -      int rc = 0;
 -      int changed = 0;
 -
 -      if (ethtool_invalid_flags(dev, data, ETH_FLAG_LRO))
 -              return -EINVAL;
 -
 -      if (data & ETH_FLAG_LRO) {
 -              if (!(dev->features & NETIF_F_LRO)) {
 -                      dev->features |= NETIF_F_LRO;
 -                      changed = 1;
 -              }
 -      } else if (dev->features & NETIF_F_LRO) {
 -              dev->features &= ~NETIF_F_LRO;
 -              changed = 1;
 -      }
 +      u32 changed = (features ^ dev->features) & NETIF_F_LRO;
  
        if (changed && netif_running(dev)) {
 +              int rc;
 +
                s2io_stop_all_tx_queue(sp);
                s2io_card_down(sp);
 +              dev->features = features;
                rc = s2io_card_up(sp);
                if (rc)
                        s2io_reset(sp);
                else
                        s2io_start_all_tx_queue(sp);
 +
 +              return rc ? rc : 1;
        }
  
 -      return rc;
 +      return 0;
  }
  
  static const struct ethtool_ops netdev_ethtool_ops = {
        .get_ringparam = s2io_ethtool_gringparam,
        .get_pauseparam = s2io_ethtool_getpause_data,
        .set_pauseparam = s2io_ethtool_setpause_data,
 -      .get_rx_csum = s2io_ethtool_get_rx_csum,
 -      .set_rx_csum = s2io_ethtool_set_rx_csum,
 -      .set_tx_csum = s2io_ethtool_op_set_tx_csum,
 -      .set_flags = s2io_ethtool_set_flags,
 -      .get_flags = ethtool_op_get_flags,
 -      .set_sg = ethtool_op_set_sg,
 -      .get_tso = s2io_ethtool_op_get_tso,
 -      .set_tso = s2io_ethtool_op_set_tso,
 -      .set_ufo = ethtool_op_set_ufo,
        .self_test = s2io_ethtool_test,
        .get_strings = s2io_ethtool_get_strings,
 -      .phys_id = s2io_ethtool_idnic,
 +      .set_phys_id = s2io_ethtool_set_led,
        .get_ethtool_stats = s2io_get_ethtool_stats,
        .get_sset_count = s2io_get_sset_count,
  };
@@@ -7163,7 -7231,7 +7163,7 @@@ static void do_s2io_card_down(struct s2
                /* As per the HW requirement we need to replenish the
                 * receive buffer to avoid the ring bump. Since there is
                 * no intention of processing the Rx frame at this pointwe are
-                * just settting the ownership bit of rxd in Each Rx
+                * just setting the ownership bit of rxd in Each Rx
                 * ring to HW and set the appropriate buffer size
                 * based on the ring mode
                 */
@@@ -7477,7 -7545,7 +7477,7 @@@ static int rx_osm_handler(struct ring_i
        if ((rxdp->Control_1 & TCP_OR_UDP_FRAME) &&
            ((!ring_data->lro) ||
             (ring_data->lro && (!(rxdp->Control_1 & RXD_FRAME_IP_FRAG)))) &&
 -          (sp->rx_csum)) {
 +          (dev->features & NETIF_F_RXCSUM)) {
                l3_csum = RXD_GET_L3_CKSUM(rxdp->Control_1);
                l4_csum = RXD_GET_L4_CKSUM(rxdp->Control_1);
                if ((l3_csum == L3_CKSUM_OK) && (l4_csum == L4_CKSUM_OK)) {
@@@ -7738,7 -7806,6 +7738,7 @@@ static const struct net_device_ops s2io
        .ndo_do_ioctl           = s2io_ioctl,
        .ndo_set_mac_address    = s2io_set_mac_addr,
        .ndo_change_mtu         = s2io_change_mtu,
 +      .ndo_set_features       = s2io_set_features,
        .ndo_vlan_rx_register   = s2io_vlan_rx_register,
        .ndo_vlan_rx_kill_vid   = s2io_vlan_rx_kill_vid,
        .ndo_tx_timeout         = s2io_tx_watchdog,
@@@ -7980,18 -8047,17 +7980,18 @@@ s2io_init_nic(struct pci_dev *pdev, con
        /*  Driver entry points */
        dev->netdev_ops = &s2io_netdev_ops;
        SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
 -      dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 -      dev->features |= NETIF_F_LRO;
 -      dev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
 +      dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM |
 +              NETIF_F_TSO | NETIF_F_TSO6 |
 +              NETIF_F_RXCSUM | NETIF_F_LRO;
 +      dev->features |= dev->hw_features |
 +              NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 +      if (sp->device_type & XFRAME_II_DEVICE) {
 +              dev->hw_features |= NETIF_F_UFO;
 +              if (ufo)
 +                      dev->features |= NETIF_F_UFO;
 +      }
        if (sp->high_dma_flag == true)
                dev->features |= NETIF_F_HIGHDMA;
 -      dev->features |= NETIF_F_TSO;
 -      dev->features |= NETIF_F_TSO6;
 -      if ((sp->device_type & XFRAME_II_DEVICE) && (ufo))  {
 -              dev->features |= NETIF_F_UFO;
 -              dev->features |= NETIF_F_HW_CSUM;
 -      }
        dev->watchdog_timeo = WATCH_DOG_TIMEOUT;
        INIT_WORK(&sp->rst_timer_task, s2io_restart_nic);
        INIT_WORK(&sp->set_link_task, s2io_set_link);
@@@ -6,7 -6,7 +6,7 @@@
   * Author: Li Yang <leoli@freescale.com>
   *
   * Limitation:
-  * Can only get/set setttings of the first queue.
+  * Can only get/set settings of the first queue.
   * Need to re-open the interface manually after changing some parameters.
   *
   * This program is free software; you can redistribute  it and/or modify it
@@@ -410,6 -410,7 +410,6 @@@ static const struct ethtool_ops uec_eth
        .set_ringparam          = uec_set_ringparam,
        .get_pauseparam         = uec_get_pauseparam,
        .set_pauseparam         = uec_set_pauseparam,
 -      .set_sg                 = ethtool_op_set_sg,
        .get_sset_count         = uec_get_sset_count,
        .get_strings            = uec_get_strings,
        .get_ethtool_stats      = uec_get_ethtool_stats,
diff --combined drivers/net/usb/usbnet.c
@@@ -109,7 -109,7 +109,7 @@@ int usbnet_get_endpoints(struct usbnet 
  
                /* take the first altsetting with in-bulk + out-bulk;
                 * remember any status endpoint, just in case;
-                * ignore other endpoints and altsetttings.
+                * ignore other endpoints and altsettings.
                 */
                for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
                        struct usb_host_endpoint        *e;
@@@ -645,7 -645,6 +645,7 @@@ int usbnet_stop (struct net_device *net
        struct driver_info      *info = dev->driver_info;
        int                     retval;
  
 +      clear_bit(EVENT_DEV_OPEN, &dev->flags);
        netif_stop_queue (net);
  
        netif_info(dev, ifdown, dev->net,
@@@ -737,7 -736,6 +737,7 @@@ int usbnet_open (struct net_device *net
                }
        }
  
 +      set_bit(EVENT_DEV_OPEN, &dev->flags);
        netif_start_queue (net);
        netif_info(dev, ifup, dev->net,
                   "open: enable queueing (rx %d, tx %d) mtu %d %s framing\n",
@@@ -1261,9 -1259,6 +1261,9 @@@ void usbnet_disconnect (struct usb_inte
        if (dev->driver_info->unbind)
                dev->driver_info->unbind (dev, intf);
  
 +      usb_kill_urb(dev->interrupt);
 +      usb_free_urb(dev->interrupt);
 +
        free_netdev(net);
        usb_put_dev (xdev);
  }
@@@ -1503,10 -1498,6 +1503,10 @@@ int usbnet_resume (struct usb_interfac
        int                     retval;
  
        if (!--dev->suspend_count) {
 +              /* resume interrupt URBs */
 +              if (dev->interrupt && test_bit(EVENT_DEV_OPEN, &dev->flags))
 +                      usb_submit_urb(dev->interrupt, GFP_NOIO);
 +
                spin_lock_irq(&dev->txq.lock);
                while ((res = usb_get_from_anchor(&dev->deferred))) {
  
                smp_mb();
                clear_bit(EVENT_DEV_ASLEEP, &dev->flags);
                spin_unlock_irq(&dev->txq.lock);
 -              if (!(dev->txq.qlen >= TX_QLEN(dev)))
 -                      netif_start_queue(dev->net);
 -              tasklet_schedule (&dev->bh);
 +
 +              if (test_bit(EVENT_DEV_OPEN, &dev->flags)) {
 +                      if (!(dev->txq.qlen >= TX_QLEN(dev)))
 +                              netif_start_queue(dev->net);
 +                      tasklet_schedule (&dev->bh);
 +              }
        }
        return 0;
  }
@@@ -1541,9 -1529,9 +1541,9 @@@ EXPORT_SYMBOL_GPL(usbnet_resume)
  
  static int __init usbnet_init(void)
  {
 -      /* compiler should optimize this out */
 -      BUILD_BUG_ON (sizeof (((struct sk_buff *)0)->cb)
 -                      < sizeof (struct skb_data));
 +      /* Compiler should optimize this out. */
 +      BUILD_BUG_ON(
 +              FIELD_SIZEOF(struct sk_buff, cb) < sizeof(struct skb_data));
  
        random_ether_addr(node_id);
        return 0;
@@@ -652,7 -652,7 +652,7 @@@ static const struct ar9300_eeprom ar930
                .regDmn = { LE16(0), LE16(0x1f) },
                .txrxMask =  0x77, /* 4 bits tx and 4 bits rx */
                .opCapFlags = {
 -                      .opFlags = AR5416_OPFLAGS_11G | AR5416_OPFLAGS_11A,
 +                      .opFlags = AR5416_OPFLAGS_11A,
                        .eepMisc = 0,
                },
                .rfSilent = 0,
                .db_stage2 = {3, 3, 3}, /* 3 chain */
                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
 -              .xpaBiasLvl = 0,
 +              .xpaBiasLvl = 0xf,
                .txFrameToDataStart = 0x0e,
                .txFrameToPaOn = 0x0e,
                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
@@@ -3217,6 -3217,7 +3217,6 @@@ static int ar9300_compress_decision(str
                                    u8 *word, int length, int mdata_size)
  {
        struct ath_common *common = ath9k_hw_common(ah);
 -      u8 *dptr;
        const struct ar9300_eeprom *eep = NULL;
  
        switch (code) {
                break;
        case _CompressBlock:
                if (reference == 0) {
 -                      dptr = mptr;
                } else {
                        eep = ar9003_eeprom_struct_find_by_id(reference);
                        if (eep == NULL) {
@@@ -3327,26 -3329,26 +3327,26 @@@ static int ar9300_eeprom_restore_intern
        else
                cptr = AR9300_BASE_ADDR;
        ath_dbg(common, ATH_DBG_EEPROM,
-               "Trying EEPROM accesss at Address 0x%04x\n", cptr);
+               "Trying EEPROM access at Address 0x%04x\n", cptr);
        if (ar9300_check_eeprom_header(ah, read, cptr))
                goto found;
  
        cptr = AR9300_BASE_ADDR_512;
        ath_dbg(common, ATH_DBG_EEPROM,
-               "Trying EEPROM accesss at Address 0x%04x\n", cptr);
+               "Trying EEPROM access at Address 0x%04x\n", cptr);
        if (ar9300_check_eeprom_header(ah, read, cptr))
                goto found;
  
        read = ar9300_read_otp;
        cptr = AR9300_BASE_ADDR;
        ath_dbg(common, ATH_DBG_EEPROM,
-               "Trying OTP accesss at Address 0x%04x\n", cptr);
+               "Trying OTP access at Address 0x%04x\n", cptr);
        if (ar9300_check_eeprom_header(ah, read, cptr))
                goto found;
  
        cptr = AR9300_BASE_ADDR_512;
        ath_dbg(common, ATH_DBG_EEPROM,
-               "Trying OTP accesss at Address 0x%04x\n", cptr);
+               "Trying OTP access at Address 0x%04x\n", cptr);
        if (ar9300_check_eeprom_header(ah, read, cptr))
                goto found;
  
@@@ -3442,15 -3444,13 +3442,15 @@@ static void ar9003_hw_xpa_bias_level_ap
  {
        int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
  
 -      if (AR_SREV_9485(ah))
 +      if (AR_SREV_9485(ah) || AR_SREV_9340(ah))
                REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
        else {
                REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
 -              REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB,
 -                            bias >> 2);
 -              REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
 +              REG_RMW_FIELD(ah, AR_CH0_THERM,
 +                              AR_CH0_THERM_XPABIASLVL_MSB,
 +                              bias >> 2);
 +              REG_RMW_FIELD(ah, AR_CH0_THERM,
 +                              AR_CH0_THERM_XPASHORT2GND, 1);
        }
  }
  
@@@ -3497,77 -3497,34 +3497,77 @@@ static u16 ar9003_hw_ant_ctrl_chain_get
  
  static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
  {
 +      int chain;
 +      u32 regval;
 +      u32 ant_div_ctl1;
 +      static const u32 switch_chain_reg[AR9300_MAX_CHAINS] = {
 +                      AR_PHY_SWITCH_CHAIN_0,
 +                      AR_PHY_SWITCH_CHAIN_1,
 +                      AR_PHY_SWITCH_CHAIN_2,
 +      };
 +
        u32 value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
 +
        REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM, AR_SWITCH_TABLE_COM_ALL, value);
  
        value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
        REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
  
 -      value = ar9003_hw_ant_ctrl_chain_get(ah, 0, is2ghz);
 -      REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_0, AR_SWITCH_TABLE_ALL, value);
 -
 -      if (!AR_SREV_9485(ah)) {
 -              value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
 -              REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_1, AR_SWITCH_TABLE_ALL,
 -                            value);
 -
 -              value = ar9003_hw_ant_ctrl_chain_get(ah, 2, is2ghz);
 -              REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_2, AR_SWITCH_TABLE_ALL,
 -                            value);
 +      for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
 +              if ((ah->rxchainmask & BIT(chain)) ||
 +                  (ah->txchainmask & BIT(chain))) {
 +                      value = ar9003_hw_ant_ctrl_chain_get(ah, chain,
 +                                                           is2ghz);
 +                      REG_RMW_FIELD(ah, switch_chain_reg[chain],
 +                                    AR_SWITCH_TABLE_ALL, value);
 +              }
        }
  
        if (AR_SREV_9485(ah)) {
                value = ath9k_hw_ar9300_get_eeprom(ah, EEP_ANT_DIV_CTL1);
 -              REG_RMW_FIELD(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_CTRL_ALL,
 -                            value);
 -              REG_RMW_FIELD(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_ENABLE,
 -                            value >> 6);
 -              REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT, AR_FAST_DIV_ENABLE,
 -                            value >> 7);
 +              /*
 +               * main_lnaconf, alt_lnaconf, main_tb, alt_tb
 +               * are the fields present
 +               */
 +              regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
 +              regval &= (~AR_ANT_DIV_CTRL_ALL);
 +              regval |= (value & 0x3f) << AR_ANT_DIV_CTRL_ALL_S;
 +              /* enable_lnadiv */
 +              regval &= (~AR_PHY_9485_ANT_DIV_LNADIV);
 +              regval |= ((value >> 6) & 0x1) <<
 +                              AR_PHY_9485_ANT_DIV_LNADIV_S;
 +              REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
 +
 +              /*enable fast_div */
 +              regval = REG_READ(ah, AR_PHY_CCK_DETECT);
 +              regval &= (~AR_FAST_DIV_ENABLE);
 +              regval |= ((value >> 7) & 0x1) <<
 +                              AR_FAST_DIV_ENABLE_S;
 +              REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
 +              ant_div_ctl1 =
 +                      ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
 +              /* check whether antenna diversity is enabled */
 +              if ((ant_div_ctl1 >> 0x6) == 0x3) {
 +                      regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
 +                      /*
 +                       * clear bits 25-30 main_lnaconf, alt_lnaconf,
 +                       * main_tb, alt_tb
 +                       */
 +                      regval &= (~(AR_PHY_9485_ANT_DIV_MAIN_LNACONF |
 +                                      AR_PHY_9485_ANT_DIV_ALT_LNACONF |
 +                                      AR_PHY_9485_ANT_DIV_ALT_GAINTB |
 +                                      AR_PHY_9485_ANT_DIV_MAIN_GAINTB));
 +                      /* by default use LNA1 for the main antenna */
 +                      regval |= (AR_PHY_9485_ANT_DIV_LNA1 <<
 +                                      AR_PHY_9485_ANT_DIV_MAIN_LNACONF_S);
 +                      regval |= (AR_PHY_9485_ANT_DIV_LNA2 <<
 +                                      AR_PHY_9485_ANT_DIV_ALT_LNACONF_S);
 +                      REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
 +              }
 +
 +
        }
 +
  }
  
  static void ar9003_hw_drive_strength_apply(struct ath_hw *ah)
@@@ -3677,16 -3634,13 +3677,16 @@@ static void ar9003_hw_atten_apply(struc
  
        /* Test value. if 0 then attenuation is unused. Don't load anything. */
        for (i = 0; i < 3; i++) {
 -              value = ar9003_hw_atten_chain_get(ah, i, chan);
 -              REG_RMW_FIELD(ah, ext_atten_reg[i],
 -                            AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
 -
 -              value = ar9003_hw_atten_chain_get_margin(ah, i, chan);
 -              REG_RMW_FIELD(ah, ext_atten_reg[i],
 -                            AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN, value);
 +              if (ah->txchainmask & BIT(i)) {
 +                      value = ar9003_hw_atten_chain_get(ah, i, chan);
 +                      REG_RMW_FIELD(ah, ext_atten_reg[i],
 +                                    AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
 +
 +                      value = ar9003_hw_atten_chain_get_margin(ah, i, chan);
 +                      REG_RMW_FIELD(ah, ext_atten_reg[i],
 +                                    AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
 +                                    value);
 +              }
        }
  }
  
@@@ -3795,9 -3749,8 +3795,9 @@@ static void ath9k_hw_ar9300_set_board_v
        ar9003_hw_ant_ctrl_apply(ah, IS_CHAN_2GHZ(chan));
        ar9003_hw_drive_strength_apply(ah);
        ar9003_hw_atten_apply(ah, chan);
 -      ar9003_hw_internal_regulator_apply(ah);
 -      if (AR_SREV_9485(ah))
 +      if (!AR_SREV_9340(ah))
 +              ar9003_hw_internal_regulator_apply(ah);
 +      if (AR_SREV_9485(ah) || AR_SREV_9340(ah))
                ar9003_hw_apply_tuning_caps(ah);
  }
  
@@@ -4041,16 -3994,6 +4041,16 @@@ static int ar9003_hw_tx_power_regwrite(
                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 0)
            );
  
 +        /* Write the power for duplicated frames - HT40 */
 +
 +        /* dup40_cck (LSB), dup40_ofdm, ext20_cck, ext20_ofdm (MSB) */
 +      REG_WRITE(ah, 0xa3e0,
 +                POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 24) |
 +                POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 16) |
 +                POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24],  8) |
 +                POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L],  0)
 +          );
 +
        /* Write the HT20 power per rate set */
  
        /* 0/8/16 (LSB), 1-3/9-11/17-19, 4, 5 (MSB) */
@@@ -5,7 -5,7 +5,7 @@@
   *
   * GPL LICENSE SUMMARY
   *
 - * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 + * Copyright(c) 2008 - 2011 Intel Corporation. All rights reserved.
   *
   * This program is free software; you can redistribute it and/or modify
   * it under the terms of version 2 of the GNU General Public License as
@@@ -30,7 -30,7 +30,7 @@@
   *
   * BSD LICENSE
   *
 - * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 + * Copyright(c) 2005 - 2011 Intel Corporation. All rights reserved.
   * All rights reserved.
   *
   * Redistribution and use in source and binary forms, with or without
@@@ -605,7 -605,7 +605,7 @@@ void iwl_init_sensitivity(struct iwl_pr
        IWL_DEBUG_CALIB(priv, "<<return 0x%X\n", ret);
  }
  
 -void iwl_sensitivity_calibration(struct iwl_priv *priv, void *resp)
 +void iwl_sensitivity_calibration(struct iwl_priv *priv)
  {
        u32 rx_enable_time;
        u32 fa_cck;
        }
  
        spin_lock_irqsave(&priv->lock, flags);
 -      if (iwl_bt_statistics(priv)) {
 -              rx_info = &(((struct iwl_bt_notif_statistics *)resp)->
 -                            rx.general.common);
 -              ofdm = &(((struct iwl_bt_notif_statistics *)resp)->rx.ofdm);
 -              cck = &(((struct iwl_bt_notif_statistics *)resp)->rx.cck);
 -      } else {
 -              rx_info = &(((struct iwl_notif_statistics *)resp)->rx.general);
 -              ofdm = &(((struct iwl_notif_statistics *)resp)->rx.ofdm);
 -              cck = &(((struct iwl_notif_statistics *)resp)->rx.cck);
 -      }
 +      rx_info = &priv->statistics.rx_non_phy;
 +      ofdm = &priv->statistics.rx_ofdm;
 +      cck = &priv->statistics.rx_cck;
        if (rx_info->interference_data_flag != INTERFERENCE_DATA_AVAILABLE) {
                IWL_DEBUG_CALIB(priv, "<< invalid data.\n");
                spin_unlock_irqrestore(&priv->lock, flags);
@@@ -817,8 -824,8 +817,8 @@@ static void iwl_find_disconn_antenna(st
                                find_first_chain(priv->cfg->valid_tx_ant);
                        data->disconn_array[first_chain] = 0;
                        active_chains |= BIT(first_chain);
-                       IWL_DEBUG_CALIB(priv, "All Tx chains are disconnected \
-                                       W/A - declare %d as connected\n",
+                       IWL_DEBUG_CALIB(priv,
+                                       "All Tx chains are disconnected W/A - declare %d as connected\n",
                                        first_chain);
                        break;
                }
   * 1)  Which antennas are connected.
   * 2)  Differential rx gain settings to balance the 3 receivers.
   */
 -void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
 +void iwl_chain_noise_calibration(struct iwl_priv *priv)
  {
        struct iwl_chain_noise_data *data = NULL;
  
        }
  
        spin_lock_irqsave(&priv->lock, flags);
 -      if (iwl_bt_statistics(priv)) {
 -              rx_info = &(((struct iwl_bt_notif_statistics *)stat_resp)->
 -                            rx.general.common);
 -      } else {
 -              rx_info = &(((struct iwl_notif_statistics *)stat_resp)->
 -                            rx.general);
 -      }
 +
 +      rx_info = &priv->statistics.rx_non_phy;
 +
        if (rx_info->interference_data_flag != INTERFERENCE_DATA_AVAILABLE) {
                IWL_DEBUG_CALIB(priv, " << Interference data unavailable\n");
                spin_unlock_irqrestore(&priv->lock, flags);
  
        rxon_band24 = !!(ctx->staging.flags & RXON_FLG_BAND_24G_MSK);
        rxon_chnum = le16_to_cpu(ctx->staging.channel);
 -      if (iwl_bt_statistics(priv)) {
 -              stat_band24 = !!(((struct iwl_bt_notif_statistics *)
 -                               stat_resp)->flag &
 -                               STATISTICS_REPLY_FLG_BAND_24G_MSK);
 -              stat_chnum = le32_to_cpu(((struct iwl_bt_notif_statistics *)
 -                                       stat_resp)->flag) >> 16;
 -      } else {
 -              stat_band24 = !!(((struct iwl_notif_statistics *)
 -                               stat_resp)->flag &
 -                               STATISTICS_REPLY_FLG_BAND_24G_MSK);
 -              stat_chnum = le32_to_cpu(((struct iwl_notif_statistics *)
 -                                       stat_resp)->flag) >> 16;
 -      }
 +      stat_band24 =
 +              !!(priv->statistics.flag & STATISTICS_REPLY_FLG_BAND_24G_MSK);
 +      stat_chnum = le32_to_cpu(priv->statistics.flag) >> 16;
  
        /* Make sure we accumulate data for just the associated channel
         *   (even if scanning). */
@@@ -1,6 -1,6 +1,6 @@@
  /******************************************************************************
   *
 - * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 + * Copyright(c) 2003 - 2011 Intel Corporation. All rights reserved.
   *
   * Portions of this file are derived from the ipw3945 project, as well
   * as portions of the ieee80211 subsystem header files.
@@@ -59,6 -59,7 +59,6 @@@
  #include "iwl-sta.h"
  #include "iwl-agn-calib.h"
  #include "iwl-agn.h"
 -#include "iwl-agn-led.h"
  
  
  /******************************************************************************
@@@ -102,6 -103,70 +102,6 @@@ void iwl_update_chain_flags(struct iwl_
        }
  }
  
 -static void iwl_clear_free_frames(struct iwl_priv *priv)
 -{
 -      struct list_head *element;
 -
 -      IWL_DEBUG_INFO(priv, "%d frames on pre-allocated heap on clear.\n",
 -                     priv->frames_count);
 -
 -      while (!list_empty(&priv->free_frames)) {
 -              element = priv->free_frames.next;
 -              list_del(element);
 -              kfree(list_entry(element, struct iwl_frame, list));
 -              priv->frames_count--;
 -      }
 -
 -      if (priv->frames_count) {
 -              IWL_WARN(priv, "%d frames still in use.  Did we lose one?\n",
 -                          priv->frames_count);
 -              priv->frames_count = 0;
 -      }
 -}
 -
 -static struct iwl_frame *iwl_get_free_frame(struct iwl_priv *priv)
 -{
 -      struct iwl_frame *frame;
 -      struct list_head *element;
 -      if (list_empty(&priv->free_frames)) {
 -              frame = kzalloc(sizeof(*frame), GFP_KERNEL);
 -              if (!frame) {
 -                      IWL_ERR(priv, "Could not allocate frame!\n");
 -                      return NULL;
 -              }
 -
 -              priv->frames_count++;
 -              return frame;
 -      }
 -
 -      element = priv->free_frames.next;
 -      list_del(element);
 -      return list_entry(element, struct iwl_frame, list);
 -}
 -
 -static void iwl_free_frame(struct iwl_priv *priv, struct iwl_frame *frame)
 -{
 -      memset(frame, 0, sizeof(*frame));
 -      list_add(&frame->list, &priv->free_frames);
 -}
 -
 -static u32 iwl_fill_beacon_frame(struct iwl_priv *priv,
 -                               struct ieee80211_hdr *hdr,
 -                               int left)
 -{
 -      lockdep_assert_held(&priv->mutex);
 -
 -      if (!priv->beacon_skb)
 -              return 0;
 -
 -      if (priv->beacon_skb->len > left)
 -              return 0;
 -
 -      memcpy(hdr, priv->beacon_skb->data, priv->beacon_skb->len);
 -
 -      return priv->beacon_skb->len;
 -}
 -
  /* Parse the beacon frame to find the TIM element and set tim_idx & tim_size */
  static void iwl_set_beacon_tim(struct iwl_priv *priv,
                               struct iwl_tx_beacon_cmd *tx_beacon_cmd,
                IWL_WARN(priv, "Unable to find TIM Element in beacon\n");
  }
  
 -static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 -                                     struct iwl_frame *frame)
 +int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
  {
        struct iwl_tx_beacon_cmd *tx_beacon_cmd;
 +      struct iwl_host_cmd cmd = {
 +              .id = REPLY_TX_BEACON,
 +              .flags = CMD_SIZE_HUGE,
 +      };
        u32 frame_size;
        u32 rate_flags;
        u32 rate;
 +      int err;
 +
        /*
         * We have to set up the TX command, the TX Beacon command, and the
         * beacon contents.
                return 0;
        }
  
 -      /* Initialize memory */
 -      tx_beacon_cmd = &frame->u.beacon;
 -      memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
 +      if (WARN_ON(!priv->beacon_skb))
 +              return -EINVAL;
 +
 +      /* Allocate beacon memory */
 +      tx_beacon_cmd = kzalloc(sizeof(*tx_beacon_cmd) + priv->beacon_skb->len,
 +                              GFP_KERNEL);
 +      if (!tx_beacon_cmd)
 +              return -ENOMEM;
 +
 +      frame_size = priv->beacon_skb->len;
  
        /* Set up TX beacon contents */
 -      frame_size = iwl_fill_beacon_frame(priv, tx_beacon_cmd->frame,
 -                              sizeof(frame->u) - sizeof(*tx_beacon_cmd));
 -      if (WARN_ON_ONCE(frame_size > MAX_MPDU_SIZE))
 -              return 0;
 -      if (!frame_size)
 -              return 0;
 +      memcpy(tx_beacon_cmd->frame, priv->beacon_skb->data, frame_size);
  
        /* Set up TX command fields */
        tx_beacon_cmd->tx.len = cpu_to_le16((u16)frame_size);
        tx_beacon_cmd->tx.rate_n_flags = iwl_hw_set_rate_n_flags(rate,
                        rate_flags);
  
 -      return sizeof(*tx_beacon_cmd) + frame_size;
 -}
 +      /* Submit command */
 +      cmd.len = sizeof(*tx_beacon_cmd) + frame_size;
 +      cmd.data = tx_beacon_cmd;
  
 -int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
 -{
 -      struct iwl_frame *frame;
 -      unsigned int frame_size;
 -      int rc;
 -
 -      frame = iwl_get_free_frame(priv);
 -      if (!frame) {
 -              IWL_ERR(priv, "Could not obtain free frame buffer for beacon "
 -                        "command.\n");
 -              return -ENOMEM;
 -      }
 +      err = iwl_send_cmd_sync(priv, &cmd);
  
 -      frame_size = iwl_hw_get_beacon_cmd(priv, frame);
 -      if (!frame_size) {
 -              IWL_ERR(priv, "Error configuring the beacon command\n");
 -              iwl_free_frame(priv, frame);
 -              return -EINVAL;
 -      }
 -
 -      rc = iwl_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size,
 -                            &frame->u.cmd[0]);
 +      /* Free temporary storage */
 +      kfree(tx_beacon_cmd);
  
 -      iwl_free_frame(priv, frame);
 -
 -      return rc;
 +      return err;
  }
  
  static inline dma_addr_t iwl_tfd_tb_get_addr(struct iwl_tfd *tfd, u8 idx)
@@@ -318,9 -395,7 +318,9 @@@ int iwl_hw_txq_attach_buf_to_tfd(struc
                return -EINVAL;
        }
  
 -      BUG_ON(addr & ~DMA_BIT_MASK(36));
 +      if (WARN_ON(addr & ~DMA_BIT_MASK(36)))
 +              return -EINVAL;
 +
        if (unlikely(addr & ~IWL_TX_DMA_MASK))
                IWL_ERR(priv, "Unaligned address = %llx\n",
                          (unsigned long long)addr);
   * Tell nic where to find circular buffer of Tx Frame Descriptors for
   * given Tx queue, and enable the DMA channel used for that queue.
   *
 - * 4965 supports up to 16 Tx queues in DRAM, mapped to up to 8 Tx DMA
 + * supports up to 16 Tx queues in DRAM, mapped to up to 8 Tx DMA
   * channels supported in hardware.
   */
  int iwl_hw_tx_queue_init(struct iwl_priv *priv,
@@@ -408,14 -483,12 +408,14 @@@ static void iwl_bg_bt_full_concurrency(
                container_of(work, struct iwl_priv, bt_full_concurrency);
        struct iwl_rxon_context *ctx;
  
 +      mutex_lock(&priv->mutex);
 +
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 -              return;
 +              goto out;
  
        /* dont send host command if rf-kill is on */
        if (!iwl_is_ready_rf(priv))
 -              return;
 +              goto out;
  
        IWL_DEBUG_INFO(priv, "BT coex in %s mode\n",
                       priv->bt_full_concurrent ?
         * LQ & RXON updated cmds must be sent before BT Config cmd
         * to avoid 3-wire collisions
         */
 -      mutex_lock(&priv->mutex);
        for_each_context(priv, ctx) {
                if (priv->cfg->ops->hcmd->set_rxon_chain)
                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
                iwlcore_commit_rxon(priv, ctx);
        }
 -      mutex_unlock(&priv->mutex);
  
        priv->cfg->ops->hcmd->send_bt_config(priv);
 +out:
 +      mutex_unlock(&priv->mutex);
  }
  
  /**
@@@ -483,7 -556,7 +483,7 @@@ static void iwl_print_cont_event_trace(
        }
  
        /* Set starting address; reads will auto-increment */
 -      _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
 +      iwl_write32(priv, HBUS_TARG_MEM_RADDR, ptr);
        rmb();
  
        /*
         * place event id # at far right for easier visual parsing.
         */
        for (i = 0; i < num_events; i++) {
 -              ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 -              time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 +              ev = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
 +              time = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        trace_iwlwifi_dev_ucode_cont_event(priv,
                                                        0, time, ev);
                } else {
 -                      data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 +                      data = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
                        trace_iwlwifi_dev_ucode_cont_event(priv,
                                                time, data, ev);
                }
@@@ -515,7 -588,10 +515,7 @@@ static void iwl_continuous_event_trace(
        u32 num_wraps;  /* # times uCode wrapped to top of log */
        u32 next_entry; /* index of next entry to be written by uCode */
  
 -      if (priv->ucode_type == UCODE_INIT)
 -              base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
 -      else
 -              base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
 +      base = priv->device_pointers.error_event_table;
        if (priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                capacity = iwl_read_targ_mem(priv, base);
                num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
@@@ -644,10 -720,7 +644,10 @@@ static void iwl_rx_handle(struct iwl_pr
                /* If an RXB doesn't have a Rx queue slot associated with it,
                 * then a bug has been introduced in the queue refilling
                 * routines -- catch it here */
 -              BUG_ON(rxb == NULL);
 +              if (WARN_ON(rxb == NULL)) {
 +                      i = (i + 1) & RX_QUEUE_MASK;
 +                      continue;
 +              }
  
                rxq->queue[i] = NULL;
  
                                if (w->cmd == pkt->hdr.cmd) {
                                        w->triggered = true;
                                        if (w->fn)
 -                                              w->fn(priv, pkt);
 +                                              w->fn(priv, pkt, w->fn_data);
                                }
                        }
                        spin_unlock(&priv->_agn.notif_wait_lock);
  
                        wake_up_all(&priv->_agn.notif_waitq);
                }
 +              if (priv->pre_rx_handler)
 +                      priv->pre_rx_handler(priv, rxb);
  
                /* Based on type of command response or notification,
                 *   handle those that need handling via function in
                iwlagn_rx_queue_restock(priv);
  }
  
 -/* call this function to flush any scheduled tasklet */
 -static inline void iwl_synchronize_irq(struct iwl_priv *priv)
 -{
 -      /* wait to make sure we flush pending tasklet*/
 -      synchronize_irq(priv->pci_dev->irq);
 -      tasklet_kill(&priv->irq_tasklet);
 -}
 -
 -static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
 -{
 -      u32 inta, handled = 0;
 -      u32 inta_fh;
 -      unsigned long flags;
 -      u32 i;
 -#ifdef CONFIG_IWLWIFI_DEBUG
 -      u32 inta_mask;
 -#endif
 -
 -      spin_lock_irqsave(&priv->lock, flags);
 -
 -      /* Ack/clear/reset pending uCode interrupts.
 -       * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
 -       *  and will clear only when CSR_FH_INT_STATUS gets cleared. */
 -      inta = iwl_read32(priv, CSR_INT);
 -      iwl_write32(priv, CSR_INT, inta);
 -
 -      /* Ack/clear/reset pending flow-handler (DMA) interrupts.
 -       * Any new interrupts that happen after this, either while we're
 -       * in this tasklet, or later, will show up in next ISR/tasklet. */
 -      inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
 -      iwl_write32(priv, CSR_FH_INT_STATUS, inta_fh);
 -
 -#ifdef CONFIG_IWLWIFI_DEBUG
 -      if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
 -              /* just for debug */
 -              inta_mask = iwl_read32(priv, CSR_INT_MASK);
 -              IWL_DEBUG_ISR(priv, "inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
 -                            inta, inta_mask, inta_fh);
 -      }
 -#endif
 -
 -      spin_unlock_irqrestore(&priv->lock, flags);
 -
 -      /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
 -       * atomic, make sure that inta covers all the interrupts that
 -       * we've discovered, even if FH interrupt came in just after
 -       * reading CSR_INT. */
 -      if (inta_fh & CSR49_FH_INT_RX_MASK)
 -              inta |= CSR_INT_BIT_FH_RX;
 -      if (inta_fh & CSR49_FH_INT_TX_MASK)
 -              inta |= CSR_INT_BIT_FH_TX;
 -
 -      /* Now service all interrupt bits discovered above. */
 -      if (inta & CSR_INT_BIT_HW_ERR) {
 -              IWL_ERR(priv, "Hardware error detected.  Restarting.\n");
 -
 -              /* Tell the device to stop sending interrupts */
 -              iwl_disable_interrupts(priv);
 -
 -              priv->isr_stats.hw++;
 -              iwl_irq_handle_error(priv);
 -
 -              handled |= CSR_INT_BIT_HW_ERR;
 -
 -              return;
 -      }
 -
 -#ifdef CONFIG_IWLWIFI_DEBUG
 -      if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
 -              /* NIC fires this, but we don't use it, redundant with WAKEUP */
 -              if (inta & CSR_INT_BIT_SCD) {
 -                      IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
 -                                    "the frame/frames.\n");
 -                      priv->isr_stats.sch++;
 -              }
 -
 -              /* Alive notification via Rx interrupt will do the real work */
 -              if (inta & CSR_INT_BIT_ALIVE) {
 -                      IWL_DEBUG_ISR(priv, "Alive interrupt\n");
 -                      priv->isr_stats.alive++;
 -              }
 -      }
 -#endif
 -      /* Safely ignore these bits for debug checks below */
 -      inta &= ~(CSR_INT_BIT_SCD | CSR_INT_BIT_ALIVE);
 -
 -      /* HW RF KILL switch toggled */
 -      if (inta & CSR_INT_BIT_RF_KILL) {
 -              int hw_rf_kill = 0;
 -              if (!(iwl_read32(priv, CSR_GP_CNTRL) &
 -                              CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW))
 -                      hw_rf_kill = 1;
 -
 -              IWL_WARN(priv, "RF_KILL bit toggled to %s.\n",
 -                              hw_rf_kill ? "disable radio" : "enable radio");
 -
 -              priv->isr_stats.rfkill++;
 -
 -              /* driver only loads ucode once setting the interface up.
 -               * the driver allows loading the ucode even if the radio
 -               * is killed. Hence update the killswitch state here. The
 -               * rfkill handler will care about restarting if needed.
 -               */
 -              if (!test_bit(STATUS_ALIVE, &priv->status)) {
 -                      if (hw_rf_kill)
 -                              set_bit(STATUS_RF_KILL_HW, &priv->status);
 -                      else
 -                              clear_bit(STATUS_RF_KILL_HW, &priv->status);
 -                      wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill);
 -              }
 -
 -              handled |= CSR_INT_BIT_RF_KILL;
 -      }
 -
 -      /* Chip got too hot and stopped itself */
 -      if (inta & CSR_INT_BIT_CT_KILL) {
 -              IWL_ERR(priv, "Microcode CT kill error detected.\n");
 -              priv->isr_stats.ctkill++;
 -              handled |= CSR_INT_BIT_CT_KILL;
 -      }
 -
 -      /* Error detected by uCode */
 -      if (inta & CSR_INT_BIT_SW_ERR) {
 -              IWL_ERR(priv, "Microcode SW error detected. "
 -                      " Restarting 0x%X.\n", inta);
 -              priv->isr_stats.sw++;
 -              iwl_irq_handle_error(priv);
 -              handled |= CSR_INT_BIT_SW_ERR;
 -      }
 -
 -      /*
 -       * uCode wakes up after power-down sleep.
 -       * Tell device about any new tx or host commands enqueued,
 -       * and about any Rx buffers made available while asleep.
 -       */
 -      if (inta & CSR_INT_BIT_WAKEUP) {
 -              IWL_DEBUG_ISR(priv, "Wakeup interrupt\n");
 -              iwl_rx_queue_update_write_ptr(priv, &priv->rxq);
 -              for (i = 0; i < priv->hw_params.max_txq_num; i++)
 -                      iwl_txq_update_write_ptr(priv, &priv->txq[i]);
 -              priv->isr_stats.wakeup++;
 -              handled |= CSR_INT_BIT_WAKEUP;
 -      }
 -
 -      /* All uCode command responses, including Tx command responses,
 -       * Rx "responses" (frame-received notification), and other
 -       * notifications from uCode come through here*/
 -      if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
 -              iwl_rx_handle(priv);
 -              priv->isr_stats.rx++;
 -              handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
 -      }
 -
 -      /* This "Tx" DMA channel is used only for loading uCode */
 -      if (inta & CSR_INT_BIT_FH_TX) {
 -              IWL_DEBUG_ISR(priv, "uCode load interrupt\n");
 -              priv->isr_stats.tx++;
 -              handled |= CSR_INT_BIT_FH_TX;
 -              /* Wake up uCode load routine, now that load is complete */
 -              priv->ucode_write_complete = 1;
 -              wake_up_interruptible(&priv->wait_command_queue);
 -      }
 -
 -      if (inta & ~handled) {
 -              IWL_ERR(priv, "Unhandled INTA bits 0x%08x\n", inta & ~handled);
 -              priv->isr_stats.unhandled++;
 -      }
 -
 -      if (inta & ~(priv->inta_mask)) {
 -              IWL_WARN(priv, "Disabled INTA bits 0x%08x were pending\n",
 -                       inta & ~priv->inta_mask);
 -              IWL_WARN(priv, "   with FH_INT = 0x%08x\n", inta_fh);
 -      }
 -
 -      /* Re-enable all interrupts */
 -      /* only Re-enable if disabled by irq */
 -      if (test_bit(STATUS_INT_ENABLED, &priv->status))
 -              iwl_enable_interrupts(priv);
 -      /* Re-enable RF_KILL if it occurred */
 -      else if (handled & CSR_INT_BIT_RF_KILL)
 -              iwl_enable_rfkill_int(priv);
 -
 -#ifdef CONFIG_IWLWIFI_DEBUG
 -      if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
 -              inta = iwl_read32(priv, CSR_INT);
 -              inta_mask = iwl_read32(priv, CSR_INT_MASK);
 -              inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
 -              IWL_DEBUG_ISR(priv, "End inta 0x%08x, enabled 0x%08x, fh 0x%08x, "
 -                      "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
 -      }
 -#endif
 -}
 -
  /* tasklet for iwlagn interrupt */
  static void iwl_irq_tasklet(struct iwl_priv *priv)
  {
                if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                        handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
                        iwl_write32(priv, CSR_FH_INT_STATUS,
 -                                      CSR49_FH_INT_RX_MASK);
 +                                      CSR_FH_INT_RX_MASK);
                }
                if (inta & CSR_INT_BIT_RX_PERIODIC) {
                        handled |= CSR_INT_BIT_RX_PERIODIC;
  
        /* This "Tx" DMA channel is used only for loading uCode */
        if (inta & CSR_INT_BIT_FH_TX) {
 -              iwl_write32(priv, CSR_FH_INT_STATUS, CSR49_FH_INT_TX_MASK);
 +              iwl_write32(priv, CSR_FH_INT_STATUS, CSR_FH_INT_TX_MASK);
                IWL_DEBUG_ISR(priv, "uCode load interrupt\n");
                priv->isr_stats.tx++;
                handled |= CSR_INT_BIT_FH_TX;
@@@ -1093,48 -1357,26 +1093,48 @@@ static struct attribute_group iwl_attri
   *
   ******************************************************************************/
  
 -static void iwl_dealloc_ucode_pci(struct iwl_priv *priv)
 +static void iwl_free_fw_desc(struct pci_dev *pci_dev, struct fw_desc *desc)
 +{
 +      if (desc->v_addr)
 +              dma_free_coherent(&pci_dev->dev, desc->len,
 +                                desc->v_addr, desc->p_addr);
 +      desc->v_addr = NULL;
 +      desc->len = 0;
 +}
 +
 +static void iwl_free_fw_img(struct pci_dev *pci_dev, struct fw_img *img)
 +{
 +      iwl_free_fw_desc(pci_dev, &img->code);
 +      iwl_free_fw_desc(pci_dev, &img->data);
 +}
 +
 +static int iwl_alloc_fw_desc(struct pci_dev *pci_dev, struct fw_desc *desc,
 +                           const void *data, size_t len)
  {
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_code);
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_data);
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_init);
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_init_data);
 -      iwl_free_fw_desc(priv->pci_dev, &priv->ucode_boot);
 +      if (!len) {
 +              desc->v_addr = NULL;
 +              return -EINVAL;
 +      }
 +
 +      desc->v_addr = dma_alloc_coherent(&pci_dev->dev, len,
 +                                        &desc->p_addr, GFP_KERNEL);
 +      if (!desc->v_addr)
 +              return -ENOMEM;
 +      desc->len = len;
 +      memcpy(desc->v_addr, data, len);
 +      return 0;
  }
  
 -static void iwl_nic_start(struct iwl_priv *priv)
 +static void iwl_dealloc_ucode_pci(struct iwl_priv *priv)
  {
 -      /* Remove all resets to allow NIC to operate */
 -      iwl_write32(priv, CSR_RESET, 0);
 +      iwl_free_fw_img(priv->pci_dev, &priv->ucode_rt);
 +      iwl_free_fw_img(priv->pci_dev, &priv->ucode_init);
  }
  
  struct iwlagn_ucode_capabilities {
        u32 max_probe_length;
        u32 standard_phy_calibration_size;
 -      bool pan;
 +      u32 flags;
  };
  
  static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
@@@ -1180,8 -1422,8 +1180,8 @@@ static int __must_check iwl_request_fir
  }
  
  struct iwlagn_firmware_pieces {
 -      const void *inst, *data, *init, *init_data, *boot;
 -      size_t inst_size, data_size, init_size, init_data_size, boot_size;
 +      const void *inst, *data, *init, *init_data;
 +      size_t inst_size, data_size, init_size, init_data_size;
  
        u32 build;
  
@@@ -1202,18 -1444,28 +1202,18 @@@ static int iwlagn_load_legacy_firmware(
  
        switch (api_ver) {
        default:
 -              /*
 -               * 4965 doesn't revision the firmware file format
 -               * along with the API version, it always uses v1
 -               * file format.
 -               */
 -              if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) !=
 -                              CSR_HW_REV_TYPE_4965) {
 -                      hdr_size = 28;
 -                      if (ucode_raw->size < hdr_size) {
 -                              IWL_ERR(priv, "File size too small!\n");
 -                              return -EINVAL;
 -                      }
 -                      pieces->build = le32_to_cpu(ucode->u.v2.build);
 -                      pieces->inst_size = le32_to_cpu(ucode->u.v2.inst_size);
 -                      pieces->data_size = le32_to_cpu(ucode->u.v2.data_size);
 -                      pieces->init_size = le32_to_cpu(ucode->u.v2.init_size);
 -                      pieces->init_data_size = le32_to_cpu(ucode->u.v2.init_data_size);
 -                      pieces->boot_size = le32_to_cpu(ucode->u.v2.boot_size);
 -                      src = ucode->u.v2.data;
 -                      break;
 +              hdr_size = 28;
 +              if (ucode_raw->size < hdr_size) {
 +                      IWL_ERR(priv, "File size too small!\n");
 +                      return -EINVAL;
                }
 -              /* fall through for 4965 */
 +              pieces->build = le32_to_cpu(ucode->u.v2.build);
 +              pieces->inst_size = le32_to_cpu(ucode->u.v2.inst_size);
 +              pieces->data_size = le32_to_cpu(ucode->u.v2.data_size);
 +              pieces->init_size = le32_to_cpu(ucode->u.v2.init_size);
 +              pieces->init_data_size = le32_to_cpu(ucode->u.v2.init_data_size);
 +              src = ucode->u.v2.data;
 +              break;
        case 0:
        case 1:
        case 2:
                pieces->data_size = le32_to_cpu(ucode->u.v1.data_size);
                pieces->init_size = le32_to_cpu(ucode->u.v1.init_size);
                pieces->init_data_size = le32_to_cpu(ucode->u.v1.init_data_size);
 -              pieces->boot_size = le32_to_cpu(ucode->u.v1.boot_size);
                src = ucode->u.v1.data;
                break;
        }
        /* Verify size of file vs. image size info in file's header */
        if (ucode_raw->size != hdr_size + pieces->inst_size +
                                pieces->data_size + pieces->init_size +
 -                              pieces->init_data_size + pieces->boot_size) {
 +                              pieces->init_data_size) {
  
                IWL_ERR(priv,
                        "uCode file size %d does not match expected size\n",
        src += pieces->init_size;
        pieces->init_data = src;
        src += pieces->init_data_size;
 -      pieces->boot = src;
 -      src += pieces->boot_size;
  
        return 0;
  }
@@@ -1350,7 -1605,8 +1350,7 @@@ static int iwlagn_load_firmware(struct 
                        pieces->init_data_size = tlv_len;
                        break;
                case IWL_UCODE_TLV_BOOT:
 -                      pieces->boot = tlv_data;
 -                      pieces->boot_size = tlv_len;
 +                      IWL_ERR(priv, "Found unexpected BOOT ucode\n");
                        break;
                case IWL_UCODE_TLV_PROBE_MAX_LEN:
                        if (tlv_len != sizeof(u32))
                case IWL_UCODE_TLV_PAN:
                        if (tlv_len)
                                goto invalid_tlv_len;
 -                      capa->pan = true;
 +                      capa->flags |= IWL_UCODE_TLV_FLAGS_PAN;
 +                      break;
 +              case IWL_UCODE_TLV_FLAGS:
 +                      /* must be at least one u32 */
 +                      if (tlv_len < sizeof(u32))
 +                              goto invalid_tlv_len;
 +                      /* and a proper number of u32s */
 +                      if (tlv_len % sizeof(u32))
 +                              goto invalid_tlv_len;
 +                      /*
 +                       * This driver only reads the first u32 as
 +                       * right now no more features are defined,
 +                       * if that changes then either the driver
 +                       * will not work with the new firmware, or
 +                       * it'll not take advantage of new features.
 +                       */
 +                      capa->flags = le32_to_cpup((__le32 *)tlv_data);
                        break;
                case IWL_UCODE_TLV_INIT_EVTLOG_PTR:
                        if (tlv_len != sizeof(u32))
                                        le32_to_cpup((__le32 *)tlv_data);
                        break;
                default:
 -                      IWL_WARN(priv, "unknown TLV: %d\n", tlv_type);
 +                      IWL_DEBUG_INFO(priv, "unknown TLV: %d\n", tlv_type);
                        break;
                }
        }
@@@ -1566,6 -1806,8 +1566,6 @@@ static void iwl_ucode_callback(const st
                       pieces.init_size);
        IWL_DEBUG_INFO(priv, "f/w package hdr init data size = %Zd\n",
                       pieces.init_data_size);
 -      IWL_DEBUG_INFO(priv, "f/w package hdr boot inst size = %Zd\n",
 -                     pieces.boot_size);
  
        /* Verify that uCode images will fit in card's SRAM */
        if (pieces.inst_size > priv->hw_params.max_inst_size) {
                goto try_again;
        }
  
 -      if (pieces.boot_size > priv->hw_params.max_bsm_size) {
 -              IWL_ERR(priv, "uCode boot instr len %Zd too large to fit in\n",
 -                      pieces.boot_size);
 -              goto try_again;
 -      }
 -
        /* Allocate ucode buffers for card's bus-master loading ... */
  
        /* Runtime instructions and 2 copies of data:
         * 1) unmodified from disk
         * 2) backup cache for save/restore during power-downs */
 -      priv->ucode_code.len = pieces.inst_size;
 -      iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_code);
 -
 -      priv->ucode_data.len = pieces.data_size;
 -      iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data);
 -
 -      priv->ucode_data_backup.len = pieces.data_size;
 -      iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
 -
 -      if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
 -          !priv->ucode_data_backup.v_addr)
 +      if (iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_rt.code,
 +                            pieces.inst, pieces.inst_size))
 +              goto err_pci_alloc;
 +      if (iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_rt.data,
 +                            pieces.data, pieces.data_size))
                goto err_pci_alloc;
  
        /* Initialization instructions and data */
        if (pieces.init_size && pieces.init_data_size) {
 -              priv->ucode_init.len = pieces.init_size;
 -              iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init);
 -
 -              priv->ucode_init_data.len = pieces.init_data_size;
 -              iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init_data);
 -
 -              if (!priv->ucode_init.v_addr || !priv->ucode_init_data.v_addr)
 +              if (iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init.code,
 +                                    pieces.init, pieces.init_size))
                        goto err_pci_alloc;
 -      }
 -
 -      /* Bootstrap (instructions only, no data) */
 -      if (pieces.boot_size) {
 -              priv->ucode_boot.len = pieces.boot_size;
 -              iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_boot);
 -
 -              if (!priv->ucode_boot.v_addr)
 +              if (iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init.data,
 +                                    pieces.init_data, pieces.init_data_size))
                        goto err_pci_alloc;
        }
  
                        priv->cfg->base_params->max_event_log_size;
        priv->_agn.inst_errlog_ptr = pieces.inst_errlog_ptr;
  
 -      if (ucode_capa.pan) {
 +      priv->new_scan_threshold_behaviour =
 +              !!(ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWSCAN);
 +
 +      if (ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PAN) {
                priv->valid_contexts |= BIT(IWL_RXON_CTX_PAN);
                priv->sta_key_max_num = STA_KEY_MAX_NUM_PAN;
        } else
                priv->sta_key_max_num = STA_KEY_MAX_NUM;
  
 -      /* Copy images into buffers for card's bus-master reads ... */
 -
 -      /* Runtime instructions (first block of data in file) */
 -      IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode instr len %Zd\n",
 -                      pieces.inst_size);
 -      memcpy(priv->ucode_code.v_addr, pieces.inst, pieces.inst_size);
 -
 -      IWL_DEBUG_INFO(priv, "uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
 -              priv->ucode_code.v_addr, (u32)priv->ucode_code.p_addr);
 -
 -      /*
 -       * Runtime data
 -       * NOTE:  Copy into backup buffer will be done in iwl_up()
 -       */
 -      IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode data len %Zd\n",
 -                      pieces.data_size);
 -      memcpy(priv->ucode_data.v_addr, pieces.data, pieces.data_size);
 -      memcpy(priv->ucode_data_backup.v_addr, pieces.data, pieces.data_size);
 -
 -      /* Initialization instructions */
 -      if (pieces.init_size) {
 -              IWL_DEBUG_INFO(priv, "Copying (but not loading) init instr len %Zd\n",
 -                              pieces.init_size);
 -              memcpy(priv->ucode_init.v_addr, pieces.init, pieces.init_size);
 -      }
 -
 -      /* Initialization data */
 -      if (pieces.init_data_size) {
 -              IWL_DEBUG_INFO(priv, "Copying (but not loading) init data len %Zd\n",
 -                             pieces.init_data_size);
 -              memcpy(priv->ucode_init_data.v_addr, pieces.init_data,
 -                     pieces.init_data_size);
 -      }
 -
 -      /* Bootstrap instructions */
 -      IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n",
 -                      pieces.boot_size);
 -      memcpy(priv->ucode_boot.v_addr, pieces.boot, pieces.boot_size);
 +      if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
 +              priv->cmd_queue = IWL_IPAN_CMD_QUEUE_NUM;
 +      else
 +              priv->cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
  
        /*
         * figure out the offset of chain noise reset and gain commands
@@@ -1766,7 -2062,7 +1766,7 @@@ static const char *desc_lookup(u32 num
        max = ARRAY_SIZE(advanced_lookup) - 1;
        for (i = 0; i < max; i++) {
                if (advanced_lookup[i].num == num)
-                       break;;
+                       break;
        }
        return advanced_lookup[i].name;
  }
@@@ -1780,13 -2076,13 +1780,13 @@@ void iwl_dump_nic_error_log(struct iwl_
        u32 desc, time, count, base, data1;
        u32 blink1, blink2, ilink1, ilink2;
        u32 pc, hcmd;
 +      struct iwl_error_event_table table;
  
 -      if (priv->ucode_type == UCODE_INIT) {
 -              base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
 +      base = priv->device_pointers.error_event_table;
 +      if (priv->ucode_type == UCODE_SUBTYPE_INIT) {
                if (!base)
                        base = priv->_agn.init_errlog_ptr;
        } else {
 -              base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
                if (!base)
                        base = priv->_agn.inst_errlog_ptr;
        }
        if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                IWL_ERR(priv,
                        "Not valid error log pointer 0x%08X for %s uCode\n",
 -                      base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
 +                      base,
 +                      (priv->ucode_type == UCODE_SUBTYPE_INIT)
 +                                      ? "Init" : "RT");
                return;
        }
  
 -      count = iwl_read_targ_mem(priv, base);
 +      iwl_read_targ_mem_words(priv, base, &table, sizeof(table));
 +
 +      count = table.valid;
  
        if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
                IWL_ERR(priv, "Start IWL Error Log Dump:\n");
                        priv->status, count);
        }
  
 -      desc = iwl_read_targ_mem(priv, base + 1 * sizeof(u32));
 +      desc = table.error_id;
        priv->isr_stats.err_code = desc;
 -      pc = iwl_read_targ_mem(priv, base + 2 * sizeof(u32));
 -      blink1 = iwl_read_targ_mem(priv, base + 3 * sizeof(u32));
 -      blink2 = iwl_read_targ_mem(priv, base + 4 * sizeof(u32));
 -      ilink1 = iwl_read_targ_mem(priv, base + 5 * sizeof(u32));
 -      ilink2 = iwl_read_targ_mem(priv, base + 6 * sizeof(u32));
 -      data1 = iwl_read_targ_mem(priv, base + 7 * sizeof(u32));
 -      data2 = iwl_read_targ_mem(priv, base + 8 * sizeof(u32));
 -      line = iwl_read_targ_mem(priv, base + 9 * sizeof(u32));
 -      time = iwl_read_targ_mem(priv, base + 11 * sizeof(u32));
 -      hcmd = iwl_read_targ_mem(priv, base + 22 * sizeof(u32));
 +      pc = table.pc;
 +      blink1 = table.blink1;
 +      blink2 = table.blink2;
 +      ilink1 = table.ilink1;
 +      ilink2 = table.ilink2;
 +      data1 = table.data1;
 +      data2 = table.data2;
 +      line = table.line;
 +      time = table.tsf_low;
 +      hcmd = table.hcmd;
  
        trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, data2, line,
                                      blink1, blink2, ilink1, ilink2);
@@@ -1855,11 -2147,12 +1855,11 @@@ static int iwl_print_event_log(struct i
        if (num_events == 0)
                return pos;
  
 -      if (priv->ucode_type == UCODE_INIT) {
 -              base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
 +      base = priv->device_pointers.log_event_table;
 +      if (priv->ucode_type == UCODE_SUBTYPE_INIT) {
                if (!base)
                        base = priv->_agn.init_evtlog_ptr;
        } else {
 -              base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
                if (!base)
                        base = priv->_agn.inst_evtlog_ptr;
        }
        iwl_grab_nic_access(priv);
  
        /* Set starting address; reads will auto-increment */
 -      _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
 +      iwl_write32(priv, HBUS_TARG_MEM_RADDR, ptr);
        rmb();
  
        /* "time" is actually "data" for mode 0 (no timestamp).
        * place event id # at far right for easier visual parsing. */
        for (i = 0; i < num_events; i++) {
 -              ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 -              time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 +              ev = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
 +              time = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        /* data, ev */
                        if (bufsz) {
                                        time, ev);
                        }
                } else {
 -                      data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
 +                      data = iwl_read32(priv, HBUS_TARG_MEM_RDAT);
                        if (bufsz) {
                                pos += scnprintf(*buf + pos, bufsz - pos,
                                                "EVT_LOGT:%010u:0x%08x:%04u\n",
@@@ -1968,12 -2261,13 +1968,12 @@@ int iwl_dump_nic_event_log(struct iwl_p
        int pos = 0;
        size_t bufsz = 0;
  
 -      if (priv->ucode_type == UCODE_INIT) {
 -              base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
 +      base = priv->device_pointers.log_event_table;
 +      if (priv->ucode_type == UCODE_SUBTYPE_INIT) {
                logsize = priv->_agn.init_evtlog_size;
                if (!base)
                        base = priv->_agn.init_evtlog_ptr;
        } else {
 -              base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
                logsize = priv->_agn.inst_evtlog_size;
                if (!base)
                        base = priv->_agn.inst_evtlog_ptr;
        if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                IWL_ERR(priv,
                        "Invalid event log pointer 0x%08X for %s uCode\n",
 -                      base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
 +                      base,
 +                      (priv->ucode_type == UCODE_SUBTYPE_INIT)
 +                                      ? "Init" : "RT");
                return -EINVAL;
        }
  
@@@ -2131,14 -2423,30 +2131,14 @@@ static int iwlagn_send_calib_cfg_rt(str
   *                   from protocol/runtime uCode (initialization uCode's
   *                   Alive gets handled by iwl_init_alive_start()).
   */
 -static void iwl_alive_start(struct iwl_priv *priv)
 +int iwl_alive_start(struct iwl_priv *priv)
  {
        int ret = 0;
        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
  
 -      IWL_DEBUG_INFO(priv, "Runtime Alive received.\n");
 -
 -      /* Initialize uCode has loaded Runtime uCode ... verify inst image.
 -       * This is a paranoid check, because we would not have gotten the
 -       * "runtime" alive if code weren't properly loaded.  */
 -      if (iwl_verify_ucode(priv)) {
 -              /* Runtime instruction load was bad;
 -               * take it all the way back down so we can try again */
 -              IWL_DEBUG_INFO(priv, "Bad runtime uCode load.\n");
 -              goto restart;
 -      }
 -
 -      ret = priv->cfg->ops->lib->alive_notify(priv);
 -      if (ret) {
 -              IWL_WARN(priv,
 -                      "Could not complete ALIVE transition [ntf]: %d\n", ret);
 -              goto restart;
 -      }
 +      iwl_reset_ict(priv);
  
 +      IWL_DEBUG_INFO(priv, "Runtime Alive received.\n");
  
        /* After the ALIVE response, we can send host commands to the uCode */
        set_bit(STATUS_ALIVE, &priv->status);
        iwl_setup_watchdog(priv);
  
        if (iwl_is_rfkill(priv))
 -              return;
 +              return -ERFKILL;
  
        /* download priority table before any calibration request */
        if (priv->cfg->bt_params &&
                iwlagn_send_prio_tbl(priv);
  
                /* FIXME: w/a to force change uCode BT state machine */
 -              iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
 -                      BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
 -              iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
 -                      BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
 +              ret = iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
 +                                       BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
 +              if (ret)
 +                      return ret;
 +              ret = iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
 +                                       BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
 +              if (ret)
 +                      return ret;
        }
        if (priv->hw_params.calib_rt_cfg)
                iwlagn_send_calib_cfg_rt(priv, priv->hw_params.calib_rt_cfg);
        set_bit(STATUS_READY, &priv->status);
  
        /* Configure the adapter for unassociated operation */
 -      iwlcore_commit_rxon(priv, ctx);
 +      ret = iwlcore_commit_rxon(priv, ctx);
 +      if (ret)
 +              return ret;
  
        /* At this point, the NIC is initialized and operational */
        iwl_rf_kill_ct_config(priv);
  
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
 -      wake_up_interruptible(&priv->wait_command_queue);
 -
 -      iwl_power_update_mode(priv, true);
 -      IWL_DEBUG_INFO(priv, "Updated power mode\n");
  
 -
 -      return;
 -
 - restart:
 -      queue_work(priv->workqueue, &priv->restart);
 +      return iwl_power_update_mode(priv, true);
  }
  
  static void iwl_cancel_deferred_work(struct iwl_priv *priv);
  
  static void __iwl_down(struct iwl_priv *priv)
  {
 -      unsigned long flags;
 -      int exit_pending = test_bit(STATUS_EXIT_PENDING, &priv->status);
 +      int exit_pending;
  
        IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
  
        priv->bt_full_concurrent = false;
        priv->bt_ci_compliance = 0;
  
 -      /* Unblock any waiting calls */
 -      wake_up_interruptible_all(&priv->wait_command_queue);
 -
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
        if (!exit_pending)
                clear_bit(STATUS_EXIT_PENDING, &priv->status);
  
 -      /* stop and reset the on-board processor */
 -      iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 -
 -      /* tell the device to stop sending interrupts */
 -      spin_lock_irqsave(&priv->lock, flags);
 -      iwl_disable_interrupts(priv);
 -      spin_unlock_irqrestore(&priv->lock, flags);
 -      iwl_synchronize_irq(priv);
 -
        if (priv->mac80211_registered)
                ieee80211_stop_queues(priv->hw);
  
 -      /* If we have not previously called iwl_init() then
 -       * clear all bits but the RF Kill bit and return */
 -      if (!iwl_is_init(priv)) {
 -              priv->status = test_bit(STATUS_RF_KILL_HW, &priv->status) <<
 -                                      STATUS_RF_KILL_HW |
 -                             test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
 -                                      STATUS_GEO_CONFIGURED |
 -                             test_bit(STATUS_EXIT_PENDING, &priv->status) <<
 -                                      STATUS_EXIT_PENDING;
 -              goto exit;
 -      }
 -
 -      /* ...otherwise clear out all the status bits but the RF Kill
 -       * bit and continue taking the NIC down. */
 +      /* Clear out all status bits but a few that are stable across reset */
        priv->status &= test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                STATUS_RF_KILL_HW |
                        test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
                       test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                STATUS_EXIT_PENDING;
  
 -      /* device going down, Stop using ICT table */
 -      if (priv->cfg->ops->lib->isr_ops.disable)
 -              priv->cfg->ops->lib->isr_ops.disable(priv);
 -
 -      iwlagn_txq_ctx_stop(priv);
 -      iwlagn_rxq_stop(priv);
 -
 -      /* Power-down device's busmaster DMA clocks */
 -      iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
 -      udelay(5);
 -
 -      /* Make sure (redundant) we've released our request to stay awake */
 -      iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 -
 -      /* Stop the device, and put it in low power state */
 -      iwl_apm_stop(priv);
 -
 - exit:
 -      memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
 +      iwlagn_stop_device(priv);
  
        dev_kfree_skb(priv->beacon_skb);
        priv->beacon_skb = NULL;
 -
 -      /* clear out any free frames */
 -      iwl_clear_free_frames(priv);
  }
  
  static void iwl_down(struct iwl_priv *priv)
  
  #define HW_READY_TIMEOUT (50)
  
 +/* Note: returns poll_bit return value, which is >= 0 if success */
  static int iwl_set_hw_ready(struct iwl_priv *priv)
  {
 -      int ret = 0;
 +      int ret;
  
        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
                                HW_READY_TIMEOUT);
 -      if (ret != -ETIMEDOUT)
 -              priv->hw_ready = true;
 -      else
 -              priv->hw_ready = false;
  
 -      IWL_DEBUG_INFO(priv, "hardware %s\n",
 -                    (priv->hw_ready == 1) ? "ready" : "not ready");
 +      IWL_DEBUG_INFO(priv, "hardware%s ready\n", ret < 0 ? " not" : "");
        return ret;
  }
  
 -static int iwl_prepare_card_hw(struct iwl_priv *priv)
 +/* Note: returns standard 0/-ERROR code */
 +int iwl_prepare_card_hw(struct iwl_priv *priv)
  {
 -      int ret = 0;
 +      int ret;
  
        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter\n");
  
        ret = iwl_set_hw_ready(priv);
 -      if (priv->hw_ready)
 -              return ret;
 +      if (ret >= 0)
 +              return 0;
  
        /* If HW is not ready, prepare the conditions to check again */
        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
                        ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
                        CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
  
 -      /* HW should be ready by now, check again. */
 -      if (ret != -ETIMEDOUT)
 -              iwl_set_hw_ready(priv);
 +      if (ret < 0)
 +              return ret;
  
 +      /* HW should be ready by now, check again. */
 +      ret = iwl_set_hw_ready(priv);
 +      if (ret >= 0)
 +              return 0;
        return ret;
  }
  
  static int __iwl_up(struct iwl_priv *priv)
  {
        struct iwl_rxon_context *ctx;
 -      int i;
        int ret;
  
 +      lockdep_assert_held(&priv->mutex);
 +
        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
                IWL_WARN(priv, "Exit pending; will not bring the NIC up\n");
                return -EIO;
        }
  
 -      if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
 -              IWL_ERR(priv, "ucode not available for device bringup\n");
 -              return -EIO;
 -      }
 -
        for_each_context(priv, ctx) {
                ret = iwlagn_alloc_bcast_station(priv, ctx);
                if (ret) {
                }
        }
  
 -      iwl_prepare_card_hw(priv);
 -
 -      if (!priv->hw_ready) {
 -              IWL_WARN(priv, "Exit HW not ready\n");
 -              return -EIO;
 -      }
 -
 -      /* If platform's RF_KILL switch is NOT set to KILL */
 -      if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
 -              clear_bit(STATUS_RF_KILL_HW, &priv->status);
 -      else
 -              set_bit(STATUS_RF_KILL_HW, &priv->status);
 -
 -      if (iwl_is_rfkill(priv)) {
 -              wiphy_rfkill_set_hw_state(priv->hw->wiphy, true);
 -
 -              iwl_enable_interrupts(priv);
 -              IWL_WARN(priv, "Radio disabled by HW RF Kill switch\n");
 -              return 0;
 +      ret = iwlagn_run_init_ucode(priv);
 +      if (ret) {
 +              IWL_ERR(priv, "Failed to run INIT ucode: %d\n", ret);
 +              goto error;
        }
  
 -      iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 -
 -      /* must be initialised before iwl_hw_nic_init */
 -      if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
 -              priv->cmd_queue = IWL_IPAN_CMD_QUEUE_NUM;
 -      else
 -              priv->cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
 -
 -      ret = iwlagn_hw_nic_init(priv);
 +      ret = iwlagn_load_ucode_wait_alive(priv,
 +                                         &priv->ucode_rt,
 +                                         UCODE_SUBTYPE_REGULAR,
 +                                         UCODE_SUBTYPE_REGULAR_NEW);
        if (ret) {
 -              IWL_ERR(priv, "Unable to init nic\n");
 -              return ret;
 +              IWL_ERR(priv, "Failed to start RT ucode: %d\n", ret);
 +              goto error;
        }
  
 -      /* make sure rfkill handshake bits are cleared */
 -      iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
 -      iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
 -                  CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
 -
 -      /* clear (again), then enable host interrupts */
 -      iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 -      iwl_enable_interrupts(priv);
 -
 -      /* really make sure rfkill handshake bits are cleared */
 -      iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
 -      iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
 -
 -      /* Copy original ucode data image from disk into backup cache.
 -       * This will be used to initialize the on-board processor's
 -       * data SRAM for a clean start when the runtime program first loads. */
 -      memcpy(priv->ucode_data_backup.v_addr, priv->ucode_data.v_addr,
 -             priv->ucode_data.len);
 -
 -      for (i = 0; i < MAX_HW_RESTARTS; i++) {
 -
 -              /* load bootstrap state machine,
 -               * load bootstrap program into processor's memory,
 -               * prepare to load the "initialize" uCode */
 -              ret = priv->cfg->ops->lib->load_ucode(priv);
 -
 -              if (ret) {
 -                      IWL_ERR(priv, "Unable to set up bootstrap uCode: %d\n",
 -                              ret);
 -                      continue;
 -              }
 -
 -              /* start card; "initialize" will load runtime ucode */
 -              iwl_nic_start(priv);
 -
 -              IWL_DEBUG_INFO(priv, DRV_NAME " is coming up\n");
 -
 -              return 0;
 -      }
 +      ret = iwl_alive_start(priv);
 +      if (ret)
 +              goto error;
 +      return 0;
  
 + error:
        set_bit(STATUS_EXIT_PENDING, &priv->status);
        __iwl_down(priv);
        clear_bit(STATUS_EXIT_PENDING, &priv->status);
  
 -      /* tried to restart and config the device for as long as our
 -       * patience could withstand */
 -      IWL_ERR(priv, "Unable to initialize device after %d attempts.\n", i);
 -      return -EIO;
 +      IWL_ERR(priv, "Unable to initialize device.\n");
 +      return ret;
  }
  
  
   *
   *****************************************************************************/
  
 -static void iwl_bg_init_alive_start(struct work_struct *data)
 -{
 -      struct iwl_priv *priv =
 -          container_of(data, struct iwl_priv, init_alive_start.work);
 -
 -      if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 -              return;
 -
 -      mutex_lock(&priv->mutex);
 -      priv->cfg->ops->lib->init_alive_start(priv);
 -      mutex_unlock(&priv->mutex);
 -}
 -
 -static void iwl_bg_alive_start(struct work_struct *data)
 -{
 -      struct iwl_priv *priv =
 -          container_of(data, struct iwl_priv, alive_start.work);
 -
 -      if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 -              return;
 -
 -      /* enable dram interrupt */
 -      if (priv->cfg->ops->lib->isr_ops.reset)
 -              priv->cfg->ops->lib->isr_ops.reset(priv);
 -
 -      mutex_lock(&priv->mutex);
 -      iwl_alive_start(priv);
 -      mutex_unlock(&priv->mutex);
 -}
 -
  static void iwl_bg_run_time_calib_work(struct work_struct *work)
  {
        struct iwl_priv *priv = container_of(work, struct iwl_priv,
        }
  
        if (priv->start_calib) {
 -              if (iwl_bt_statistics(priv)) {
 -                      iwl_chain_noise_calibration(priv,
 -                                      (void *)&priv->_agn.statistics_bt);
 -                      iwl_sensitivity_calibration(priv,
 -                                      (void *)&priv->_agn.statistics_bt);
 -              } else {
 -                      iwl_chain_noise_calibration(priv,
 -                                      (void *)&priv->_agn.statistics);
 -                      iwl_sensitivity_calibration(priv,
 -                                      (void *)&priv->_agn.statistics);
 -              }
 +              iwl_chain_noise_calibration(priv);
 +              iwl_sensitivity_calibration(priv);
        }
  
        mutex_unlock(&priv->mutex);
  }
  
 +static void iwlagn_prepare_restart(struct iwl_priv *priv)
 +{
 +      struct iwl_rxon_context *ctx;
 +      bool bt_full_concurrent;
 +      u8 bt_ci_compliance;
 +      u8 bt_load;
 +      u8 bt_status;
 +
 +      lockdep_assert_held(&priv->mutex);
 +
 +      for_each_context(priv, ctx)
 +              ctx->vif = NULL;
 +      priv->is_open = 0;
 +
 +      /*
 +       * __iwl_down() will clear the BT status variables,
 +       * which is correct, but when we restart we really
 +       * want to keep them so restore them afterwards.
 +       *
 +       * The restart process will later pick them up and
 +       * re-configure the hw when we reconfigure the BT
 +       * command.
 +       */
 +      bt_full_concurrent = priv->bt_full_concurrent;
 +      bt_ci_compliance = priv->bt_ci_compliance;
 +      bt_load = priv->bt_traffic_load;
 +      bt_status = priv->bt_status;
 +
 +      __iwl_down(priv);
 +
 +      priv->bt_full_concurrent = bt_full_concurrent;
 +      priv->bt_ci_compliance = bt_ci_compliance;
 +      priv->bt_traffic_load = bt_load;
 +      priv->bt_status = bt_status;
 +}
 +
  static void iwl_bg_restart(struct work_struct *data)
  {
        struct iwl_priv *priv = container_of(data, struct iwl_priv, restart);
                return;
  
        if (test_and_clear_bit(STATUS_FW_ERROR, &priv->status)) {
 -              struct iwl_rxon_context *ctx;
 -              bool bt_full_concurrent;
 -              u8 bt_ci_compliance;
 -              u8 bt_load;
 -              u8 bt_status;
 -
                mutex_lock(&priv->mutex);
 -              for_each_context(priv, ctx)
 -                      ctx->vif = NULL;
 -              priv->is_open = 0;
 -
 -              /*
 -               * __iwl_down() will clear the BT status variables,
 -               * which is correct, but when we restart we really
 -               * want to keep them so restore them afterwards.
 -               *
 -               * The restart process will later pick them up and
 -               * re-configure the hw when we reconfigure the BT
 -               * command.
 -               */
 -              bt_full_concurrent = priv->bt_full_concurrent;
 -              bt_ci_compliance = priv->bt_ci_compliance;
 -              bt_load = priv->bt_traffic_load;
 -              bt_status = priv->bt_status;
 -
 -              __iwl_down(priv);
 -
 -              priv->bt_full_concurrent = bt_full_concurrent;
 -              priv->bt_ci_compliance = bt_ci_compliance;
 -              priv->bt_traffic_load = bt_load;
 -              priv->bt_status = bt_status;
 -
 +              iwlagn_prepare_restart(priv);
                mutex_unlock(&priv->mutex);
                iwl_cancel_deferred_work(priv);
                ieee80211_restart_hw(priv->hw);
        } else {
 -              iwl_down(priv);
 -
 -              if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 -                      return;
 -
 -              mutex_lock(&priv->mutex);
 -              __iwl_up(priv);
 -              mutex_unlock(&priv->mutex);
 +              WARN_ON(1);
        }
  }
  
@@@ -2574,6 -3031,8 +2574,6 @@@ unlock
   *
   *****************************************************************************/
  
 -#define UCODE_READY_TIMEOUT   (4 * HZ)
 -
  /*
   * Not a mac80211 entry point function, but it fits in with all the
   * other mac80211 functions grouped here.
@@@ -2596,16 -3055,14 +2596,16 @@@ static int iwl_mac_setup_register(struc
  
        hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
  
 -      if (!priv->cfg->base_params->broken_powersave)
 -              hw->flags |= IEEE80211_HW_SUPPORTS_PS |
 -                           IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 +      hw->flags |= IEEE80211_HW_SUPPORTS_PS |
 +                   IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
  
        if (priv->cfg->sku & IWL_SKU_N)
                hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
                             IEEE80211_HW_SUPPORTS_STATIC_SMPS;
  
 +      if (capa->flags & IWL_UCODE_TLV_FLAGS_MFP)
 +              hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 +
        hw->sta_data_size = sizeof(struct iwl_station_priv);
        hw->vif_data_size = sizeof(struct iwl_vif_priv);
  
  }
  
  
 -int iwlagn_mac_start(struct ieee80211_hw *hw)
 +static int iwlagn_mac_start(struct ieee80211_hw *hw)
  {
        struct iwl_priv *priv = hw->priv;
        int ret;
        mutex_lock(&priv->mutex);
        ret = __iwl_up(priv);
        mutex_unlock(&priv->mutex);
 -
        if (ret)
                return ret;
  
 -      if (iwl_is_rfkill(priv))
 -              goto out;
 -
        IWL_DEBUG_INFO(priv, "Start UP work done.\n");
  
 -      /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
 -       * mac80211 will not be run successfully. */
 -      ret = wait_event_interruptible_timeout(priv->wait_command_queue,
 -                      test_bit(STATUS_READY, &priv->status),
 -                      UCODE_READY_TIMEOUT);
 -      if (!ret) {
 -              if (!test_bit(STATUS_READY, &priv->status)) {
 -                      IWL_ERR(priv, "START_ALIVE timeout after %dms.\n",
 -                              jiffies_to_msecs(UCODE_READY_TIMEOUT));
 -                      return -ETIMEDOUT;
 -              }
 -      }
 +      /* Now we should be done, and the READY bit should be set. */
 +      if (WARN_ON(!test_bit(STATUS_READY, &priv->status)))
 +              ret = -EIO;
  
        iwlagn_led_enable(priv);
  
 -out:
        priv->is_open = 1;
        IWL_DEBUG_MAC80211(priv, "leave\n");
        return 0;
  }
  
 -void iwlagn_mac_stop(struct ieee80211_hw *hw)
 +static void iwlagn_mac_stop(struct ieee80211_hw *hw)
  {
        struct iwl_priv *priv = hw->priv;
  
        IWL_DEBUG_MAC80211(priv, "leave\n");
  }
  
 -void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 +static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
  {
        struct iwl_priv *priv = hw->priv;
  
        IWL_DEBUG_MACDUMP(priv, "leave\n");
  }
  
 -void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
 -                              struct ieee80211_vif *vif,
 -                              struct ieee80211_key_conf *keyconf,
 -                              struct ieee80211_sta *sta,
 -                              u32 iv32, u16 *phase1key)
 +static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
 +                                     struct ieee80211_vif *vif,
 +                                     struct ieee80211_key_conf *keyconf,
 +                                     struct ieee80211_sta *sta,
 +                                     u32 iv32, u16 *phase1key)
  {
        struct iwl_priv *priv = hw->priv;
        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
        IWL_DEBUG_MAC80211(priv, "leave\n");
  }
  
 -int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 -                     struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 -                     struct ieee80211_key_conf *key)
 +static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 +                            struct ieee80211_vif *vif,
 +                            struct ieee80211_sta *sta,
 +                            struct ieee80211_key_conf *key)
  {
        struct iwl_priv *priv = hw->priv;
        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
  
        IWL_DEBUG_MAC80211(priv, "enter\n");
  
 -      if (priv->cfg->mod_params->sw_crypto) {
 +      if (iwlagn_mod_params.sw_crypto) {
                IWL_DEBUG_MAC80211(priv, "leave - hwcrypto disabled\n");
                return -EOPNOTSUPP;
        }
        return ret;
  }
  
 -int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
 -                          struct ieee80211_vif *vif,
 -                          enum ieee80211_ampdu_mlme_action action,
 -                          struct ieee80211_sta *sta, u16 tid, u16 *ssn,
 -                          u8 buf_size)
 +static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
 +                                 struct ieee80211_vif *vif,
 +                                 enum ieee80211_ampdu_mlme_action action,
 +                                 struct ieee80211_sta *sta, u16 tid, u16 *ssn,
 +                                 u8 buf_size)
  {
        struct iwl_priv *priv = hw->priv;
        int ret = -EINVAL;
                }
                break;
        case IEEE80211_AMPDU_TX_OPERATIONAL:
 +              buf_size = min_t(int, buf_size, LINK_QUAL_AGG_FRAME_LIMIT_DEF);
 +
 +              iwlagn_txq_agg_queue_setup(priv, sta, tid, buf_size);
 +
                /*
                 * If the limit is 0, then it wasn't initialised yet,
                 * use the default. We can do that since we take the
        return ret;
  }
  
 -int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
 -                     struct ieee80211_vif *vif,
 -                     struct ieee80211_sta *sta)
 +static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
 +                            struct ieee80211_vif *vif,
 +                            struct ieee80211_sta *sta)
  {
        struct iwl_priv *priv = hw->priv;
        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
        return 0;
  }
  
 -void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
 -                             struct ieee80211_channel_switch *ch_switch)
 +static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
 +                              struct ieee80211_channel_switch *ch_switch)
  {
        struct iwl_priv *priv = hw->priv;
        const struct iwl_channel_info *ch_info;
  
        IWL_DEBUG_MAC80211(priv, "enter\n");
  
 +      mutex_lock(&priv->mutex);
 +
        if (iwl_is_rfkill(priv))
 -              goto out_exit;
 +              goto out;
  
        if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
            test_bit(STATUS_SCANNING, &priv->status))
 -              goto out_exit;
 +              goto out;
  
        if (!iwl_is_associated_ctx(ctx))
 -              goto out_exit;
 +              goto out;
  
        /* channel switch in progress */
        if (priv->switch_rxon.switch_in_progress == true)
 -              goto out_exit;
 +              goto out;
  
 -      mutex_lock(&priv->mutex);
        if (priv->cfg->ops->lib->set_channel_switch) {
  
                ch = channel->hw_value;
        }
  out:
        mutex_unlock(&priv->mutex);
 -out_exit:
        if (!priv->switch_rxon.switch_in_progress)
                ieee80211_chswitch_done(ctx->vif, false);
        IWL_DEBUG_MAC80211(priv, "leave\n");
  }
  
 -void iwlagn_configure_filter(struct ieee80211_hw *hw,
 -                           unsigned int changed_flags,
 -                           unsigned int *total_flags,
 -                           u64 multicast)
 +static void iwlagn_configure_filter(struct ieee80211_hw *hw,
 +                                  unsigned int changed_flags,
 +                                  unsigned int *total_flags,
 +                                  u64 multicast)
  {
        struct iwl_priv *priv = hw->priv;
        __le32 filter_or = 0, filter_nand = 0;
                        FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
  }
  
 -void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
 +static void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
  {
        struct iwl_priv *priv = hw->priv;
  
@@@ -3263,6 -3729,8 +3263,6 @@@ static void iwl_setup_deferred_work(str
        INIT_WORK(&priv->tx_flush, iwl_bg_tx_flush);
        INIT_WORK(&priv->bt_full_concurrency, iwl_bg_bt_full_concurrency);
        INIT_WORK(&priv->bt_runtime_config, iwl_bg_bt_runtime_config);
 -      INIT_DELAYED_WORK(&priv->init_alive_start, iwl_bg_init_alive_start);
 -      INIT_DELAYED_WORK(&priv->alive_start, iwl_bg_alive_start);
        INIT_DELAYED_WORK(&priv->_agn.hw_roc_work, iwlagn_bg_roc_done);
  
        iwl_setup_scan_deferred_work(priv);
        priv->watchdog.data = (unsigned long)priv;
        priv->watchdog.function = iwl_bg_watchdog;
  
 -      if (!priv->cfg->base_params->use_isr_legacy)
 -              tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
 -                      iwl_irq_tasklet, (unsigned long)priv);
 -      else
 -              tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
 -                      iwl_irq_tasklet_legacy, (unsigned long)priv);
 +      tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
 +              iwl_irq_tasklet, (unsigned long)priv);
  }
  
  static void iwl_cancel_deferred_work(struct iwl_priv *priv)
        if (priv->cfg->ops->lib->cancel_deferred_work)
                priv->cfg->ops->lib->cancel_deferred_work(priv);
  
 -      cancel_delayed_work_sync(&priv->init_alive_start);
 -      cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->run_time_calib_work);
        cancel_work_sync(&priv->beacon_update);
  
@@@ -3331,7 -3805,10 +3331,7 @@@ static int iwl_init_drv(struct iwl_pri
        spin_lock_init(&priv->sta_lock);
        spin_lock_init(&priv->hcmd_lock);
  
 -      INIT_LIST_HEAD(&priv->free_frames);
 -
        mutex_init(&priv->mutex);
 -      mutex_init(&priv->sync_cmd_mutex);
  
        priv->ieee_channels = NULL;
        priv->ieee_rates = NULL;
                priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
        }
  
 -      /* Set the tx_power_user_lmt to the lowest power level
 -       * this value will get overwritten by channel max power avg
 -       * from eeprom */
 -      priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
 -      priv->tx_power_next = IWLAGN_TX_POWER_TARGET_POWER_MIN;
 -
        ret = iwl_init_channel_map(priv);
        if (ret) {
                IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
@@@ -3422,30 -3905,28 +3422,30 @@@ struct ieee80211_ops iwlagn_hw_ops = 
        .cancel_remain_on_channel = iwl_mac_cancel_remain_on_channel,
        .offchannel_tx = iwl_mac_offchannel_tx,
        .offchannel_tx_cancel_wait = iwl_mac_offchannel_tx_cancel_wait,
 +      CFG80211_TESTMODE_CMD(iwl_testmode_cmd)
  };
  
 -static void iwl_hw_detect(struct iwl_priv *priv)
 +static u32 iwl_hw_detect(struct iwl_priv *priv)
  {
 -      priv->hw_rev = _iwl_read32(priv, CSR_HW_REV);
 -      priv->hw_wa_rev = _iwl_read32(priv, CSR_HW_REV_WA_REG);
 -      priv->rev_id = priv->pci_dev->revision;
 -      IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", priv->rev_id);
 +      u8 rev_id;
 +
 +      pci_read_config_byte(priv->pci_dev, PCI_REVISION_ID, &rev_id);
 +      IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
 +      return iwl_read32(priv, CSR_HW_REV);
  }
  
  static int iwl_set_hw_params(struct iwl_priv *priv)
  {
        priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
        priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
 -      if (priv->cfg->mod_params->amsdu_size_8K)
 +      if (iwlagn_mod_params.amsdu_size_8K)
                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
        else
                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
  
        priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
  
 -      if (priv->cfg->mod_params->disable_11n)
 +      if (iwlagn_mod_params.disable_11n)
                priv->cfg->sku &= ~IWL_SKU_N;
  
        /* Device-specific setup */
@@@ -3474,28 -3955,6 +3474,28 @@@ static const u8 iwlagn_pan_ac_to_queue[
        7, 6, 5, 4,
  };
  
 +/* This function both allocates and initializes hw and priv. */
 +static struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg)
 +{
 +      struct iwl_priv *priv;
 +      /* mac80211 allocates memory for this device instance, including
 +       *   space for this driver's private structure */
 +      struct ieee80211_hw *hw;
 +
 +      hw = ieee80211_alloc_hw(sizeof(struct iwl_priv), &iwlagn_hw_ops);
 +      if (hw == NULL) {
 +              pr_err("%s: Can not allocate network device\n",
 +                     cfg->name);
 +              goto out;
 +      }
 +
 +      priv = hw->priv;
 +      priv->hw = hw;
 +
 +out:
 +      return hw;
 +}
 +
  static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  {
        int err = 0, i;
        struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
        unsigned long flags;
        u16 pci_cmd, num_mac;
 +      u32 hw_rev;
  
        /************************
         * 1. Allocating HW data
         ************************/
  
 -      /* Disabling hardware scan means that mac80211 will perform scans
 -       * "the hard way", rather than using device's scan. */
 -      if (cfg->mod_params->disable_hw_scan) {
 -              dev_printk(KERN_DEBUG, &(pdev->dev),
 -                      "sw scan support is deprecated\n");
 -              iwlagn_hw_ops.hw_scan = NULL;
 -      }
 -
        hw = iwl_alloc_all(cfg);
        if (!hw) {
                err = -ENOMEM;
        priv = hw->priv;
        /* At this point both hw and priv are allocated. */
  
 +      priv->ucode_type = UCODE_SUBTYPE_NONE_LOADED;
 +
        /*
         * The default context is always valid,
         * more may be discovered when firmware
         */
        iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
  
 -      iwl_hw_detect(priv);
 +      hw_rev = iwl_hw_detect(priv);
        IWL_INFO(priv, "Detected %s, REV=0x%X\n",
 -              priv->cfg->name, priv->hw_rev);
 +              priv->cfg->name, hw_rev);
  
        /* We disable the RETRY_TIMEOUT register (0x41) to keep
         * PCI Tx retries from interfering with C3 CPU state */
        pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
  
 -      iwl_prepare_card_hw(priv);
 -      if (!priv->hw_ready) {
 +      if (iwl_prepare_card_hw(priv)) {
                IWL_WARN(priv, "Failed, HW not ready\n");
                goto out_iounmap;
        }
         * 4. Read EEPROM
         *****************/
        /* Read the EEPROM */
 -      err = iwl_eeprom_init(priv);
 +      err = iwl_eeprom_init(priv, hw_rev);
        if (err) {
                IWL_ERR(priv, "Unable to init EEPROM\n");
                goto out_iounmap;
  
        pci_enable_msi(priv->pci_dev);
  
 -      if (priv->cfg->ops->lib->isr_ops.alloc)
 -              priv->cfg->ops->lib->isr_ops.alloc(priv);
 +      iwl_alloc_isr_ict(priv);
  
 -      err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr_ops.isr,
 +      err = request_irq(priv->pci_dev->irq, iwl_isr_ict,
                          IRQF_SHARED, DRV_NAME, priv);
        if (err) {
                IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
  
        iwl_setup_deferred_work(priv);
        iwl_setup_rx_handlers(priv);
 +      iwl_testmode_init(priv);
  
        /*********************************************
         * 8. Enable interrupts and read RFKILL state
        destroy_workqueue(priv->workqueue);
        priv->workqueue = NULL;
        free_irq(priv->pci_dev->irq, priv);
 -      if (priv->cfg->ops->lib->isr_ops.free)
 -              priv->cfg->ops->lib->isr_ops.free(priv);
 +      iwl_free_isr_ict(priv);
   out_disable_msi:
        pci_disable_msi(priv->pci_dev);
        iwl_uninit_drv(priv);
@@@ -3817,9 -4283,17 +3817,9 @@@ static void __devexit iwl_pci_remove(st
        if (priv->mac80211_registered) {
                ieee80211_unregister_hw(priv->hw);
                priv->mac80211_registered = 0;
 -      } else {
 -              iwl_down(priv);
        }
  
 -      /*
 -       * Make sure device is reset to low power before unloading driver.
 -       * This may be redundant with iwl_down(), but there are paths to
 -       * run iwl_down() without calling apm_ops.stop(), and there are
 -       * paths to avoid running iwl_down() at all before leaving driver.
 -       * This (inexpensive) call *makes sure* device is reset.
 -       */
 +      /* Reset to low power before unloading driver. */
        iwl_apm_stop(priv);
  
        iwl_tt_exit(priv);
  
        iwl_uninit_drv(priv);
  
 -      if (priv->cfg->ops->lib->isr_ops.free)
 -              priv->cfg->ops->lib->isr_ops.free(priv);
 +      iwl_free_isr_ict(priv);
  
        dev_kfree_skb(priv->beacon_skb);
  
@@@ -4046,21 -4521,21 +4046,21 @@@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_c
        {IWL_PCI_DEVICE(0x088F, 0x4266, iwl6035_2bg_cfg)},
        {IWL_PCI_DEVICE(0x088E, 0x4466, iwl6035_2bg_cfg)},
  
 -/* 200 Series */
 -      {IWL_PCI_DEVICE(0x0894, 0x0022, iwl200_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0895, 0x0222, iwl200_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0894, 0x0422, iwl200_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0894, 0x0026, iwl200_bg_cfg)},
 -      {IWL_PCI_DEVICE(0x0895, 0x0226, iwl200_bg_cfg)},
 -      {IWL_PCI_DEVICE(0x0894, 0x0426, iwl200_bg_cfg)},
 -
 -/* 230 Series */
 -      {IWL_PCI_DEVICE(0x0892, 0x0062, iwl230_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0893, 0x0262, iwl230_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0892, 0x0462, iwl230_bgn_cfg)},
 -      {IWL_PCI_DEVICE(0x0892, 0x0066, iwl230_bg_cfg)},
 -      {IWL_PCI_DEVICE(0x0893, 0x0266, iwl230_bg_cfg)},
 -      {IWL_PCI_DEVICE(0x0892, 0x0466, iwl230_bg_cfg)},
 +/* 105 Series */
 +      {IWL_PCI_DEVICE(0x0894, 0x0022, iwl105_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0895, 0x0222, iwl105_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0894, 0x0422, iwl105_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0894, 0x0026, iwl105_bg_cfg)},
 +      {IWL_PCI_DEVICE(0x0895, 0x0226, iwl105_bg_cfg)},
 +      {IWL_PCI_DEVICE(0x0894, 0x0426, iwl105_bg_cfg)},
 +
 +/* 135 Series */
 +      {IWL_PCI_DEVICE(0x0892, 0x0062, iwl135_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0893, 0x0262, iwl135_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0892, 0x0462, iwl135_bgn_cfg)},
 +      {IWL_PCI_DEVICE(0x0892, 0x0066, iwl135_bg_cfg)},
 +      {IWL_PCI_DEVICE(0x0893, 0x0266, iwl135_bg_cfg)},
 +      {IWL_PCI_DEVICE(0x0892, 0x0466, iwl135_bg_cfg)},
  
        {0}
  };
@@@ -4110,21 -4585,43 +4110,21 @@@ module_exit(iwl_exit)
  module_init(iwl_init);
  
  #ifdef CONFIG_IWLWIFI_DEBUG
 -module_param_named(debug50, iwl_debug_level, uint, S_IRUGO);
 -MODULE_PARM_DESC(debug50, "50XX debug output mask (deprecated)");
  module_param_named(debug, iwl_debug_level, uint, S_IRUGO | S_IWUSR);
  MODULE_PARM_DESC(debug, "debug output mask");
  #endif
  
 -module_param_named(swcrypto50, iwlagn_mod_params.sw_crypto, bool, S_IRUGO);
 -MODULE_PARM_DESC(swcrypto50,
 -               "using crypto in software (default 0 [hardware]) (deprecated)");
  module_param_named(swcrypto, iwlagn_mod_params.sw_crypto, int, S_IRUGO);
  MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 -module_param_named(queues_num50,
 -                 iwlagn_mod_params.num_of_queues, int, S_IRUGO);
 -MODULE_PARM_DESC(queues_num50,
 -               "number of hw queues in 50xx series (deprecated)");
  module_param_named(queues_num, iwlagn_mod_params.num_of_queues, int, S_IRUGO);
  MODULE_PARM_DESC(queues_num, "number of hw queues.");
 -module_param_named(11n_disable50, iwlagn_mod_params.disable_11n, int, S_IRUGO);
 -MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality (deprecated)");
  module_param_named(11n_disable, iwlagn_mod_params.disable_11n, int, S_IRUGO);
  MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
 -module_param_named(amsdu_size_8K50, iwlagn_mod_params.amsdu_size_8K,
 -                 int, S_IRUGO);
 -MODULE_PARM_DESC(amsdu_size_8K50,
 -               "enable 8K amsdu size in 50XX series (deprecated)");
  module_param_named(amsdu_size_8K, iwlagn_mod_params.amsdu_size_8K,
                   int, S_IRUGO);
  MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
 -module_param_named(fw_restart50, iwlagn_mod_params.restart_fw, int, S_IRUGO);
 -MODULE_PARM_DESC(fw_restart50,
 -               "restart firmware in case of error (deprecated)");
  module_param_named(fw_restart, iwlagn_mod_params.restart_fw, int, S_IRUGO);
  MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
 -module_param_named(
 -      disable_hw_scan, iwlagn_mod_params.disable_hw_scan, int, S_IRUGO);
 -MODULE_PARM_DESC(disable_hw_scan,
 -               "disable hardware scanning (default 0) (deprecated)");
  
  module_param_named(ucode_alternative, iwlagn_wanted_ucode_alternative, int,
                   S_IRUGO);
@@@ -24,7 -24,6 +24,7 @@@
   * Hsinchu 300, Taiwan.
   *
   * Larry Finger <Larry.Finger@lwfinger.net>
 + *
   *****************************************************************************/
  
  #include "wifi.h"
@@@ -36,7 -35,7 +36,7 @@@
  /*mutex for start & stop is must here. */
  static int rtl_op_start(struct ieee80211_hw *hw)
  {
 -      int err = 0;
 +      int err;
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
  
                return 0;
        mutex_lock(&rtlpriv->locks.conf_mutex);
        err = rtlpriv->intf_ops->adapter_start(hw);
 -      if (err)
 -              goto out;
 -      rtl_watch_dog_timer_callback((unsigned long)hw);
 -out:
 +      if (!err)
 +              rtl_watch_dog_timer_callback((unsigned long)hw);
        mutex_unlock(&rtlpriv->locks.conf_mutex);
        return err;
  }
@@@ -71,7 -72,6 +71,7 @@@ static void rtl_op_stop(struct ieee8021
  
        mac->link_state = MAC80211_NOLINK;
        memset(mac->bssid, 0, 6);
 +      mac->vendor = PEER_UNKNOWN;
  
        /*reset sec info */
        rtl_cam_reset_sec_info(hw);
@@@ -87,8 -87,6 +87,8 @@@ static void rtl_op_tx(struct ieee80211_
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
 +      struct rtl_tcb_desc tcb_desc;
 +      memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
  
        if (unlikely(is_hal_stop(rtlhal) || ppsc->rfpwr_state != ERFON))
                goto err_free;
@@@ -96,8 -94,8 +96,8 @@@
        if (!test_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status))
                goto err_free;
  
 -
 -      rtlpriv->intf_ops->adapter_tx(hw, skb);
 +      if (!rtlpriv->intf_ops->waitq_insert(hw, skb))
 +              rtlpriv->intf_ops->adapter_tx(hw, skb, &tcb_desc);
  
        return;
  
@@@ -138,26 -136,10 +138,26 @@@ static int rtl_op_add_interface(struct 
  
                mac->link_state = MAC80211_LINKED;
                rtlpriv->cfg->ops->set_bcn_reg(hw);
 +              if (rtlpriv->rtlhal.current_bandtype == BAND_ON_2_4G)
 +                      mac->basic_rates = 0xfff;
 +              else
 +                      mac->basic_rates = 0xff0;
 +              rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
 +                              (u8 *) (&mac->basic_rates));
 +
                break;
        case NL80211_IFTYPE_AP:
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
                         ("NL80211_IFTYPE_AP\n"));
 +
 +              mac->link_state = MAC80211_LINKED;
 +              rtlpriv->cfg->ops->set_bcn_reg(hw);
 +              if (rtlpriv->rtlhal.current_bandtype == BAND_ON_2_4G)
 +                      mac->basic_rates = 0xfff;
 +              else
 +                      mac->basic_rates = 0xff0;
 +              rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
 +                              (u8 *) (&mac->basic_rates));
                break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@@ -204,12 -186,13 +204,12 @@@ static void rtl_op_remove_interface(str
        mac->vif = NULL;
        mac->link_state = MAC80211_NOLINK;
        memset(mac->bssid, 0, 6);
 +      mac->vendor = PEER_UNKNOWN;
        mac->opmode = NL80211_IFTYPE_UNSPECIFIED;
        rtlpriv->cfg->ops->set_network_type(hw, mac->opmode);
 -
        mutex_unlock(&rtlpriv->locks.conf_mutex);
  }
  
 -
  static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
  
        /*For LPS */
        if (changed & IEEE80211_CONF_CHANGE_PS) {
 -              if (conf->flags & IEEE80211_CONF_PS)
 -                      rtl_lps_enter(hw);
 -              else
 -                      rtl_lps_leave(hw);
 +              cancel_delayed_work(&rtlpriv->works.ps_work);
 +              cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
 +              if (conf->flags & IEEE80211_CONF_PS) {
 +                      rtlpriv->psc.sw_ps_enabled = true;
 +                      /* sleep here is must, or we may recv the beacon and
 +                       * cause mac80211 into wrong ps state, this will cause
 +                       * power save nullfunc send fail, and further cause
 +                       * pkt loss, So sleep must quickly but not immediatly
 +                       * because that will cause nullfunc send by mac80211
 +                       * fail, and cause pkt loss, we have tested that 5mA
 +                       * is worked very well */
 +                      if (!rtlpriv->psc.multi_buffered)
 +                              queue_delayed_work(rtlpriv->works.rtl_wq,
 +                                              &rtlpriv->works.ps_work,
 +                                              MSECS(5));
 +              } else {
 +                      rtl_swlps_rf_awake(hw);
 +                      rtlpriv->psc.sw_ps_enabled = false;
 +              }
        }
  
        if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
                case NL80211_CHAN_NO_HT:
                        /* SC */
                        mac->cur_40_prime_sc =
 -                          PRIME_CHNL_OFFSET_DONT_CARE;
 +                              PRIME_CHNL_OFFSET_DONT_CARE;
                        rtlphy->current_chan_bw = HT_CHANNEL_WIDTH_20;
                        mac->bw_40 = false;
                        break;
                        /* SC */
                        mac->cur_40_prime_sc = PRIME_CHNL_OFFSET_UPPER;
                        rtlphy->current_chan_bw =
 -                          HT_CHANNEL_WIDTH_20_40;
 +                              HT_CHANNEL_WIDTH_20_40;
                        mac->bw_40 = true;
  
                        /*wide channel */
                        /* SC */
                        mac->cur_40_prime_sc = PRIME_CHNL_OFFSET_LOWER;
                        rtlphy->current_chan_bw =
 -                          HT_CHANNEL_WIDTH_20_40;
 +                              HT_CHANNEL_WIDTH_20_40;
                        mac->bw_40 = true;
  
                        /*wide channel */
                default:
                        mac->bw_40 = false;
                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
 -                               ("switch case not processed\n"));
 +                                      ("switch case not processed\n"));
                        break;
                }
  
                if (wide_chan <= 0)
                        wide_chan = 1;
 +
 +              /* In scanning, before we go offchannel we may send a ps=1 null
 +               * to AP, and then we may send a ps = 0 null to AP quickly, but
 +               * first null may have caused AP to put lots of packet to hw tx
 +               * buffer. These packets must be tx'd before we go off channel
 +               * so we must delay more time to let AP flush these packets
 +               * before going offchannel, or dis-association or delete BA will
 +               * happen by AP
 +               */
 +              if (rtlpriv->mac80211.offchan_deley) {
 +                      rtlpriv->mac80211.offchan_deley = false;
 +                      mdelay(50);
 +              }
                rtlphy->current_channel = wide_chan;
  
 -              rtlpriv->cfg->ops->set_channel_access(hw);
                rtlpriv->cfg->ops->switch_channel(hw);
 +              rtlpriv->cfg->ops->set_channel_access(hw);
                rtlpriv->cfg->ops->set_bw_mode(hw,
                                               hw->conf.channel_type);
        }
@@@ -390,28 -345,27 +390,28 @@@ static void rtl_op_configure_filter(str
                }
        }
  
 -      if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
 -              /*
 -               *TODO: BIT(5) is probe response BIT(8) is beacon
 -               *TODO: Use define for BIT(5) and BIT(8)
 -               */
 -              if (*new_flags & FIF_BCN_PRBRESP_PROMISC)
 -                      mac->rx_mgt_filter |= (BIT(5) | BIT(8));
 -              else
 -                      mac->rx_mgt_filter &= ~(BIT(5) | BIT(8));
 +      /* if ssid not set to hw don't check bssid
 +       * here just used for linked scanning, & linked
 +       * and nolink check bssid is set in set network_type */
 +      if ((changed_flags & FIF_BCN_PRBRESP_PROMISC) &&
 +              (mac->link_state >= MAC80211_LINKED)) {
 +              if (mac->opmode != NL80211_IFTYPE_AP) {
 +                      if (*new_flags & FIF_BCN_PRBRESP_PROMISC) {
 +                              rtlpriv->cfg->ops->set_chk_bssid(hw, false);
 +                      } else {
 +                              rtlpriv->cfg->ops->set_chk_bssid(hw, true);
 +                      }
 +              }
        }
  
        if (changed_flags & FIF_CONTROL) {
                if (*new_flags & FIF_CONTROL) {
                        mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF];
 -                      mac->rx_ctrl_filter |= RTL_SUPPORTED_CTRL_FILTER;
  
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
                                 ("Enable receive control frame.\n"));
                } else {
                        mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF];
 -                      mac->rx_ctrl_filter &= ~RTL_SUPPORTED_CTRL_FILTER;
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
                                 ("Disable receive control frame.\n"));
                }
                                 ("Disable receive other BSS's frame.\n"));
                }
        }
 -
 -      rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
 -      rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_MGT_FILTER,
 -                                    (u8 *) (&mac->rx_mgt_filter));
 -      rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_CTRL_FILTER,
 -                                    (u8 *) (&mac->rx_ctrl_filter));
  }
 +static int rtl_op_sta_add(struct ieee80211_hw *hw,
 +                       struct ieee80211_vif *vif,
 +                       struct ieee80211_sta *sta)
 +{
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 +      struct rtl_sta_info *sta_entry;
 +
 +      if (sta) {
 +              sta_entry = (struct rtl_sta_info *) sta->drv_priv;
 +              if (rtlhal->current_bandtype == BAND_ON_2_4G) {
 +                      sta_entry->wireless_mode = WIRELESS_MODE_G;
 +                      if (sta->supp_rates[0] <= 0xf)
 +                              sta_entry->wireless_mode = WIRELESS_MODE_B;
 +                      if (sta->ht_cap.ht_supported == true)
 +                              sta_entry->wireless_mode = WIRELESS_MODE_N_24G;
 +              } else if (rtlhal->current_bandtype == BAND_ON_5G) {
 +                      sta_entry->wireless_mode = WIRELESS_MODE_A;
 +                      if (sta->ht_cap.ht_supported == true)
 +                              sta_entry->wireless_mode = WIRELESS_MODE_N_24G;
 +              }
 +
 +              /* I found some times mac80211 give wrong supp_rates for adhoc*/
 +              if (rtlpriv->mac80211.opmode == NL80211_IFTYPE_ADHOC)
 +                      sta_entry->wireless_mode = WIRELESS_MODE_G;
  
 +              RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
 +                      ("Add sta addr is "MAC_FMT"\n", MAC_ARG(sta->addr)));
 +              rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
 +      }
 +      return 0;
 +}
 +static int rtl_op_sta_remove(struct ieee80211_hw *hw,
 +                              struct ieee80211_vif *vif,
 +                              struct ieee80211_sta *sta)
 +{
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_sta_info *sta_entry;
 +      if (sta) {
 +              RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
 +                      ("Remove sta addr is "MAC_FMT"\n", MAC_ARG(sta->addr)));
 +              sta_entry = (struct rtl_sta_info *) sta->drv_priv;
 +              sta_entry->wireless_mode = 0;
 +              sta_entry->ratr_index = 0;
 +      }
 +      return 0;
 +}
  static int _rtl_get_hal_qnum(u16 queue)
  {
        int qnum;
@@@ -532,18 -446,19 +532,18 @@@ static void rtl_op_bss_info_changed(str
                             struct ieee80211_bss_conf *bss_conf, u32 changed)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
 +      struct ieee80211_sta *sta = NULL;
  
        mutex_lock(&rtlpriv->locks.conf_mutex);
 -
        if ((vif->type == NL80211_IFTYPE_ADHOC) ||
            (vif->type == NL80211_IFTYPE_AP) ||
            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
 -
                if ((changed & BSS_CHANGED_BEACON) ||
                    (changed & BSS_CHANGED_BEACON_ENABLED &&
                     bss_conf->enable_beacon)) {
 -
                        if (mac->beacon_enabled == 0) {
                                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                         ("BSS_CHANGED_BEACON_ENABLED\n"));
                                                rtlpriv->cfg->maps
                                                [RTL_IBSS_INT_MASKS],
                                                0);
 +
 +                              if (rtlpriv->cfg->ops->linked_set_reg)
 +                                      rtlpriv->cfg->ops->linked_set_reg(hw);
                        }
 -              } else {
 +              }
 +              if ((changed & BSS_CHANGED_BEACON_ENABLED &&
 +                      !bss_conf->enable_beacon)) {
                        if (mac->beacon_enabled == 1) {
                                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                         ("ADHOC DISABLE BEACON\n"));
                                                [RTL_IBSS_INT_MASKS]);
                        }
                }
 -
                if (changed & BSS_CHANGED_BEACON_INT) {
                        RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE,
                                 ("BSS_CHANGED_BEACON_INT\n"));
        /*TODO: reference to enum ieee80211_bss_change */
        if (changed & BSS_CHANGED_ASSOC) {
                if (bss_conf->assoc) {
 +                      /* we should reset all sec info & cam
 +                       * before set cam after linked, we should not
 +                       * reset in disassoc, that will cause tkip->wep
 +                       * fail because some flag will be wrong */
 +                      /* reset sec info */
 +                      rtl_cam_reset_sec_info(hw);
 +                      /* reset cam to fix wep fail issue
 +                       * when change from wpa to wep */
 +                      rtl_cam_reset_all_entry(hw);
 +
                        mac->link_state = MAC80211_LINKED;
                        mac->cnt_after_linked = 0;
                        mac->assoc_id = bss_conf->aid;
                        memcpy(mac->bssid, bss_conf->bssid, 6);
  
 +                      if (rtlpriv->cfg->ops->linked_set_reg)
 +                              rtlpriv->cfg->ops->linked_set_reg(hw);
 +                      if (mac->opmode == NL80211_IFTYPE_STATION && sta)
 +                              rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                 ("BSS_CHANGED_ASSOC\n"));
                } else {
  
                        mac->link_state = MAC80211_NOLINK;
                        memset(mac->bssid, 0, 6);
 -
 -                      /* reset sec info */
 -                      rtl_cam_reset_sec_info(hw);
 +                      mac->vendor = PEER_UNKNOWN;
  
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                                 ("BSS_CHANGED_UN_ASSOC\n"));
        }
  
        if (changed & BSS_CHANGED_HT) {
 -              struct ieee80211_sta *sta = NULL;
 -
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                         ("BSS_CHANGED_HT\n"));
 -
                rcu_read_lock();
 -              sta = ieee80211_find_sta(mac->vif, mac->bssid);
 -
 +              sta = get_sta(hw, vif, (u8 *)bss_conf->bssid);
                if (sta) {
                        if (sta->ht_cap.ampdu_density >
                            mac->current_ampdu_density)
        }
  
        if (changed & BSS_CHANGED_BSSID) {
 -              struct ieee80211_sta *sta = NULL;
                u32 basic_rates;
 -              u8 i;
  
                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID,
                                              (u8 *) bss_conf->bssid);
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
                         (MAC_FMT "\n", MAC_ARG(bss_conf->bssid)));
  
 +              mac->vendor = PEER_UNKNOWN;
                memcpy(mac->bssid, bss_conf->bssid, 6);
 -              if (is_valid_ether_addr(bss_conf->bssid)) {
 -                      switch (vif->type) {
 -                      case NL80211_IFTYPE_UNSPECIFIED:
 -                              break;
 -                      case NL80211_IFTYPE_ADHOC:
 -                              break;
 -                      case NL80211_IFTYPE_STATION:
 -                              break;
 -                      case NL80211_IFTYPE_AP:
 -                              break;
 -                      default:
 -                              RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
 -                                       ("switch case not process\n"));
 -                              break;
 -                      }
 -                      rtlpriv->cfg->ops->set_network_type(hw, vif->type);
 -              } else
 -                      rtlpriv->cfg->ops->set_network_type(hw,
 -                                      NL80211_IFTYPE_UNSPECIFIED);
 -
 -              memset(mac->mcs, 0, 16);
 -              mac->ht_enable = false;
 -              mac->sgi_40 = false;
 -              mac->sgi_20 = false;
 -
 -              if (!bss_conf->use_short_slot)
 -                      mac->mode = WIRELESS_MODE_B;
 -              else
 -                      mac->mode = WIRELESS_MODE_G;
 +              rtlpriv->cfg->ops->set_network_type(hw, vif->type);
  
                rcu_read_lock();
 -              sta = ieee80211_find_sta(mac->vif, mac->bssid);
 +              sta = get_sta(hw, vif, (u8 *)bss_conf->bssid);
 +              if (!sta) {
 +                      rcu_read_unlock();
 +                      goto out;
 +              }
  
 -              if (sta) {
 -                      if (sta->ht_cap.ht_supported) {
 +              if (rtlhal->current_bandtype == BAND_ON_5G) {
 +                      mac->mode = WIRELESS_MODE_A;
 +              } else {
 +                      if (sta->supp_rates[0] <= 0xf)
 +                              mac->mode = WIRELESS_MODE_B;
 +                      else
 +                              mac->mode = WIRELESS_MODE_G;
 +              }
 +
 +              if (sta->ht_cap.ht_supported) {
 +                      if (rtlhal->current_bandtype == BAND_ON_2_4G)
                                mac->mode = WIRELESS_MODE_N_24G;
 -                              mac->ht_enable = true;
 -                      }
 +                      else
 +                              mac->mode = WIRELESS_MODE_N_5G;
 +              }
  
 -                      if (mac->ht_enable) {
 -                              u16 ht_cap = sta->ht_cap.cap;
 -                              memcpy(mac->mcs, (u8 *) (&sta->ht_cap.mcs), 16);
 -
 -                              for (i = 0; i < 16; i++)
 -                                      RT_TRACE(rtlpriv, COMP_MAC80211,
 -                                               DBG_LOUD, ("%x ",
 -                                                          mac->mcs[i]));
 -                              RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
 -                                       ("\n"));
 -
 -                              if (ht_cap & IEEE80211_HT_CAP_SGI_40)
 -                                      mac->sgi_40 = true;
 -
 -                              if (ht_cap & IEEE80211_HT_CAP_SGI_20)
 -                                      mac->sgi_20 = true;
 -
 -                              /*
 -                               * for cisco 1252 bw20 it's wrong
 -                               * if (ht_cap &
 -                               *     IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 -                               *      mac->bw_40 = true;
 -                               * }
 -                               */
 -                      }
 +              /* just station need it, because ibss & ap mode will
 +               * set in sta_add, and will be NULL here */
 +              if (mac->opmode == NL80211_IFTYPE_STATION) {
 +                      struct rtl_sta_info *sta_entry;
 +                      sta_entry = (struct rtl_sta_info *) sta->drv_priv;
 +                      sta_entry->wireless_mode = mac->mode;
 +              }
 +
 +              if (sta->ht_cap.ht_supported) {
 +                      mac->ht_enable = true;
 +
 +                      /*
 +                       * for cisco 1252 bw20 it's wrong
 +                       * if (ht_cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
 +                       *      mac->bw_40 = true;
 +                       * }
 +                       * */
                }
 -              rcu_read_unlock();
  
 -              /*mac80211 just give us CCK rates any time
 -               *So we add G rate in basic rates when
 -               not in B mode*/
                if (changed & BSS_CHANGED_BASIC_RATES) {
 -                      if (mac->mode == WIRELESS_MODE_B)
 -                              basic_rates = bss_conf->basic_rates | 0x00f;
 +                      /* for 5G must << RATE_6M_INDEX=4,
 +                       * because 5G have no cck rate*/
 +                      if (rtlhal->current_bandtype == BAND_ON_5G)
 +                              basic_rates = sta->supp_rates[1] << 4;
                        else
 -                              basic_rates = bss_conf->basic_rates | 0xff0;
 -
 -                      if (!vif)
 -                              goto out;
 +                              basic_rates = sta->supp_rates[0];
  
                        mac->basic_rates = basic_rates;
                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
                                        (u8 *) (&basic_rates));
 -
 -                      if (rtlpriv->dm.useramask)
 -                              rtlpriv->cfg->ops->update_rate_mask(hw, 0);
 -                      else
 -                              rtlpriv->cfg->ops->update_rate_table(hw);
 -
                }
 +              rcu_read_unlock();
        }
  
        /*
@@@ -783,7 -719,7 +783,7 @@@ static void rtl_op_set_tsf(struct ieee8
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-       u8 bibss = (mac->opmode == NL80211_IFTYPE_ADHOC) ? 1 : 0;;
+       u8 bibss = (mac->opmode == NL80211_IFTYPE_ADHOC) ? 1 : 0;
  
        mac->tsf = tsf;
        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_CORRECT_TSF, (u8 *) (&bibss));
@@@ -824,17 -760,16 +824,17 @@@ static int rtl_op_ampdu_action(struct i
        case IEEE80211_AMPDU_TX_START:
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                         ("IEEE80211_AMPDU_TX_START: TID:%d\n", tid));
 -              return rtl_tx_agg_start(hw, sta->addr, tid, ssn);
 +              return rtl_tx_agg_start(hw, sta, tid, ssn);
                break;
        case IEEE80211_AMPDU_TX_STOP:
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                         ("IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid));
 -              return rtl_tx_agg_stop(hw, sta->addr, tid);
 +              return rtl_tx_agg_stop(hw, sta, tid);
                break;
        case IEEE80211_AMPDU_TX_OPERATIONAL:
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                         ("IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid));
 +              rtl_tx_agg_oper(hw, sta, tid);
                break;
        case IEEE80211_AMPDU_RX_START:
                RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
@@@ -864,12 -799,8 +864,12 @@@ static void rtl_op_sw_scan_start(struc
        if (mac->link_state == MAC80211_LINKED) {
                rtl_lps_leave(hw);
                mac->link_state = MAC80211_LINKED_SCANNING;
 -      } else
 +      } else {
                rtl_ips_nic_on(hw);
 +      }
 +
 +      /* Dual mac */
 +      rtlpriv->rtlhal.load_imrandiqk_setting_for2g = false;
  
        rtlpriv->cfg->ops->led_control(hw, LED_CTL_SITE_SURVEY);
        rtlpriv->cfg->ops->scan_operation_backup(hw, SCAN_OPT_BACKUP);
@@@ -881,19 -812,22 +881,19 @@@ static void rtl_op_sw_scan_complete(str
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
  
        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, ("\n"));
 -
 -      rtlpriv->cfg->ops->scan_operation_backup(hw, SCAN_OPT_RESTORE);
        mac->act_scanning = false;
 +      /* Dual mac */
 +      rtlpriv->rtlhal.load_imrandiqk_setting_for2g = false;
 +
        if (mac->link_state == MAC80211_LINKED_SCANNING) {
                mac->link_state = MAC80211_LINKED;
 -
 -              /* fix fwlps issue */
 -              rtlpriv->cfg->ops->set_network_type(hw, mac->opmode);
 -
 -              if (rtlpriv->dm.useramask)
 -                      rtlpriv->cfg->ops->update_rate_mask(hw, 0);
 -              else
 -                      rtlpriv->cfg->ops->update_rate_table(hw);
 -
 +              if (mac->opmode == NL80211_IFTYPE_STATION) {
 +                      /* fix fwlps issue */
 +                      rtlpriv->cfg->ops->set_network_type(hw, mac->opmode);
 +              }
        }
  
 +      rtlpriv->cfg->ops->scan_operation_backup(hw, SCAN_OPT_RESTORE);
  }
  
  static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        rtl_ips_nic_on(hw);
        mutex_lock(&rtlpriv->locks.conf_mutex);
        /* <1> get encryption alg */
 +
        switch (key->cipher) {
        case WLAN_CIPHER_SUITE_WEP40:
                key_type = WEP40_ENCRYPTION;
                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, ("alg:WEP40\n"));
 -              rtlpriv->sec.use_defaultkey = true;
                break;
        case WLAN_CIPHER_SUITE_WEP104:
                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                         ("alg:WEP104\n"));
                key_type = WEP104_ENCRYPTION;
 -              rtlpriv->sec.use_defaultkey = true;
                break;
        case WLAN_CIPHER_SUITE_TKIP:
                key_type = TKIP_ENCRYPTION;
                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, ("alg:TKIP\n"));
 -              if (mac->opmode == NL80211_IFTYPE_ADHOC)
 -                      rtlpriv->sec.use_defaultkey = true;
                break;
        case WLAN_CIPHER_SUITE_CCMP:
                key_type = AESCCMP_ENCRYPTION;
                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, ("alg:CCMP\n"));
 -              if (mac->opmode == NL80211_IFTYPE_ADHOC)
 -                      rtlpriv->sec.use_defaultkey = true;
                break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                         ("alg_err:%x!!!!:\n", key->cipher));
                goto out_unlock;
        }
 +      if (key_type == WEP40_ENCRYPTION ||
 +                      key_type == WEP104_ENCRYPTION ||
 +                      mac->opmode == NL80211_IFTYPE_ADHOC)
 +              rtlpriv->sec.use_defaultkey = true;
 +
        /* <2> get key_idx */
        key_idx = (u8) (key->keyidx);
        if (key_idx > 3)
                goto out_unlock;
        /* <3> if pairwise key enable_hw_sec */
        group_key = !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE);
 -      if ((!group_key) || (mac->opmode == NL80211_IFTYPE_ADHOC) ||
 -          rtlpriv->sec.pairwise_enc_algorithm == NO_ENCRYPTION) {
 -              if (rtlpriv->sec.pairwise_enc_algorithm == NO_ENCRYPTION &&
 -                  (key_type == WEP40_ENCRYPTION ||
 -                   key_type == WEP104_ENCRYPTION))
 -                      wep_only = true;
 -              rtlpriv->sec.pairwise_enc_algorithm = key_type;
 -              rtlpriv->cfg->ops->enable_hw_sec(hw);
 +
 +      /* wep always be group key, but there are two conditions:
 +       * 1) wep only: is just for wep enc, in this condition
 +       * rtlpriv->sec.pairwise_enc_algorithm == NO_ENCRYPTION
 +       * will be true & enable_hw_sec will be set when wep
 +       * ke setting.
 +       * 2) wep(group) + AES(pairwise): some AP like cisco
 +       * may use it, in this condition enable_hw_sec will not
 +       * be set when wep key setting */
 +      /* we must reset sec_info after lingked before set key,
 +       * or some flag will be wrong*/
 +      if (mac->opmode == NL80211_IFTYPE_AP) {
 +              if (!group_key || key_type == WEP40_ENCRYPTION ||
 +                      key_type == WEP104_ENCRYPTION) {
 +                      if (group_key)
 +                              wep_only = true;
 +                      rtlpriv->cfg->ops->enable_hw_sec(hw);
 +              }
 +      } else {
 +              if ((!group_key) || (mac->opmode == NL80211_IFTYPE_ADHOC) ||
 +                   rtlpriv->sec.pairwise_enc_algorithm == NO_ENCRYPTION) {
 +                      if (rtlpriv->sec.pairwise_enc_algorithm ==
 +                          NO_ENCRYPTION &&
 +                          (key_type == WEP40_ENCRYPTION ||
 +                          key_type == WEP104_ENCRYPTION))
 +                              wep_only = true;
 +                      rtlpriv->sec.pairwise_enc_algorithm = key_type;
 +                      RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
 +                              ("set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1"
 +                              " TKIP:2 AES:4 WEP104:5)\n", key_type));
 +                      rtlpriv->cfg->ops->enable_hw_sec(hw);
 +              }
        }
        /* <4> set key based on cmd */
        switch (cmd) {
                        if (!sta) {
                                RT_ASSERT(false, ("pairwise key withnot"
                                                  "mac_addr\n"));
 +
                                err = -EOPNOTSUPP;
                                goto out_unlock;
                        }
                RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
                         ("disable key delete one entry\n"));
                /*set local buf about wep key. */
 +              if (mac->opmode == NL80211_IFTYPE_AP) {
 +                      if (sta)
 +                              rtl_cam_del_entry(hw, sta->addr);
 +              }
                memset(rtlpriv->sec.key_buf[key_idx], 0, key->keylen);
                rtlpriv->sec.key_len[key_idx] = 0;
                memcpy(mac_addr, zero_addr, ETH_ALEN);
@@@ -1106,18 -1011,6 +1106,18 @@@ static void rtl_op_rfkill_poll(struct i
        mutex_unlock(&rtlpriv->locks.conf_mutex);
  }
  
 +/* this function is called by mac80211 to flush tx buffer
 + * before switch channle or power save, or tx buffer packet
 + * maybe send after offchannel or rf sleep, this may cause
 + * dis-association by AP */
 +static void rtl_op_flush(struct ieee80211_hw *hw, bool drop)
 +{
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +
 +      if (rtlpriv->intf_ops->flush)
 +              rtlpriv->intf_ops->flush(hw, drop);
 +}
 +
  const struct ieee80211_ops rtl_ops = {
        .start = rtl_op_start,
        .stop = rtl_op_stop,
        .remove_interface = rtl_op_remove_interface,
        .config = rtl_op_config,
        .configure_filter = rtl_op_configure_filter,
 +      .sta_add = rtl_op_sta_add,
 +      .sta_remove = rtl_op_sta_remove,
        .set_key = rtl_op_set_key,
        .conf_tx = rtl_op_conf_tx,
        .bss_info_changed = rtl_op_bss_info_changed,
        .sw_scan_start = rtl_op_sw_scan_start,
        .sw_scan_complete = rtl_op_sw_scan_complete,
        .rfkill_poll = rtl_op_rfkill_poll,
 +      .flush = rtl_op_flush,
  };
  #include "../wifi.h"
  #include "../efuse.h"
  #include "../base.h"
 +#include "../regd.h"
  #include "../cam.h"
  #include "../ps.h"
  #include "../pci.h"
  #include "reg.h"
  #include "def.h"
  #include "phy.h"
 +#include "../rtl8192c/fw_common.h"
  #include "dm.h"
  #include "led.h"
  #include "hw.h"
@@@ -139,6 -137,15 +139,6 @@@ void rtl92ce_get_hw_reg(struct ieee8021
  
                break;
                }
 -      case HW_VAR_MGT_FILTER:
 -              *((u16 *) (val)) = rtl_read_word(rtlpriv, REG_RXFLTMAP0);
 -              break;
 -      case HW_VAR_CTRL_FILTER:
 -              *((u16 *) (val)) = rtl_read_word(rtlpriv, REG_RXFLTMAP1);
 -              break;
 -      case HW_VAR_DATA_FILTER:
 -              *((u16 *) (val)) = rtl_read_word(rtlpriv, REG_RXFLTMAP2);
 -              break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                         ("switch case not process\n"));
  void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
                        rate_cfg |= 0x01;
                        rtl_write_byte(rtlpriv, REG_RRSR, rate_cfg & 0xff);
                        rtl_write_byte(rtlpriv, REG_RRSR + 1,
 -                                     (rate_cfg >> 8)&0xff);
 +                                     (rate_cfg >> 8) & 0xff);
                        while (rate_cfg > 0x1) {
                                rate_cfg = (rate_cfg >> 1);
                                rate_index++;
                        break;
                }
        case HW_VAR_AMPDU_FACTOR:{
 -                      u8 regtoset_normal[4] = { 0x41, 0xa8, 0x72, 0xb9 };
 +                      u8 regtoset_normal[4] = {0x41, 0xa8, 0x72, 0xb9};
 +                      u8 regtoset_bt[4] = {0x31, 0x74, 0x42, 0x97};
  
                        u8 factor_toset;
                        u8 *p_regtoset = NULL;
                        u8 index = 0;
  
 -                      p_regtoset = regtoset_normal;
 +                      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +                          (rtlpcipriv->bt_coexist.bt_coexist_type ==
 +                          BT_CSR_BC4))
 +                              p_regtoset = regtoset_bt;
 +                      else
 +                              p_regtoset = regtoset_normal;
  
                        factor_toset = *((u8 *) val);
                        if (factor_toset <= 3) {
                }
        case HW_VAR_AC_PARAM:{
                        u8 e_aci = *((u8 *) val);
 -                      u32 u4b_ac_param;
 -                      u16 cw_min = le16_to_cpu(mac->ac[e_aci].cw_min);
 -                      u16 cw_max = le16_to_cpu(mac->ac[e_aci].cw_max);
 -                      u16 tx_op = le16_to_cpu(mac->ac[e_aci].tx_op);
 -
 -                      u4b_ac_param = (u32) mac->ac[e_aci].aifs;
 -                      u4b_ac_param |= ((u32)cw_min
 -                                       & 0xF) << AC_PARAM_ECW_MIN_OFFSET;
 -                      u4b_ac_param |= ((u32)cw_max &
 -                                       0xF) << AC_PARAM_ECW_MAX_OFFSET;
 -                      u4b_ac_param |= (u32)tx_op << AC_PARAM_TXOP_OFFSET;
 -
 -                      RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
 -                               ("queue:%x, ac_param:%x\n", e_aci,
 -                                u4b_ac_param));
 -
 -                      switch (e_aci) {
 -                      case AC1_BK:
 -                              rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM,
 -                                              u4b_ac_param);
 -                              break;
 -                      case AC0_BE:
 -                              rtl_write_dword(rtlpriv, REG_EDCA_BE_PARAM,
 -                                              u4b_ac_param);
 -                              break;
 -                      case AC2_VI:
 -                              rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM,
 -                                              u4b_ac_param);
 -                              break;
 -                      case AC3_VO:
 -                              rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM,
 -                                              u4b_ac_param);
 -                              break;
 -                      default:
 -                              RT_ASSERT(false,
 -                                ("SetHwReg8185(): invalid aci: %d !\n",
 -                                 e_aci));
 -                              break;
 -                      }
 +                      rtl92c_dm_init_edca_turbo(hw);
  
                        if (rtlpci->acm_method != eAcmWay2_SW)
                                rtlpriv->cfg->ops->set_hw_reg(hw,
        case HW_VAR_CORRECT_TSF:{
                        u8 btype_ibss = ((u8 *) (val))[0];
  
 -                      /*btype_ibss = (mac->opmode == NL80211_IFTYPE_ADHOC) ?
 -                                      1 : 0;*/
 -
                        if (btype_ibss == true)
                                _rtl92ce_stop_tx_beacon(hw);
  
                        rtl_write_dword(rtlpriv, REG_TSFTR,
                                        (u32) (mac->tsf & 0xffffffff));
                        rtl_write_dword(rtlpriv, REG_TSFTR + 4,
 -                                      (u32) ((mac->tsf >> 32)&0xffffffff));
 +                                      (u32) ((mac->tsf >> 32) & 0xffffffff));
  
                        _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
  
                        break;
  
                }
 -      case HW_VAR_MGT_FILTER:
 -              rtl_write_word(rtlpriv, REG_RXFLTMAP0, *(u16 *) val);
 -              break;
 -      case HW_VAR_CTRL_FILTER:
 -              rtl_write_word(rtlpriv, REG_RXFLTMAP1, *(u16 *) val);
 -              break;
 -      case HW_VAR_DATA_FILTER:
 -              rtl_write_word(rtlpriv, REG_RXFLTMAP2, *(u16 *) val);
 -              break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("switch case "
                                                        "not process\n"));
@@@ -629,12 -679,12 +629,12 @@@ static void _rtl92ce_gen_refresh_led_st
                rtl92ce_sw_led_on(hw, pLed0);
        else
                rtl92ce_sw_led_off(hw, pLed0);
 -
  }
  
  static bool _rtl92ce_init_mac(struct ieee80211_hw *hw)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
  
        u16 retry;
  
        rtl_write_byte(rtlpriv, REG_RSV_CTRL, 0x00);
 +      if (rtlpcipriv->bt_coexist.bt_coexistence) {
 +              u32 value32;
 +              value32 = rtl_read_dword(rtlpriv, REG_APS_FSMCO);
 +              value32 |= (SOP_ABG | SOP_AMB | XOP_BTCK);
 +              rtl_write_dword(rtlpriv, REG_APS_FSMCO, value32);
 +      }
        rtl_write_byte(rtlpriv, REG_SPS0_CTRL, 0x2b);
        rtl_write_byte(rtlpriv, REG_AFE_XTAL_CTRL, 0x0F);
  
 +      if (rtlpcipriv->bt_coexist.bt_coexistence) {
 +              u32 u4b_tmp = rtl_read_dword(rtlpriv, REG_AFE_XTAL_CTRL);
 +
 +              u4b_tmp &= (~0x00024800);
 +              rtl_write_dword(rtlpriv, REG_AFE_XTAL_CTRL, u4b_tmp);
 +      }
 +
        bytetmp = rtl_read_byte(rtlpriv, REG_APS_FSMCO + 1) | BIT(0);
        udelay(2);
  
        rtl_write_byte(rtlpriv, REG_SYS_ISO_CTRL + 1, 0x82);
        udelay(2);
  
 +      if (rtlpcipriv->bt_coexist.bt_coexistence) {
 +              bytetmp = rtl_read_byte(rtlpriv, REG_AFE_XTAL_CTRL+2) & 0xfd;
 +              rtl_write_byte(rtlpriv, REG_AFE_XTAL_CTRL+2, bytetmp);
 +      }
 +
        rtl_write_word(rtlpriv, REG_CR, 0x2ff);
  
        if (_rtl92ce_llt_table_init(hw) == false)
-               return false;;
+               return false;
  
        rtl_write_dword(rtlpriv, REG_HISR, 0xffffffff);
        rtl_write_byte(rtlpriv, REG_HISRE, 0xff);
  
        rtl_write_dword(rtlpriv, REG_MCUTST_1, 0x0);
  
-       return true;;
+       return true;
  }
  
  static void _rtl92ce_hw_configure(struct ieee80211_hw *hw)
  {
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
        u8 reg_bw_opmode;
        u32 reg_ratr, reg_prsr;
  
        rtl_write_dword(rtlpriv, REG_RARFRC, 0x01000000);
        rtl_write_dword(rtlpriv, REG_RARFRC + 4, 0x07060504);
  
 -      rtl_write_dword(rtlpriv, REG_AGGLEN_LMT, 0xb972a841);
 +      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +          (rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4))
 +              rtl_write_dword(rtlpriv, REG_AGGLEN_LMT, 0x97427431);
 +      else
 +              rtl_write_dword(rtlpriv, REG_AGGLEN_LMT, 0xb972a841);
  
        rtl_write_byte(rtlpriv, REG_ATIMWND, 0x2);
  
        rtl_write_byte(rtlpriv, REG_PIFS, 0x1C);
        rtl_write_byte(rtlpriv, REG_AGGR_BREAK_TIME, 0x16);
  
 -      rtl_write_word(rtlpriv, REG_NAV_PROT_LEN, 0x0020);
 -
 -      rtl_write_word(rtlpriv, REG_NAV_PROT_LEN, 0x0020);
 +      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +          (rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4)) {
 +              rtl_write_word(rtlpriv, REG_NAV_PROT_LEN, 0x0020);
 +              rtl_write_word(rtlpriv, REG_PROT_MODE_CTRL, 0x0402);
 +      } else {
 +              rtl_write_word(rtlpriv, REG_NAV_PROT_LEN, 0x0020);
 +              rtl_write_word(rtlpriv, REG_NAV_PROT_LEN, 0x0020);
 +      }
  
 -      rtl_write_dword(rtlpriv, REG_FAST_EDCA_CTRL, 0x086666);
 +      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +           (rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4))
 +              rtl_write_dword(rtlpriv, REG_FAST_EDCA_CTRL, 0x03086666);
 +      else
 +              rtl_write_dword(rtlpriv, REG_FAST_EDCA_CTRL, 0x086666);
  
        rtl_write_byte(rtlpriv, REG_ACKTO, 0x40);
  
@@@ -930,8 -948,8 +930,8 @@@ int rtl92ce_hw_init(struct ieee80211_h
        }
  
        rtlhal->last_hmeboxnum = 0;
 -      rtl92ce_phy_mac_config(hw);
 -      rtl92ce_phy_bb_config(hw);
 +      rtl92c_phy_mac_config(hw);
 +      rtl92c_phy_bb_config(hw);
        rtlphy->rf_mode = RF_OP_BY_SW_3WIRE;
        rtl92c_phy_rf_config(hw);
        rtlphy->rfreg_chnlval[0] = rtl_get_rfreg(hw, (enum radio_path)0,
        _rtl92ce_hw_configure(hw);
        rtl_cam_reset_all_entry(hw);
        rtl92ce_enable_hw_security_config(hw);
 +
        ppsc->rfpwr_state = ERFON;
 +
        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_ETHER_ADDR, mac->mac_addr);
        _rtl92ce_enable_aspm_back_door(hw);
        rtlpriv->intf_ops->enable_aspm(hw);
 +
 +      rtl8192ce_bt_hw_init(hw);
 +
        if (ppsc->rfpwr_state == ERFON) {
                rtl92c_phy_set_rfpath_switch(hw, 1);
 -              if (iqk_initialized)
 +              if (iqk_initialized) {
                        rtl92c_phy_iq_calibrate(hw, true);
 -              else {
 +              else {
                        rtl92c_phy_iq_calibrate(hw, false);
                        iqk_initialized = true;
                }
@@@ -1115,62 -1128,75 +1115,62 @@@ static int _rtl92ce_set_media_status(st
        return 0;
  }
  
 -static void _rtl92ce_set_check_bssid(struct ieee80211_hw *hw,
 -                                   enum nl80211_iftype type)
 +void rtl92ce_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
 -      u8 filterout_non_associated_bssid = false;
  
 -      switch (type) {
 -      case NL80211_IFTYPE_ADHOC:
 -      case NL80211_IFTYPE_STATION:
 -              filterout_non_associated_bssid = true;
 -              break;
 -      case NL80211_IFTYPE_UNSPECIFIED:
 -      case NL80211_IFTYPE_AP:
 -      default:
 -              break;
 -      }
 +      if (rtlpriv->psc.rfpwr_state != ERFON)
 +              return;
  
 -      if (filterout_non_associated_bssid == true) {
 +      if (check_bssid == true) {
                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
                                              (u8 *) (&reg_rcr));
                _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
 -      } else if (filterout_non_associated_bssid == false) {
 +      } else if (check_bssid == false) {
                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
                _rtl92ce_set_bcn_ctrl_reg(hw, BIT(4), 0);
                rtlpriv->cfg->ops->set_hw_reg(hw,
                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
        }
 +
  }
  
  int rtl92ce_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
  {
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +
        if (_rtl92ce_set_media_status(hw, type))
                return -EOPNOTSUPP;
 -      _rtl92ce_set_check_bssid(hw, type);
 +
 +      if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
 +              if (type != NL80211_IFTYPE_AP)
 +                      rtl92ce_set_check_bssid(hw, true);
 +      } else {
 +              rtl92ce_set_check_bssid(hw, false);
 +      }
 +
        return 0;
  }
  
 +/* don't set REG_EDCA_BE_PARAM here because mac80211 will send pkt when scan */
  void rtl92ce_set_qos(struct ieee80211_hw *hw, int aci)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 -      struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 -      u32 u4b_ac_param;
 -      u16 cw_min = le16_to_cpu(mac->ac[aci].cw_min);
 -      u16 cw_max = le16_to_cpu(mac->ac[aci].cw_max);
 -      u16 tx_op = le16_to_cpu(mac->ac[aci].tx_op);
 -
        rtl92c_dm_init_edca_turbo(hw);
 -      u4b_ac_param = (u32) mac->ac[aci].aifs;
 -      u4b_ac_param |= (u32) ((cw_min & 0xF) << AC_PARAM_ECW_MIN_OFFSET);
 -      u4b_ac_param |= (u32) ((cw_max & 0xF) << AC_PARAM_ECW_MAX_OFFSET);
 -      u4b_ac_param |= (u32) (tx_op << AC_PARAM_TXOP_OFFSET);
 -      RT_TRACE(rtlpriv, COMP_QOS, DBG_DMESG,
 -               ("queue:%x, ac_param:%x aifs:%x cwmin:%x cwmax:%x txop:%x\n",
 -                aci, u4b_ac_param, mac->ac[aci].aifs, cw_min,
 -                cw_max, tx_op));
        switch (aci) {
        case AC1_BK:
 -              rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM, u4b_ac_param);
 +              rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM, 0xa44f);
                break;
        case AC0_BE:
 -              rtl_write_dword(rtlpriv, REG_EDCA_BE_PARAM, u4b_ac_param);
 +              /* rtl_write_dword(rtlpriv, REG_EDCA_BE_PARAM, u4b_ac_param); */
                break;
        case AC2_VI:
 -              rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM, u4b_ac_param);
 +              rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM, 0x5e4322);
                break;
        case AC3_VO:
 -              rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM, u4b_ac_param);
 +              rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM, 0x2f3222);
                break;
        default:
                RT_ASSERT(false, ("invalid aci: %d !\n", aci));
@@@ -1201,10 -1227,8 +1201,10 @@@ void rtl92ce_disable_interrupt(struct i
  static void _rtl92ce_poweroff_adapter(struct ieee80211_hw *hw)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
        u8 u1b_tmp;
 +      u32 u4b_tmp;
  
        rtlpriv->intf_ops->enable_aspm(hw);
        rtl_write_byte(rtlpriv, REG_TXPAUSE, 0xFF);
        rtl_write_byte(rtlpriv, REG_MCUFWDL, 0x00);
        rtl_write_dword(rtlpriv, REG_GPIO_PIN_CTRL, 0x00000000);
        u1b_tmp = rtl_read_byte(rtlpriv, REG_GPIO_PIN_CTRL);
 -      rtl_write_dword(rtlpriv, REG_GPIO_PIN_CTRL, 0x00FF0000 |
 -                      (u1b_tmp << 8));
 +      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +           ((rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4) ||
 +           (rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC8))) {
 +              rtl_write_dword(rtlpriv, REG_GPIO_PIN_CTRL, 0x00F30000 |
 +                              (u1b_tmp << 8));
 +      } else {
 +              rtl_write_dword(rtlpriv, REG_GPIO_PIN_CTRL, 0x00FF0000 |
 +                              (u1b_tmp << 8));
 +      }
        rtl_write_word(rtlpriv, REG_GPIO_IO_SEL, 0x0790);
        rtl_write_word(rtlpriv, REG_LEDCFG0, 0x8080);
        rtl_write_byte(rtlpriv, REG_AFE_PLL_CTRL, 0x80);
        rtl_write_byte(rtlpriv, REG_SPS0_CTRL, 0x23);
 -      rtl_write_byte(rtlpriv, REG_AFE_XTAL_CTRL, 0x0e);
 +      if (rtlpcipriv->bt_coexist.bt_coexistence) {
 +              u4b_tmp = rtl_read_dword(rtlpriv, REG_AFE_XTAL_CTRL);
 +              u4b_tmp |= 0x03824800;
 +              rtl_write_dword(rtlpriv, REG_AFE_XTAL_CTRL, u4b_tmp);
 +      } else {
 +              rtl_write_dword(rtlpriv, REG_AFE_XTAL_CTRL, 0x0e);
 +      }
 +
        rtl_write_byte(rtlpriv, REG_RSV_CTRL, 0x0e);
        rtl_write_byte(rtlpriv, REG_APS_FSMCO + 1, 0x10);
  }
@@@ -1317,7 -1327,6 +1317,7 @@@ void rtl92ce_update_interrupt_mask(stru
  
        RT_TRACE(rtlpriv, COMP_INTR, DBG_LOUD,
                 ("add_msr:%x, rm_msr:%x\n", add_msr, rm_msr));
 +
        if (add_msr)
                rtlpci->irq_mask[0] |= add_msr;
        if (rm_msr)
@@@ -1573,7 -1582,7 +1573,7 @@@ static void _rtl92ce_read_adapter_info(
                         ("RTL819X Not boot from eeprom, check it !!"));
        }
  
 -      RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_LOUD, ("MAP\n"),
 +      RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, ("MAP\n"),
                      hwinfo, HWSET_MAX_SIZE);
  
        eeprom_id = *((u16 *)&hwinfo[0]);
                                             rtlefuse->autoload_failflag,
                                             hwinfo);
  
 +      rtl8192ce_read_bt_coexist_info_from_hwpg(hw,
 +                                               rtlefuse->autoload_failflag,
 +                                               hwinfo);
 +
        rtlefuse->eeprom_channelplan = *(u8 *)&hwinfo[EEPROM_CHANNELPLAN];
        rtlefuse->eeprom_version = *(u16 *)&hwinfo[EEPROM_VERSION];
        rtlefuse->txpwr_fromeprom = true;
        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                 ("EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid));
  
 +      /* set channel paln to world wide 13 */
 +      rtlefuse->channel_plan = COUNTRY_CODE_WORLD_WIDE_13;
 +
        if (rtlhal->oem_id == RT_CID_DEFAULT) {
                switch (rtlefuse->eeprom_oemid) {
                case EEPROM_CID_DEFAULT:
@@@ -1699,36 -1701,30 +1699,36 @@@ void rtl92ce_read_eeprom_info(struct ie
        } else {
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("Autoload ERR!!\n"));
        }
 -
        _rtl92ce_hal_customized_behavior(hw);
  }
  
 -void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw)
 +static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
 +              struct ieee80211_sta *sta)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
        struct rtl_phy *rtlphy = &(rtlpriv->phy);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 -
 -      u32 ratr_value = (u32) mac->basic_rates;
 -      u8 *mcsrate = mac->mcs;
 +      struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 +      u32 ratr_value;
        u8 ratr_index = 0;
        u8 nmode = mac->ht_enable;
 -      u8 mimo_ps = 1;
 +      u8 mimo_ps = IEEE80211_SMPS_OFF;
        u16 shortgi_rate;
        u32 tmp_ratr_value;
        u8 curtxbw_40mhz = mac->bw_40;
 -      u8 curshortgi_40mhz = mac->sgi_40;
 -      u8 curshortgi_20mhz = mac->sgi_20;
 +      u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
 +                             1 : 0;
 +      u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
 +                             1 : 0;
        enum wireless_mode wirelessmode = mac->mode;
  
 -      ratr_value |= ((*(u16 *) (mcsrate))) << 12;
 -
 +      if (rtlhal->current_bandtype == BAND_ON_5G)
 +              ratr_value = sta->supp_rates[1] << 4;
 +      else
 +              ratr_value = sta->supp_rates[0];
 +      ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
 +                      sta->ht_cap.mcs.rx_mask[0] << 12);
        switch (wirelessmode) {
        case WIRELESS_MODE_B:
                if (ratr_value & 0x0000000c)
        case WIRELESS_MODE_N_24G:
        case WIRELESS_MODE_N_5G:
                nmode = 1;
 -              if (mimo_ps == 0) {
 +              if (mimo_ps == IEEE80211_SMPS_STATIC) {
                        ratr_value &= 0x0007F005;
                } else {
                        u32 ratr_mask;
                break;
        }
  
 -      ratr_value &= 0x0FFFFFFF;
 +      if ((rtlpcipriv->bt_coexist.bt_coexistence) &&
 +          (rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4) &&
 +          (rtlpcipriv->bt_coexist.bt_cur_state) &&
 +          (rtlpcipriv->bt_coexist.bt_ant_isolation) &&
 +          ((rtlpcipriv->bt_coexist.bt_service == BT_SCO) ||
 +          (rtlpcipriv->bt_coexist.bt_service == BT_BUSY)))
 +              ratr_value &= 0x0fffcfc0;
 +      else
 +              ratr_value &= 0x0FFFFFFF;
  
 -      if (nmode && ((curtxbw_40mhz && curshortgi_40mhz) || (!curtxbw_40mhz &&
 -                     curshortgi_20mhz))) {
 +      if (nmode && ((curtxbw_40mhz &&
 +                       curshortgi_40mhz) || (!curtxbw_40mhz &&
 +                                             curshortgi_20mhz))) {
  
                ratr_value |= 0x10000000;
                tmp_ratr_value = (ratr_value >> 12);
                 ("%x\n", rtl_read_dword(rtlpriv, REG_ARFR0)));
  }
  
 -void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
 +static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
 +              struct ieee80211_sta *sta, u8 rssi_level)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_phy *rtlphy = &(rtlpriv->phy);
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 -      u32 ratr_bitmap = (u32) mac->basic_rates;
 -      u8 *p_mcsrate = mac->mcs;
 +      struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 +      struct rtl_sta_info *sta_entry = NULL;
 +      u32 ratr_bitmap;
        u8 ratr_index;
 -      u8 curtxbw_40mhz = mac->bw_40;
 -      u8 curshortgi_40mhz = mac->sgi_40;
 -      u8 curshortgi_20mhz = mac->sgi_20;
 -      enum wireless_mode wirelessmode = mac->mode;
 +      u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
 +                              ? 1 : 0;
 +      u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
 +                              1 : 0;
 +      u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
 +                              1 : 0;
 +      enum wireless_mode wirelessmode = 0;
        bool shortgi = false;
        u8 rate_mask[5];
        u8 macid = 0;
 -      u8 mimops = 1;
 -
 -      ratr_bitmap |= (p_mcsrate[1] << 20) | (p_mcsrate[0] << 12);
 +      u8 mimo_ps = IEEE80211_SMPS_OFF;
 +
 +      sta_entry = (struct rtl_sta_info *) sta->drv_priv;
 +      wirelessmode = sta_entry->wireless_mode;
 +      if (mac->opmode == NL80211_IFTYPE_STATION)
 +              curtxbw_40mhz = mac->bw_40;
 +      else if (mac->opmode == NL80211_IFTYPE_AP ||
 +              mac->opmode == NL80211_IFTYPE_ADHOC)
 +              macid = sta->aid + 1;
 +
 +      if (rtlhal->current_bandtype == BAND_ON_5G)
 +              ratr_bitmap = sta->supp_rates[1] << 4;
 +      else
 +              ratr_bitmap = sta->supp_rates[0];
 +      ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
 +                      sta->ht_cap.mcs.rx_mask[0] << 12);
        switch (wirelessmode) {
        case WIRELESS_MODE_B:
                ratr_index = RATR_INX_WIRELESS_B;
        case WIRELESS_MODE_N_5G:
                ratr_index = RATR_INX_WIRELESS_NGB;
  
 -              if (mimops == 0) {
 +              if (mimo_ps == IEEE80211_SMPS_STATIC) {
                        if (rssi_level == 1)
                                ratr_bitmap &= 0x00070000;
                        else if (rssi_level == 2)
        }
        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
                 ("ratr_bitmap :%x\n", ratr_bitmap));
 -      *(u32 *)&rate_mask = (ratr_bitmap & 0x0fffffff) |
 -                                     (ratr_index << 28);
 +      *(u32 *)&rate_mask = EF4BYTE((ratr_bitmap & 0x0fffffff) |
 +                                   (ratr_index << 28));
        rate_mask[4] = macid | (shortgi ? 0x20 : 0x00) | 0x80;
        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, ("Rate_index:%x, "
                                                 "ratr_val:%x, %x:%x:%x:%x:%x\n",
                                                 rate_mask[2], rate_mask[3],
                                                 rate_mask[4]));
        rtl92c_fill_h2c_cmd(hw, H2C_RA_MASK, 5, rate_mask);
 +
 +      if (macid != 0)
 +              sta_entry->ratr_index = ratr_index;
 +}
 +
 +void rtl92ce_update_hal_rate_tbl(struct ieee80211_hw *hw,
 +              struct ieee80211_sta *sta, u8 rssi_level)
 +{
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +
 +      if (rtlpriv->dm.useramask)
 +              rtl92ce_update_hal_rate_mask(hw, sta, rssi_level);
 +      else
 +              rtl92ce_update_hal_rate_table(hw, sta);
  }
  
  void rtl92ce_update_channel_access_setting(struct ieee80211_hw *hw)
        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SIFS, (u8 *)&sifs_timer);
  }
  
 -bool rtl92ce_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid)
 +bool rtl92ce_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid)
  {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
        bool actuallyset = false;
        unsigned long flag;
  
 -      if ((rtlpci->up_first_time == 1) || (rtlpci->being_init_adapter))
 +      if (rtlpci->being_init_adapter)
                return false;
  
        if (ppsc->swrf_processing)
  
        cur_rfstate = ppsc->rfpwr_state;
  
 -      if ((ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) &&
 -          RT_IN_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM)) {
 -              rtlpriv->intf_ops->disable_aspm(hw);
 -              RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM);
 -      }
 -
        rtl_write_byte(rtlpriv, REG_MAC_PINMUX_CFG, rtl_read_byte(rtlpriv,
                       REG_MAC_PINMUX_CFG)&~(BIT(3)));
  
        }
  
        if (actuallyset) {
 -              if (e_rfpowerstate_toset == ERFON) {
 -                      if ((ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) &&
 -                          RT_IN_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM)) {
 -                              rtlpriv->intf_ops->disable_aspm(hw);
 -                              RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM);
 -                      }
 -              }
 -
                spin_lock_irqsave(&rtlpriv->locks.rf_ps_lock, flag);
                ppsc->rfchange_inprogress = false;
                spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flag);
 -
 -              if (e_rfpowerstate_toset == ERFOFF) {
 -                      if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) {
 -                              rtlpriv->intf_ops->enable_aspm(hw);
 -                              RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM);
 -                      }
 -              }
 -
 -      } else if (e_rfpowerstate_toset == ERFOFF || cur_rfstate == ERFOFF) {
 +      } else {
                if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_HALT_NIC)
                        RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
  
 -              if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) {
 -                      rtlpriv->intf_ops->enable_aspm(hw);
 -                      RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_ASPM);
 -              }
 -
 -              spin_lock_irqsave(&rtlpriv->locks.rf_ps_lock, flag);
 -              ppsc->rfchange_inprogress = false;
 -              spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flag);
 -      } else {
                spin_lock_irqsave(&rtlpriv->locks.rf_ps_lock, flag);
                ppsc->rfchange_inprogress = false;
                spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flag);
@@@ -2100,31 -2086,15 +2100,31 @@@ void rtl92ce_set_key(struct ieee80211_h
                                macaddr = cam_const_broad;
                                entry_id = key_index;
                        } else {
 +                              if (mac->opmode == NL80211_IFTYPE_AP) {
 +                                      entry_id = rtl_cam_get_free_entry(hw,
 +                                                               p_macaddr);
 +                                      if (entry_id >=  TOTAL_CAM_ENTRY) {
 +                                              RT_TRACE(rtlpriv, COMP_SEC,
 +                                                   DBG_EMERG,
 +                                                   ("Can not find free hw"
 +                                                   " security cam entry\n"));
 +                                              return;
 +                                      }
 +                              } else {
 +                                      entry_id = CAM_PAIRWISE_KEY_POSITION;
 +                              }
 +
                                key_index = PAIRWISE_KEYIDX;
 -                              entry_id = CAM_PAIRWISE_KEY_POSITION;
                                is_pairwise = true;
                        }
                }
  
                if (rtlpriv->sec.key_len[key_index] == 0) {
                        RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
 -                               ("delete one entry\n"));
 +                               ("delete one entry, entry_id is %d\n",
 +                               entry_id));
 +                      if (mac->opmode == NL80211_IFTYPE_AP)
 +                              rtl_cam_del_entry(hw, p_macaddr);
                        rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
                } else {
                        RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
                }
        }
  }
 +
 +static void rtl8192ce_bt_var_init(struct ieee80211_hw *hw)
 +{
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
 +
 +      rtlpcipriv->bt_coexist.bt_coexistence =
 +                      rtlpcipriv->bt_coexist.eeprom_bt_coexist;
 +      rtlpcipriv->bt_coexist.bt_ant_num =
 +                      rtlpcipriv->bt_coexist.eeprom_bt_ant_num;
 +      rtlpcipriv->bt_coexist.bt_coexist_type =
 +                      rtlpcipriv->bt_coexist.eeprom_bt_type;
 +
 +      if (rtlpcipriv->bt_coexist.reg_bt_iso == 2)
 +              rtlpcipriv->bt_coexist.bt_ant_isolation =
 +                      rtlpcipriv->bt_coexist.eeprom_bt_ant_isolation;
 +      else
 +              rtlpcipriv->bt_coexist.bt_ant_isolation =
 +                      rtlpcipriv->bt_coexist.reg_bt_iso;
 +
 +      rtlpcipriv->bt_coexist.bt_radio_shared_type =
 +                      rtlpcipriv->bt_coexist.eeprom_bt_radio_shared;
 +
 +      if (rtlpcipriv->bt_coexist.bt_coexistence) {
 +
 +              if (rtlpcipriv->bt_coexist.reg_bt_sco == 1)
 +                      rtlpcipriv->bt_coexist.bt_service = BT_OTHER_ACTION;
 +              else if (rtlpcipriv->bt_coexist.reg_bt_sco == 2)
 +                      rtlpcipriv->bt_coexist.bt_service = BT_SCO;
 +              else if (rtlpcipriv->bt_coexist.reg_bt_sco == 4)
 +                      rtlpcipriv->bt_coexist.bt_service = BT_BUSY;
 +              else if (rtlpcipriv->bt_coexist.reg_bt_sco == 5)
 +                      rtlpcipriv->bt_coexist.bt_service = BT_OTHERBUSY;
 +              else
 +                      rtlpcipriv->bt_coexist.bt_service = BT_IDLE;
 +
 +              rtlpcipriv->bt_coexist.bt_edca_ul = 0;
 +              rtlpcipriv->bt_coexist.bt_edca_dl = 0;
 +              rtlpcipriv->bt_coexist.bt_rssi_state = 0xff;
 +      }
 +}
 +
 +void rtl8192ce_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
 +                                            bool auto_load_fail, u8 *hwinfo)
 +{
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
 +      u8 value;
 +
 +      if (!auto_load_fail) {
 +              rtlpcipriv->bt_coexist.eeprom_bt_coexist =
 +                                      ((hwinfo[RF_OPTION1] & 0xe0) >> 5);
 +              value = hwinfo[RF_OPTION4];
 +              rtlpcipriv->bt_coexist.eeprom_bt_type = ((value & 0xe) >> 1);
 +              rtlpcipriv->bt_coexist.eeprom_bt_ant_num = (value & 0x1);
 +              rtlpcipriv->bt_coexist.eeprom_bt_ant_isolation =
 +                                                       ((value & 0x10) >> 4);
 +              rtlpcipriv->bt_coexist.eeprom_bt_radio_shared =
 +                                                       ((value & 0x20) >> 5);
 +      } else {
 +              rtlpcipriv->bt_coexist.eeprom_bt_coexist = 0;
 +              rtlpcipriv->bt_coexist.eeprom_bt_type = BT_2WIRE;
 +              rtlpcipriv->bt_coexist.eeprom_bt_ant_num = ANT_X2;
 +              rtlpcipriv->bt_coexist.eeprom_bt_ant_isolation = 0;
 +              rtlpcipriv->bt_coexist.eeprom_bt_radio_shared = BT_RADIO_SHARED;
 +      }
 +
 +      rtl8192ce_bt_var_init(hw);
 +}
 +
 +void rtl8192ce_bt_reg_init(struct ieee80211_hw *hw)
 +{
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
 +
 +      /* 0:Low, 1:High, 2:From Efuse. */
 +      rtlpcipriv->bt_coexist.reg_bt_iso = 2;
 +      /* 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter. */
 +      rtlpcipriv->bt_coexist.reg_bt_sco = 3;
 +      /* 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU. */
 +      rtlpcipriv->bt_coexist.reg_bt_sco = 0;
 +}
 +
 +
 +void rtl8192ce_bt_hw_init(struct ieee80211_hw *hw)
 +{
 +      struct rtl_priv *rtlpriv = rtl_priv(hw);
 +      struct rtl_phy *rtlphy = &(rtlpriv->phy);
 +      struct rtl_pci_priv *rtlpcipriv = rtl_pcipriv(hw);
 +
 +      u8 u1_tmp;
 +
 +      if (rtlpcipriv->bt_coexist.bt_coexistence &&
 +          ((rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC4) ||
 +            rtlpcipriv->bt_coexist.bt_coexist_type == BT_CSR_BC8)) {
 +
 +              if (rtlpcipriv->bt_coexist.bt_ant_isolation)
 +                      rtl_write_byte(rtlpriv, REG_GPIO_MUXCFG, 0xa0);
 +
 +              u1_tmp = rtl_read_byte(rtlpriv, 0x4fd) &
 +                       BIT_OFFSET_LEN_MASK_32(0, 1);
 +              u1_tmp = u1_tmp |
 +                       ((rtlpcipriv->bt_coexist.bt_ant_isolation == 1) ?
 +                       0 : BIT_OFFSET_LEN_MASK_32(1, 1)) |
 +                       ((rtlpcipriv->bt_coexist.bt_service == BT_SCO) ?
 +                       0 : BIT_OFFSET_LEN_MASK_32(2, 1));
 +              rtl_write_byte(rtlpriv, 0x4fd, u1_tmp);
 +
 +              rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
 +              rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+8, 0xffbd0040);
 +              rtl_write_dword(rtlpriv, REG_BT_COEX_TABLE+0xc, 0x40000010);
 +
 +              /* Config to 1T1R. */
 +              if (rtlphy->rf_type == RF_1T1R) {
 +                      u1_tmp = rtl_read_byte(rtlpriv, ROFDM0_TRXPATHENABLE);
 +                      u1_tmp &= ~(BIT_OFFSET_LEN_MASK_32(1, 1));
 +                      rtl_write_byte(rtlpriv, ROFDM0_TRXPATHENABLE, u1_tmp);
 +
 +                      u1_tmp = rtl_read_byte(rtlpriv, ROFDM1_TRXPATHENABLE);
 +                      u1_tmp &= ~(BIT_OFFSET_LEN_MASK_32(1, 1));
 +                      rtl_write_byte(rtlpriv, ROFDM1_TRXPATHENABLE, u1_tmp);
 +              }
 +      }
 +}
 +
 +void rtl92ce_suspend(struct ieee80211_hw *hw)
 +{
 +}
 +
 +void rtl92ce_resume(struct ieee80211_hw *hw)
 +{
 +}
@@@ -1,5 -1,5 +1,5 @@@
  /**
 - * Copyright (C) 2005 - 2010 ServerEngines
 + * Copyright (C) 2005 - 2011 Emulex
   * All rights reserved.
   *
   * This program is free software; you can redistribute it and/or
@@@ -7,16 -7,16 +7,16 @@@
   * as published by the Free Software Foundation.  The full GNU General
   * Public License is included in this distribution in the file called COPYING.
   *
 - * Written by: Jayamohan Kallickal (jayamohank@serverengines.com)
 + * Written by: Jayamohan Kallickal (jayamohan.kallickal@emulex.com)
   *
   * Contact Information:
 - * linux-drivers@serverengines.com
 - *
 - *  ServerEngines
 - * 209 N. Fair Oaks Ave
 - * Sunnyvale, CA 94085
 + * linux-drivers@emulex.com
   *
 + * Emulex
 + * 3333 Susan Street
 + * Costa Mesa, CA 92626
   */
 +
  #include <linux/reboot.h>
  #include <linux/delay.h>
  #include <linux/slab.h>
@@@ -420,8 -420,7 +420,8 @@@ static int beiscsi_setup_boot_info(stru
        return 0;
  
  free_kset:
 -      iscsi_boot_destroy_kset(phba->boot_kset);
 +      if (phba->boot_kset)
 +              iscsi_boot_destroy_kset(phba->boot_kset);
        return -ENOMEM;
  }
  
@@@ -619,7 -618,7 +619,7 @@@ static void beiscsi_get_params(struct b
                                    + BE2_NOPOUT_REQ));
        phba->params.cxns_per_ctrl = phba->fw_config.iscsi_cid_count;
        phba->params.asyncpdus_per_ctrl = phba->fw_config.iscsi_cid_count * 2;
-       phba->params.icds_per_ctrl = phba->fw_config.iscsi_icd_count;;
+       phba->params.icds_per_ctrl = phba->fw_config.iscsi_icd_count;
        phba->params.num_sge_per_io = BE2_SGE;
        phba->params.defpdu_hdr_sz = BE2_DEFPDU_HDR_SZ;
        phba->params.defpdu_data_sz = BE2_DEFPDU_DATA_SZ;
@@@ -782,7 -781,7 +782,7 @@@ static irqreturn_t be_isr(int irq, voi
        int isr;
  
        phba = dev_id;
-       ctrl = &phba->ctrl;;
+       ctrl = &phba->ctrl;
        isr = ioread32(ctrl->csr + CEV_ISR0_OFFSET +
                       (PCI_FUNC(ctrl->pdev->devfn) * CEV_ISR_SIZE));
        if (!isr)
@@@ -3465,23 -3464,23 +3465,23 @@@ static void hwi_enable_intr(struct beis
        addr = (u8 __iomem *) ((u8 __iomem *) ctrl->pcicfg +
                        PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET);
        reg = ioread32(addr);
 -      SE_DEBUG(DBG_LVL_8, "reg =x%08x\n", reg);
  
        enabled = reg & MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
        if (!enabled) {
                reg |= MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
                SE_DEBUG(DBG_LVL_8, "reg =x%08x addr=%p\n", reg, addr);
                iowrite32(reg, addr);
 -              if (!phba->msix_enabled) {
 -                      eq = &phwi_context->be_eq[0].q;
 +      }
 +
 +      if (!phba->msix_enabled) {
 +              eq = &phwi_context->be_eq[0].q;
 +              SE_DEBUG(DBG_LVL_8, "eq->id=%d\n", eq->id);
 +              hwi_ring_eq_db(phba, eq->id, 0, 0, 1, 1);
 +      } else {
 +              for (i = 0; i <= phba->num_cpus; i++) {
 +                      eq = &phwi_context->be_eq[i].q;
                        SE_DEBUG(DBG_LVL_8, "eq->id=%d\n", eq->id);
                        hwi_ring_eq_db(phba, eq->id, 0, 0, 1, 1);
 -              } else {
 -                      for (i = 0; i <= phba->num_cpus; i++) {
 -                              eq = &phwi_context->be_eq[i].q;
 -                              SE_DEBUG(DBG_LVL_8, "eq->id=%d\n", eq->id);
 -                              hwi_ring_eq_db(phba, eq->id, 0, 0, 1, 1);
 -                      }
                }
        }
  }
@@@ -4020,17 -4019,12 +4020,17 @@@ static int beiscsi_mtask(struct iscsi_t
                hwi_write_buffer(pwrb, task);
                break;
        case ISCSI_OP_NOOP_OUT:
 -              AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
 -                            INI_RD_CMD);
 -              if (task->hdr->ttt == ISCSI_RESERVED_TAG)
 +              if (task->hdr->ttt != ISCSI_RESERVED_TAG) {
 +                      AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
 +                                    TGT_DM_CMD);
 +                      AMAP_SET_BITS(struct amap_iscsi_wrb, cmdsn_itt,
 +                                    pwrb, 0);
                        AMAP_SET_BITS(struct amap_iscsi_wrb, dmsg, pwrb, 0);
 -              else
 +              } else {
 +                      AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
 +                                    INI_RD_CMD);
                        AMAP_SET_BITS(struct amap_iscsi_wrb, dmsg, pwrb, 1);
 +              }
                hwi_write_buffer(pwrb, task);
                break;
        case ISCSI_OP_TEXT:
@@@ -4150,11 -4144,10 +4150,11 @@@ static void beiscsi_remove(struct pci_d
                            phba->ctrl.mbox_mem_alloced.size,
                            phba->ctrl.mbox_mem_alloced.va,
                            phba->ctrl.mbox_mem_alloced.dma);
 +      if (phba->boot_kset)
 +              iscsi_boot_destroy_kset(phba->boot_kset);
        iscsi_host_remove(phba->shost);
        pci_dev_put(phba->pcidev);
        iscsi_host_free(phba->shost);
 -      iscsi_boot_destroy_kset(phba->boot_kset);
  }
  
  static void beiscsi_msix_enable(struct beiscsi_hba *phba)
diff --combined drivers/scsi/constants.c
@@@ -34,7 -34,7 +34,7 @@@
  static const char * cdb_byte0_names[] = {
  /* 00-03 */ "Test Unit Ready", "Rezero Unit/Rewind", NULL, "Request Sense",
  /* 04-07 */ "Format Unit/Medium", "Read Block Limits", NULL,
-           "Reasssign Blocks",
+           "Reassign Blocks",
  /* 08-0d */ "Read(6)", NULL, "Write(6)", "Seek(6)", NULL, NULL,
  /* 0e-12 */ NULL, "Read Reverse", "Write Filemarks", "Space", "Inquiry",  
  /* 13-16 */ "Verify(6)", "Recover Buffered Data", "Mode Select(6)",
@@@ -772,7 -772,6 +772,7 @@@ static const struct error_info addition
        {0x3802, "Esn - power management class event"},
        {0x3804, "Esn - media class event"},
        {0x3806, "Esn - device busy class event"},
 +      {0x3807, "Thin Provisioning soft threshold reached"},
  
        {0x3900, "Saving parameters not supported"},
  
diff --combined drivers/scsi/esp_scsi.c
@@@ -708,7 -708,8 +708,7 @@@ static void esp_maybe_execute_command(s
        tp = &esp->target[tgt];
        lp = dev->hostdata;
  
 -      list_del(&ent->list);
 -      list_add(&ent->list, &esp->active_cmds);
 +      list_move(&ent->list, &esp->active_cmds);
  
        esp->active_cmd = ent;
  
@@@ -1058,7 -1059,7 +1058,7 @@@ static struct esp_cmd_entry *esp_reconn
        esp->ops->send_dma_cmd(esp, esp->command_block_dma,
                               2, 2, 1, ESP_CMD_DMA | ESP_CMD_TI);
  
-       /* ACK the msssage.  */
+       /* ACK the message.  */
        scsi_esp_cmd(esp, ESP_CMD_MOK);
  
        for (i = 0; i < ESP_RESELECT_TAG_LIMIT; i++) {
@@@ -1243,7 -1244,8 +1243,7 @@@ static int esp_finish_select(struct es
                /* Now that the state is unwound properly, put back onto
                 * the issue queue.  This command is no longer active.
                 */
 -              list_del(&ent->list);
 -              list_add(&ent->list, &esp->queued_cmds);
 +              list_move(&ent->list, &esp->queued_cmds);
                esp->active_cmd = NULL;
  
                /* Return value ignored by caller, it directly invokes
@@@ -598,7 -598,7 +598,7 @@@ lpfc_bsg_rport_els(struct fc_bsg_job *j
        dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
        dd_data->context_un.iocb.rspiocbq = rspiocbq;
        dd_data->context_un.iocb.set_job = job;
-       dd_data->context_un.iocb.bmp = NULL;;
+       dd_data->context_un.iocb.bmp = NULL;
        dd_data->context_un.iocb.ndlp = ndlp;
  
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
@@@ -2426,7 -2426,6 +2426,7 @@@ lpfc_bsg_wake_mbox_wait(struct lpfc_hb
  {
        struct bsg_job_data *dd_data;
        struct fc_bsg_job *job;
 +      struct lpfc_mbx_nembed_cmd *nembed_sge;
        uint32_t size;
        unsigned long flags;
        uint8_t *to;
                        memcpy(to, from, size);
                } else if ((phba->sli_rev == LPFC_SLI_REV4) &&
                        (pmboxq->u.mb.mbxCommand == MBX_SLI4_CONFIG)) {
 -                      struct lpfc_mbx_nembed_cmd *nembed_sge =
 -                              (struct lpfc_mbx_nembed_cmd *)
 -                              &pmboxq->u.mb.un.varWords[0];
 +                      nembed_sge = (struct lpfc_mbx_nembed_cmd *)
 +                                      &pmboxq->u.mb.un.varWords[0];
  
                        from = (uint8_t *)dd_data->context_un.mbox.dmp->dma.
                                                virt;
                                        job->reply_payload.sg_cnt,
                                        from, size);
                job->reply->result = 0;
 -
 +              /* need to hold the lock until we set job->dd_data to NULL
 +               * to hold off the timeout handler returning to the mid-layer
 +               * while we are still processing the job.
 +               */
                job->dd_data = NULL;
 +              dd_data->context_un.mbox.set_job = NULL;
 +              spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
                job->job_done(job);
 +      } else {
 +              dd_data->context_un.mbox.set_job = NULL;
 +              spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
        }
 -      dd_data->context_un.mbox.set_job = NULL;
 -      /* need to hold the lock until we call job done to hold off
 -       * the timeout handler returning to the midlayer while
 -       * we are stillprocessing the job
 -       */
 -      spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
  
        kfree(dd_data->context_un.mbox.mb);
        mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
@@@ -2646,11 -2644,6 +2646,11 @@@ lpfc_bsg_issue_mbox(struct lpfc_hba *ph
        struct ulp_bde64 *rxbpl = NULL;
        struct dfc_mbox_req *mbox_req = (struct dfc_mbox_req *)
                job->request->rqst_data.h_vendor.vendor_cmd;
 +      struct READ_EVENT_LOG_VAR *rdEventLog;
 +      uint32_t transmit_length, receive_length, mode;
 +      struct lpfc_mbx_nembed_cmd *nembed_sge;
 +      struct mbox_header *header;
 +      struct ulp_bde64 *bde;
        uint8_t *ext = NULL;
        int rc = 0;
        uint8_t *from;
        /* in case no data is transferred */
        job->reply->reply_payload_rcv_len = 0;
  
 +      /* sanity check to protect driver */
 +      if (job->reply_payload.payload_len > BSG_MBOX_SIZE ||
 +          job->request_payload.payload_len > BSG_MBOX_SIZE) {
 +              rc = -ERANGE;
 +              goto job_done;
 +      }
 +
        /* check if requested extended data lengths are valid */
 -      if ((mbox_req->inExtWLen > MAILBOX_EXT_SIZE) ||
 -              (mbox_req->outExtWLen > MAILBOX_EXT_SIZE)) {
 +      if ((mbox_req->inExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t)) ||
 +          (mbox_req->outExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t))) {
                rc = -ERANGE;
                goto job_done;
        }
         * use ours
         */
        if (pmb->mbxCommand == MBX_RUN_BIU_DIAG64) {
 -              uint32_t transmit_length = pmb->un.varWords[1];
 -              uint32_t receive_length = pmb->un.varWords[4];
 +              transmit_length = pmb->un.varWords[1];
 +              receive_length = pmb->un.varWords[4];
                /* transmit length cannot be greater than receive length or
                 * mailbox extension size
                 */
                from += sizeof(MAILBOX_t);
                memcpy((uint8_t *)dmp->dma.virt, from, transmit_length);
        } else if (pmb->mbxCommand == MBX_READ_EVENT_LOG) {
 -              struct READ_EVENT_LOG_VAR *rdEventLog =
 -                      &pmb->un.varRdEventLog ;
 -              uint32_t receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
 -              uint32_t mode =  bf_get(lpfc_event_log, rdEventLog);
 +              rdEventLog = &pmb->un.varRdEventLog;
 +              receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
 +              mode = bf_get(lpfc_event_log, rdEventLog);
  
                /* receive length cannot be greater than mailbox
                 * extension size
                        /* rebuild the command for sli4 using our own buffers
                        * like we do for biu diags
                        */
 -                      uint32_t receive_length = pmb->un.varWords[2];
 +                      receive_length = pmb->un.varWords[2];
                        /* receive length cannot be greater than mailbox
                         * extension size
                         */
                        pmb->un.varWords[4] = putPaddrHigh(dmp->dma.phys);
                } else if ((pmb->mbxCommand == MBX_UPDATE_CFG) &&
                        pmb->un.varUpdateCfg.co) {
 -                      struct ulp_bde64 *bde =
 -                              (struct ulp_bde64 *)&pmb->un.varWords[4];
 +                      bde = (struct ulp_bde64 *)&pmb->un.varWords[4];
  
                        /* bde size cannot be greater than mailbox ext size */
                        if (bde->tus.f.bdeSize > MAILBOX_EXT_SIZE) {
                        memcpy((uint8_t *)dmp->dma.virt, from,
                                bde->tus.f.bdeSize);
                } else if (pmb->mbxCommand == MBX_SLI4_CONFIG) {
 -                      struct lpfc_mbx_nembed_cmd *nembed_sge;
 -                      struct mbox_header *header;
 -                      uint32_t receive_length;
 -
                        /* rebuild the command for sli4 using our own buffers
                        * like we do for biu diags
                        */
@@@ -3394,7 -3386,6 +3394,7 @@@ no_dd_data
        job->dd_data = NULL;
        return rc;
  }
 +
  /**
   * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
   * @job: fc_bsg_job to handle
@@@ -3040,7 -3040,7 +3040,7 @@@ lpfc_sli_sp_handle_rspiocb(struct lpfc_
        list_add_tail(&rspiocbp->list, &(pring->iocb_continueq));
        pring->iocb_continueq_cnt++;
  
-       /* Now, determine whetehr the list is completed for processing */
+       /* Now, determine whether the list is completed for processing */
        irsp = &rspiocbp->iocb;
        if (irsp->ulpLe) {
                /*
@@@ -4769,7 -4769,8 +4769,7 @@@ lpfc_sli4_hba_setup(struct lpfc_hba *ph
        else
                phba->hba_flag &= ~HBA_FIP_SUPPORT;
  
 -      if (phba->sli_rev != LPFC_SLI_REV4 ||
 -          !(phba->hba_flag & HBA_FCOE_MODE)) {
 +      if (phba->sli_rev != LPFC_SLI_REV4) {
                lpfc_printf_log(phba, KERN_ERR, LOG_MBOX | LOG_SLI,
                        "0376 READ_REV Error. SLI Level %d "
                        "FCoE enabled %d\n",
                lpfc_reg_fcfi(phba, mboxq);
                mboxq->vport = phba->pport;
                rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
 -              if (rc == MBX_SUCCESS)
 -                      rc = 0;
 -              else
 +              if (rc != MBX_SUCCESS)
                        goto out_unset_queue;
 +              rc = 0;
 +              phba->fcf.fcfi = bf_get(lpfc_reg_fcfi_fcfi,
 +                                      &mboxq->u.mqe.un.reg_fcfi);
        }
        /*
         * The port is ready, set the host's link state to LINK_DOWN
@@@ -6402,7 -6402,6 +6402,7 @@@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phb
        uint32_t els_id = LPFC_ELS_ID_DEFAULT;
        int numBdes, i;
        struct ulp_bde64 bde;
 +      struct lpfc_nodelist *ndlp;
  
        fip = phba->hba_flag & HBA_FIP_SUPPORT;
        /* The fcp commands will set command type */
  
        switch (iocbq->iocb.ulpCommand) {
        case CMD_ELS_REQUEST64_CR:
 +              ndlp = (struct lpfc_nodelist *)iocbq->context1;
                if (!iocbq->iocb.ulpLe) {
                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "2007 Only Limited Edition cmd Format"
                        els_id = ((iocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK)
                                        >> LPFC_FIP_ELS_ID_SHIFT);
                }
 +              bf_set(wqe_temp_rpi, &wqe->els_req.wqe_com, ndlp->nlp_rpi);
                bf_set(wqe_els_id, &wqe->els_req.wqe_com, els_id);
                bf_set(wqe_dbde, &wqe->els_req.wqe_com, 1);
                bf_set(wqe_iod, &wqe->els_req.wqe_com, LPFC_WQE_IOD_READ);
                command_type = OTHER_COMMAND;
        break;
        case CMD_XMIT_ELS_RSP64_CX:
 +              ndlp = (struct lpfc_nodelist *)iocbq->context1;
                /* words0-2 BDE memcpy */
                /* word3 iocb=iotag32 wqe=response_payload_len */
                wqe->xmit_els_rsp.response_payload_len = xmit_len;
                bf_set(wqe_lenloc, &wqe->xmit_els_rsp.wqe_com,
                       LPFC_WQE_LENLOC_WORD3);
                bf_set(wqe_ebde_cnt, &wqe->xmit_els_rsp.wqe_com, 0);
 +              bf_set(wqe_rsp_temp_rpi, &wqe->xmit_els_rsp, ndlp->nlp_rpi);
                command_type = OTHER_COMMAND;
        break;
        case CMD_CLOSE_XRI_CN:
@@@ -10527,8 -10522,8 +10527,8 @@@ lpfc_cq_create(struct lpfc_hba *phba, s
        bf_set(lpfc_mbox_hdr_version, &shdr->request,
               phba->sli4_hba.pc_sli4_params.cqv);
        if (phba->sli4_hba.pc_sli4_params.cqv == LPFC_Q_CREATE_VERSION_2) {
 -              bf_set(lpfc_mbx_cq_create_page_size, &cq_create->u.request,
 -                     (PAGE_SIZE/SLI4_PAGE_SIZE));
 +              /* FW only supports 1. Should be PAGE_SIZE/SLI4_PAGE_SIZE */
 +              bf_set(lpfc_mbx_cq_create_page_size, &cq_create->u.request, 1);
                bf_set(lpfc_cq_eq_id_2, &cq_create->u.request.context,
                       eq->queue_id);
        } else {
@@@ -10972,12 -10967,6 +10972,12 @@@ lpfc_rq_create(struct lpfc_hba *phba, s
                       &rq_create->u.request.context,
                       hrq->entry_count);
                rq_create->u.request.context.buffer_size = LPFC_HDR_BUF_SIZE;
 +              bf_set(lpfc_rq_context_rqe_size,
 +                     &rq_create->u.request.context,
 +                     LPFC_RQE_SIZE_8);
 +              bf_set(lpfc_rq_context_page_size,
 +                     &rq_create->u.request.context,
 +                     (PAGE_SIZE/SLI4_PAGE_SIZE));
        } else {
                switch (hrq->entry_count) {
                default:
               phba->sli4_hba.pc_sli4_params.rqv);
        if (phba->sli4_hba.pc_sli4_params.rqv == LPFC_Q_CREATE_VERSION_1) {
                bf_set(lpfc_rq_context_rqe_count_1,
 -                     &rq_create->u.request.context,
 -                     hrq->entry_count);
 +                     &rq_create->u.request.context, hrq->entry_count);
                rq_create->u.request.context.buffer_size = LPFC_DATA_BUF_SIZE;
 +              bf_set(lpfc_rq_context_rqe_size, &rq_create->u.request.context,
 +                     LPFC_RQE_SIZE_8);
 +              bf_set(lpfc_rq_context_page_size, &rq_create->u.request.context,
 +                     (PAGE_SIZE/SLI4_PAGE_SIZE));
        } else {
                switch (drq->entry_count) {
                default:
@@@ -1,6 -1,6 +1,6 @@@
  /*
   * QLogic Fibre Channel HBA Driver
 - * Copyright (c)  2003-2010 QLogic Corporation
 + * Copyright (c)  2003-2011 QLogic Corporation
   *
   * See LICENSE.qla2xxx for copyright and licensing details.
   */
@@@ -843,10 -843,7 +843,10 @@@ qla2x00_process_completed_request(struc
                qla_printk(KERN_WARNING, ha,
                    "Invalid SCSI completion handle %d.\n", index);
  
 -              set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 +              if (IS_QLA82XX(ha))
 +                      set_bit(FCOE_CTX_RESET_NEEDED, &vha->dpc_flags);
 +              else
 +                      set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                return;
        }
  
                qla_printk(KERN_WARNING, ha,
                    "Invalid ISP SCSI completion handle\n");
  
 -              set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 +              if (IS_QLA82XX(ha))
 +                      set_bit(FCOE_CTX_RESET_NEEDED, &vha->dpc_flags);
 +              else
 +                      set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
        }
  }
  
@@@ -884,10 -878,7 +884,10 @@@ qla2x00_get_sp_from_handle(scsi_qla_hos
        if (index >= MAX_OUTSTANDING_COMMANDS) {
                qla_printk(KERN_WARNING, ha,
                    "%s: Invalid completion handle (%x).\n", func, index);
 -              set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 +              if (IS_QLA82XX(ha))
 +                      set_bit(FCOE_CTX_RESET_NEEDED, &vha->dpc_flags);
 +              else
 +                      set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                goto done;
        }
        sp = req->outstanding_cmds[index];
@@@ -1060,7 -1051,7 +1060,7 @@@ qla2x00_ct_entry(scsi_qla_host_t *vha, 
                }
                DEBUG2(qla2x00_dump_buffer((uint8_t *)pkt, sizeof(*pkt)));
        } else {
-               bsg_job->reply->result =  DID_OK << 16;;
+               bsg_job->reply->result =  DID_OK << 16;
                bsg_job->reply->reply_payload_rcv_len =
                    bsg_job->reply_payload.payload_len;
                bsg_job->reply_len = 0;
@@@ -1155,7 -1146,7 +1155,7 @@@ qla24xx_els_ct_entry(scsi_qla_host_t *v
                DEBUG2(qla2x00_dump_buffer((uint8_t *)pkt, sizeof(*pkt)));
        }
        else {
-               bsg_job->reply->result =  DID_OK << 16;;
+               bsg_job->reply->result =  DID_OK << 16;
                bsg_job->reply->reply_payload_rcv_len = bsg_job->reply_payload.payload_len;
                bsg_job->reply_len = 0;
        }
@@@ -1573,10 -1564,7 +1573,10 @@@ qla2x00_status_entry(scsi_qla_host_t *v
                    "scsi(%ld): Invalid status handle (0x%x).\n", vha->host_no,
                    sts->handle);
  
 -              set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 +              if (IS_QLA82XX(ha))
 +                      set_bit(FCOE_CTX_RESET_NEEDED, &vha->dpc_flags);
 +              else
 +                      set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                qla2xxx_wake_dpc(vha);
                return;
        }
        if (logit)
                DEBUG2(qla_printk(KERN_INFO, ha,
                    "scsi(%ld:%d:%d) FCP command status: 0x%x-0x%x (0x%x) "
 -                  "oxid=0x%x cdb=%02x%02x%02x len=0x%x "
 +                  "portid=%02x%02x%02x oxid=0x%x cdb=%02x%02x%02x len=0x%x "
                    "rsp_info=0x%x resid=0x%x fw_resid=0x%x\n", vha->host_no,
                    cp->device->id, cp->device->lun, comp_status, scsi_status,
 -                  cp->result, ox_id, cp->cmnd[0],
 -                  cp->cmnd[1], cp->cmnd[2], scsi_bufflen(cp), rsp_info_len,
 -                  resid_len, fw_resid_len));
 +                  cp->result, fcport->d_id.b.domain, fcport->d_id.b.area,
 +                  fcport->d_id.b.al_pa, ox_id, cp->cmnd[0], cp->cmnd[1],
 +                  cp->cmnd[2], scsi_bufflen(cp), rsp_info_len, resid_len,
 +                  fw_resid_len));
  
        if (rsp->status_srb == NULL)
                qla2x00_sp_compl(ha, sp);
@@@ -1921,17 -1908,13 +1921,17 @@@ qla2x00_error_entry(scsi_qla_host_t *vh
                qla2x00_sp_compl(ha, sp);
  
        } else if (pkt->entry_type == COMMAND_A64_TYPE || pkt->entry_type ==
 -          COMMAND_TYPE || pkt->entry_type == COMMAND_TYPE_7) {
 +              COMMAND_TYPE || pkt->entry_type == COMMAND_TYPE_7
 +              || pkt->entry_type == COMMAND_TYPE_6) {
                DEBUG2(printk("scsi(%ld): Error entry - invalid handle\n",
 -                  vha->host_no));
 +                      vha->host_no));
                qla_printk(KERN_WARNING, ha,
 -                  "Error entry - invalid handle\n");
 +                      "Error entry - invalid handle\n");
  
 -              set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 +              if (IS_QLA82XX(ha))
 +                      set_bit(FCOE_CTX_RESET_NEEDED, &vha->dpc_flags);
 +              else
 +                      set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
                qla2xxx_wake_dpc(vha);
        }
  }
diff --combined fs/partitions/ldm.c
@@@ -565,7 -565,7 +565,7 @@@ static bool ldm_validate_partition_tabl
  
        data = read_part_sector(state, 0, &sect);
        if (!data) {
-               ldm_crit ("Disk read failed.");
+               ldm_info ("Disk read failed.");
                return false;
        }
  
@@@ -1335,11 -1335,6 +1335,11 @@@ static bool ldm_frag_add (const u8 *dat
  
        list_add_tail (&f->list, frags);
  found:
 +      if (rec >= f->num) {
 +              ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
 +              return false;
 +      }
 +
        if (f->map & (1 << rec)) {
                ldm_error ("Duplicate VBLK, part %d.", rec);
                f->map &= 0x7F;                 /* Mark the group as broken */
diff --combined lib/Kconfig.debug
@@@ -7,7 -7,8 +7,8 @@@ config PRINTK_TIM
          included in printk output.  This allows you to measure
          the interval between kernel operations, including bootup
          operations.  This is useful for identifying long delays
-         in kernel startup.
+         in kernel startup.  Or add printk.time=1 at boot-time.
+         See Documentation/kernel-parameters.txt
  
  config DEFAULT_MESSAGE_LOGLEVEL
        int "Default message log level (1-7)"
@@@ -238,21 -239,6 +239,21 @@@ config DETECT_HUNG_TAS
          enabled then all held locks will also be reported. This
          feature has negligible overhead.
  
 +config DEFAULT_HUNG_TASK_TIMEOUT
 +      int "Default timeout for hung task detection (in seconds)"
 +      depends on DETECT_HUNG_TASK
 +      default 120
 +      help
 +        This option controls the default timeout (in seconds) used
 +        to determine when a task has become non-responsive and should
 +        be considered hung.
 +
 +        It can be adjusted at runtime via the kernel.hung_task_timeout
 +        sysctl or by writing a value to /proc/sys/kernel/hung_task_timeout.
 +
 +        A timeout of 0 disables the check.  The default is two minutes.
 +        Keeping the default should be fine in most cases.
 +
  config BOOTPARAM_HUNG_TASK_PANIC
        bool "Panic (Reboot) On Hung Tasks"
        depends on DETECT_HUNG_TASK
@@@ -352,7 -338,7 +353,7 @@@ config DEBUG_OBJECTS_WOR
  
  config DEBUG_OBJECTS_RCU_HEAD
        bool "Debug RCU callbacks objects"
 -      depends on DEBUG_OBJECTS && PREEMPT
 +      depends on DEBUG_OBJECTS
        help
          Enable this to turn on debugging of RCU list heads (call_rcu() usage).
  
@@@ -413,9 -399,9 +414,9 @@@ config SLUB_STAT
  config DEBUG_KMEMLEAK
        bool "Kernel memory leak detector"
        depends on DEBUG_KERNEL && EXPERIMENTAL && !MEMORY_HOTPLUG && \
 -              (X86 || ARM || PPC || S390 || SPARC64 || SUPERH || MICROBLAZE || TILE)
 +              (X86 || ARM || PPC || MIPS || S390 || SPARC64 || SUPERH || MICROBLAZE || TILE)
  
 -      select DEBUG_FS if SYSFS
 +      select DEBUG_FS
        select STACKTRACE if STACKTRACE_SUPPORT
        select KALLSYMS
        select CRC32
@@@ -890,9 -876,22 +891,9 @@@ config RCU_TORTURE_TEST_RUNNABL
          Say N here if you want the RCU torture tests to start only
          after being manually enabled via /proc.
  
 -config RCU_CPU_STALL_DETECTOR
 -      bool "Check for stalled CPUs delaying RCU grace periods"
 -      depends on TREE_RCU || TREE_PREEMPT_RCU
 -      default y
 -      help
 -        This option causes RCU to printk information on which
 -        CPUs are delaying the current grace period, but only when
 -        the grace period extends for excessive time periods.
 -
 -        Say N if you want to disable such checks.
 -
 -        Say Y if you are unsure.
 -
  config RCU_CPU_STALL_TIMEOUT
        int "RCU CPU stall timeout in seconds"
 -      depends on RCU_CPU_STALL_DETECTOR
 +      depends on TREE_RCU || TREE_PREEMPT_RCU
        range 3 300
        default 60
        help
          RCU grace period persists, additional CPU stall warnings are
          printed at more widely spaced intervals.
  
 -config RCU_CPU_STALL_DETECTOR_RUNNABLE
 -      bool "RCU CPU stall checking starts automatically at boot"
 -      depends on RCU_CPU_STALL_DETECTOR
 -      default y
 -      help
 -        If set, start checking for RCU CPU stalls immediately on
 -        boot.  Otherwise, RCU CPU stall checking must be manually
 -        enabled.
 -
 -        Say Y if you are unsure.
 -
 -        Say N if you wish to suppress RCU CPU stall checking during boot.
 -
  config RCU_CPU_STALL_VERBOSE
        bool "Print additional per-task information for RCU_CPU_STALL_DETECTOR"
 -      depends on RCU_CPU_STALL_DETECTOR && TREE_PREEMPT_RCU
 +      depends on TREE_PREEMPT_RCU
        default y
        help
          This option causes RCU to printk detailed per-task information
diff --combined lib/vsprintf.c
@@@ -797,7 -797,7 +797,7 @@@ char *uuid_string(char *buf, char *end
        return string(buf, end, uuid, spec);
  }
  
 -int kptr_restrict = 1;
 +int kptr_restrict __read_mostly;
  
  /*
   * Show a '%p' thing.  A kernel extension is that the '%p' is followed
@@@ -1161,8 -1161,7 +1161,7 @@@ qualifier
   * return is greater than or equal to @size, the resulting
   * string is truncated.
   *
-  * Call this function if you are already dealing with a va_list.
-  * You probably want snprintf() instead.
+  * If you're not already dealing with a va_list consider using snprintf().
   */
  int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
  {
@@@ -1336,8 -1335,7 +1335,7 @@@ EXPORT_SYMBOL(vsnprintf)
   * the @buf not including the trailing '\0'. If @size is == 0 the function
   * returns 0.
   *
-  * Call this function if you are already dealing with a va_list.
-  * You probably want scnprintf() instead.
+  * If you're not already dealing with a va_list consider using scnprintf().
   *
   * See the vsnprintf() documentation for format string extensions over C99.
   */
@@@ -1416,8 -1414,7 +1414,7 @@@ EXPORT_SYMBOL(scnprintf)
   * into @buf. Use vsnprintf() or vscnprintf() in order to avoid
   * buffer overflows.
   *
-  * Call this function if you are already dealing with a va_list.
-  * You probably want sprintf() instead.
+  * If you're not already dealing with a va_list consider using sprintf().
   *
   * See the vsnprintf() documentation for format string extensions over C99.
   */
diff --combined mm/page_alloc.c
@@@ -54,7 -54,6 +54,7 @@@
  #include <trace/events/kmem.h>
  #include <linux/ftrace_event.h>
  #include <linux/memcontrol.h>
 +#include <linux/prefetch.h>
  
  #include <asm/tlbflush.h>
  #include <asm/div64.h>
@@@ -2318,21 -2317,6 +2318,21 @@@ void free_pages(unsigned long addr, uns
  
  EXPORT_SYMBOL(free_pages);
  
 +static void *make_alloc_exact(unsigned long addr, unsigned order, size_t size)
 +{
 +      if (addr) {
 +              unsigned long alloc_end = addr + (PAGE_SIZE << order);
 +              unsigned long used = addr + PAGE_ALIGN(size);
 +
 +              split_page(virt_to_page((void *)addr), order);
 +              while (used < alloc_end) {
 +                      free_page(used);
 +                      used += PAGE_SIZE;
 +              }
 +      }
 +      return (void *)addr;
 +}
 +
  /**
   * alloc_pages_exact - allocate an exact number physically-contiguous pages.
   * @size: the number of bytes to allocate
@@@ -2352,32 -2336,21 +2352,32 @@@ void *alloc_pages_exact(size_t size, gf
        unsigned long addr;
  
        addr = __get_free_pages(gfp_mask, order);
 -      if (addr) {
 -              unsigned long alloc_end = addr + (PAGE_SIZE << order);
 -              unsigned long used = addr + PAGE_ALIGN(size);
 -
 -              split_page(virt_to_page((void *)addr), order);
 -              while (used < alloc_end) {
 -                      free_page(used);
 -                      used += PAGE_SIZE;
 -              }
 -      }
 -
 -      return (void *)addr;
 +      return make_alloc_exact(addr, order, size);
  }
  EXPORT_SYMBOL(alloc_pages_exact);
  
 +/**
 + * alloc_pages_exact_nid - allocate an exact number of physically-contiguous
 + *                       pages on a node.
 + * @nid: the preferred node ID where memory should be allocated
 + * @size: the number of bytes to allocate
 + * @gfp_mask: GFP flags for the allocation
 + *
 + * Like alloc_pages_exact(), but try to allocate on node nid first before falling
 + * back.
 + * Note this is not alloc_pages_exact_node() which allocates on a specific node,
 + * but is not exact.
 + */
 +void *alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask)
 +{
 +      unsigned order = get_order(size);
 +      struct page *p = alloc_pages_node(nid, gfp_mask, order);
 +      if (!p)
 +              return NULL;
 +      return make_alloc_exact((unsigned long)page_address(p), order, size);
 +}
 +EXPORT_SYMBOL(alloc_pages_exact_nid);
 +
  /**
   * free_pages_exact - release memory allocated via alloc_pages_exact()
   * @virt: the value returned by alloc_pages_exact.
@@@ -3541,7 -3514,7 +3541,7 @@@ static void setup_pagelist_highmark(str
                pcp->batch = PAGE_SHIFT * 8;
  }
  
- static __meminit void setup_zone_pageset(struct zone *zone)
+ static void setup_zone_pageset(struct zone *zone)
  {
        int cpu;
  
@@@ -3591,7 -3564,7 +3591,7 @@@ int zone_wait_table_init(struct zone *z
  
        if (!slab_is_available()) {
                zone->wait_table = (wait_queue_head_t *)
 -                      alloc_bootmem_node(pgdat, alloc_size);
 +                      alloc_bootmem_node_nopanic(pgdat, alloc_size);
        } else {
                /*
                 * This case means that a zone whose size was 0 gets new memory
@@@ -4168,8 -4141,7 +4168,8 @@@ static void __init setup_usemap(struct 
        unsigned long usemapsize = usemap_size(zonesize);
        zone->pageblock_flags = NULL;
        if (usemapsize)
 -              zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
 +              zone->pageblock_flags = alloc_bootmem_node_nopanic(pgdat,
 +                                                                 usemapsize);
  }
  #else
  static inline void setup_usemap(struct pglist_data *pgdat,
@@@ -4335,7 -4307,7 +4335,7 @@@ static void __init_refok alloc_node_mem
                size =  (end - start) * sizeof(struct page);
                map = alloc_remap(pgdat->node_id, size);
                if (!map)
 -                      map = alloc_bootmem_node(pgdat, size);
 +                      map = alloc_bootmem_node_nopanic(pgdat, size);
                pgdat->node_mem_map = map + (pgdat->node_start_pfn - start);
        }
  #ifndef CONFIG_NEED_MULTIPLE_NODES
@@@ -280,7 -280,7 +280,7 @@@ static ssize_t sel_write_disable(struc
  
        length = -ENOMEM;
        if (count >= PAGE_SIZE)
-               goto out;;
+               goto out;
  
        /* No partial writes. */
        length = -EINVAL;
@@@ -876,12 -876,12 +876,12 @@@ static ssize_t sel_write_user(struct fi
  
        length = task_has_security(current, SECURITY__COMPUTE_USER);
        if (length)
-               goto out;;
+               goto out;
  
        length = -ENOMEM;
        con = kzalloc(size + 1, GFP_KERNEL);
        if (!con)
-               goto out;;
+               goto out;
  
        length = -ENOMEM;
        user = kzalloc(size + 1, GFP_KERNEL);
@@@ -941,7 -941,7 +941,7 @@@ static ssize_t sel_write_member(struct 
        length = -ENOMEM;
        scon = kzalloc(size + 1, GFP_KERNEL);
        if (!scon)
-               goto out;;
+               goto out;
  
        length = -ENOMEM;
        tcon = kzalloc(size + 1, GFP_KERNEL);
@@@ -1380,14 -1380,10 +1380,14 @@@ static int sel_avc_stats_seq_show(struc
        if (v == SEQ_START_TOKEN)
                seq_printf(seq, "lookups hits misses allocations reclaims "
                           "frees\n");
 -      else
 -              seq_printf(seq, "%u %u %u %u %u %u\n", st->lookups,
 -                         st->hits, st->misses, st->allocations,
 +      else {
 +              unsigned int lookups = st->lookups;
 +              unsigned int misses = st->misses;
 +              unsigned int hits = lookups - misses;
 +              seq_printf(seq, "%u %u %u %u %u %u\n", lookups,
 +                         hits, misses, st->allocations,
                           st->reclaims, st->frees);
 +      }
        return 0;
  }