Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6
[safe/jmp/linux-2.6] / drivers / net / wireless / b43legacy / main.c
index f0e56df..ef829ee 100644 (file)
@@ -3,7 +3,7 @@
  *  Broadcom B43legacy wireless driver
  *
  *  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
- *  Copyright (c) 2005 Stefano Brivio <st3@riseup.net>
+ *  Copyright (c) 2005-2008 Stefano Brivio <stefano.brivio@polimi.it>
  *  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
  *  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
  *  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
@@ -60,6 +60,8 @@ MODULE_AUTHOR("Stefano Brivio");
 MODULE_AUTHOR("Michael Buesch");
 MODULE_LICENSE("GPL");
 
+MODULE_FIRMWARE(B43legacy_SUPPORTED_FIRMWARE_ID);
+
 #if defined(CONFIG_B43LEGACY_DMA) && defined(CONFIG_B43LEGACY_PIO)
 static int modparam_pio;
 module_param_named(pio, modparam_pio, int, 0444);
@@ -75,18 +77,6 @@ module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
 MODULE_PARM_DESC(bad_frames_preempt, "enable(1) / disable(0) Bad Frames"
                 " Preemption");
 
-static int modparam_short_retry = B43legacy_DEFAULT_SHORT_RETRY_LIMIT;
-module_param_named(short_retry, modparam_short_retry, int, 0444);
-MODULE_PARM_DESC(short_retry, "Short-Retry-Limit (0 - 15)");
-
-static int modparam_long_retry = B43legacy_DEFAULT_LONG_RETRY_LIMIT;
-module_param_named(long_retry, modparam_long_retry, int, 0444);
-MODULE_PARM_DESC(long_retry, "Long-Retry-Limit (0 - 15)");
-
-static int modparam_noleds;
-module_param_named(noleds, modparam_noleds, int, 0444);
-MODULE_PARM_DESC(noleds, "Turn off all LED activity");
-
 static char modparam_fwpostfix[16];
 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
 MODULE_PARM_DESC(fwpostfix, "Postfix for the firmware files to load.");
@@ -105,28 +95,29 @@ MODULE_DEVICE_TABLE(ssb, b43legacy_ssb_tbl);
  * data in there. This data is the same for all devices, so we don't
  * get concurrency issues */
 #define RATETAB_ENT(_rateid, _flags) \
-       {                                                       \
-               .rate   = B43legacy_RATE_TO_100KBPS(_rateid),   \
-               .val    = (_rateid),                            \
-               .val2   = (_rateid),                            \
-               .flags  = (_flags),                             \
+       {                                                               \
+               .bitrate        = B43legacy_RATE_TO_100KBPS(_rateid),   \
+               .hw_value       = (_rateid),                            \
+               .flags          = (_flags),                             \
        }
+/*
+ * NOTE: When changing this, sync with xmit.c's
+ *      b43legacy_plcp_get_bitrate_idx_* functions!
+ */
 static struct ieee80211_rate __b43legacy_ratetable[] = {
-       RATETAB_ENT(B43legacy_CCK_RATE_1MB, IEEE80211_RATE_CCK),
-       RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43legacy_OFDM_RATE_6MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_9MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_12MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_18MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_24MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_36MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_48MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43legacy_OFDM_RATE_54MB, IEEE80211_RATE_OFDM),
+       RATETAB_ENT(B43legacy_CCK_RATE_1MB, 0),
+       RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43legacy_OFDM_RATE_6MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_9MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_12MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_18MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_24MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_36MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_48MB, 0),
+       RATETAB_ENT(B43legacy_OFDM_RATE_54MB, 0),
 };
-#define b43legacy_a_ratetable          (__b43legacy_ratetable + 4)
-#define b43legacy_a_ratetable_size     8
 #define b43legacy_b_ratetable          (__b43legacy_ratetable + 0)
 #define b43legacy_b_ratetable_size     4
 #define b43legacy_g_ratetable          (__b43legacy_ratetable + 0)
@@ -134,14 +125,8 @@ static struct ieee80211_rate __b43legacy_ratetable[] = {
 
 #define CHANTAB_ENT(_chanid, _freq) \
        {                                                       \
-               .chan   = (_chanid),                            \
-               .freq   = (_freq),                              \
-               .val    = (_chanid),                            \
-               .flag   = IEEE80211_CHAN_W_SCAN |               \
-                         IEEE80211_CHAN_W_ACTIVE_SCAN |        \
-                         IEEE80211_CHAN_W_IBSS,                \
-               .power_level    = 0x0A,                         \
-               .antenna_max    = 0xFF,                         \
+               .center_freq    = (_freq),                      \
+               .hw_value       = (_chanid),                    \
        }
 static struct ieee80211_channel b43legacy_bg_chantable[] = {
        CHANTAB_ENT(1, 2412),
@@ -159,7 +144,20 @@ static struct ieee80211_channel b43legacy_bg_chantable[] = {
        CHANTAB_ENT(13, 2472),
        CHANTAB_ENT(14, 2484),
 };
-#define b43legacy_bg_chantable_size    ARRAY_SIZE(b43legacy_bg_chantable)
+
+static struct ieee80211_supported_band b43legacy_band_2GHz_BPHY = {
+       .channels = b43legacy_bg_chantable,
+       .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
+       .bitrates = b43legacy_b_ratetable,
+       .n_bitrates = b43legacy_b_ratetable_size,
+};
+
+static struct ieee80211_supported_band b43legacy_band_2GHz_GPHY = {
+       .channels = b43legacy_bg_chantable,
+       .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
+       .bitrates = b43legacy_g_ratetable,
+       .n_bitrates = b43legacy_g_ratetable_size,
+};
 
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev);
 static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev);
@@ -237,8 +235,8 @@ static void b43legacy_ram_write(struct b43legacy_wldev *dev, u16 offset,
 
        B43legacy_WARN_ON(offset % 4 != 0);
 
-       status = b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
-       if (status & B43legacy_SBF_XFER_REG_BYTESWAP)
+       status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       if (status & B43legacy_MACCTL_BE)
                val = swab32(val);
 
        b43legacy_write32(dev, B43legacy_MMIO_RAM_CONTROL, offset);
@@ -446,9 +444,9 @@ static void b43legacy_time_lock(struct b43legacy_wldev *dev)
 {
        u32 status;
 
-       status = b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
-       status |= B43legacy_SBF_TIME_UPDATE;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, status);
+       status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       status |= B43legacy_MACCTL_TBTTHOLD;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
        mmiowb();
 }
 
@@ -456,9 +454,9 @@ static void b43legacy_time_unlock(struct b43legacy_wldev *dev)
 {
        u32 status;
 
-       status = b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
-       status &= ~B43legacy_SBF_TIME_UPDATE;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, status);
+       status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       status &= ~B43legacy_MACCTL_TBTTHOLD;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
 }
 
 static void b43legacy_tsf_write_locked(struct b43legacy_wldev *dev, u64 tsf)
@@ -659,7 +657,7 @@ void b43legacy_dummy_transmission(struct b43legacy_wldev *dev)
                b43legacy_ram_write(dev, i * 4, buffer[i]);
 
        /* dummy read follows */
-       b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
+       b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 
        b43legacy_write16(dev, 0x0568, 0x0000);
        b43legacy_write16(dev, 0x07C0, 0x0000);
@@ -806,10 +804,9 @@ static void b43legacy_jssi_write(struct b43legacy_wldev *dev, u32 jssi)
 static void b43legacy_generate_noise_sample(struct b43legacy_wldev *dev)
 {
        b43legacy_jssi_write(dev, 0x7F7F7F7F);
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS2_BITFIELD,
-                         b43legacy_read32(dev,
-                         B43legacy_MMIO_STATUS2_BITFIELD)
-                         | (1 << 4));
+       b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
+                         b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
+                         | B43legacy_MACCMD_BGNOISE);
        B43legacy_WARN_ON(dev->noisecalc.channel_at_start !=
                            dev->phy.channel);
 }
@@ -898,18 +895,18 @@ static void handle_irq_tbtt_indication(struct b43legacy_wldev *dev)
                if (1/*FIXME: the last PSpoll frame was sent successfully */)
                        b43legacy_power_saving_ctl_bits(dev, -1, -1);
        }
-       dev->reg124_set_0x4 = 0;
        if (b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
-               dev->reg124_set_0x4 = 1;
+               dev->dfq_valid = 1;
 }
 
 static void handle_irq_atim_end(struct b43legacy_wldev *dev)
 {
-       if (!dev->reg124_set_0x4) /*FIXME rename this variable*/
-               return;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS2_BITFIELD,
-                         b43legacy_read32(dev, B43legacy_MMIO_STATUS2_BITFIELD)
-                         | 0x4);
+       if (dev->dfq_valid) {
+               b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
+                                 b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
+                                 | B43legacy_MACCMD_DFQ_VALID);
+               dev->dfq_valid = 0;
+       }
 }
 
 static void handle_irq_pmq(struct b43legacy_wldev *dev)
@@ -965,32 +962,77 @@ static void b43legacy_write_beacon_template(struct b43legacy_wldev *dev,
                                            u16 ram_offset,
                                            u16 shm_size_offset, u8 rate)
 {
-       int len;
-       const u8 *data;
 
-       B43legacy_WARN_ON(!dev->cached_beacon);
-       len = min((size_t)dev->cached_beacon->len,
+       unsigned int i, len, variable_len;
+       const struct ieee80211_mgmt *bcn;
+       const u8 *ie;
+       bool tim_found = 0;
+
+       bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
+       len = min((size_t)dev->wl->current_beacon->len,
                  0x200 - sizeof(struct b43legacy_plcp_hdr6));
-       data = (const u8 *)(dev->cached_beacon->data);
-       b43legacy_write_template_common(dev, data,
-                                       len, ram_offset,
+
+       b43legacy_write_template_common(dev, (const u8 *)bcn, len, ram_offset,
                                        shm_size_offset, rate);
+
+       /* Find the position of the TIM and the DTIM_period value
+        * and write them to SHM. */
+       ie = bcn->u.beacon.variable;
+       variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
+       for (i = 0; i < variable_len - 2; ) {
+               uint8_t ie_id, ie_len;
+
+               ie_id = ie[i];
+               ie_len = ie[i + 1];
+               if (ie_id == 5) {
+                       u16 tim_position;
+                       u16 dtim_period;
+                       /* This is the TIM Information Element */
+
+                       /* Check whether the ie_len is in the beacon data range. */
+                       if (variable_len < ie_len + 2 + i)
+                               break;
+                       /* A valid TIM is at least 4 bytes long. */
+                       if (ie_len < 4)
+                               break;
+                       tim_found = 1;
+
+                       tim_position = sizeof(struct b43legacy_plcp_hdr6);
+                       tim_position += offsetof(struct ieee80211_mgmt,
+                                                u.beacon.variable);
+                       tim_position += i;
+
+                       dtim_period = ie[i + 3];
+
+                       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                                       B43legacy_SHM_SH_TIMPOS, tim_position);
+                       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                                       B43legacy_SHM_SH_DTIMP, dtim_period);
+                       break;
+               }
+               i += ie_len + 2;
+       }
+       if (!tim_found) {
+               b43legacywarn(dev->wl, "Did not find a valid TIM IE in the "
+                             "beacon template packet. AP or IBSS operation "
+                             "may be broken.\n");
+       }
 }
 
 static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
                                            u16 shm_offset, u16 size,
-                                           u8 rate)
+                                           struct ieee80211_rate *rate)
 {
        struct b43legacy_plcp_hdr4 plcp;
        u32 tmp;
        __le16 dur;
 
        plcp.data = 0;
-       b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
+       b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->bitrate);
        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                              dev->wl->if_id,
+                                              dev->wl->vif,
                                               size,
-                                              B43legacy_RATE_TO_100KBPS(rate));
+                                              rate);
        /* Write PLCP in two parts and timing for packet transfer */
        tmp = le32_to_cpu(plcp.data);
        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset,
@@ -1007,45 +1049,44 @@ static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
  * 2) Patching duration field
  * 3) Stripping TIM
  */
-static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
-                                        u16 *dest_size, u8 rate)
+static const u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
+                                              u16 *dest_size,
+                                              struct ieee80211_rate *rate)
 {
        const u8 *src_data;
        u8 *dest_data;
-       u16 src_size;
-       u16 elem_size;
-       u16 src_pos;
-       u16 dest_pos;
+       u16 src_size, elem_size, src_pos, dest_pos;
        __le16 dur;
        struct ieee80211_hdr *hdr;
+       size_t ie_start;
 
-       B43legacy_WARN_ON(!dev->cached_beacon);
-       src_size = dev->cached_beacon->len;
-       src_data = (const u8 *)dev->cached_beacon->data;
+       src_size = dev->wl->current_beacon->len;
+       src_data = (const u8 *)dev->wl->current_beacon->data;
 
-       if (unlikely(src_size < 0x24)) {
-               b43legacydbg(dev->wl, "b43legacy_generate_probe_resp: "
-                      "invalid beacon\n");
+       /* Get the start offset of the variable IEs in the packet. */
+       ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+       B43legacy_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt,
+                                              u.beacon.variable));
+
+       if (B43legacy_WARN_ON(src_size < ie_start))
                return NULL;
-       }
 
        dest_data = kmalloc(src_size, GFP_ATOMIC);
        if (unlikely(!dest_data))
                return NULL;
 
-       /* 0x24 is offset of first variable-len Information-Element
-        * in beacon frame.
-        */
-       memcpy(dest_data, src_data, 0x24);
-       src_pos = 0x24;
-       dest_pos = 0x24;
-       for (; src_pos < src_size - 2; src_pos += elem_size) {
+       /* Copy the static data and all Information Elements, except the TIM. */
+       memcpy(dest_data, src_data, ie_start);
+       src_pos = ie_start;
+       dest_pos = ie_start;
+       for ( ; src_pos < src_size - 2; src_pos += elem_size) {
                elem_size = src_data[src_pos + 1] + 2;
-               if (src_data[src_pos] != 0x05) { /* TIM */
-                       memcpy(dest_data + dest_pos, src_data + src_pos,
-                              elem_size);
-                       dest_pos += elem_size;
+               if (src_data[src_pos] == 5) {
+                       /* This is the TIM. */
+                       continue;
                }
+               memcpy(dest_data + dest_pos, src_data + src_pos, elem_size);
+               dest_pos += elem_size;
        }
        *dest_size = dest_pos;
        hdr = (struct ieee80211_hdr *)dest_data;
@@ -1054,9 +1095,9 @@ static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                         IEEE80211_STYPE_PROBE_RESP);
        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                              dev->wl->if_id,
+                                              dev->wl->vif,
                                               *dest_size,
-                                              B43legacy_RATE_TO_100KBPS(rate));
+                                              rate);
        hdr->duration_id = dur;
 
        return dest_data;
@@ -1064,13 +1105,13 @@ static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
 
 static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
                                                u16 ram_offset,
-                                               u16 shm_size_offset, u8 rate)
+                                               u16 shm_size_offset,
+                                               struct ieee80211_rate *rate)
 {
-       u8 *probe_resp_data;
+       const u8 *probe_resp_data;
        u16 size;
 
-       B43legacy_WARN_ON(!dev->cached_beacon);
-       size = dev->cached_beacon->len;
+       size = dev->wl->current_beacon->len;
        probe_resp_data = b43legacy_generate_probe_resp(dev, &size, rate);
        if (unlikely(!probe_resp_data))
                return;
@@ -1079,59 +1120,37 @@ static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
         * all possible basic rates
         */
        b43legacy_write_probe_resp_plcp(dev, 0x31A, size,
-                                       B43legacy_CCK_RATE_1MB);
+                                       &b43legacy_b_ratetable[0]);
        b43legacy_write_probe_resp_plcp(dev, 0x32C, size,
-                                       B43legacy_CCK_RATE_2MB);
+                                       &b43legacy_b_ratetable[1]);
        b43legacy_write_probe_resp_plcp(dev, 0x33E, size,
-                                       B43legacy_CCK_RATE_5MB);
+                                       &b43legacy_b_ratetable[2]);
        b43legacy_write_probe_resp_plcp(dev, 0x350, size,
-                                       B43legacy_CCK_RATE_11MB);
+                                       &b43legacy_b_ratetable[3]);
 
        size = min((size_t)size,
                   0x200 - sizeof(struct b43legacy_plcp_hdr6));
        b43legacy_write_template_common(dev, probe_resp_data,
                                        size, ram_offset,
-                                       shm_size_offset, rate);
+                                       shm_size_offset, rate->bitrate);
        kfree(probe_resp_data);
 }
 
-static int b43legacy_refresh_cached_beacon(struct b43legacy_wldev *dev,
-                                          struct sk_buff *beacon)
+/* Asynchronously update the packet templates in template RAM.
+ * Locking: Requires wl->irq_lock to be locked. */
+static void b43legacy_update_templates(struct b43legacy_wl *wl,
+                                      struct sk_buff *beacon)
 {
-       if (dev->cached_beacon)
-               kfree_skb(dev->cached_beacon);
-       dev->cached_beacon = beacon;
+       /* This is the top half of the ansynchronous beacon update. The bottom
+        * half is the beacon IRQ. Beacon update must be asynchronous to avoid
+        * sending an invalid beacon. This can happen for example, if the
+        * firmware transmits a beacon while we are updating it. */
 
-       return 0;
-}
-
-static void b43legacy_update_templates(struct b43legacy_wldev *dev)
-{
-       u32 status;
-
-       B43legacy_WARN_ON(!dev->cached_beacon);
-
-       b43legacy_write_beacon_template(dev, 0x68, 0x18,
-                                       B43legacy_CCK_RATE_1MB);
-       b43legacy_write_beacon_template(dev, 0x468, 0x1A,
-                                       B43legacy_CCK_RATE_1MB);
-       b43legacy_write_probe_resp_template(dev, 0x268, 0x4A,
-                                           B43legacy_CCK_RATE_11MB);
-
-       status = b43legacy_read32(dev, B43legacy_MMIO_STATUS2_BITFIELD);
-       status |= 0x03;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS2_BITFIELD, status);
-}
-
-static void b43legacy_refresh_templates(struct b43legacy_wldev *dev,
-                                       struct sk_buff *beacon)
-{
-       int err;
-
-       err = b43legacy_refresh_cached_beacon(dev, beacon);
-       if (unlikely(err))
-               return;
-       b43legacy_update_templates(dev);
+       if (wl->current_beacon)
+               dev_kfree_skb_any(wl->current_beacon);
+       wl->current_beacon = beacon;
+       wl->beacon0_uploaded = 0;
+       wl->beacon1_uploaded = 0;
 }
 
 static void b43legacy_set_ssid(struct b43legacy_wldev *dev,
@@ -1172,38 +1191,37 @@ static void b43legacy_set_beacon_int(struct b43legacy_wldev *dev,
 
 static void handle_irq_beacon(struct b43legacy_wldev *dev)
 {
-       u32 status;
+       struct b43legacy_wl *wl = dev->wl;
+       u32 cmd;
 
-       if (!b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
+       if (!b43legacy_is_mode(wl, IEEE80211_IF_TYPE_AP))
                return;
 
-       dev->irq_savedstate &= ~B43legacy_IRQ_BEACON;
-       status = b43legacy_read32(dev, B43legacy_MMIO_STATUS2_BITFIELD);
-
-       if (!dev->cached_beacon || ((status & 0x1) && (status & 0x2))) {
-               /* ACK beacon IRQ. */
-               b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
-                                 B43legacy_IRQ_BEACON);
-               dev->irq_savedstate |= B43legacy_IRQ_BEACON;
-               if (dev->cached_beacon)
-                       kfree_skb(dev->cached_beacon);
-               dev->cached_beacon = NULL;
-               return;
-       }
-       if (!(status & 0x1)) {
-               b43legacy_write_beacon_template(dev, 0x68, 0x18,
-                                               B43legacy_CCK_RATE_1MB);
-               status |= 0x1;
-               b43legacy_write32(dev, B43legacy_MMIO_STATUS2_BITFIELD,
-                                 status);
-       }
-       if (!(status & 0x2)) {
-               b43legacy_write_beacon_template(dev, 0x468, 0x1A,
-                                               B43legacy_CCK_RATE_1MB);
-               status |= 0x2;
-               b43legacy_write32(dev, B43legacy_MMIO_STATUS2_BITFIELD,
-                                 status);
+       /* This is the bottom half of the asynchronous beacon update. */
+
+       cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
+       if (!(cmd & B43legacy_MACCMD_BEACON0_VALID)) {
+               if (!wl->beacon0_uploaded) {
+                       b43legacy_write_beacon_template(dev, 0x68,
+                                                       B43legacy_SHM_SH_BTL0,
+                                                       B43legacy_CCK_RATE_1MB);
+                       b43legacy_write_probe_resp_template(dev, 0x268,
+                                                           B43legacy_SHM_SH_PRTLEN,
+                                                           &__b43legacy_ratetable[3]);
+                       wl->beacon0_uploaded = 1;
+               }
+               cmd |= B43legacy_MACCMD_BEACON0_VALID;
+       }
+       if (!(cmd & B43legacy_MACCMD_BEACON1_VALID)) {
+               if (!wl->beacon1_uploaded) {
+                       b43legacy_write_beacon_template(dev, 0x468,
+                                                       B43legacy_SHM_SH_BTL1,
+                                                       B43legacy_CCK_RATE_1MB);
+                       wl->beacon1_uploaded = 1;
+               }
+               cmd |= B43legacy_MACCMD_BEACON1_VALID;
        }
+       b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
 }
 
 static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
@@ -1217,7 +1235,6 @@ static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
        u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
        u32 merged_dma_reason = 0;
        int i;
-       int activity = 0;
        unsigned long flags;
 
        spin_lock_irqsave(&dev->wl->irq_lock, flags);
@@ -1234,8 +1251,15 @@ static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
        if (unlikely(reason & B43legacy_IRQ_MAC_TXERR))
                b43legacyerr(dev->wl, "MAC transmission error\n");
 
-       if (unlikely(reason & B43legacy_IRQ_PHY_TXERR))
+       if (unlikely(reason & B43legacy_IRQ_PHY_TXERR)) {
                b43legacyerr(dev->wl, "PHY transmission error\n");
+               rmb();
+               if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
+                       b43legacyerr(dev->wl, "Too many PHY TX errors, "
+                                             "restarting the controller\n");
+                       b43legacy_controller_restart(dev, "PHY TX errors");
+               }
+       }
 
        if (unlikely(merged_dma_reason & (B43legacy_DMAIRQ_FATALMASK |
                                          B43legacy_DMAIRQ_NONFATALMASK))) {
@@ -1281,7 +1305,6 @@ static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
                        b43legacy_pio_rx(dev->pio.queue0);
                else
                        b43legacy_dma_rx(dev->dma.rx_ring0);
-               /* We intentionally don't set "activity" to 1, here. */
        }
        B43legacy_WARN_ON(dma_reason[1] & B43legacy_DMAIRQ_RX_DONE);
        B43legacy_WARN_ON(dma_reason[2] & B43legacy_DMAIRQ_RX_DONE);
@@ -1290,20 +1313,13 @@ static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
                        b43legacy_pio_rx(dev->pio.queue3);
                else
                        b43legacy_dma_rx(dev->dma.rx_ring3);
-               activity = 1;
        }
        B43legacy_WARN_ON(dma_reason[4] & B43legacy_DMAIRQ_RX_DONE);
        B43legacy_WARN_ON(dma_reason[5] & B43legacy_DMAIRQ_RX_DONE);
 
-       if (reason & B43legacy_IRQ_TX_OK) {
+       if (reason & B43legacy_IRQ_TX_OK)
                handle_irq_transmit_status(dev);
-               activity = 1;
-               /* TODO: In AP mode, this also causes sending of powersave
-                        responses. */
-       }
 
-       if (!modparam_noleds)
-               b43legacy_leds_update(dev, activity);
        b43legacy_interrupt_enable(dev, dev->irq_savedstate);
        mmiowb();
        spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
@@ -1419,7 +1435,7 @@ static void b43legacy_release_firmware(struct b43legacy_wldev *dev)
 static void b43legacy_print_fw_helptext(struct b43legacy_wl *wl)
 {
        b43legacyerr(wl, "You must go to http://linuxwireless.org/en/users/"
-                    "Drivers/bcm43xx#devicefirmware "
+                    "Drivers/b43#devicefirmware "
                     "and download the correct firmware (version 3).\n");
 }
 
@@ -1500,6 +1516,7 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev)
        }
        if (!fw->initvals) {
                switch (dev->phy.type) {
+               case B43legacy_PHYTYPE_B:
                case B43legacy_PHYTYPE_G:
                        if ((rev >= 5) && (rev <= 10))
                                filename = "b0g0initvals5";
@@ -1517,6 +1534,7 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev)
        }
        if (!fw->initvals_band) {
                switch (dev->phy.type) {
+               case B43legacy_PHYTYPE_B:
                case B43legacy_PHYTYPE_G:
                        if ((rev >= 5) && (rev <= 10))
                                filename = "b0g0bsinitvals5";
@@ -1562,9 +1580,20 @@ static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
        u16 fwpatch;
        u16 fwdate;
        u16 fwtime;
-       u32 tmp;
+       u32 tmp, macctl;
        int err = 0;
 
+       /* Jump the microcode PSM to offset 0 */
+       macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       B43legacy_WARN_ON(macctl & B43legacy_MACCTL_PSM_RUN);
+       macctl |= B43legacy_MACCTL_PSM_JMP0;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
+       /* Zero out all microcode PSM registers and shared memory. */
+       for (i = 0; i < 64; i++)
+               b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, i, 0);
+       for (i = 0; i < 4096; i += 2)
+               b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, i, 0);
+
        /* Upload Microcode. */
        data = (__be32 *) (dev->fw.ucode->data + hdr_len);
        len = (dev->fw.ucode->size - hdr_len) / sizeof(__be32);
@@ -1595,7 +1624,12 @@ static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
 
        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
                          B43legacy_IRQ_ALL);
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, 0x00020402);
+
+       /* Start the microcode PSM */
+       macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       macctl &= ~B43legacy_MACCTL_PSM_JMP0;
+       macctl |= B43legacy_MACCTL_PSM_RUN;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
 
        /* Wait for the microcode to load and respond */
        i = 0;
@@ -1608,9 +1642,13 @@ static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
                        b43legacyerr(dev->wl, "Microcode not responding\n");
                        b43legacy_print_fw_helptext(dev->wl);
                        err = -ENODEV;
-                       goto out;
+                       goto error;
+               }
+               msleep_interruptible(50);
+               if (signal_pending(current)) {
+                       err = -EINTR;
+                       goto error;
                }
-               udelay(10);
        }
        /* dummy read follows */
        b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
@@ -1631,19 +1669,26 @@ static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
                             " is supported. You must change your firmware"
                             " files.\n");
                b43legacy_print_fw_helptext(dev->wl);
-               b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, 0);
                err = -EOPNOTSUPP;
-               goto out;
+               goto error;
        }
-       b43legacydbg(dev->wl, "Loading firmware version 0x%X, patch level %u "
-              "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n", fwrev, fwpatch,
-              (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
-              (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
+       b43legacyinfo(dev->wl, "Loading firmware version 0x%X, patch level %u "
+                     "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n", fwrev, fwpatch,
+                     (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
+                     (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F,
+                     fwtime & 0x1F);
 
        dev->fw.rev = fwrev;
        dev->fw.patch = fwpatch;
 
-out:
+       return 0;
+
+error:
+       macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       macctl &= ~B43legacy_MACCTL_PSM_RUN;
+       macctl |= B43legacy_MACCTL_PSM_JMP0;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
+
        return err;
 }
 
@@ -1750,12 +1795,11 @@ static int b43legacy_gpio_init(struct b43legacy_wldev *dev)
        u32 mask;
        u32 set;
 
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD,
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
                          b43legacy_read32(dev,
-                         B43legacy_MMIO_STATUS_BITFIELD)
+                         B43legacy_MMIO_MACCTL)
                          & 0xFFFF3FFF);
 
-       b43legacy_leds_switch_all(dev, 0);
        b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
                          b43legacy_read16(dev,
                          B43legacy_MMIO_GPIO_MASK)
@@ -1767,7 +1811,7 @@ static int b43legacy_gpio_init(struct b43legacy_wldev *dev)
                mask |= 0x0060;
                set |= 0x0060;
        }
-       if (dev->dev->bus->sprom.r1.boardflags_lo & B43legacy_BFL_PACTRL) {
+       if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_PACTRL) {
                b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
                                  b43legacy_read16(dev,
                                  B43legacy_MMIO_GPIO_MASK)
@@ -1811,17 +1855,23 @@ void b43legacy_mac_enable(struct b43legacy_wldev *dev)
 {
        dev->mac_suspended--;
        B43legacy_WARN_ON(dev->mac_suspended < 0);
+       B43legacy_WARN_ON(irqs_disabled());
        if (dev->mac_suspended == 0) {
-               b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD,
+               b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
                                  b43legacy_read32(dev,
-                                 B43legacy_MMIO_STATUS_BITFIELD)
-                                 | B43legacy_SBF_MAC_ENABLED);
+                                 B43legacy_MMIO_MACCTL)
+                                 | B43legacy_MACCTL_ENABLED);
                b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
                                  B43legacy_IRQ_MAC_SUSPENDED);
                /* the next two are dummy reads */
-               b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
+               b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
                b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
                b43legacy_power_saving_ctl_bits(dev, -1, -1);
+
+               /* Re-enable IRQs. */
+               spin_lock_irq(&dev->wl->irq_lock);
+               b43legacy_interrupt_enable(dev, dev->irq_savedstate);
+               spin_unlock_irq(&dev->wl->irq_lock);
        }
 }
 
@@ -1831,20 +1881,31 @@ void b43legacy_mac_suspend(struct b43legacy_wldev *dev)
        int i;
        u32 tmp;
 
+       might_sleep();
+       B43legacy_WARN_ON(irqs_disabled());
        B43legacy_WARN_ON(dev->mac_suspended < 0);
+
        if (dev->mac_suspended == 0) {
+               /* Mask IRQs before suspending MAC. Otherwise
+                * the MAC stays busy and won't suspend. */
+               spin_lock_irq(&dev->wl->irq_lock);
+               tmp = b43legacy_interrupt_disable(dev, B43legacy_IRQ_ALL);
+               spin_unlock_irq(&dev->wl->irq_lock);
+               b43legacy_synchronize_irq(dev);
+               dev->irq_savedstate = tmp;
+
                b43legacy_power_saving_ctl_bits(dev, -1, 1);
-               b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD,
+               b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
                                  b43legacy_read32(dev,
-                                 B43legacy_MMIO_STATUS_BITFIELD)
-                                 & ~B43legacy_SBF_MAC_ENABLED);
+                                 B43legacy_MMIO_MACCTL)
+                                 & ~B43legacy_MACCTL_ENABLED);
                b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
-               for (i = 10000; i; i--) {
+               for (i = 40; i; i--) {
                        tmp = b43legacy_read32(dev,
                                               B43legacy_MMIO_GEN_IRQ_REASON);
                        if (tmp & B43legacy_IRQ_MAC_SUSPENDED)
                                goto out;
-                       udelay(1);
+                       msleep(1);
                }
                b43legacyerr(dev->wl, "MAC suspend failed\n");
        }
@@ -1989,27 +2050,10 @@ static void b43legacy_mgmtframe_txantenna(struct b43legacy_wldev *dev,
                              B43legacy_SHM_SH_PRPHYCTL, tmp);
 }
 
-/* Returns TRUE, if the radio is enabled in hardware. */
-static bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
-{
-       if (dev->phy.rev >= 3) {
-               if (!(b43legacy_read32(dev, B43legacy_MMIO_RADIO_HWENABLED_HI)
-                     & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
-                       return 1;
-       } else {
-               if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
-                   & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
-                       return 1;
-       }
-       return 0;
-}
-
 /* This is the opposite of b43legacy_chip_init() */
 static void b43legacy_chip_exit(struct b43legacy_wldev *dev)
 {
-       b43legacy_radio_turn_off(dev);
-       if (!modparam_noleds)
-               b43legacy_leds_exit(dev);
+       b43legacy_radio_turn_off(dev, 1);
        b43legacy_gpio_cleanup(dev);
        /* firmware is released later */
 }
@@ -2022,12 +2066,15 @@ static int b43legacy_chip_init(struct b43legacy_wldev *dev)
        struct b43legacy_phy *phy = &dev->phy;
        int err;
        int tmp;
-       u32 value32;
+       u32 value32, macctl;
        u16 value16;
 
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD,
-                         B43legacy_SBF_CORE_READY
-                         | B43legacy_SBF_400);
+       /* Initialize the MAC control */
+       macctl = B43legacy_MACCTL_IHR_ENABLED | B43legacy_MACCTL_SHM_ENABLED;
+       if (dev->phy.gmode)
+               macctl |= B43legacy_MACCTL_GMODE;
+       macctl |= B43legacy_MACCTL_INFRA;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
 
        err = b43legacy_request_firmware(dev);
        if (err)
@@ -2039,9 +2086,10 @@ static int b43legacy_chip_init(struct b43legacy_wldev *dev)
        err = b43legacy_gpio_init(dev);
        if (err)
                goto out; /* firmware is released later */
+
        err = b43legacy_upload_initvals(dev);
        if (err)
-               goto err_gpio_cleanup;
+               goto err_gpio_clean;
        b43legacy_radio_turn_on(dev);
 
        b43legacy_write16(dev, 0x03E6, 0x0000);
@@ -2066,12 +2114,12 @@ static int b43legacy_chip_init(struct b43legacy_wldev *dev)
        if (dev->dev->id.revision < 5)
                b43legacy_write32(dev, 0x010C, 0x01000000);
 
-       value32 = b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
-       value32 &= ~B43legacy_SBF_MODE_NOTADHOC;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, value32);
-       value32 = b43legacy_read32(dev, B43legacy_MMIO_STATUS_BITFIELD);
-       value32 |= B43legacy_SBF_MODE_NOTADHOC;
-       b43legacy_write32(dev, B43legacy_MMIO_STATUS_BITFIELD, value32);
+       value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       value32 &= ~B43legacy_MACCTL_INFRA;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
+       value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       value32 |= B43legacy_MACCTL_INFRA;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
 
        if (b43legacy_using_pio(dev)) {
                b43legacy_write32(dev, 0x0210, 0x00000100);
@@ -2113,14 +2161,17 @@ static int b43legacy_chip_init(struct b43legacy_wldev *dev)
        b43legacy_write16(dev, B43legacy_MMIO_POWERUP_DELAY,
                          dev->dev->bus->chipco.fast_pwrup_delay);
 
+       /* PHY TX errors counter. */
+       atomic_set(&phy->txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
+
        B43legacy_WARN_ON(err != 0);
        b43legacydbg(dev->wl, "Chip initialized\n");
 out:
        return err;
 
 err_radio_off:
-       b43legacy_radio_turn_off(dev);
-err_gpio_cleanup:
+       b43legacy_radio_turn_off(dev, 1);
+err_gpio_clean:
        b43legacy_gpio_cleanup(dev);
        goto out;
 }
@@ -2140,7 +2191,7 @@ static void b43legacy_periodic_every120sec(struct b43legacy_wldev *dev)
 static void b43legacy_periodic_every60sec(struct b43legacy_wldev *dev)
 {
        b43legacy_phy_lo_mark_all_unused(dev);
-       if (dev->dev->bus->sprom.r1.boardflags_lo & B43legacy_BFL_RSSI) {
+       if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_RSSI) {
                b43legacy_mac_suspend(dev);
                b43legacy_calc_nrssi_slope(dev);
                b43legacy_mac_enable(dev);
@@ -2156,20 +2207,9 @@ static void b43legacy_periodic_every30sec(struct b43legacy_wldev *dev)
 static void b43legacy_periodic_every15sec(struct b43legacy_wldev *dev)
 {
        b43legacy_phy_xmitpower(dev); /* FIXME: unless scanning? */
-}
 
-static void b43legacy_periodic_every1sec(struct b43legacy_wldev *dev)
-{
-       bool radio_hw_enable;
-
-       /* check if radio hardware enabled status changed */
-       radio_hw_enable = b43legacy_is_hw_radio_enabled(dev);
-       if (unlikely(dev->radio_hw_enable != radio_hw_enable)) {
-               dev->radio_hw_enable = radio_hw_enable;
-               b43legacyinfo(dev->wl, "Radio hardware status changed to %s\n",
-                      (radio_hw_enable) ? "enabled" : "disabled");
-               b43legacy_leds_update(dev, 0);
-       }
+       atomic_set(&dev->phy.txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
+       wmb();
 }
 
 static void do_periodic_work(struct b43legacy_wldev *dev)
@@ -2177,94 +2217,45 @@ static void do_periodic_work(struct b43legacy_wldev *dev)
        unsigned int state;
 
        state = dev->periodic_state;
-       if (state % 120 == 0)
+       if (state % 8 == 0)
                b43legacy_periodic_every120sec(dev);
-       if (state % 60 == 0)
+       if (state % 4 == 0)
                b43legacy_periodic_every60sec(dev);
-       if (state % 30 == 0)
+       if (state % 2 == 0)
                b43legacy_periodic_every30sec(dev);
-       if (state % 15 == 0)
-               b43legacy_periodic_every15sec(dev);
-       b43legacy_periodic_every1sec(dev);
+       b43legacy_periodic_every15sec(dev);
 }
 
-/* Estimate a "Badness" value based on the periodic work
- * state-machine state. "Badness" is worse (bigger), if the
- * periodic work will take longer.
+/* Periodic work locking policy:
+ *     The whole periodic work handler is protected by
+ *     wl->mutex. If another lock is needed somewhere in the
+ *     pwork callchain, it's aquired in-place, where it's needed.
  */
-static int estimate_periodic_work_badness(unsigned int state)
-{
-       int badness = 0;
-
-       if (state % 120 == 0) /* every 120 sec */
-               badness += 10;
-       if (state % 60 == 0) /* every 60 sec */
-               badness += 5;
-       if (state % 30 == 0) /* every 30 sec */
-               badness += 1;
-       if (state % 15 == 0) /* every 15 sec */
-               badness += 1;
-
-#define BADNESS_LIMIT  4
-       return badness;
-}
-
 static void b43legacy_periodic_work_handler(struct work_struct *work)
 {
-       struct b43legacy_wldev *dev =
-                            container_of(work, struct b43legacy_wldev,
-                            periodic_work.work);
-       unsigned long flags;
+       struct b43legacy_wldev *dev = container_of(work, struct b43legacy_wldev,
+                                            periodic_work.work);
+       struct b43legacy_wl *wl = dev->wl;
        unsigned long delay;
-       u32 savedirqs = 0;
-       int badness;
 
-       mutex_lock(&dev->wl->mutex);
+       mutex_lock(&wl->mutex);
 
        if (unlikely(b43legacy_status(dev) != B43legacy_STAT_STARTED))
                goto out;
        if (b43legacy_debug(dev, B43legacy_DBG_PWORK_STOP))
                goto out_requeue;
 
-       badness = estimate_periodic_work_badness(dev->periodic_state);
-       if (badness > BADNESS_LIMIT) {
-               spin_lock_irqsave(&dev->wl->irq_lock, flags);
-               /* Suspend TX as we don't want to transmit packets while
-                * we recalibrate the hardware. */
-               b43legacy_tx_suspend(dev);
-               savedirqs = b43legacy_interrupt_disable(dev,
-                                                         B43legacy_IRQ_ALL);
-               /* Periodic work will take a long time, so we want it to
-                * be preemtible and release the spinlock. */
-               spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
-               b43legacy_synchronize_irq(dev);
-
-               do_periodic_work(dev);
-
-               spin_lock_irqsave(&dev->wl->irq_lock, flags);
-               b43legacy_interrupt_enable(dev, savedirqs);
-               b43legacy_tx_resume(dev);
-               mmiowb();
-               spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
-       } else {
-               /* Take the global driver lock. This will lock any operation. */
-               spin_lock_irqsave(&dev->wl->irq_lock, flags);
+       do_periodic_work(dev);
 
-               do_periodic_work(dev);
-
-               mmiowb();
-               spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
-       }
        dev->periodic_state++;
 out_requeue:
        if (b43legacy_debug(dev, B43legacy_DBG_PWORK_FAST))
                delay = msecs_to_jiffies(50);
        else
-               delay = round_jiffies_relative(HZ);
-       queue_delayed_work(dev->wl->hw->workqueue,
-                          &dev->periodic_work, delay);
+               delay = round_jiffies_relative(HZ * 15);
+       queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
 out:
-       mutex_unlock(&dev->wl->mutex);
+       mutex_unlock(&wl->mutex);
 }
 
 static void b43legacy_periodic_tasks_setup(struct b43legacy_wldev *dev)
@@ -2366,9 +2357,9 @@ static int b43legacy_rng_init(struct b43legacy_wl *wl)
        return err;
 }
 
-static int b43legacy_tx(struct ieee80211_hw *hw,
-                       struct sk_buff *skb,
-                       struct ieee80211_tx_control *ctl)
+static int b43legacy_op_tx(struct ieee80211_hw *hw,
+                          struct sk_buff *skb,
+                          struct ieee80211_tx_control *ctl)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
@@ -2392,15 +2383,15 @@ out:
        return NETDEV_TX_OK;
 }
 
-static int b43legacy_conf_tx(struct ieee80211_hw *hw,
-                            int queue,
-                            const struct ieee80211_tx_queue_params *params)
+static int b43legacy_op_conf_tx(struct ieee80211_hw *hw,
+                               int queue,
+                               const struct ieee80211_tx_queue_params *params)
 {
        return 0;
 }
 
-static int b43legacy_get_tx_stats(struct ieee80211_hw *hw,
-                                 struct ieee80211_tx_queue_stats *stats)
+static int b43legacy_op_get_tx_stats(struct ieee80211_hw *hw,
+                                    struct ieee80211_tx_queue_stats *stats)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
@@ -2422,8 +2413,8 @@ out:
        return err;
 }
 
-static int b43legacy_get_stats(struct ieee80211_hw *hw,
-                              struct ieee80211_low_level_stats *stats)
+static int b43legacy_op_get_stats(struct ieee80211_hw *hw,
+                                 struct ieee80211_low_level_stats *stats)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        unsigned long flags;
@@ -2572,8 +2563,8 @@ static int b43legacy_antenna_from_ieee80211(u8 antenna)
        }
 }
 
-static int b43legacy_dev_config(struct ieee80211_hw *hw,
-                               struct ieee80211_conf *conf)
+static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
+                                  struct ieee80211_conf *conf)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev;
@@ -2589,14 +2580,16 @@ static int b43legacy_dev_config(struct ieee80211_hw *hw,
        antenna_rx = b43legacy_antenna_from_ieee80211(conf->antenna_sel_rx);
 
        mutex_lock(&wl->mutex);
+       dev = wl->current_dev;
+       phy = &dev->phy;
 
        /* Switch the PHY mode (if necessary). */
-       switch (conf->phymode) {
-       case MODE_IEEE80211B:
-               new_phymode = B43legacy_PHYMODE_B;
-               break;
-       case MODE_IEEE80211G:
-               new_phymode = B43legacy_PHYMODE_G;
+       switch (conf->channel->band) {
+       case IEEE80211_BAND_2GHZ:
+               if (phy->type == B43legacy_PHYTYPE_B)
+                       new_phymode = B43legacy_PHYMODE_B;
+               else
+                       new_phymode = B43legacy_PHYMODE_G;
                break;
        default:
                B43legacy_WARN_ON(1);
@@ -2604,8 +2597,6 @@ static int b43legacy_dev_config(struct ieee80211_hw *hw,
        err = b43legacy_switch_phymode(wl, new_phymode);
        if (err)
                goto out_unlock_mutex;
-       dev = wl->current_dev;
-       phy = &dev->phy;
 
        /* Disable IRQs while reconfiguring the device.
         * This makes it possible to drop the spinlock throughout
@@ -2621,8 +2612,8 @@ static int b43legacy_dev_config(struct ieee80211_hw *hw,
 
        /* Switch to the requested channel.
         * The firmware takes care of races with the TX handler. */
-       if (conf->channel_val != phy->channel)
-               b43legacy_radio_selectchannel(dev, conf->channel_val, 0);
+       if (conf->channel->hw_value != phy->channel)
+               b43legacy_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
        /* Enable/Disable ShortSlot timing. */
        if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME))
@@ -2634,6 +2625,8 @@ static int b43legacy_dev_config(struct ieee80211_hw *hw,
                        b43legacy_short_slot_timing_disable(dev);
        }
 
+       dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
+
        /* Adjust the desired TX power level. */
        if (conf->power_level != 0) {
                if (conf->power_level != phy->power_level) {
@@ -2660,7 +2653,7 @@ static int b43legacy_dev_config(struct ieee80211_hw *hw,
                                              " physically off. Press the"
                                              " button to turn it on.\n");
                } else {
-                       b43legacy_radio_turn_off(dev);
+                       b43legacy_radio_turn_off(dev, 0);
                        b43legacyinfo(dev->wl, "Radio turned off by"
                                      " software\n");
                }
@@ -2676,37 +2669,11 @@ out_unlock_mutex:
        return err;
 }
 
-static int b43legacy_dev_set_key(struct ieee80211_hw *hw,
-                                enum set_key_cmd cmd,
-                                const u8 *local_addr, const u8 *addr,
-                                struct ieee80211_key_conf *key)
-{
-       struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
-       struct b43legacy_wldev *dev = wl->current_dev;
-       unsigned long flags;
-       int err = -EOPNOTSUPP;
-       DECLARE_MAC_BUF(mac);
-
-       if (!dev)
-               return -ENODEV;
-       mutex_lock(&wl->mutex);
-       spin_lock_irqsave(&wl->irq_lock, flags);
-
-       if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
-               err = -ENODEV;
-       }
-       spin_unlock_irqrestore(&wl->irq_lock, flags);
-       mutex_unlock(&wl->mutex);
-       b43legacydbg(wl, "Using software based encryption for "
-                    "mac: %s\n", print_mac(mac, addr));
-       return err;
-}
-
-static void b43legacy_configure_filter(struct ieee80211_hw *hw,
-                                      unsigned int changed,
-                                      unsigned int *fflags,
-                                      int mc_count,
-                                      struct dev_addr_list *mc_list)
+static void b43legacy_op_configure_filter(struct ieee80211_hw *hw,
+                                         unsigned int changed,
+                                         unsigned int *fflags,
+                                         int mc_count,
+                                         struct dev_addr_list *mc_list)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
@@ -2741,9 +2708,9 @@ static void b43legacy_configure_filter(struct ieee80211_hw *hw,
        spin_unlock_irqrestore(&wl->irq_lock, flags);
 }
 
-static int b43legacy_config_interface(struct ieee80211_hw *hw,
-                                     int if_id,
-                                     struct ieee80211_if_conf *conf)
+static int b43legacy_op_config_interface(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_if_conf *conf)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
@@ -2753,7 +2720,7 @@ static int b43legacy_config_interface(struct ieee80211_hw *hw,
                return -ENODEV;
        mutex_lock(&wl->mutex);
        spin_lock_irqsave(&wl->irq_lock, flags);
-       B43legacy_WARN_ON(wl->if_id != if_id);
+       B43legacy_WARN_ON(wl->vif != vif);
        if (conf->bssid)
                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
        else
@@ -2763,7 +2730,7 @@ static int b43legacy_config_interface(struct ieee80211_hw *hw,
                        B43legacy_WARN_ON(conf->type != IEEE80211_IF_TYPE_AP);
                        b43legacy_set_ssid(dev, conf->ssid, conf->ssid_len);
                        if (conf->beacon)
-                               b43legacy_refresh_templates(dev, conf->beacon);
+                               b43legacy_update_templates(wl, conf->beacon);
                }
                b43legacy_write_mac_bssid_templates(dev);
        }
@@ -2781,6 +2748,17 @@ static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
 
        if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
                return;
+
+       /* Disable and sync interrupts. We must do this before than
+        * setting the status to INITIALIZED, as the interrupt handler
+        * won't care about IRQs then. */
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       dev->irq_savedstate = b43legacy_interrupt_disable(dev,
+                                                         B43legacy_IRQ_ALL);
+       b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+       b43legacy_synchronize_irq(dev);
+
        b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
 
        mutex_unlock(&wl->mutex);
@@ -2791,14 +2769,6 @@ static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
 
        ieee80211_stop_queues(wl->hw); /* FIXME this could cause a deadlock */
 
-       /* Disable and sync interrupts. */
-       spin_lock_irqsave(&wl->irq_lock, flags);
-       dev->irq_savedstate = b43legacy_interrupt_disable(dev,
-                                                         B43legacy_IRQ_ALL);
-       b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
-       spin_unlock_irqrestore(&wl->irq_lock, flags);
-       b43legacy_synchronize_irq(dev);
-
        b43legacy_mac_suspend(dev);
        free_irq(dev->dev->irq, dev);
        b43legacydbg(wl, "Wireless interface stopped\n");
@@ -2939,8 +2909,6 @@ static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
        memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
        memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
 
-       /* Flags */
-       phy->locked = 0;
        /* Assume the radio is enabled. If it's not enabled, the state will
         * immediately get fixed on the first periodic work run. */
        dev->radio_hw_enable = 1;
@@ -2973,7 +2941,6 @@ static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
        phy->lofcal = 0xFFFF;
        phy->initval = 0xFFFF;
 
-       spin_lock_init(&phy->lock);
        phy->interfmode = B43legacy_INTERFMODE_NONE;
        phy->channel = 0xFF;
 }
@@ -2981,7 +2948,7 @@ static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
 static void setup_struct_wldev_for_init(struct b43legacy_wldev *dev)
 {
        /* Flags */
-       dev->reg124_set_0x4 = 0;
+       dev->dfq_valid = 0;
 
        /* Stats */
        memset(&dev->stats, 0, sizeof(dev->stats));
@@ -3026,34 +2993,89 @@ static void b43legacy_imcfglo_timeouts_workaround(struct b43legacy_wldev *dev)
 #endif /* CONFIG_SSB_DRIVER_PCICORE */
 }
 
+/* Write the short and long frame retry limit values. */
+static void b43legacy_set_retry_limits(struct b43legacy_wldev *dev,
+                                      unsigned int short_retry,
+                                      unsigned int long_retry)
+{
+       /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
+        * the chip-internal counter. */
+       short_retry = min(short_retry, (unsigned int)0xF);
+       long_retry = min(long_retry, (unsigned int)0xF);
+
+       b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0006, short_retry);
+       b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0007, long_retry);
+}
+
+static void b43legacy_set_synth_pu_delay(struct b43legacy_wldev *dev,
+                                         bool idle) {
+       u16 pu_delay = 1050;
+
+       if (b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
+               pu_delay = 500;
+       if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
+               pu_delay = max(pu_delay, (u16)2400);
+
+       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                             B43legacy_SHM_SH_SPUWKUP, pu_delay);
+}
+
+/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
+static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
+{
+       u16 pretbtt;
+
+       /* The time value is in microseconds. */
+       if (b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
+               pretbtt = 2;
+       else
+               pretbtt = 250;
+       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                             B43legacy_SHM_SH_PRETBTT, pretbtt);
+       b43legacy_write16(dev, B43legacy_MMIO_TSF_CFP_PRETBTT, pretbtt);
+}
+
 /* Shutdown a wireless core */
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
 {
        struct b43legacy_wl *wl = dev->wl;
        struct b43legacy_phy *phy = &dev->phy;
+       u32 macctl;
 
        B43legacy_WARN_ON(b43legacy_status(dev) > B43legacy_STAT_INITIALIZED);
        if (b43legacy_status(dev) != B43legacy_STAT_INITIALIZED)
                return;
        b43legacy_set_status(dev, B43legacy_STAT_UNINIT);
 
+       /* Stop the microcode PSM. */
+       macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
+       macctl &= ~B43legacy_MACCTL_PSM_RUN;
+       macctl |= B43legacy_MACCTL_PSM_JMP0;
+       b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
+
        mutex_unlock(&wl->mutex);
        /* Must unlock as it would otherwise deadlock. No races here.
         * Cancel possibly pending workqueues. */
        cancel_work_sync(&dev->restart_work);
        mutex_lock(&wl->mutex);
 
+       b43legacy_leds_exit(dev);
        b43legacy_rng_exit(dev->wl);
        b43legacy_pio_free(dev);
        b43legacy_dma_free(dev);
        b43legacy_chip_exit(dev);
-       b43legacy_radio_turn_off(dev);
+       b43legacy_radio_turn_off(dev, 1);
        b43legacy_switch_analog(dev, 0);
        if (phy->dyn_tssi_tbl)
                kfree(phy->tssi2dbm);
        kfree(phy->lo_control);
        phy->lo_control = NULL;
+       if (dev->wl->current_beacon) {
+               dev_kfree_skb_any(dev->wl->current_beacon);
+               dev->wl->current_beacon = NULL;
+       }
+
        ssb_device_disable(dev->dev, 0);
        ssb_bus_may_powerdown(dev->dev->bus);
 }
@@ -3090,7 +3112,6 @@ static void prepare_phy_data_for_init(struct b43legacy_wldev *dev)
 
        /* Flags */
        phy->calibrated = 0;
-       phy->locked = 0;
 
        if (phy->_lo_pairs)
                memset(phy->_lo_pairs, 0,
@@ -3150,7 +3171,7 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
                hf |= B43legacy_HF_SYMW;
                if (phy->rev == 1)
                        hf |= B43legacy_HF_GDCW;
-               if (sprom->r1.boardflags_lo & B43legacy_BFL_PACTRL)
+               if (sprom->boardflags_lo & B43legacy_BFL_PACTRL)
                        hf |= B43legacy_HF_OFDMPABOOST;
        } else if (phy->type == B43legacy_PHYTYPE_B) {
                hf |= B43legacy_HF_SYMW;
@@ -3159,16 +3180,9 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
        }
        b43legacy_hf_write(dev, hf);
 
-       /* Short/Long Retry Limit.
-        * The retry-limit is a 4-bit counter. Enforce this to avoid overflowing
-        * the chip-internal counter.
-        */
-       tmp = limit_value(modparam_short_retry, 0, 0xF);
-       b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
-                             0x0006, tmp);
-       tmp = limit_value(modparam_long_retry, 0, 0xF);
-       b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
-                             0x0007, tmp);
+       b43legacy_set_retry_limits(dev,
+                                  B43legacy_DEFAULT_SHORT_RETRY_LIMIT,
+                                  B43legacy_DEFAULT_LONG_RETRY_LIMIT);
 
        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
                              0x0044, 3);
@@ -3207,19 +3221,16 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
        if (err)
                goto err_chip_exit;
 
-       b43legacy_write16(dev, 0x0612, 0x0050);
-       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0416, 0x0050);
-       b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0414, 0x01F4);
+       b43legacy_set_synth_pu_delay(dev, 1);
 
        ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
-       memset(wl->bssid, 0, ETH_ALEN);
-       memset(wl->mac_addr, 0, ETH_ALEN);
        b43legacy_upload_card_macaddress(dev);
        b43legacy_security_init(dev);
        b43legacy_rng_init(wl);
 
        b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
 
+       b43legacy_leds_init(dev);
 out:
        return err;
 
@@ -3236,8 +3247,8 @@ err_kfree_lo_control:
        return err;
 }
 
-static int b43legacy_add_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_if_init_conf *conf)
+static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_if_init_conf *conf)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev;
@@ -3260,12 +3271,14 @@ static int b43legacy_add_interface(struct ieee80211_hw *hw,
 
        dev = wl->current_dev;
        wl->operating = 1;
-       wl->if_id = conf->if_id;
+       wl->vif = conf->vif;
        wl->if_type = conf->type;
        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
 
        spin_lock_irqsave(&wl->irq_lock, flags);
        b43legacy_adjust_opmode(dev);
+       b43legacy_set_pretbtt(dev);
+       b43legacy_set_synth_pu_delay(dev, 0);
        b43legacy_upload_card_macaddress(dev);
        spin_unlock_irqrestore(&wl->irq_lock, flags);
 
@@ -3276,8 +3289,8 @@ static int b43legacy_add_interface(struct ieee80211_hw *hw,
        return err;
 }
 
-static void b43legacy_remove_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_if_init_conf *conf)
+static void b43legacy_op_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_if_init_conf *conf)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
@@ -3288,7 +3301,8 @@ static void b43legacy_remove_interface(struct ieee80211_hw *hw,
        mutex_lock(&wl->mutex);
 
        B43legacy_WARN_ON(!wl->operating);
-       B43legacy_WARN_ON(wl->if_id != conf->if_id);
+       B43legacy_WARN_ON(wl->vif != conf->vif);
+       wl->vif = NULL;
 
        wl->operating = 0;
 
@@ -3301,19 +3315,33 @@ static void b43legacy_remove_interface(struct ieee80211_hw *hw,
        mutex_unlock(&wl->mutex);
 }
 
-static int b43legacy_start(struct ieee80211_hw *hw)
+static int b43legacy_op_start(struct ieee80211_hw *hw)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
        int did_init = 0;
        int err = 0;
+       bool do_rfkill_exit = 0;
+
+       /* First register RFkill.
+        * LEDs that are registered later depend on it. */
+       b43legacy_rfkill_init(dev);
+
+       /* Kill all old instance specific information to make sure
+        * the card won't use it in the short timeframe between start
+        * and mac80211 reconfiguring it. */
+       memset(wl->bssid, 0, ETH_ALEN);
+       memset(wl->mac_addr, 0, ETH_ALEN);
+       wl->filter_flags = 0;
 
        mutex_lock(&wl->mutex);
 
        if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
                err = b43legacy_wireless_core_init(dev);
-               if (err)
+               if (err) {
+                       do_rfkill_exit = 1;
                        goto out_mutex_unlock;
+               }
                did_init = 1;
        }
 
@@ -3322,6 +3350,7 @@ static int b43legacy_start(struct ieee80211_hw *hw)
                if (err) {
                        if (did_init)
                                b43legacy_wireless_core_exit(dev);
+                       do_rfkill_exit = 1;
                        goto out_mutex_unlock;
                }
        }
@@ -3329,14 +3358,19 @@ static int b43legacy_start(struct ieee80211_hw *hw)
 out_mutex_unlock:
        mutex_unlock(&wl->mutex);
 
+       if (do_rfkill_exit)
+               b43legacy_rfkill_exit(dev);
+
        return err;
 }
 
-void b43legacy_stop(struct ieee80211_hw *hw)
+static void b43legacy_op_stop(struct ieee80211_hw *hw)
 {
        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
        struct b43legacy_wldev *dev = wl->current_dev;
 
+       b43legacy_rfkill_exit(dev);
+
        mutex_lock(&wl->mutex);
        if (b43legacy_status(dev) >= B43legacy_STAT_STARTED)
                b43legacy_wireless_core_stop(dev);
@@ -3344,20 +3378,78 @@ void b43legacy_stop(struct ieee80211_hw *hw)
        mutex_unlock(&wl->mutex);
 }
 
+static int b43legacy_op_set_retry_limit(struct ieee80211_hw *hw,
+                                       u32 short_retry_limit,
+                                       u32 long_retry_limit)
+{
+       struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+       struct b43legacy_wldev *dev;
+       int err = 0;
+
+       mutex_lock(&wl->mutex);
+       dev = wl->current_dev;
+       if (unlikely(!dev ||
+                    (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED))) {
+               err = -ENODEV;
+               goto out_unlock;
+       }
+       b43legacy_set_retry_limits(dev, short_retry_limit, long_retry_limit);
+out_unlock:
+       mutex_unlock(&wl->mutex);
+
+       return err;
+}
+
+static int b43legacy_op_beacon_set_tim(struct ieee80211_hw *hw,
+                                      int aid, int set)
+{
+       struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+       struct sk_buff *beacon;
+       unsigned long flags;
+
+       /* We could modify the existing beacon and set the aid bit in the TIM
+        * field, but that would probably require resizing and moving of data
+        * within the beacon template. Simply request a new beacon and let
+        * mac80211 do the hard work. */
+       beacon = ieee80211_beacon_get(hw, wl->vif, NULL);
+       if (unlikely(!beacon))
+               return -ENOMEM;
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       b43legacy_update_templates(wl, beacon);
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+       return 0;
+}
+
+static int b43legacy_op_ibss_beacon_update(struct ieee80211_hw *hw,
+                                          struct sk_buff *beacon,
+                                          struct ieee80211_tx_control *ctl)
+{
+       struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+       unsigned long flags;
+
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       b43legacy_update_templates(wl, beacon);
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+       return 0;
+}
 
 static const struct ieee80211_ops b43legacy_hw_ops = {
-       .tx = b43legacy_tx,
-       .conf_tx = b43legacy_conf_tx,
-       .add_interface = b43legacy_add_interface,
-       .remove_interface = b43legacy_remove_interface,
-       .config = b43legacy_dev_config,
-       .config_interface = b43legacy_config_interface,
-       .set_key = b43legacy_dev_set_key,
-       .configure_filter = b43legacy_configure_filter,
-       .get_stats = b43legacy_get_stats,
-       .get_tx_stats = b43legacy_get_tx_stats,
-       .start = b43legacy_start,
-       .stop = b43legacy_stop,
+       .tx                     = b43legacy_op_tx,
+       .conf_tx                = b43legacy_op_conf_tx,
+       .add_interface          = b43legacy_op_add_interface,
+       .remove_interface       = b43legacy_op_remove_interface,
+       .config                 = b43legacy_op_dev_config,
+       .config_interface       = b43legacy_op_config_interface,
+       .configure_filter       = b43legacy_op_configure_filter,
+       .get_stats              = b43legacy_op_get_stats,
+       .get_tx_stats           = b43legacy_op_get_tx_stats,
+       .start                  = b43legacy_op_start,
+       .stop                   = b43legacy_op_stop,
+       .set_retry_limit        = b43legacy_op_set_retry_limit,
+       .set_tim                = b43legacy_op_beacon_set_tim,
+       .beacon_update          = b43legacy_op_ibss_beacon_update,
 };
 
 /* Hard-reset the chip. Do not call this directly.
@@ -3406,48 +3498,19 @@ static int b43legacy_setup_modes(struct b43legacy_wldev *dev,
                                 int have_gphy)
 {
        struct ieee80211_hw *hw = dev->wl->hw;
-       struct ieee80211_hw_mode *mode;
        struct b43legacy_phy *phy = &dev->phy;
-       int cnt = 0;
-       int err;
 
        phy->possible_phymodes = 0;
-       for (; 1; cnt++) {
-               if (have_bphy) {
-                       B43legacy_WARN_ON(cnt >= B43legacy_MAX_PHYHWMODES);
-                       mode = &phy->hwmodes[cnt];
-
-                       mode->mode = MODE_IEEE80211B;
-                       mode->num_channels = b43legacy_bg_chantable_size;
-                       mode->channels = b43legacy_bg_chantable;
-                       mode->num_rates = b43legacy_b_ratetable_size;
-                       mode->rates = b43legacy_b_ratetable;
-                       err = ieee80211_register_hwmode(hw, mode);
-                       if (err)
-                               return err;
-
-                       phy->possible_phymodes |= B43legacy_PHYMODE_B;
-                       have_bphy = 0;
-                       continue;
-               }
-               if (have_gphy) {
-                       B43legacy_WARN_ON(cnt >= B43legacy_MAX_PHYHWMODES);
-                       mode = &phy->hwmodes[cnt];
-
-                       mode->mode = MODE_IEEE80211G;
-                       mode->num_channels = b43legacy_bg_chantable_size;
-                       mode->channels = b43legacy_bg_chantable;
-                       mode->num_rates = b43legacy_g_ratetable_size;
-                       mode->rates = b43legacy_g_ratetable;
-                       err = ieee80211_register_hwmode(hw, mode);
-                       if (err)
-                               return err;
-
-                       phy->possible_phymodes |= B43legacy_PHYMODE_G;
-                       have_gphy = 0;
-                       continue;
-               }
-               break;
+       if (have_bphy) {
+               hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                       &b43legacy_band_2GHz_BPHY;
+               phy->possible_phymodes |= B43legacy_PHYMODE_B;
+       }
+
+       if (have_gphy) {
+               hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                       &b43legacy_band_2GHz_GPHY;
+               phy->possible_phymodes |= B43legacy_PHYMODE_G;
        }
 
        return 0;
@@ -3495,18 +3558,13 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
        else
                have_bphy = 1;
 
-       /* Initialize LEDs structs. */
-       err = b43legacy_leds_init(dev);
-       if (err)
-               goto err_powerdown;
-
        dev->phy.gmode = (have_gphy || have_bphy);
        tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
        b43legacy_wireless_core_reset(dev, tmp);
 
        err = b43legacy_phy_versioning(dev);
        if (err)
-               goto err_leds_exit;
+               goto err_powerdown;
        /* Check if this device supports multiband. */
        if (!pdev ||
            (pdev->device != 0x4312 &&
@@ -3532,17 +3590,17 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
 
        err = b43legacy_validate_chipaccess(dev);
        if (err)
-               goto err_leds_exit;
+               goto err_powerdown;
        err = b43legacy_setup_modes(dev, have_bphy, have_gphy);
        if (err)
-               goto err_leds_exit;
+               goto err_powerdown;
 
        /* Now set some default "current_dev" */
        if (!wl->current_dev)
                wl->current_dev = dev;
        INIT_WORK(&dev->restart_work, b43legacy_chip_reset);
 
-       b43legacy_radio_turn_off(dev);
+       b43legacy_radio_turn_off(dev, 1);
        b43legacy_switch_analog(dev, 0);
        ssb_device_disable(dev->dev, 0);
        ssb_bus_may_powerdown(bus);
@@ -3550,8 +3608,6 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
 out:
        return err;
 
-err_leds_exit:
-       b43legacy_leds_exit(dev);
 err_powerdown:
        ssb_bus_may_powerdown(bus);
        return err;
@@ -3634,12 +3690,7 @@ static void b43legacy_sprom_fixup(struct ssb_bus *bus)
        if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
            bus->boardinfo.type == 0x4E &&
            bus->boardinfo.rev > 0x40)
-               bus->sprom.r1.boardflags_lo |= B43legacy_BFL_PACTRL;
-
-       /* Convert Antennagain values to Q5.2 */
-       if (bus->sprom.r1.antenna_gain_bg == 0xFF)
-               bus->sprom.r1.antenna_gain_bg = 2; /* if unset, use 2 dBm */
-       bus->sprom.r1.antenna_gain_bg <<= 2;
+               bus->sprom.boardflags_lo |= B43legacy_BFL_PACTRL;
 }
 
 static void b43legacy_wireless_exit(struct ssb_device *dev,
@@ -3674,10 +3725,10 @@ static int b43legacy_wireless_init(struct ssb_device *dev)
        hw->max_noise = -110;
        hw->queues = 1; /* FIXME: hardware has more queues */
        SET_IEEE80211_DEV(hw, dev->dev);
-       if (is_valid_ether_addr(sprom->r1.et1mac))
-               SET_IEEE80211_PERM_ADDR(hw, sprom->r1.et1mac);
+       if (is_valid_ether_addr(sprom->et1mac))
+               SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
        else
-               SET_IEEE80211_PERM_ADDR(hw, sprom->r1.il0mac);
+               SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
 
        /* Get and initialize struct b43legacy_wl */
        wl = hw_to_b43legacy_wl(hw);
@@ -3829,6 +3880,32 @@ static struct ssb_driver b43legacy_ssb_driver = {
        .resume         = b43legacy_resume,
 };
 
+static void b43legacy_print_driverinfo(void)
+{
+       const char *feat_pci = "", *feat_leds = "", *feat_rfkill = "",
+                  *feat_pio = "", *feat_dma = "";
+
+#ifdef CONFIG_B43LEGACY_PCI_AUTOSELECT
+       feat_pci = "P";
+#endif
+#ifdef CONFIG_B43LEGACY_LEDS
+       feat_leds = "L";
+#endif
+#ifdef CONFIG_B43LEGACY_RFKILL
+       feat_rfkill = "R";
+#endif
+#ifdef CONFIG_B43LEGACY_PIO
+       feat_pio = "I";
+#endif
+#ifdef CONFIG_B43LEGACY_DMA
+       feat_dma = "D";
+#endif
+       printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
+              "[ Features: %s%s%s%s%s, Firmware-ID: "
+              B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
+              feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
+}
+
 static int __init b43legacy_init(void)
 {
        int err;
@@ -3839,6 +3916,8 @@ static int __init b43legacy_init(void)
        if (err)
                goto err_dfs_exit;
 
+       b43legacy_print_driverinfo();
+
        return err;
 
 err_dfs_exit: