WLAN: Initial commit of the STM CW1200 WLAN driver.

LL IO API is defined and implemented.
TX queue is designed and implemented.
WSM API subset is defined.
mac80211 API is implemented partly.
FW downloading is working.
BH is _not_ implemented.

RX BH is implemented.

1. RX WSM API is defined and stubs are created.
2. RX BH is implemented (not verifiyed yet).

Reference WSM API implementation.

wsm_configuration / wsm_configuration_confirm.
Not veryfied yet.

BH and WSM TX, basic WSM notification.

Device startup is finished.

TODO at mac80211 layer:
 - start
 - add_interface
 - config
 - config_tx
 - config_filter
 - hw_scan
 - remove_interface
 - stop

TODO in general:
 - proper (random?) MAC address

TODO in WSM:
 - datapath

Basic mac80211 STA interface is implemented (not verified yet, but should be working).

Random MAC address is implemented.
Defined and implemented:
 - cw1200_start
 - cw1200_stop
 - cw1200_add_interface
 - cw1200_remove_interface
 - cw1200_config
 - cw1200_conf_tx
FW code is moved to fwio.[hc]
STA code is moved to sta.[hc]
AP code is moved to ap.[hc]

TODO:
 - configure_filter()
 - hw_scan()
 - datapath

Some bugfix.

Piggyback RX-ing.

Bugbix: wrong buf_id_rx calculation.

Finaly! RX datapath is implemented.

TX datapath is implemented.

HW scan is implemented.

TODO:
 - hw_scan: little refactoring. I hate gotos.
 - Join
 - Unjoin
 - SKB pool
 - BH monitor / chip restarter

Development.

+ Proper handling of scan IEs

Join. TX/RX should be working now.

Development.

+ Proper handling of scan IEs
+ Ping is working!!! (with some hacks)

Development.

 + TX rate policy cache is implemented.
 + TX rate policy table uploading is implemented.
 + TX queues stop/resume.
 + WSM STA API (except MIBs) is 100% finished.
 + Direct TX-ing of probe requests is converted to start-scan WSM cmd
   (workaround against FW "feature").
 + All work moved to an own workqueue.
 + Scan timeout is implemented (workaround against a known bug in FW).
 + set_key is implemented.

TODO:
 - Full WSM API support.
 - Join refactoring
 - Assoc status updates.

Verification and bugfixing.

 + Direct probe is verified. Some bugs fixed.
 + TX timeout is implemented... and rolled back: no way to cancel TX.
 + TX hang is fixed: FW hangs if tx->more is set but no more data available.
 + TX rate table uploading is moved into a separate workitem: can't schedule in datapath.
 + TX status reporting is enabled.
 + Removed hacks from Join: should be able to connect to any AP now.
 + TX rate cache bugfix: incorrect handling of policies like 100000000008900000000000.
 + TX rate cache optimization: upload only changed policies.
 + Unjoin is implemented for TX and RX.
 + Join is triggered for auth. frames only.
 + Join timeout is implemented.
 + wsm_set_bss_params is called from assoc notification.
 + wsm_set_association_mode is called from assoc notification.
 + set_beacon_wakeup_period is called from assoc notification.
 + HT information is now available in priv->ht_cap, priv->association_mode
 + CTS protection is set.
 + RTS threshold is set and verified.
 + Warning cleanup.
 + TODOs for compat-wireless-2010-07-16 API change.
 + Very basic RSSI subscription. However reporting is NIY.
 + Some bugfix for minestrel. F.e. policy like 10:9 11:9 0:1 0:1 -1:0 should be handled ok.
 + MaxTxCount (short/long) is implemented and verified.
 + Channel switch is protected now.
 + OverrideInternalTxRate is implemented.. and rolled back: internal rate controlselection is better.

TODO:
 - Security is not validated yet
 - Set HT parameters of TX data according to priv->ht_cap, priv->association_mode.
 - Strange: set_beacon_wakeup_period is called with DTIM 1 always. Why???
 - RSSI subscription events.
 - How to do unjoin?

Style changes.

Modifications to make the code compatible with checkpath. Not finished yet.
1. // -> /* */
2. whitespaces
3. formatting
4. warning- & error fix

No functional changes in the commit.

Verification.

 + RSSI reporting is working.
 + WEP is working. Dynamic WEP key switching is implemented to select TX WEP key on-fly
 + WPA/CCMP and WPA2/CCMP are working.
 + WPA/TKIP and WPA2/TKIP are working.
 + MIC failure event is implemented.
 + Unjoin is implemented as a reset. Why not?
 + wsm_flush_tx() added to flush TX port after wsm_lock_tx_async().
 + race condition in wsm_lock_tx()/wsm_flush_tx() is fixed.
 + RSSI subscription is under research.
 + Event reporting is implemented.
 + Beacon loss event is prepared (but not sent)
 + Link loss is implemented.

TODO:

On target..

 + Bugfix: DMA from non-DMAble memory in FW downloading.
 + RSSI subscription is finished.
 + RSSI event reporting is implemented.
 + Beacon loss event is reimplemented with respect to scan.
 + Memory leak in WSM event processing is fixed.
 + Code is verified on target. Set CW1200_U8500_PLATFORM to build for target.
 + Scan turns on powersave to prevent AP from TXing.
 + Spinning of direct_probe work is fixed.
 + Workaround is implemented for "FIXME: we can't use 'more' at all: we don't know future."

TODO:

Verification on device.

 + Correct deinitialization of async work.
 + New WSM API.
 + WMM is verified and fixed (queue prioritization).
 + Bug in TX is fixed (freezing of TCP traffic).
 + STE CQM extensions are implemented.
 + HW revision detection is implemented.
 + A crash/hangs in scan is fixed.
 + 802.11 slot time is set
 + 11n: first steps: Mixed mode is working.
 + 11n: Block ACK config.
 + Keep-alive work is implemented (but it is not doing anything yet).

TODO:
 - Copyright statements and COPYING
 - STE API for power-save
 - Need to deinit bt_thread, isn't it?

Copyright statements and bt_thread deinitialization.

 + Copyright statements
 + bt_thread deinitialization (NOT TESTED ON DEVICE AT ALL!!!)

Cumulative TODO:
 - COPYING
 - STE API for power-save
 - Set HT parameters of TX data. 11n verification.
 - SKB pool - reuse previously allocated SKBs
 - BH monitor / chip restarter
 - IBSS
 - AP mode
 - U-APSD configuration
 - Memory leak verification, coverity, checkpatch
 = It looks like that's it.

Mainline to compat-wireless-20010-12-03

 No functional changes in this commit.
 + Changes in compat-wireless API.
 + Changes in kerner API.
 + Changes in kernel header structures.

TODO:
 - New code in cw1200_bss_info_changed() needs to be verified.
 - ht_operation_mode needs to be cached in priv.

Some HT refactoring.

 + ht_operation_mode is cached in priv
 + channel_type is cached in priv
 + New header for HT-related code: ht.h
 + Greenfield mode is used for TX if possible.
 + HT flags are reported back to rate control correctly.

TODO:
 - Verify A-MPDU factor settings in cw1200_band_2ghz.

SKB cache is implemented.

Firmware loading refactoring.

 + CUT 2.0 detection is implemented.
 + Standard firmware loading API is used.
 + Firmware loading path is changed to /lib/firmware/cw1200/
 + Firmware is put to the project: ./firmware/

TODO:
 - Firmware copying at build time.

Bringup after mainlining.

+ FW downloading is working now.

TODO:
 - BH thread can't read data block from device.

Init: removing GPIO toggling. Not needed anymore.

WLAN: Fix for missing GPIO_HIGH, GPIO_LOW

The patch defines CW1200_GPIO_{HIGH|LOW} as replacement of
GPIO_{HIGH|LOW}, which might be absent on the target platform.

Also it allows build without compat wireless tree.

Added cw1200 to drivers/staging Kconfig and Makefile.

Added two CONFIG_ flags:

 + CONFIG_CW1200 - Enables the generic cw1200 module
 + CONFIG_CW1200_U8500_PLATFORM - U8500 platform integration

Removed binary firmware files, they do not belong in the kernel tree.

Added TODO file for cw1200 staging driver.

Added more help text to Kconfig

Removed checkpatch warnings. There is still one left.

Removed all checkpatch warnings for cw1200.h

Removed checkpatch warnings from cw1200_stdio.c.

There is still one left.

Removed checkpatch warnings for fwio.h

Removed checkpatch warning for hwio.c

Removed checkpatch warnings for main.c

There are still some warninges left.

Removed checkpatch warnings from queue.c

There are still some warnings left

Removed checkpatch warnings for queue.h

Removed checkpatch warnings for sbus.h

Removed checkpatch warnings for scan.c

Removed checkpatch warnings for scan.h

Removed checkpatch warnings for sta.c

Removed checkpatch warnings for txrc.c

Removed checkpatch warnings for txrx.h

Removed checkpatch warnings from wsm.c

Lots of "line over 80 char..." warnings left.

Minor checkpatch warning cleanup on wsm.c

WLAN: CW1200: Development: SoftAP mode

WLAN: CW1200: AP development.

 + Basic open AP is woking (prototyping done).

TODO:
 - Check AP scan & assoc with sniffer
 - WSM API: TxPowerLevel in scan requests.
 - WSM API: Frame in TX and RX indication.
 - WSM API: Flags in set_bss_params.
 - WSM API: IGTKGroupKey in key info.
 - WSM API: MultiTX confirm
 - WSM API: Config block ACK
 - WSM API: BA timeout indication.

CW1200: WLAN: Fix for a merge error.

This commit fixes build error introduced by WLAN: CW1200: AP development.

WLAN: CW1200: Fix for a warning in net/mac80211/rx.c

WLAN: CW1200: Add / remove key refactoring for AP mode.

Keys are cached in the driver and loaded after wsm_start() is called.

Verified (AP mode):
 + Open security:	OK
 + WEP40:		OK
 + WEP104:		FAIL (WSM_STATUS_DECRYPTFAILURE)
 + CCMP:		FAIL (MIC failure detected by STA. STA->AP decrypted OK)
 + TKIP:		FAIL (MIC failure detected by STA. STA->AP decrypted OK)

WLAN: CW1200: Proper handling of stop request in the AP mode.

WLAN: CW1200: Firmware-driven keep-alive is implemented.

CW1200: SDIO card detection is implemented.

Removed dependency to u8500_sdio_detect_card().
New moule parameter "device" is implemented to point to the SDIO interface
device is connected to.

WLAN: CW1200: Checkpatch cleanup.

 + wsm.c is cleared.
 + sta.c is cleared.
 + ap.c  is cleared.
 + bh.c  is cleared.
 + cw1200_sdio.c is cleared.
 + main.c is cleared.
 + queue.c is cleared.
 + scan.c is cleared.
 + txrx.c is cleared.
 + cw1200.h is cleared.
 + hwio.h is cleared.
 + ht.h  is cleared.
 + wsm_get_tx is (finally!) redesigned.

TODO:
 - wsm.h

WLAN: CW1200: Checkpatch cleanup.

 + wsm.h is cleared.

Code is ready for submission.

WLAN: CW1200: Module parameter for MAC address.

New module parameter for cw1200_core.ko: "macaddr".
Usage: modprobe cw1200_core macaddr=0x00,0x80,0xE1,0x30,0x40,0x50
Random MAC address by default.

WLAN: CW1200: Fix for a crash in skb_release_data().

WLAN: CW1200: Fix for a too short WSM timeout in stressed condition.

WLAN: CW1200: Bugfix after regression testing.

Datapath is verified (several gigabytes of downloaded data).

WLAN: STA mode development.

 + AP API sta_add/sta_semove is implemented.
 + wsm_suspend_resume_indication is implemented.
 + Unique link ID is allocated for STAs in AP mode as WSM requires.
 + wsm_map_link is implemented.
 + wsm_reset is modified to support multiple link IDs.
 + cw1200_suspend_resume handler is implemented in the ap.c.
 + no more hardcoded SSIDs
 + Debug logs functionality is exposed to the kernel config.
 + Suspend / resume is supported by queue.
 + TKIP multicast TX (AP mode) is fixed.

TODO:
 - AP mode with powersave is not verified.

WLAN: Support for non-power-of-two SDIO transfer.

WLAN: AP mode verification and bugfixing.

 + Fix for broken broadcasts.
 + Redesign of PS implementation in AP mode.
 + set_tim() is implemented.
 + sta_notify() is implemented.

WLAN: IV/ICV injection fixed.

Fixed: skb was modified prior to sanity check.

There is also a workaround against a bug in WSM_A21.05.0288
firmware in this commit. In AP mode FW calculates FCS incorrectly
when DA is FF:FF:FF:FF:FF:FF (was seen with TKIP and CCMP security).
Workaround checks DA and replaces FF:FF:FF:FF:FF:FF with multicast
address 01:00:5E:00:00:16. Workaround is disabled by #if 0 (can be
used only for verification, should not be enabled in production).

WLAN: Disabling debug printouts (STA/AP).

WLAN: Updating u8500_defconfig with CW1200 driver.

WLAN: AP mode fine-tuning.

 + Explicitly set broadcast bit in TIM when broadcasts are available.
 + Split handling of management frames (link ID = 0) and buffered
   multicasts (link ID = CW1200_LINK_ID_AFTER_DTIM)

Signed-off-by: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>

27 files changed, 9113 insertions, 0 deletions

diff --git a/drivers/staging/cw1200/.gitignore b/drivers/staging/cw1200/.gitignore
new file mode 100644
index 00000000000..6ad0d1ec58e
--- /dev/null
+++ b/drivers/staging/cw1200/.gitignore
@@ -0,0 +1,10 @@
+*.o
+*.ko
+*.ko.cmd
+.tmp_versions
+modules.order
+Module.symvers
+Module.markers
+*.o.cmd
+*.mod.c
+*.swp
diff --git a/drivers/staging/cw1200/Kconfig b/drivers/staging/cw1200/Kconfig
new file mode 100644
index 00000000000..19ac553b745
--- /dev/null
+++ b/drivers/staging/cw1200/Kconfig
@@ -0,0 +1,66 @@
+config CW1200
+       tristate "CW1200 WLAN support"
+       select MAC80211
+       select CFG80211
+       help
+
+         This is an experimental driver for the cw1200 chip-set.
+         Enabling this option enables the generic driver without
+         any platform support.
+
+         Please select the appropriate platform below.
+
+if CW1200
+
+config CW1200_U8500_PLATFORM
+      bool "U8500 platform support"
+      depends on CW1200
+      select CW1200_NON_POWER_OF_TWO_BLOCKSIZES
+      help
+        Say Y if you want to include support for the u8500 platform.
+        This will add u8500 specific initializing code for cw1200.
+
+config CW1200_NON_POWER_OF_TWO_BLOCKSIZES
+      bool "Platform supports non-power-of-two SDIO transfer"
+      depends on CW1200
+      help
+        Say N here only if you are running the driver on a platform
+        which does not have support for non-power-of-two SDIO transfer.
+        If unsure, say Y.
+
+
+config CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+      bool "Software keep-alive (DEVELOPMENT)"
+      depends on CW1200
+      help
+        Say Y if your firmware does not support keep-alive functionality
+        or you suspect problems with the implementation.
+        Please finalize software the software keep-alive functionality in
+        that case.
+
+        If unsure, say N.
+
+menu "Driver debug features"
+      depends on CW1200
+
+config CW1200_BH_DEBUG
+      bool "Enable low-level device communication logs (DEVELOPMENT)"
+
+config CW1200_WSM_DEBUG
+      bool "Enable WSM API debug messages (DEVELOPMENT)"
+
+config CW1200_WSM_DUMPS
+      bool "Verbose WSM API logging (DEVELOPMENT)"
+
+config CW1200_TXRX_DEBUG
+      bool "Enable TX/RX debug messages (DEVELOPMENT)"
+
+config CW1200_TX_POLICY_DEBUG
+      bool "Enable TX policy debug (DEVELOPMENT)"
+
+config CW1200_STA_DEBUG
+      bool "Enable STA/AP debug (DEVELOPMENT)"
+
+endmenu
+
+endif
diff --git a/drivers/staging/cw1200/Makefile b/drivers/staging/cw1200/Makefile
new file mode 100644
index 00000000000..f14637ed297
--- /dev/null
+++ b/drivers/staging/cw1200/Makefile
@@ -0,0 +1,45 @@
+ifeq ($(CONFIG_CW1200_U8500_PLATFORM),y)
+        EXTRA_CFLAGS += -DCW1200_U8500_PLATFORM=1
+endif
+
+ifeq ($(CONFIG_CW1200_NON_POWER_OF_TWO_BLOCKSIZES),y)
+	EXTRA_CFLAGS += -DCW1200_NON_POWER_OF_TWO_BLOCKSIZES=1
+endif
+
+ifeq ($(CONFIG_CW1200_USE_STE_EXTENSIONS),y)
+	EXTRA_CFLAGS += -DUSE_STE_EXTENSIONS=1
+endif
+
+ifeq ($(CONFIG_CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE),y)
+	EXTRA_CFLAGS += -DCW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE=1
+endif
+
+ifeq ($(CONFIG_CW1200_BH_DEBUG),y)
+	EXTRA_CFLAGS += -DCW1200_DEBUG_ENABLE_BH_LOGS=1
+endif
+
+ifeq ($(CONFIG_CW1200_WSM_DEBUG),y)
+	EXTRA_CFLAGS += -DCW1200_DEBUG_ENABLE_WSM_LOGS=1
+endif
+
+ifeq ($(CONFIG_CW1200_WSM_DUMPS),y)
+	EXTRA_CFLAGS += -DCW1200_DEBUG_ENABLE_WSM_DUMPS=1
+endif
+
+ifeq ($(CONFIG_CW1200_TXRX_DEBUG),y)
+	EXTRA_CFLAGS += -DCW1200_TXRX_DEBUG=1
+endif
+
+ifeq ($(CONFIG_CW1200_TX_POLICY_DEBUG),y)
+	EXTRA_CFLAGS += -DCW1200_TX_POLICY_DEBUG=1
+endif
+
+ifeq ($(CONFIG_CW1200_STA_DEBUG),y)
+	EXTRA_CFLAGS += -DCW1200_DEBUG_ENABLE_STA_LOGS
+endif
+
+cw1200_core-objs		:= fwio.o txrx.o main.o queue.o hwio.o bh.o wsm.o sta.o ap.o scan.o
+cw1200_wlan-objs		:= cw1200_sdio.o
+
+obj-$(CONFIG_CW1200)		+= cw1200_core.o
+obj-$(CONFIG_CW1200)		+= cw1200_wlan.o
diff --git a/drivers/staging/cw1200/TODO b/drivers/staging/cw1200/TODO
new file mode 100644
index 00000000000..0d2be40e1f4
--- /dev/null
+++ b/drivers/staging/cw1200/TODO
@@ -0,0 +1,10 @@
+TODO:
+        - IBSS: Not implemented (3-10 m*d).
+        - 11n: Almost done. WSM API upgrade is required fo finish implementation. (2-3 m*d).
+        - 11n: verification (??? m*d Resources? WLAN RF lab? 11n sniffers
+          availability? Bring up of the test equipment?).
+        - memory leakage verification and proper cleanup: not done (1-3 m*d).
+        - AP (hot-spot) mode: Implemented, some problems with WEP104/WPA/WPA2 security.
+          FW bug? To be investigated.
+        - U-APSD configuration (0.5-1 m*d).
+        - Cleanup of debug printouts (1 m*d).
diff --git a/drivers/staging/cw1200/ap.c b/drivers/staging/cw1200/ap.c
new file mode 100644
index 00000000000..93aee42ab6c
--- /dev/null
+++ b/drivers/staging/cw1200/ap.c
@@ -0,0 +1,595 @@
+/*
+ * mac80211 STA and AP API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "cw1200.h"
+#include "sta.h"
+#include "ap.h"
+#include "bh.h"
+
+#ifdef CW1200_DEBUG_ENABLE_STA_LOGS
+#define ap_printk(...) printk(__VA_ARGS__)
+#else
+#define ap_printk(...)
+#endif
+
+static int cw1200_upload_beacon(struct cw1200_common *priv);
+static int cw1200_start_ap(struct cw1200_common *priv);
+static int cw1200_update_beaconing(struct cw1200_common *priv);
+
+
+/* ******************************************************************** */
+/* AP API								*/
+
+int cw1200_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   struct ieee80211_sta *sta)
+{
+	struct cw1200_common *priv = hw->priv;
+	struct cw1200_sta_priv *sta_priv =
+			(struct cw1200_sta_priv *)&sta->drv_priv;
+	struct wsm_map_link map_link = {
+		.link_id = 0,
+	};
+
+
+	/* Link ID mapping works fine in STA mode as well.
+	 * It's better to keep same handling for both STA ans AP modes */
+#if 0
+	if (priv->mode != NL80211_IFTYPE_AP)
+		return 0;
+#endif
+
+	map_link.link_id = ffs(~(priv->link_id_map | 1)) - 1;
+	if (map_link.link_id > CW1200_MAX_STA_IN_AP_MODE) {
+		sta_priv->link_id = 0;
+		printk(KERN_INFO "[AP] No more link ID available.\n");
+		return -ENOENT;
+	}
+
+	memcpy(map_link.mac_addr, sta->addr, ETH_ALEN);
+	if (!WARN_ON(wsm_map_link(priv, &map_link))) {
+		sta_priv->link_id = map_link.link_id;
+		priv->link_id_map |= 1 << map_link.link_id;
+		ap_printk(KERN_DEBUG "[AP] STA added, link_id: %d\n",
+			map_link.link_id);
+	}
+	return 0;
+}
+
+int cw1200_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                      struct ieee80211_sta *sta)
+{
+	struct cw1200_common *priv = hw->priv;
+	struct cw1200_sta_priv *sta_priv =
+			(struct cw1200_sta_priv *)&sta->drv_priv;
+	struct wsm_reset reset = {
+		.link_id = 0,
+		.reset_statistics = false,
+	};
+
+	if (sta_priv->link_id) {
+		ap_printk(KERN_DEBUG "[AP] STA removed, link_id: %d\n",
+			sta_priv->link_id);
+		reset.link_id = sta_priv->link_id;
+		priv->link_id_map &= ~(1 << sta_priv->link_id);
+		sta_priv->link_id = 0;
+		WARN_ON(wsm_reset(priv, &reset));
+	}
+	return 0;
+}
+
+void cw1200_sta_notify(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+		       enum sta_notify_cmd notify_cmd,
+		       struct ieee80211_sta *sta)
+{
+	struct cw1200_common *priv = dev->priv;
+	struct cw1200_sta_priv *sta_priv =
+		(struct cw1200_sta_priv *)&sta->drv_priv;
+	u32 bit = 1 << sta_priv->link_id;
+
+	switch (notify_cmd) {
+		case STA_NOTIFY_SLEEP:
+			priv->sta_asleep_mask |= bit;
+			break;
+		case STA_NOTIFY_AWAKE:
+			priv->sta_asleep_mask &= ~bit;
+			cw1200_bh_wakeup(priv);
+			break;
+	}
+}
+
+static int cw1200_set_tim_impl(struct cw1200_common *priv, bool multicast)
+{
+	struct wsm_template_frame frame = {
+		.frame_type = WSM_FRAME_TYPE_BEACON,
+	};
+	u16 tim_offset, tim_length;
+
+	ap_printk(KERN_DEBUG "[AP] %s.\n", __func__);
+
+	frame.skb = ieee80211_beacon_get_tim(priv->hw, priv->vif,
+			&tim_offset, &tim_length);
+	if (WARN_ON(!frame.skb))
+		return -ENOMEM;
+
+	if (tim_offset && tim_length >= 6) {
+		/* Ignore DTIM count from mac80211:
+		 * firmware handles DTIM internally. */
+		frame.skb->data[tim_offset + 2] = 0;
+
+		/* Set/reset aid0 bit */
+		if (multicast)
+			frame.skb->data[tim_offset + 4] |= 1;
+		else
+			frame.skb->data[tim_offset + 4] &= ~1;
+	}
+
+	WARN_ON(wsm_set_template_frame(priv, &frame));
+
+	dev_kfree_skb(frame.skb);
+
+	return 0;
+}
+
+void cw1200_set_tim_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, set_tim_work);
+	(void)cw1200_set_tim_impl(priv, !priv->suspend_multicast);
+}
+
+int cw1200_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
+		   bool set)
+{
+	struct cw1200_common *priv = dev->priv;
+	queue_work(priv->workqueue, &priv->set_tim_work);
+	return 0;
+}
+
+void cw1200_bss_info_changed(struct ieee80211_hw *dev,
+			     struct ieee80211_vif *vif,
+			     struct ieee80211_bss_conf *info,
+			     u32 changed)
+{
+	struct cw1200_common *priv = dev->priv;
+	struct ieee80211_conf *conf = &dev->conf;
+
+	mutex_lock(&priv->conf_mutex);
+	if (changed & BSS_CHANGED_BSSID) {
+		memcpy(priv->bssid, info->bssid, ETH_ALEN);
+		cw1200_setup_mac(priv);
+	}
+
+	/* TODO: BSS_CHANGED_IBSS */
+	/* TODO: BSS_CHANGED_ARP_FILTER */
+
+	if (changed & BSS_CHANGED_BEACON_ENABLED)
+		priv->enable_beacon = info->enable_beacon;
+
+	if (changed & BSS_CHANGED_BEACON)
+		WARN_ON(cw1200_upload_beacon(priv));
+
+	if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
+			BSS_CHANGED_BEACON_INT))
+		WARN_ON(cw1200_update_beaconing(priv));
+
+	if (changed & BSS_CHANGED_ASSOC) {
+		wsm_lock_tx(priv);
+		priv->wep_default_key_id = -1;
+		wsm_unlock_tx(priv);
+
+		if (!info->assoc /* && !info->ibss_joined */) {
+			priv->cqm_link_loss_count = 60;
+			priv->cqm_beacon_loss_count = 20;
+			priv->cqm_tx_failure_thold = 0;
+		}
+		priv->cqm_tx_failure_count = 0;
+	}
+
+	if (changed &
+	    (BSS_CHANGED_ASSOC |
+	     BSS_CHANGED_BASIC_RATES |
+	     BSS_CHANGED_ERP_PREAMBLE |
+	     BSS_CHANGED_HT |
+	     BSS_CHANGED_ERP_SLOT)) {
+		ap_printk(KERN_DEBUG "BSS_CHANGED_ASSOC.\n");
+		if (info->assoc) { /* TODO: ibss_joined */
+			int dtim_interval = conf->ps_dtim_period;
+			int listen_interval = conf->listen_interval;
+			struct ieee80211_sta *sta = NULL;
+
+			/* Associated: kill join timeout */
+			cancel_delayed_work_sync(&priv->join_timeout);
+
+			/* TODO: This code is not verified {{{ */
+			rcu_read_lock();
+			if (info->bssid)
+				sta = ieee80211_find_sta(vif, info->bssid);
+			if (sta) {
+				BUG_ON(!priv->channel);
+				priv->ht_info.ht_cap = sta->ht_cap;
+				priv->bss_params.operationalRateSet =
+					__cpu_to_le32(
+					cw1200_rate_mask_to_wsm(priv,
+					sta->supp_rates[priv->channel->band]));
+				priv->ht_info.channel_type =
+						info->channel_type;
+				priv->ht_info.operation_mode =
+						info->ht_operation_mode;
+			} else {
+				memset(&priv->ht_info, 0,
+						sizeof(priv->ht_info));
+				priv->bss_params.operationalRateSet = -1;
+			}
+			rcu_read_unlock();
+			/* }}} */
+
+			priv->association_mode.greenfieldMode =
+				cw1200_ht_greenfield(&priv->ht_info);
+			priv->association_mode.flags =
+				WSM_ASSOCIATION_MODE_SNOOP_ASSOC_FRAMES |
+				WSM_ASSOCIATION_MODE_USE_PREAMBLE_TYPE |
+				WSM_ASSOCIATION_MODE_USE_HT_MODE |
+				WSM_ASSOCIATION_MODE_USE_BASIC_RATE_SET |
+				WSM_ASSOCIATION_MODE_USE_MPDU_START_SPACING;
+			priv->association_mode.preambleType =
+				info->use_short_preamble ?
+				WSM_JOIN_PREAMBLE_SHORT :
+				WSM_JOIN_PREAMBLE_LONG;
+			priv->association_mode.basicRateSet = __cpu_to_le32(
+				cw1200_rate_mask_to_wsm(priv,
+				info->basic_rates));
+			priv->association_mode.mpduStartSpacing =
+				cw1200_ht_ampdu_density(&priv->ht_info);
+
+#ifdef USE_STE_EXTENSIONS
+			priv->cqm_beacon_loss_count =
+					info->cqm_beacon_miss_thold;
+			priv->cqm_tx_failure_thold =
+					info->cqm_tx_fail_thold;
+			priv->cqm_tx_failure_count = 0;
+#endif /* USE_STE_EXTENSIONS */
+
+			priv->bss_params.beaconLostCount =
+					priv->cqm_beacon_loss_count ?
+					priv->cqm_beacon_loss_count :
+					priv->cqm_link_loss_count;
+
+			priv->bss_params.aid = info->aid;
+
+			if (dtim_interval < 1)
+				dtim_interval = 1;
+			if (dtim_interval < priv->join_dtim_period)
+				dtim_interval = priv->join_dtim_period;
+			if (listen_interval < dtim_interval)
+				listen_interval = 0;
+
+			ap_printk(KERN_DEBUG "[STA] DTIM %d, listen %d\n",
+				dtim_interval, listen_interval);
+			ap_printk(KERN_DEBUG "[STA] Preamble: %d, " \
+				"Greenfield: %d, Aid: %d, " \
+				"Rates: 0x%.8X, Basic: 0x%.8X\n",
+				priv->association_mode.preambleType,
+				priv->association_mode.greenfieldMode,
+				priv->bss_params.aid,
+				priv->bss_params.operationalRateSet,
+				priv->association_mode.basicRateSet);
+			WARN_ON(wsm_set_association_mode(priv,
+				&priv->association_mode));
+			WARN_ON(wsm_set_bss_params(priv, &priv->bss_params));
+			WARN_ON(wsm_set_beacon_wakeup_period(priv,
+				dtim_interval, listen_interval));
+#if 0
+			/* It's better to override internal TX rete; otherwise
+			 * device sends RTS at too high rate. However device
+			 * can't receive CTS at 1 and 2 Mbps. Well, 5.5 is a
+			 * good choice for RTS/CTS, but that means PS poll
+			 * will be sent at the same rate - impact on link
+			 * budget. Not sure what is better.. */
+
+			/* Update: internal rate selection algorythm is not
+			 * bad: if device is not receiving CTS at high rate,
+			 * it drops RTS rate.
+			 * So, conclusion: if-0 the code. Keep code just for
+			 * information:
+			 * Do not touch WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE! */
+
+			/* ~3 is a bug in device: RTS/CTS is not working at
+			 * low rates */
+
+			__le32 internal_tx_rate = __cpu_to_le32(__ffs(
+				priv->association_mode.basicRateSet & ~3));
+			WARN_ON(wsm_write_mib(priv,
+				WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE,
+				&internal_tx_rate,
+				sizeof(internal_tx_rate)));
+#endif
+		} else {
+			memset(&priv->association_mode, 0,
+				sizeof(priv->association_mode));
+			memset(&priv->bss_params, 0, sizeof(priv->bss_params));
+		}
+	}
+	if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT)) {
+		__le32 use_cts_prot = info->use_cts_prot ?
+			__cpu_to_le32(1) : 0;
+
+		ap_printk(KERN_DEBUG "[STA] CTS protection %d\n",
+			info->use_cts_prot);
+		WARN_ON(wsm_write_mib(priv, WSM_MIB_ID_NON_ERP_PROTECTION,
+			&use_cts_prot, sizeof(use_cts_prot)));
+	}
+	if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_SLOT)) {
+		__le32 slot_time = info->use_short_slot ?
+			__cpu_to_le32(9) : __cpu_to_le32(20);
+		ap_printk(KERN_DEBUG "[STA] Slot time :%d us.\n",
+			__le32_to_cpu(slot_time));
+		WARN_ON(wsm_write_mib(priv, WSM_MIB_ID_DOT11_SLOT_TIME,
+			&slot_time, sizeof(slot_time)));
+	}
+	if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_CQM)) {
+		struct wsm_rcpi_rssi_threshold threshold = {
+			.rssiRcpiMode = WSM_RCPI_RSSI_USE_RSSI,
+			.rollingAverageCount = 1,
+		};
+
+#if 0
+		/* For verification purposes */
+		info->cqm_rssi_thold = -50;
+		info->cqm_rssi_hyst = 4;
+#endif /* 0 */
+
+		ap_printk(KERN_DEBUG "[CQM] RSSI threshold subscribe: %d +- %d\n",
+			info->cqm_rssi_thold, info->cqm_rssi_hyst);
+#ifdef USE_STE_EXTENSIONS
+		ap_printk(KERN_DEBUG "[CQM] Beacon loss subscribe: %d\n",
+			info->cqm_beacon_miss_thold);
+		ap_printk(KERN_DEBUG "[CQM] TX failure subscribe: %d\n",
+			info->cqm_tx_fail_thold);
+		priv->cqm_rssi_thold = info->cqm_rssi_thold;
+		priv->cqm_rssi_hyst = info->cqm_rssi_hyst;
+#endif /* USE_STE_EXTENSIONS */
+		if (info->cqm_rssi_thold || info->cqm_rssi_hyst) {
+			/* RSSI subscription enabled */
+			/* TODO: It's not a correct way of setting threshold.
+			 * Upper and lower must be set equal here and adjusted
+			 * in callback. However current implementation is much
+			 * more relaible and stable. */
+			threshold.upperThreshold =
+				info->cqm_rssi_thold + info->cqm_rssi_hyst;
+			threshold.lowerThreshold =
+				info->cqm_rssi_thold;
+			threshold.rssiRcpiMode |=
+				WSM_RCPI_RSSI_THRESHOLD_ENABLE;
+		} else {
+			/* There is a bug in FW, see sta.c. We have to enable
+			 * dummy subscription to get correct RSSI values. */
+			threshold.rssiRcpiMode |=
+				WSM_RCPI_RSSI_THRESHOLD_ENABLE |
+				WSM_RCPI_RSSI_DONT_USE_UPPER |
+				WSM_RCPI_RSSI_DONT_USE_LOWER;
+		}
+		WARN_ON(wsm_set_rcpi_rssi_threshold(priv, &threshold));
+
+#ifdef USE_STE_EXTENSIONS
+		priv->cqm_tx_failure_thold = info->cqm_tx_fail_thold;
+		priv->cqm_tx_failure_count = 0;
+
+		if (priv->cqm_beacon_loss_count !=
+				info->cqm_beacon_miss_thold) {
+			priv->cqm_beacon_loss_count =
+				info->cqm_beacon_miss_thold;
+			priv->bss_params.beaconLostCount =
+				priv->cqm_beacon_loss_count ?
+				priv->cqm_beacon_loss_count :
+				priv->cqm_link_loss_count;
+			WARN_ON(wsm_set_bss_params(priv, &priv->bss_params));
+		}
+#endif /* USE_STE_EXTENSIONS */
+	}
+	mutex_unlock(&priv->conf_mutex);
+}
+
+void cw1200_multicast_start_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, multicast_start_work);
+
+        (void)cw1200_set_tim_impl(priv, true);
+	wsm_lock_tx(priv);
+	priv->suspend_multicast = false;
+	wsm_unlock_tx(priv);
+	cw1200_bh_wakeup(priv);
+}
+
+void cw1200_multicast_stop_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, multicast_stop_work);
+
+	/* Lock flushes send queue in device. Just to make sure DTIM beacom
+	 * and frames are sent. */
+	wsm_lock_tx(priv);
+	priv->suspend_multicast = true;
+        (void)cw1200_set_tim_impl(priv, false);
+	wsm_unlock_tx(priv);
+}
+
+/* ******************************************************************** */
+/* WSM callback								*/
+void cw1200_suspend_resume(struct cw1200_common *priv,
+			  struct wsm_suspend_resume *arg)
+{
+	int queue = 1 << wsm_queue_id_to_linux(arg->queue);
+	u32 unicast = 1 << arg->link_id;
+	u32 after_dtim = 1 << CW1200_LINK_ID_AFTER_DTIM;
+	u32 wakeup_required = 0;
+	u32 set = 0;
+	u32 clear;
+	u32 tx_suspend_mask;
+	int i;
+
+	if (!arg->link_id) /* For all links */
+		unicast = (1 << (CW1200_MAX_STA_IN_AP_MODE + 1)) - 2;
+
+	ap_printk(KERN_DEBUG "[AP] %s: %s\n",
+		arg->stop ? "stop" : "start",
+		arg->multicast ? "broadcast" : "unicast");
+
+	if (arg->multicast) {
+		if (arg->stop)
+			queue_work(priv->workqueue,
+				&priv->multicast_stop_work);
+		else {
+			/* Handle only if there is data to be sent */
+			for (i = 0; i < 4; ++i) {
+				if (cw1200_queue_get_num_queued(
+						&priv->tx_queue[i],
+						after_dtim)) {
+					queue_work(priv->workqueue,
+						&priv->multicast_start_work);
+					break;
+				}
+			}
+		}
+	} else {
+		if (arg->stop)
+			set = unicast;
+		else
+			set = 0;
+
+		clear = set ^ unicast;
+
+		/* TODO: if (!priv->uapsd) */
+		queue = 0x0F;
+
+		for (i = 0; i < 4; ++i) {
+			if (!(queue & (1 << i)))
+				continue;
+
+			tx_suspend_mask = priv->tx_suspend_mask[i];
+			priv->tx_suspend_mask[i] =
+				(tx_suspend_mask & ~clear) | set;
+
+			wakeup_required = wakeup_required ||
+				cw1200_queue_get_num_queued(
+					&priv->tx_queue[i],
+					tx_suspend_mask & clear);
+		}
+	}
+	if (wakeup_required)
+		cw1200_bh_wakeup(priv);
+	return;
+}
+
+
+/* ******************************************************************** */
+/* AP privates								*/
+
+static int cw1200_upload_beacon(struct cw1200_common *priv)
+{
+	int ret = 0;
+	const u8 *ssidie;
+	const struct ieee80211_mgmt *mgmt;
+	struct wsm_template_frame frame = {
+		.frame_type = WSM_FRAME_TYPE_BEACON,
+	};
+
+	ap_printk(KERN_DEBUG "[AP] %s.\n", __func__);
+
+	frame.skb = ieee80211_beacon_get(priv->hw, priv->vif);
+	if (WARN_ON(!frame.skb))
+		return -ENOMEM;
+
+	mgmt = (struct ieee80211_mgmt *)frame.skb->data;
+	ssidie = cfg80211_find_ie(WLAN_EID_SSID,
+		mgmt->u.beacon.variable,
+		frame.skb->len - (mgmt->u.beacon.variable - frame.skb->data));
+	memset(priv->ssid, 0, sizeof(priv->ssid));
+	if (ssidie) {
+		priv->ssid_length = ssidie[1];
+		if (WARN_ON(priv->ssid_length > sizeof(priv->ssid)))
+			priv->ssid_length = sizeof(priv->ssid);
+		memcpy(priv->ssid, &ssidie[2], priv->ssid_length);
+	} else {
+		priv->ssid_length = 0;
+	}
+
+	ret = wsm_set_template_frame(priv, &frame);
+	if (!ret) {
+		/* TODO: Distille probe resp; remove TIM
+		 * and other beacon-specific IEs */
+		*(__le16 *)frame.skb->data =
+			__cpu_to_le16(IEEE80211_FTYPE_MGMT |
+				      IEEE80211_STYPE_PROBE_RESP);
+		frame.frame_type = WSM_FRAME_TYPE_PROBE_RESPONSE;
+		ret = wsm_set_template_frame(priv, &frame);
+	}
+	dev_kfree_skb(frame.skb);
+
+	return ret;
+}
+
+static int cw1200_start_ap(struct cw1200_common *priv)
+{
+	int ret;
+	struct ieee80211_bss_conf *conf = &priv->vif->bss_conf;
+	struct wsm_start start = {
+		.mode = WSM_START_MODE_AP,
+		.band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+				WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G,
+		.channelNumber = priv->channel->hw_value,
+		.beaconInterval = conf->beacon_int,
+		.DTIMPeriod = conf->dtim_period,
+		.preambleType = conf->use_short_preamble ?
+				WSM_JOIN_PREAMBLE_SHORT :
+				WSM_JOIN_PREAMBLE_LONG,
+		.probeDelay = 100,
+		.basicRateSet = cw1200_rate_mask_to_wsm(priv,
+				conf->basic_rates),
+		.ssidLength = priv->ssid_length,
+	};
+	struct wsm_beacon_transmit transmit = {
+		.enableBeaconing = priv->enable_beacon,
+	};
+
+	memcpy(&start.ssid[0], priv->ssid, start.ssidLength);
+
+	ap_printk(KERN_DEBUG "[AP] ch: %d(%d), bcn: %d(%d), brt: 0x%.8X, ssid: %.*s %s.\n",
+		start.channelNumber, start.band,
+		start.beaconInterval, start.DTIMPeriod,
+		start.basicRateSet,
+		start.ssidLength, start.ssid,
+		transmit.enableBeaconing ? "ena" : "dis");
+	ret = WARN_ON(wsm_start(priv, &start));
+	if (!ret)
+		ret = WARN_ON(cw1200_upload_keys(priv));
+	if (!ret)
+		ret = WARN_ON(wsm_beacon_transmit(priv, &transmit));
+	if (!ret)
+		priv->join_status = CW1200_JOIN_STATUS_AP;
+	return ret;
+}
+
+static int cw1200_update_beaconing(struct cw1200_common *priv)
+{
+	struct wsm_reset reset = {
+		.link_id = 0,
+		.reset_statistics = true,
+	};
+
+	if (priv->mode == NL80211_IFTYPE_AP) {
+		ap_printk(KERN_DEBUG "[AP] %s.\n", __func__);
+		WARN_ON(wsm_reset(priv, &reset));
+		WARN_ON(cw1200_start_ap(priv));
+	}
+	return 0;
+}
+
diff --git a/drivers/staging/cw1200/ap.h b/drivers/staging/cw1200/ap.h
new file mode 100644
index 00000000000..77c364dfc2d
--- /dev/null
+++ b/drivers/staging/cw1200/ap.h
@@ -0,0 +1,36 @@
+/*
+ * mac80211 STA and AP API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef AP_H_INCLUDED
+#define AP_H_INCLUDED
+
+int cw1200_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
+		   bool set);
+int cw1200_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+		   struct ieee80211_sta *sta);
+int cw1200_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+		      struct ieee80211_sta *sta);
+void cw1200_sta_notify(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+		       enum sta_notify_cmd notify_cmd,
+		       struct ieee80211_sta *sta);
+void cw1200_bss_info_changed(struct ieee80211_hw *dev,
+			     struct ieee80211_vif *vif,
+			     struct ieee80211_bss_conf *info,
+			     u32 changed);
+
+void cw1200_suspend_resume(struct cw1200_common *priv,
+			  struct wsm_suspend_resume *arg);
+void cw1200_set_tim_work(struct work_struct *work);
+void cw1200_multicast_start_work(struct work_struct *work);
+void cw1200_multicast_stop_work(struct work_struct *work);
+
+
+#endif
diff --git a/drivers/staging/cw1200/bh.c b/drivers/staging/cw1200/bh.c
new file mode 100644
index 00000000000..94711af1ea3
--- /dev/null
+++ b/drivers/staging/cw1200/bh.c
@@ -0,0 +1,419 @@
+/*
+ * Device handling thread implementation for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver, which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/mac80211.h>
+#include <linux/kthread.h>
+
+#include "cw1200.h"
+#include "bh.h"
+#include "hwio.h"
+#include "wsm.h"
+#include "sbus.h"
+
+#ifdef CW1200_DEBUG_ENABLE_BH_LOGS
+#define bh_printk(...) printk(__VA_ARGS__)
+#else
+#define bh_printk(...)
+#endif
+
+static int cw1200_bh(void *arg);
+
+/* TODO: Werify these numbers with WSM specification. */
+#define DOWNLOAD_BLOCK_SIZE_WR	(0x1000 - 4)
+/* an SPI message cannot be bigger than (2"12-1)*2 bytes
+ * "*2" to cvt to bytes */
+#define MAX_SZ_RD_WR_BUFFERS	(DOWNLOAD_BLOCK_SIZE_WR*2)
+#define PIGGYBACK_CTRL_REG	(2)
+#define EFFECTIVE_BUF_SIZE	(MAX_SZ_RD_WR_BUFFERS - PIGGYBACK_CTRL_REG)
+
+typedef int (*cw1200_wsm_handler)(struct cw1200_common *priv,
+	u8 *data, size_t size);
+
+
+int cw1200_register_bh(struct cw1200_common *priv)
+{
+	int err = 0;
+	struct sched_param param = { .sched_priority = 1 };
+	bh_printk(KERN_DEBUG "[BH] register.\n");
+	BUG_ON(priv->bh_thread);
+	atomic_set(&priv->bh_rx, 0);
+	atomic_set(&priv->bh_tx, 0);
+	atomic_set(&priv->bh_term, 0);
+	priv->buf_id_tx = 0;
+	priv->buf_id_rx = 0;
+	init_waitqueue_head(&priv->bh_wq);
+	init_waitqueue_head(&priv->hw_bufs_used_wq);
+	priv->bh_thread = kthread_create(&cw1200_bh, priv, "cw1200_bh");
+	if (IS_ERR(priv->bh_thread)) {
+		err = PTR_ERR(priv->bh_thread);
+		priv->bh_thread = NULL;
+	} else {
+		WARN_ON(sched_setscheduler(priv->bh_thread,
+			SCHED_FIFO, &param));
+#ifdef HAS_PUT_TASK_STRUCT
+		get_task_struct(priv->bh_thread);
+#endif
+		wake_up_process(priv->bh_thread);
+	}
+	return err;
+}
+
+void cw1200_unregister_bh(struct cw1200_common *priv)
+{
+	struct task_struct *thread = priv->bh_thread;
+	if (WARN_ON(!thread))
+		return;
+
+	priv->bh_thread = NULL;
+	bh_printk(KERN_DEBUG "[BH] unregister.\n");
+	atomic_add(1, &priv->bh_term);
+	wake_up_interruptible(&priv->bh_wq);
+	kthread_stop(thread);
+#ifdef HAS_PUT_TASK_STRUCT
+	put_task_struct(thread);
+#endif
+}
+
+void cw1200_irq_handler(struct cw1200_common *priv)
+{
+	bh_printk(KERN_DEBUG "[BH] irq.\n");
+	if (/* WARN_ON */(priv->bh_error))
+		return;
+
+	if (atomic_add_return(1, &priv->bh_rx) == 1)
+		wake_up_interruptible(&priv->bh_wq);
+}
+
+void cw1200_bh_wakeup(struct cw1200_common *priv)
+{
+	bh_printk(KERN_DEBUG "[BH] wakeup.\n");
+	if (WARN_ON(priv->bh_error))
+		return;
+
+	if (atomic_add_return(1, &priv->bh_tx) == 1)
+		wake_up_interruptible(&priv->bh_wq);
+}
+
+static inline void wsm_alloc_tx_buffer(struct cw1200_common *priv)
+{
+	++priv->hw_bufs_used;
+}
+
+static int wsm_release_tx_buffer(struct cw1200_common *priv)
+{
+	int ret = 0;
+	int hw_bufs_used = priv->hw_bufs_used--;
+	if (WARN_ON(!hw_bufs_used))
+		ret = -1;
+	else if (hw_bufs_used >= priv->wsm_caps.numInpChBufs - 1)
+		ret = 1;
+	else if (hw_bufs_used == 1)
+		wake_up_interruptible(&priv->hw_bufs_used_wq);
+	return ret;
+}
+
+static struct sk_buff *cw1200_get_skb(struct cw1200_common *priv, size_t len)
+{
+	struct sk_buff *skb;
+	size_t alloc_len = (len > SDIO_BLOCK_SIZE) ? len : SDIO_BLOCK_SIZE;
+
+	if (len > SDIO_BLOCK_SIZE || !priv->skb_cache) {
+		skb = dev_alloc_skb(alloc_len
+				+ WSM_TX_EXTRA_HEADROOM
+				+ 8  /* TKIP IV */
+				+ 12 /* TKIP ICV + MIC */
+				- 2  /* Piggyback */);
+		/* In AP mode RXed SKB can be looped back as a broadcast.
+		 * Here we reserve enough space for headers. */
+		skb_reserve(skb, WSM_TX_EXTRA_HEADROOM
+				+ 8 /* TKIP IV */
+				- WSM_RX_EXTRA_HEADROOM);
+	} else {
+		skb = priv->skb_cache;
+		priv->skb_cache = NULL;
+	}
+	return skb;
+}
+
+static void cw1200_put_skb(struct cw1200_common *priv, struct sk_buff *skb)
+{
+	if (priv->skb_cache)
+		dev_kfree_skb(skb);
+	else
+		priv->skb_cache = skb;
+}
+
+static inline int cw1200_bh_read_ctrl_reg(struct cw1200_common *priv,
+					  u16 *ctrl_reg)
+{
+	int ret;
+
+	ret = cw1200_reg_read_16(priv,
+			ST90TDS_CONTROL_REG_ID, ctrl_reg);
+	if (ret) {
+		ret = cw1200_reg_read_16(priv,
+				ST90TDS_CONTROL_REG_ID, ctrl_reg);
+		if (ret)
+			printk(KERN_ERR
+				"[BH] Failed to read control register.\n");
+		else
+			printk(KERN_WARNING
+				"[BH] Second attempt to read control "
+				"register passed. This is a firmware bug.\n");
+	}
+
+	return ret;
+}
+
+static int cw1200_bh(void *arg)
+{
+	struct cw1200_common *priv = arg;
+	struct sk_buff *skb_rx = NULL;
+	size_t read_len = 0;
+	int rx, tx, term;
+	struct wsm_hdr *wsm;
+	size_t wsm_len;
+	int wsm_id;
+	u8 wsm_seq;
+	int rx_resync = 1;
+	u16 ctrl_reg = 0;
+	int tx_allowed;
+
+	for (;;) {
+		int status = wait_event_interruptible(priv->bh_wq, ({
+				rx = atomic_xchg(&priv->bh_rx, 0);
+				tx = atomic_xchg(&priv->bh_tx, 0);
+				term = atomic_xchg(&priv->bh_term, 0);
+				(rx || tx || term);
+			}));
+
+		if (status || term)
+			break;
+
+		if (rx) {
+			size_t alloc_len;
+			u8 *data;
+
+			if (WARN_ON(cw1200_bh_read_ctrl_reg(
+					priv, &ctrl_reg)))
+				break;
+rx:
+			read_len = (ctrl_reg & 0xFFF) * 2;
+			if (!read_len)
+				goto tx;
+
+			if (WARN_ON((read_len < sizeof(struct wsm_hdr)) ||
+					(read_len > EFFECTIVE_BUF_SIZE))) {
+				printk(KERN_DEBUG "Invalid read len: %d",
+					read_len);
+				break;
+			}
+
+			/* Add SIZE of PIGGYBACK reg (CONTROL Reg)
+			 * to the NEXT Message length + 2 Bytes for SKB */
+			read_len = read_len + 2;
+
+			BUG_ON(SDIO_BLOCK_SIZE & (SDIO_BLOCK_SIZE - 1));
+
+#ifdef CW1200_NON_POWER_OF_TWO_BLOCKSIZES
+			alloc_len = priv->sbus_ops->align_size(
+					priv->sbus_priv, read_len);
+#else
+			/* Platform's SDIO workaround */
+			alloc_len = read_len & ~(SDIO_BLOCK_SIZE - 1);
+			if (read_len & (SDIO_BLOCK_SIZE - 1))
+				alloc_len += SDIO_BLOCK_SIZE;
+#endif
+
+			skb_rx = cw1200_get_skb(priv, alloc_len);
+			if (WARN_ON(!skb_rx))
+				break;
+
+			skb_trim(skb_rx, 0);
+			skb_put(skb_rx, read_len);
+			data = skb_rx->data;
+			if (WARN_ON(!data))
+				break;
+
+			if (WARN_ON(cw1200_data_read(priv, data, alloc_len)))
+				break;
+
+			/* Piggyback */
+			ctrl_reg = __le16_to_cpu(
+				((__le16 *)data)[alloc_len / 2 - 1]);
+
+			wsm = (struct wsm_hdr *)data;
+			wsm_len = __le32_to_cpu(wsm->len);
+			if (WARN_ON(wsm_len > read_len))
+				break;
+
+#ifdef CW1200_DEBUG_ENABLE_WSM_DUMPS
+			print_hex_dump_bytes("<-- ", DUMP_PREFIX_NONE,
+				data, wsm_len);
+#endif /* CW1200_DEBUG_ENABLE_WSM_DUMPS */
+
+			wsm_id  = __le32_to_cpu(wsm->id) & 0xFFF;
+			wsm_seq = (__le32_to_cpu(wsm->id) >> 13) & 7;
+
+			skb_trim(skb_rx, wsm_len);
+
+			if (unlikely(wsm_id == 0x0800)) {
+				wsm_handle_exception(priv,
+					 &data[sizeof(*wsm)],
+					wsm_len - sizeof(*wsm));
+				break;
+			} else if (unlikely(!rx_resync)) {
+				if (WARN_ON(wsm_seq != priv->wsm_rx_seq))
+					break;
+			}
+			priv->wsm_rx_seq = (wsm_seq + 1) & 7;
+			rx_resync = 0;
+
+			if (wsm_id & 0x0400) {
+				int rc = wsm_release_tx_buffer(priv);
+				/* TODO: 3.60 Multi-transmit confirmation
+				 * requires special handling.
+				 * Not supported yet. */
+				BUG_ON((wsm_id & 0x3F) == 0x1E);
+				if (WARN_ON(rc < 0))
+					break;
+				else if (rc > 0)
+					tx = 1;
+			}
+
+			/* cw1200_wsm_rx takes care on SKB livetime */
+			if (WARN_ON(wsm_handle_rx(priv, wsm_id, wsm, &skb_rx)))
+				break;
+
+			if (skb_rx) {
+				cw1200_put_skb(priv, skb_rx);
+				skb_rx = NULL;
+			}
+
+			read_len = 0;
+
+			{
+				/* HACK!!! */
+				/* Read CONFIG Register Value - HW BUG */
+				u32 val32;
+				WARN_ON(cw1200_reg_read_32(priv,
+					ST90TDS_CONFIG_REG_ID, &val32));
+			}
+		}
+
+tx:
+		/* HACK! One buffer is reserved for control path */
+		BUG_ON(priv->hw_bufs_used > priv->wsm_caps.numInpChBufs);
+		tx_allowed =
+			priv->hw_bufs_used + 1 < priv->wsm_caps.numInpChBufs;
+		if (unlikely(!tx_allowed && priv->wsm_cmd.ptr))
+			tx_allowed = 1;
+
+		if (tx && tx_allowed) {
+			size_t tx_len;
+			u8 *data;
+			int ret;
+
+			wsm_alloc_tx_buffer(priv);
+			ret = wsm_get_tx(priv, &data, &tx_len);
+			if (ret <= 0) {
+				wsm_release_tx_buffer(priv);
+				if (WARN_ON(ret < 0))
+					break;
+			} else {
+				wsm = (struct wsm_hdr *)data;
+				BUG_ON(tx_len < sizeof(*wsm));
+				BUG_ON(__le32_to_cpu(wsm->len) != tx_len);
+
+#if 0 /* count is not implemented */
+				if (ret > 1)
+					atomic_add(1, &priv->bh_tx);
+#else
+				atomic_add(1, &priv->bh_tx);
+#endif
+
+
+#ifdef CW1200_NON_POWER_OF_TWO_BLOCKSIZES
+				tx_len = priv->sbus_ops->align_size(
+						priv->sbus_priv, tx_len);
+#else
+				/* HACK!!! Platform limitation.
+				* It is also supported by upper layer:
+				* there is always enough space at the
+				* end of the buffer. */
+				if (tx_len & (SDIO_BLOCK_SIZE - 1)) {
+					tx_len &= ~(SDIO_BLOCK_SIZE - 1);
+					tx_len += SDIO_BLOCK_SIZE;
+				}
+#endif
+
+				wsm->id |= __cpu_to_le32(
+					priv->wsm_tx_seq << 13);
+
+				if (WARN_ON(cw1200_data_write(priv,
+				    data, tx_len))) {
+					wsm_release_tx_buffer(priv);
+					break;
+				}
+
+#ifdef CW1200_DEBUG_ENABLE_WSM_DUMPS
+				print_hex_dump_bytes("--> ", DUMP_PREFIX_NONE,
+					data, __le32_to_cpu(wsm->len));
+#endif /* CW1200_DEBUG_ENABLE_WSM_DUMPS */
+
+				wsm_txed(priv, data);
+				priv->wsm_tx_seq = (priv->wsm_tx_seq + 1) & 7;
+			}
+		}
+
+		/* HACK!!! Device tends not to send interrupt
+		 * if this extra check is missing */
+		if (!(ctrl_reg & 0xFFF)) {
+			if (WARN_ON(cw1200_bh_read_ctrl_reg(
+					priv, &ctrl_reg)))
+				break;
+		}
+
+		if (ctrl_reg & 0xFFF)
+			goto rx;
+	}
+
+	if (skb_rx) {
+		cw1200_put_skb(priv, skb_rx);
+		skb_rx = NULL;
+	}
+
+
+	if (!term) {
+		cw1200_dbg(CW1200_DBG_ERROR, "[BH] Fatal error, exitting.\n");
+		priv->bh_error = 1;
+		/* TODO: schedule_work(recovery) */
+#ifndef HAS_PUT_TASK_STRUCT
+		/* The only reason of having this stupid code here is
+		 * that __put_task_struct is not exported by kernel. */
+		for (;;) {
+			int status = wait_event_interruptible(priv->bh_wq, ({
+				term = atomic_xchg(&priv->bh_term, 0);
+				(term);
+				}));
+
+			if (status || term)
+				break;
+		}
+#endif
+	}
+	return 0;
+}
diff --git a/drivers/staging/cw1200/bh.h b/drivers/staging/cw1200/bh.h
new file mode 100644
index 00000000000..b44388e164b
--- /dev/null
+++ b/drivers/staging/cw1200/bh.h
@@ -0,0 +1,26 @@
+/*
+ * Device handling thread interface for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_BH_H
+#define CW1200_BH_H
+
+/* extern */ struct cw1200_common;
+
+/* TODO: 512, actually. Was increased to 1024
+ * for compatibility with particular FW. */
+#define SDIO_BLOCK_SIZE (1024)
+
+int cw1200_register_bh(struct cw1200_common *priv);
+void cw1200_unregister_bh(struct cw1200_common *priv);
+void cw1200_irq_handler(struct cw1200_common *priv);
+void cw1200_bh_wakeup(struct cw1200_common *priv);
+
+#endif /* CW1200_BH_H */
diff --git a/drivers/staging/cw1200/cw1200.h b/drivers/staging/cw1200/cw1200.h
new file mode 100644
index 00000000000..2251f1ca756
--- /dev/null
+++ b/drivers/staging/cw1200/cw1200.h
@@ -0,0 +1,228 @@
+/*
+ * Common private data for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on the mac80211 Prism54 code, which is
+ * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
+ *
+ * Based on the islsm (softmac prism54) driver, which is:
+ * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_H
+#define CW1200_H
+
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include <linux/atomic.h>
+#include <net/mac80211.h>
+
+#include "queue.h"
+#include "wsm.h"
+#include "scan.h"
+#include "txrx.h"
+#include "ht.h"
+
+/* Debug switches */
+
+/* Dump all WSM (HI) messages. Quite a lot of logs. */
+/* #define CW1200_DEBUG_ENABLE_WSM_DUMPS */
+
+/* Enable WSM logs. Useful for low-level debugging (WSM HI control flow). */
+/* #define CW1200_DEBUG_ENABLE_WSM_LOGS */
+
+/* Enable BH logs. Useful for ultra-level debugging (interrupts and so on). */
+/* #define CW1200_DEBUG_ENABLE_BH_LOGS */
+
+/* Enable TX/RX logs. */
+/* #define CW1200_TXRX_DEBUG */
+
+/* extern */ struct sbus_ops;
+/* extern */ struct task_struct;
+
+#ifdef CW1200_TXRX_DEBUG
+#define txrx_printk(...) printk(__VA_ARGS__)
+#else
+#define txrx_printk(...)
+#endif
+
+#define CW1200_MAX_CTRL_FRAME_LEN	(0x1000)
+
+#define CW1200_MAX_STA_IN_AP_MODE	(5)
+#define CW1200_LINK_ID_AFTER_DTIM	(CW1200_MAX_STA_IN_AP_MODE + 1)
+
+enum cw1200_join_status {
+	CW1200_JOIN_STATUS_MONITOR = 0,
+	CW1200_JOIN_STATUS_STA,
+	CW1200_JOIN_STATUS_AP,
+};
+
+struct cw1200_common {
+	struct cw1200_queue		tx_queue[4];
+
+	struct ieee80211_hw		*hw;
+	struct ieee80211_vif		*vif;
+	struct device			*pdev;
+	struct workqueue_struct		*workqueue;
+
+	struct mutex			conf_mutex;
+
+	const struct sbus_ops		*sbus_ops;
+	struct sbus_priv		*sbus_priv;
+
+	/* HW type (HIF_...) */
+	int				hw_type;
+	int				hw_revision;
+
+	/* firmware/hardware info */
+	unsigned int tx_hdr_len;
+
+	/* Radio data */
+	int output_power;
+	int noise;
+
+	/* calibration, output power limit and rssi<->dBm conversation data */
+
+	/* BBP/MAC state */
+	struct ieee80211_rate *rates;
+	u8 mac_addr[ETH_ALEN];
+	struct ieee80211_channel *channel;
+	u8 bssid[ETH_ALEN];
+	struct wsm_edca_params		edca;
+	struct wsm_association_mode	association_mode;
+	struct wsm_set_bss_params	bss_params;
+	struct cw1200_ht_info		ht_info;
+	struct wsm_set_pm		powersave_mode;
+	int				cqm_rssi_thold;
+	unsigned			cqm_rssi_hyst;
+	unsigned			cqm_tx_failure_thold;
+	unsigned			cqm_tx_failure_count;
+	int				cqm_link_loss_count;
+	int				cqm_beacon_loss_count;
+	int				channel_switch_in_progress;
+	wait_queue_head_t		channel_switch_done;
+	u8				long_frame_max_tx_count;
+	u8				short_frame_max_tx_count;
+	int				mode;
+	bool				enable_beacon;
+	size_t				ssid_length;
+	u8				ssid[IEEE80211_MAX_SSID_LEN];
+
+	/* BH */
+	atomic_t			bh_rx;
+	atomic_t			bh_tx;
+	atomic_t			bh_term;
+	struct task_struct		*bh_thread;
+	int				bh_error;
+	wait_queue_head_t		bh_wq;
+	int				buf_id_tx;	/* byte */
+	int				buf_id_rx;	/* byte */
+	int				wsm_rx_seq;	/* byte */
+	int				wsm_tx_seq;	/* byte */
+	int				hw_bufs_used;
+	wait_queue_head_t		hw_bufs_used_wq;
+	struct sk_buff			*skb_cache;
+
+	/* WSM */
+	struct wsm_caps			wsm_caps;
+	struct mutex			wsm_cmd_mux;
+	struct wsm_buf			wsm_cmd_buf;
+	struct wsm_cmd			wsm_cmd;
+	wait_queue_head_t		wsm_cmd_wq;
+	wait_queue_head_t		wsm_startup_done;
+	struct wsm_cbc			wsm_cbc;
+	atomic_t			tx_lock;
+
+	/* Scan status */
+	struct cw1200_scan scan;
+
+	/* WSM Join */
+	enum cw1200_join_status	join_status;
+	u8			join_bssid[ETH_ALEN];
+	const struct wsm_tx	*join_pending_frame;
+	struct work_struct	join_work;
+	struct delayed_work	join_timeout;
+	struct work_struct	unjoin_work;
+	int			join_dtim_period;
+
+	/* TX/RX and security */
+	s8			wep_default_key_id;
+	struct work_struct	wep_key_work;
+	u32			key_map;
+	struct wsm_add_key	keys[WSM_KEY_MAX_INDEX + 1];
+	unsigned long		rx_timestamp;
+
+	/* AP powersave */
+	u32			link_id_map;
+	u32			tx_suspend_mask[4];
+	u32			sta_asleep_mask;
+	bool			suspend_multicast;
+	struct work_struct	set_tim_work;
+	struct work_struct	multicast_start_work;
+	struct work_struct	multicast_stop_work;
+
+
+	/* WSM events and CQM implementation */
+	spinlock_t		event_queue_lock;
+	struct list_head	event_queue;
+	struct work_struct	event_handler;
+	struct delayed_work	bss_loss_work;
+	struct delayed_work	connection_loss_work;
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+	struct delayed_work	keep_alive_work;
+	unsigned long		last_activity_time;
+#endif
+	struct work_struct	tx_failure_work;
+	int			delayed_link_loss;
+
+	/* TX rate policy cache */
+	struct tx_policy_cache tx_policy_cache;
+	struct work_struct tx_policy_upload_work;
+
+	/* cryptographic engine information */
+
+	/* bit field of glowing LEDs */
+	u16 softled_state;
+
+	/* statistics */
+	struct ieee80211_low_level_stats stats;
+};
+
+struct cw1200_sta_priv {
+        int link_id;
+};
+
+/* interfaces for the drivers */
+int cw1200_probe(const struct sbus_ops *sbus_ops,
+		 struct sbus_priv *sbus,
+		 struct device *pdev,
+		 struct cw1200_common **pself);
+void cw1200_release(struct cw1200_common *self);
+
+#define CW1200_DBG_MSG		0x00000001
+#define CW1200_DBG_NIY		0x00000002
+#define CW1200_DBG_SBUS		0x00000004
+#define CW1200_DBG_INIT		0x00000008
+#define CW1200_DBG_ERROR	0x00000010
+#define CW1200_DBG_LEVEL	0xFFFFFFFF
+
+#define cw1200_dbg(level, ...)				\
+	do {						\
+		if ((level) & CW1200_DBG_LEVEL)		\
+			printk(KERN_DEBUG __VA_ARGS__);	\
+	} while (0)
+
+#define STUB()						\
+	do {						\
+		cw1200_dbg(CW1200_DBG_NIY, "%s: STUB at line %d.\n", \
+		__func__, __LINE__);			\
+	} while (0)
+
+#endif /* CW1200_H */
diff --git a/drivers/staging/cw1200/cw1200_sdio.c b/drivers/staging/cw1200/cw1200_sdio.c
new file mode 100644
index 00000000000..0864984436c
--- /dev/null
+++ b/drivers/staging/cw1200/cw1200_sdio.c
@@ -0,0 +1,322 @@
+/*
+ * Mac80211 SDIO driver for ST-Ericsson CW1200 device
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/gpio.h>
+#include <linux/delay.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/card.h>
+#include <linux/spinlock.h>
+
+#include <net/mac80211.h>
+
+#include "cw1200.h"
+#include "sbus.h"
+
+MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>");
+MODULE_DESCRIPTION("mac80211 ST-Ericsson CW1200 SDIO driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("cw1200_wlan");
+
+/* Module parameter for MMC interface to probe the driver on. */
+static char device_name[10] = "mmc3";
+module_param_string(device, device_name, sizeof(device_name), S_IRUGO);
+MODULE_PARM_DESC(device, "SDIO interface device is connected to");
+
+#define CW1200_GPIO_LOW		(0)
+#define CW1200_GPIO_HIGH	(1)
+
+struct sbus_priv {
+	struct sdio_func	*func;
+	struct cw1200_common	*core;
+	spinlock_t		lock;
+	sbus_irq_handler	irq_handler;
+	void			*irq_priv;
+};
+
+static const struct sdio_device_id if_sdio_ids[] = {
+	{ SDIO_DEVICE(SDIO_ANY_ID, SDIO_ANY_ID) },
+	{ /* end: all zeroes */			},
+};
+
+/* sbus_ops implemetation */
+
+static int cw1200_sdio_memcpy_fromio(struct sbus_priv *self,
+				     unsigned int addr,
+				     void *dst, int count)
+{
+	int ret = sdio_memcpy_fromio(self->func, dst, addr, count);
+	if (ret) {
+		printk(KERN_ERR "!!! Can't read %d bytes from 0x%.8X. Err %d.\n",
+				count, addr, ret);
+	}
+	return ret;
+}
+
+static int cw1200_sdio_memcpy_toio(struct sbus_priv *self,
+				   unsigned int addr,
+				   const void *src, int count)
+{
+	return sdio_memcpy_toio(self->func, addr, (void *)src, count);
+}
+
+static void cw1200_sdio_lock(struct sbus_priv *self)
+{
+	sdio_claim_host(self->func);
+}
+
+static void cw1200_sdio_unlock(struct sbus_priv *self)
+{
+	sdio_release_host(self->func);
+}
+
+static void cw1200_sdio_irq_handler(struct sdio_func *func)
+{
+	struct sbus_priv *self = sdio_get_drvdata(func);
+	unsigned long flags;
+
+	BUG_ON(!self);
+	spin_lock_irqsave(&self->lock, flags);
+	if (self->irq_handler)
+		self->irq_handler(self->irq_priv);
+	spin_unlock_irqrestore(&self->lock, flags);
+}
+
+static int cw1200_sdio_irq_subscribe(struct sbus_priv *self,
+				     sbus_irq_handler handler,
+				     void *priv)
+{
+	int ret;
+	unsigned long flags;
+
+	if (!handler)
+		return -EINVAL;
+
+	spin_lock_irqsave(&self->lock, flags);
+	self->irq_priv = priv;
+	self->irq_handler = handler;
+	spin_unlock_irqrestore(&self->lock, flags);
+
+	printk(KERN_DEBUG "SW IRQ subscribe\n");
+	sdio_claim_host(self->func);
+	ret = sdio_claim_irq(self->func, cw1200_sdio_irq_handler);
+	sdio_release_host(self->func);
+	return ret;
+}
+
+static int cw1200_sdio_irq_unsubscribe(struct sbus_priv *self)
+{
+	int ret;
+	unsigned long flags;
+
+	WARN_ON(!self->irq_handler);
+	if (!self->irq_handler)
+		return 0;
+
+	printk(KERN_DEBUG "SW IRQ unsubscribe\n");
+	sdio_claim_host(self->func);
+	ret = sdio_release_irq(self->func);
+	sdio_release_host(self->func);
+
+	spin_lock_irqsave(&self->lock, flags);
+	self->irq_priv = NULL;
+	self->irq_handler = NULL;
+	spin_unlock_irqrestore(&self->lock, flags);
+
+	return ret;
+}
+
+#ifdef CW1200_U8500_PLATFORM
+static int cw1200_detect_card(void)
+{
+	/* HACK!!!
+	 * Rely on mmc->class_dev.class set in mmc_alloc_host
+	 * Tricky part: a new mmc hook is being (temporary) created
+	 * to discover mmc_host class.
+	 * Do you know more elegant way how to enumerate mmc_hosts?
+	 */
+
+	struct mmc_host *mmc = NULL;
+	struct class_dev_iter iter;
+	struct device *dev;
+
+	mmc = mmc_alloc_host(0, NULL);
+	if (!mmc)
+		return -ENOMEM;
+
+	BUG_ON(!mmc->class_dev.class);
+	class_dev_iter_init(&iter, mmc->class_dev.class, NULL, NULL);
+	for (;;) {
+		dev = class_dev_iter_next(&iter);
+		if (!dev) {
+			printk(KERN_ERR "CW1200: %s is not found.\n",
+				device_name);
+			break;
+		} else {
+			struct mmc_host *host = container_of(dev,
+				struct mmc_host, class_dev);
+
+			if (dev_name(&host->class_dev) &&
+				strcmp(dev_name(&host->class_dev),
+					device_name))
+				continue;
+
+			mmc_detect_change(host, 10);
+			break;
+		}
+	}
+	mmc_free_host(mmc);
+	return 0;
+}
+
+static int cw1200_sdio_off(void)
+{
+	gpio_set_value(215, CW1200_GPIO_LOW);
+	cw1200_detect_card();
+	gpio_free(215);
+	return 0;
+}
+
+static int cw1200_sdio_on(void)
+{
+	gpio_request(215, "cw1200_sdio");
+	gpio_direction_output(215, 1);
+	gpio_set_value(215, CW1200_GPIO_HIGH);
+	cw1200_detect_card();
+	return 0;
+}
+
+static int cw1200_sdio_reset(struct sbus_priv *self)
+{
+	cw1200_sdio_off();
+	mdelay(1000);
+	cw1200_sdio_on();
+	return 0;
+}
+
+#else  /* CW1200_U8500_PLATFORM */
+
+static int cw1200_sdio_off(void)
+{
+	return 0;
+}
+
+static int cw1200_sdio_on(void)
+{
+	return 0;
+}
+
+static int cw1200_sdio_reset(struct sbus_priv *self)
+{
+	return 0;
+}
+
+#endif /* CW1200_U8500_PLATFORM */
+
+static size_t cw1200_align_size(struct sbus_priv *self, size_t size)
+{
+	return sdio_align_size(self->func, size);
+}
+
+static struct sbus_ops cw1200_sdio_sbus_ops = {
+	.sbus_memcpy_fromio	= cw1200_sdio_memcpy_fromio,
+	.sbus_memcpy_toio	= cw1200_sdio_memcpy_toio,
+	.lock			= cw1200_sdio_lock,
+	.unlock			= cw1200_sdio_unlock,
+	.irq_subscribe		= cw1200_sdio_irq_subscribe,
+	.irq_unsubscribe	= cw1200_sdio_irq_unsubscribe,
+	.reset			= cw1200_sdio_reset,
+	.align_size		= cw1200_align_size,
+};
+
+/* Probe Function to be called by SDIO stack when device is discovered */
+static int cw1200_sdio_probe(struct sdio_func *func,
+			      const struct sdio_device_id *id)
+{
+	struct sbus_priv *self;
+	int status;
+	cw1200_dbg(CW1200_DBG_INIT, "Probe called\n");
+
+	self = kzalloc(sizeof(*self), GFP_KERNEL);
+	if (!self) {
+		cw1200_dbg(CW1200_DBG_ERROR, "Can't allocate SDIO sbus_priv.");
+		return -ENOMEM;
+	}
+
+	spin_lock_init(&self->lock);
+	self->func = func;
+	sdio_set_drvdata(func, self);
+	sdio_claim_host(func);
+	sdio_enable_func(func);
+	sdio_release_host(func);
+
+	status = cw1200_probe(&cw1200_sdio_sbus_ops,
+			      self, &func->dev, &self->core);
+	if (status) {
+		sdio_claim_host(func);
+		sdio_disable_func(func);
+		sdio_release_host(func);
+		sdio_set_drvdata(func, NULL);
+		kfree(self);
+	}
+
+	return status;
+}
+
+/* Disconnect Function to be called by SDIO stack when device is disconnected */
+static void cw1200_sdio_disconnect(struct sdio_func *func)
+{
+	struct sbus_priv *self = sdio_get_drvdata(func);
+
+	if (self) {
+		if (self->core) {
+			cw1200_release(self->core);
+			self->core = NULL;
+		}
+		sdio_claim_host(func);
+		sdio_disable_func(func);
+		sdio_release_host(func);
+		sdio_set_drvdata(func, NULL);
+		kfree(self);
+	}
+}
+
+static struct sdio_driver sdio_driver = {
+	.name		= "cw1200_wlan",
+	.id_table	= if_sdio_ids,
+	.probe		= cw1200_sdio_probe,
+	.remove		= cw1200_sdio_disconnect,
+};
+
+/* Init Module function -> Called by insmod */
+static int __init cw1200_sdio_init(void)
+{
+	int ret = sdio_register_driver(&sdio_driver);
+	if (ret)
+		return ret;
+	ret = cw1200_sdio_on();
+	if (ret)
+		sdio_unregister_driver(&sdio_driver);
+	return ret;
+}
+
+/* Called at Driver Unloading */
+static void __exit cw1200_sdio_exit(void)
+{
+	sdio_unregister_driver(&sdio_driver);
+	cw1200_sdio_off();
+}
+
+
+module_init(cw1200_sdio_init);
+module_exit(cw1200_sdio_exit);
diff --git a/drivers/staging/cw1200/fwio.c b/drivers/staging/cw1200/fwio.c
new file mode 100644
index 00000000000..a85062e2e3a
--- /dev/null
+++ b/drivers/staging/cw1200/fwio.c
@@ -0,0 +1,560 @@
+/*
+ * Firmware I/O code for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/vmalloc.h>
+#include <linux/sched.h>
+#include <linux/firmware.h>
+
+#include "cw1200.h"
+#include "fwio.h"
+#include "hwio.h"
+#include "sbus.h"
+#include "bh.h"
+
+static int cw1200_get_hw_type(u32 config_reg_val, int *major_revision)
+{
+	int hw_type = -1;
+	u32 silicon_type = (config_reg_val >> 24) & 0x3;
+	u32 silicon_vers = (config_reg_val >> 31) & 0x1;
+
+	/* Check if we have CW1200 or STLC9000 */
+	if ((silicon_type == 0x1) || (silicon_type == 0x2)) {
+		*major_revision = silicon_type;
+		if (silicon_vers)
+			hw_type = HIF_8601_VERSATILE;
+		else
+			hw_type = HIF_8601_SILICON;
+	} else {
+		*major_revision = 1;
+		hw_type = HIF_9000_SILICON_VERSTAILE;
+	}
+
+	return hw_type;
+}
+
+static int config_reg_read_stlc9000(struct cw1200_common *priv,
+				    u16 reg, u32 *val)
+{
+	u16 val16;
+	int ret = cw1200_reg_read_16(priv, reg, &val16);
+	if (ret < 0)
+		return ret;
+	*val = val16;
+	return 0;
+}
+
+static int config_reg_write_stlc9000(struct cw1200_common *priv,
+				     u16 reg, u32 val)
+{
+	return cw1200_reg_write_16(priv, reg, (u16)val);
+}
+
+static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
+{
+	int ret, block, num_blocks;
+	unsigned i;
+	u32 val32;
+	u32 put = 0, get = 0;
+	u8 *buf = NULL;
+	const char *fw_path;
+	const struct firmware *firmware = NULL;
+
+	/* Macroses are local. */
+#define APB_WRITE(reg, val) \
+	do { \
+		ret = cw1200_apb_write_32(priv, CW12000_APB(reg), (val)); \
+		if (ret < 0) { \
+			cw1200_dbg(CW1200_DBG_ERROR, \
+				"%s: can't write %s at line %d.\n", \
+				__func__, #reg, __LINE__); \
+			goto error; \
+		} \
+	} while (0)
+#define APB_READ(reg, val) \
+	do { \
+		ret = cw1200_apb_read_32(priv, CW12000_APB(reg), &(val)); \
+		if (ret < 0) { \
+			cw1200_dbg(CW1200_DBG_ERROR, \
+				"%s: can't read %s at line %d.\n", \
+				__func__, #reg, __LINE__); \
+			goto error; \
+		} \
+	} while (0)
+#define REG_WRITE(reg, val) \
+	do { \
+		ret = cw1200_reg_write_32(priv, (reg), (val)); \
+		if (ret < 0) { \
+			cw1200_dbg(CW1200_DBG_ERROR, \
+				"%s: can't write %s at line %d.\n", \
+				__func__, #reg, __LINE__); \
+			goto error; \
+		} \
+	} while (0)
+#define REG_READ(reg, val) \
+	do { \
+		ret = cw1200_reg_read_32(priv, (reg), &(val)); \
+		if (ret < 0) { \
+			cw1200_dbg(CW1200_DBG_ERROR, \
+				"%s: can't read %s at line %d.\n", \
+				__func__, #reg, __LINE__); \
+			goto error; \
+		} \
+	} while (0)
+
+	switch (priv->hw_revision) {
+	case CW1200_HW_REV_CUT10:
+		fw_path = FIRMWARE_CUT10;
+		break;
+	case CW1200_HW_REV_CUT11:
+		fw_path = FIRMWARE_CUT11;
+		break;
+	case CW1200_HW_REV_CUT20:
+		fw_path = FIRMWARE_CUT20;
+		break;
+	default:
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: invalid silicon revision %d.\n",
+			__func__, priv->hw_revision);
+		return -EINVAL;
+	}
+
+	/* Initialize common registers */
+	APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, DOWNLOAD_ARE_YOU_HERE);
+	APB_WRITE(DOWNLOAD_PUT_REG, 0);
+	APB_WRITE(DOWNLOAD_GET_REG, 0);
+	APB_WRITE(DOWNLOAD_STATUS_REG, DOWNLOAD_PENDING);
+	APB_WRITE(DOWNLOAD_FLAGS_REG, 0);
+
+	/* Write the NOP Instruction */
+	REG_WRITE(ST90TDS_SRAM_BASE_ADDR_REG_ID, 0xFFF20000);
+	REG_WRITE(ST90TDS_AHB_DPORT_REG_ID, 0xEAFFFFFE);
+
+	/* Release CPU from RESET */
+	REG_READ(ST90TDS_CONFIG_REG_ID, val32);
+	val32 &= ~ST90TDS_CONFIG_CPU_RESET_BIT;
+	REG_WRITE(ST90TDS_CONFIG_REG_ID, val32);
+
+	/* Enable Clock */
+	val32 &= ~ST90TDS_CONFIG_CPU_CLK_DIS_BIT;
+	REG_WRITE(ST90TDS_CONFIG_REG_ID, val32);
+
+	/* Load a firmware file */
+	ret = request_firmware(&firmware, fw_path, priv->pdev);
+	if (ret) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't load firmware file %s.\n",
+			__func__, fw_path);
+		goto error;
+	}
+	BUG_ON(!firmware->data);
+
+	buf = kmalloc(DOWNLOAD_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
+	if (!buf) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't allocate firmware buffer.\n", __func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	/* Check if the bootloader is ready */
+	for (i = 0; i < 100; i += 1 + i / 2) {
+		APB_READ(DOWNLOAD_IMAGE_SIZE_REG, val32);
+		if (val32 == DOWNLOAD_I_AM_HERE)
+			break;
+		mdelay(i);
+	} /* End of for loop */
+
+	if (val32 != DOWNLOAD_I_AM_HERE) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: bootloader is not ready.\n", __func__);
+		ret = -ETIMEDOUT;
+		goto error;
+	}
+
+	/* Calculcate number of download blocks */
+	num_blocks = (firmware->size - 1) / DOWNLOAD_BLOCK_SIZE + 1;
+
+	/* Updating the length in Download Ctrl Area */
+	val32 = firmware->size; /* Explicit cast from size_t to u32 */
+	APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, val32);
+
+	/* Firmware downloading loop */
+	for (block = 0; block < num_blocks ; block++) {
+		size_t tx_size;
+		size_t block_size;
+
+		/* check the download status */
+		APB_READ(DOWNLOAD_STATUS_REG, val32);
+		if (val32 != DOWNLOAD_PENDING) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: bootloader reported error %d.\n",
+				__func__, val32);
+			ret = -EIO;
+			goto error;
+		}
+
+		/* loop until put - get <= 24K */
+		for (i = 0; i < 100; i++) {
+			APB_READ(DOWNLOAD_GET_REG, get);
+			if ((put - get) <=
+			    (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE))
+				break;
+			mdelay(i);
+		}
+
+		if ((put - get) > (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE)) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Timeout waiting for FIFO.\n",
+				__func__);
+			return -ETIMEDOUT;
+		}
+
+		/* calculate the block size */
+		tx_size = block_size = min((size_t)(firmware->size - put),
+			(size_t)DOWNLOAD_BLOCK_SIZE);
+
+		memcpy(buf, &firmware->data[put], block_size);
+#ifdef BUG_POWER_OF_TWO_BLOCKSIZE
+		if (block_size < DOWNLOAD_BLOCK_SIZE) {
+			memset(&buf[block_size],
+				0, DOWNLOAD_BLOCK_SIZE - block_size);
+			tx_size = DOWNLOAD_BLOCK_SIZE;
+		}
+#endif /* BUG_POWER_OF_TWO_BLOCKSIZE */
+
+		/* send the block to sram */
+		ret = cw1200_apb_write(priv,
+			CW12000_APB(DOWNLOAD_FIFO_OFFSET +
+				(put & (DOWNLOAD_FIFO_SIZE - 1))),
+			buf, tx_size);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: can't write block at line %d.\n",
+				__func__, __LINE__);
+			goto error;
+		}
+
+		/* update the put register */
+		put += block_size;
+		APB_WRITE(DOWNLOAD_PUT_REG, put);
+	} /* End of firmware download loop */
+
+	/* Wait for the download completion */
+	for (i = 0; i < 300; i += 1 + i / 2) {
+		APB_READ(DOWNLOAD_STATUS_REG, val32);
+		if (val32 != DOWNLOAD_PENDING)
+			break;
+		mdelay(i);
+	}
+	if (val32 != DOWNLOAD_SUCCESS) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: wait for download completion failed. " \
+			"Read: 0x%.8X\n", __func__, val32);
+		ret = -ETIMEDOUT;
+		goto error;
+	} else {
+		cw1200_dbg(CW1200_DBG_MSG,
+			"Firmware download completed.\n");
+		ret = 0;
+	}
+
+error:
+	kfree(buf);
+	if (firmware)
+		release_firmware(firmware);
+	return ret;
+
+#undef APB_WRITE
+#undef APB_READ
+#undef REG_WRITE
+#undef REG_READ
+}
+
+int cw1200_load_firmware(struct cw1200_common *priv)
+{
+	int ret;
+	int i;
+	u32 val32;
+	u16 val16;
+	u32 dpll = 0;
+	int major_revision;
+	int (*config_reg_read)(struct cw1200_common *priv, u16 reg, u32 *val);
+	int (*config_reg_write)(struct cw1200_common *priv, u16 reg, u32 val);
+
+	BUG_ON(!priv);
+
+	/* Read CONFIG Register Value - We will read 32 bits */
+	ret = cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't read config register.\n", __func__);
+		goto out;
+	}
+
+	priv->hw_type = cw1200_get_hw_type(val32, &major_revision);
+	if (priv->hw_type < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't deduct hardware type.\n", __func__);
+		ret = -ENOTSUPP;
+		goto out;
+	}
+
+	switch (priv->hw_type) {
+	case HIF_8601_VERSATILE:
+	case HIF_8601_SILICON:
+		dpll = DPLL_INIT_VAL_CW1200;
+		config_reg_read = cw1200_reg_read_32;
+		config_reg_write = cw1200_reg_write_32;
+		break;
+	case HIF_9000_SILICON_VERSTAILE:
+		dpll = DPLL_INIT_VAL_9000;
+		config_reg_read = config_reg_read_stlc9000;
+		config_reg_write = config_reg_write_stlc9000;
+		break;
+	default:
+		BUG_ON(1);
+	}
+
+	ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID, dpll);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't write DPLL register.\n", __func__);
+		goto out;
+	}
+
+	msleep(20);
+
+	/* Read DPLL Reg value and compare with value written */
+	ret = cw1200_reg_read_32(priv,
+		ST90TDS_TSET_GEN_R_W_REG_ID, &val32);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't read DPLL register.\n", __func__);
+		goto out;
+	}
+
+	if (val32 != dpll) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: unable to initialise " \
+			"DPLL register. Wrote 0x%.8X, read 0x%.8X.\n",
+			__func__, dpll, val32);
+		ret = -EIO;
+		goto out;
+	}
+
+	/* Set wakeup bit in device */
+	ret = cw1200_reg_read_16(priv, ST90TDS_CONTROL_REG_ID, &val16);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: set_wakeup: can't read " \
+			"control register.\n", __func__);
+		goto out;
+	}
+
+	ret = cw1200_reg_write_16(priv, ST90TDS_CONTROL_REG_ID,
+		val16 | ST90TDS_CONT_WUP_BIT);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: set_wakeup: can't write " \
+			"control register.\n", __func__);
+		goto out;
+	}
+
+	/* Wait for wakeup */
+	for (i = 0 ; i < 300 ; i += 1 + i / 2) {
+		ret = cw1200_reg_read_16(priv,
+			ST90TDS_CONTROL_REG_ID, &val16);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: wait_for_wakeup: can't read " \
+				"control register.\n", __func__);
+			goto out;
+		}
+
+		if (val16 & ST90TDS_CONT_RDY_BIT) {
+			cw1200_dbg(CW1200_DBG_MSG,
+				"WLAN device is ready.\n");
+			break;
+		}
+		msleep(i);
+	}
+
+	if ((val16 & ST90TDS_CONT_RDY_BIT) == 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: wait_for_wakeup: device is not responding.\n",
+			__func__);
+		ret = -ETIMEDOUT;
+		goto out;
+	}
+
+	if (major_revision == 1) {
+		/* CW1200 Hardware detection logic : Check for CUT1.1 */
+		ret = cw1200_ahb_read_32(priv, CW1200_CUT_ID_ADDR, &val32);
+		if (ret) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: HW detection: can't read CUT ID.\n",
+				__func__);
+			goto out;
+		}
+
+		switch (val32) {
+		case CW1200_CUT_11_ID_STR:
+			cw1200_dbg(CW1200_DBG_MSG,
+				   "Cut 1.1 silicon is detected.\n");
+			priv->hw_revision = CW1200_HW_REV_CUT11;
+			break;
+		default:
+			cw1200_dbg(CW1200_DBG_MSG,
+				   "Cut 1.0 silicon is detected.\n");
+			priv->hw_revision = CW1200_HW_REV_CUT10;
+			break;
+		}
+	} else if (major_revision == 2) {
+		cw1200_dbg(CW1200_DBG_MSG, "Cut 2.0 silicon is detected.\n");
+		priv->hw_revision = CW1200_HW_REV_CUT20;
+	} else {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: unsupported silicon major revision %d.\n",
+			__func__, major_revision);
+		ret = -ENOTSUPP;
+		goto out;
+	}
+
+	/* Checking for access mode */
+	ret = config_reg_read(priv, ST90TDS_CONFIG_REG_ID, &val32);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: check_access_mode: can't read " \
+			"config register.\n", __func__);
+		goto out;
+	}
+
+	if (val32 & ST90TDS_CONFIG_ACCESS_MODE_BIT) {
+		switch (priv->hw_type)  {
+		case HIF_8601_SILICON:
+			cw1200_dbg(CW1200_DBG_MSG,
+				"%s: CW1200 detected.\n", __func__);
+			ret = cw1200_load_firmware_cw1200(priv);
+			break;
+		case HIF_8601_VERSATILE:
+			/* TODO: Not implemented yet!
+			ret = cw1200_load_firmware_cw1100(priv);
+			*/
+			ret = -ENOTSUPP;
+			goto out;
+		case HIF_9000_SILICON_VERSTAILE:
+			/* TODO: Not implemented yet!
+			ret = cw1200_load_firmware_stlc9000(priv);
+			*/
+			ret = -ENOTSUPP;
+			goto out;
+		default:
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Unknown hardware: %d.\n",
+				__func__, priv->hw_type);
+		}
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: can't download firmware.\n", __func__);
+			goto out;
+		}
+	} else {
+		cw1200_dbg(CW1200_DBG_MSG,
+			"%s: check_access_mode: device is already " \
+			"in QUEUE mode.\n", __func__);
+		/* TODO: verify this branch. Do we need something to do? */
+	}
+
+	/* Register Interrupt Handler */
+	ret = priv->sbus_ops->irq_subscribe(priv->sbus_priv,
+		(sbus_irq_handler)cw1200_irq_handler, priv);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: can't register IRQ handler.\n", __func__);
+		goto out;
+	}
+
+	if (HIF_8601_SILICON  == priv->hw_type) {
+		/* If device is CW1200 the IRQ enable/disable bits
+		 * are in CONFIG register */
+		ret = config_reg_read(priv, ST90TDS_CONFIG_REG_ID, &val32);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: enable_irq: can't read " \
+				"config register.\n", __func__);
+			goto unsubscribe;
+		}
+		ret = config_reg_write(priv, ST90TDS_CONFIG_REG_ID,
+			val32 | ST90TDS_CONF_IRQ_RDY_ENABLE);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: enable_irq: can't write " \
+				"config register.\n", __func__);
+			goto unsubscribe;
+		}
+	} else {
+		/* If device is STLC9000 the IRQ enable/disable bits
+		 * are in CONTROL register */
+		/* Enable device interrupts - Both DATA_RDY and WLAN_RDY */
+		ret = cw1200_reg_read_16(priv, ST90TDS_CONFIG_REG_ID, &val16);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: enable_irq: can't read " \
+				"control register.\n", __func__);
+			goto unsubscribe;
+		}
+		ret = cw1200_reg_write_16(priv, ST90TDS_CONFIG_REG_ID,
+			val16 | ST90TDS_CONT_IRQ_RDY_ENABLE);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: enable_irq: can't write " \
+				"control register.\n", __func__);
+			goto unsubscribe;
+		}
+
+	}
+
+	/* Configure device for MESSSAGE MODE */
+	ret = config_reg_read(priv, ST90TDS_CONFIG_REG_ID, &val32);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: set_mode: can't read config register.\n",
+			__func__);
+		goto unsubscribe;
+	}
+	ret = config_reg_write(priv, ST90TDS_CONFIG_REG_ID,
+		val32 & ~ST90TDS_CONFIG_ACCESS_MODE_BIT);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"%s: set_mode: can't write config register.\n",
+			__func__);
+		goto unsubscribe;
+	}
+
+	/* Unless we read the CONFIG Register we are
+	 * not able to get an interrupt */
+	mdelay(10);
+	config_reg_read(priv, ST90TDS_CONFIG_REG_ID, &val32);
+
+out:
+	return ret;
+
+unsubscribe:
+	priv->sbus_ops->irq_unsubscribe(priv->sbus_priv);
+	return ret;
+}
+
diff --git a/drivers/staging/cw1200/fwio.h b/drivers/staging/cw1200/fwio.h
new file mode 100644
index 00000000000..4f5e612cf10
--- /dev/null
+++ b/drivers/staging/cw1200/fwio.h
@@ -0,0 +1,33 @@
+/*
+ * Firmware API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef FWIO_H_INCLUDED
+#define FWIO_H_INCLUDED
+
+#define FIRMWARE_CUT20		("cw1200/wsm_20.bin")
+#define FIRMWARE_CUT11		("cw1200/wsm_11.bin")
+#define FIRMWARE_CUT10		("cw1200/wsm_10.bin")
+#define SDD_FILE_20		("cw1200/sdd_20.bin")
+#define SDD_FILE_11		("cw1200/sdd_11.bin")
+#define SDD_FILE_10		("cw1200/sdd_10.bin")
+
+#define CW1200_HW_REV_CUT10	(10)
+#define CW1200_HW_REV_CUT11	(11)
+#define CW1200_HW_REV_CUT20	(20)
+
+int cw1200_load_firmware(struct cw1200_common *priv);
+
+#endif
diff --git a/drivers/staging/cw1200/ht.h b/drivers/staging/cw1200/ht.h
new file mode 100644
index 00000000000..5c486a634c7
--- /dev/null
+++ b/drivers/staging/cw1200/ht.h
@@ -0,0 +1,43 @@
+/*
+ *  HT-related code for ST-Ericsson CW1200 driver
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_HT_H_INCLUDED
+#define CW1200_HT_H_INCLUDED
+
+#include <net/mac80211.h>
+
+struct cw1200_ht_info {
+	struct ieee80211_sta_ht_cap	ht_cap;
+	enum nl80211_channel_type	channel_type;
+	u16				operation_mode;
+};
+
+static inline int cw1200_is_ht(const struct cw1200_ht_info *ht_info)
+{
+	return ht_info->channel_type != NL80211_CHAN_NO_HT;
+}
+
+static inline int cw1200_ht_greenfield(const struct cw1200_ht_info *ht_info)
+{
+	return cw1200_is_ht(ht_info) &&
+		(ht_info->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
+		!(ht_info->operation_mode &
+			IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+}
+
+static inline int cw1200_ht_ampdu_density(const struct cw1200_ht_info *ht_info)
+{
+	if (!cw1200_is_ht(ht_info))
+		return 0;
+	return ht_info->ht_cap.ampdu_density;
+}
+
+#endif /* CW1200_HT_H_INCLUDED */
diff --git a/drivers/staging/cw1200/hwio.c b/drivers/staging/cw1200/hwio.c
new file mode 100644
index 00000000000..094ce8234f0
--- /dev/null
+++ b/drivers/staging/cw1200/hwio.c
@@ -0,0 +1,268 @@
+/*
+ * Low-level device IO routines for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver, which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+
+#include "cw1200.h"
+#include "hwio.h"
+#include "sbus.h"
+
+ /* Sdio addr is 4*spi_addr */
+#define SPI_REG_ADDR_TO_SDIO(spi_reg_addr) ((spi_reg_addr) << 2)
+#define SDIO_ADDR17BIT(buf_id, mpf, rfu, reg_id_ofs) \
+				((((buf_id)    & 0x1F) << 7) \
+				| (((mpf)        & 1) << 6) \
+				| (((rfu)        & 1) << 5) \
+				| (((reg_id_ofs) & 0x1F) << 0))
+
+
+static int __cw1200_reg_read(struct cw1200_common *priv, u16 addr,
+				void *buf, size_t buf_len, int buf_id)
+{
+	u16 addr_sdio;
+	u32 sdio_reg_addr_17bit ;
+
+	/* Check if buffer is aligned to 4 byte boundary */
+	if (WARN_ON(((unsigned long)buf & 3) && (buf_len > 4))) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			   "%s: buffer is not aligned.\n", __func__);
+		return -EINVAL;
+	}
+
+	/* Convert to SDIO Register Address */
+	addr_sdio = SPI_REG_ADDR_TO_SDIO(addr);
+	sdio_reg_addr_17bit = SDIO_ADDR17BIT(buf_id, 0, 0, addr_sdio);
+
+	BUG_ON(!priv->sbus_ops);
+	return priv->sbus_ops->sbus_memcpy_fromio(priv->sbus_priv,
+						  sdio_reg_addr_17bit,
+						  buf, buf_len);
+}
+
+static int __cw1200_reg_write(struct cw1200_common *priv, u16 addr,
+				const void *buf, size_t buf_len, int buf_id)
+{
+	u16 addr_sdio;
+	u32 sdio_reg_addr_17bit ;
+
+#if 0
+	/* Check if buffer is aligned to 4 byte boundary */
+	if (WARN_ON(((unsigned long)buf & 3) && (buf_len > 4))) {
+		cw1200_dbg(CW1200_DBG_ERROR, "%s: buffer is not aligned.\n",
+				__func__);
+		return -EINVAL;
+	}
+#endif
+
+	/* Convert to SDIO Register Address */
+	addr_sdio = SPI_REG_ADDR_TO_SDIO(addr);
+	sdio_reg_addr_17bit = SDIO_ADDR17BIT(buf_id, 0, 0, addr_sdio);
+
+	BUG_ON(!priv->sbus_ops);
+	return priv->sbus_ops->sbus_memcpy_toio(priv->sbus_priv,
+						sdio_reg_addr_17bit,
+						buf, buf_len);
+}
+
+static inline int __cw1200_reg_read_32(struct cw1200_common *priv,
+					u16 addr, u32 *val)
+{
+	return __cw1200_reg_read(priv, addr, val, sizeof(val), 0);
+}
+
+static inline int __cw1200_reg_write_32(struct cw1200_common *priv,
+					u16 addr, u32 val)
+{
+	return __cw1200_reg_write(priv, addr, &val, sizeof(val), 0);
+}
+
+int cw1200_reg_read(struct cw1200_common *priv, u16 addr, void *buf,
+			size_t buf_len)
+{
+	int ret;
+	BUG_ON(!priv->sbus_ops);
+	priv->sbus_ops->lock(priv->sbus_priv);
+	ret = __cw1200_reg_read(priv, addr, buf, buf_len, 0);
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
+int cw1200_reg_write(struct cw1200_common *priv, u16 addr, const void *buf,
+			size_t buf_len)
+{
+	int ret;
+	BUG_ON(!priv->sbus_ops);
+	priv->sbus_ops->lock(priv->sbus_priv);
+	ret = __cw1200_reg_write(priv, addr, buf, buf_len, 0);
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
+int cw1200_data_read(struct cw1200_common *priv, void *buf, size_t buf_len)
+{
+	int ret;
+	BUG_ON(!priv->sbus_ops);
+	priv->sbus_ops->lock(priv->sbus_priv);
+	{
+		int buf_id_rx = priv->buf_id_rx;
+		ret = __cw1200_reg_read(priv, ST90TDS_IN_OUT_QUEUE_REG_ID, buf,
+						buf_len, buf_id_rx + 1);
+		if (!ret) {
+			buf_id_rx = (buf_id_rx + 1) & 3;
+			priv->buf_id_rx = buf_id_rx;
+		}
+	}
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
+int cw1200_data_write(struct cw1200_common *priv, const void *buf,
+			size_t buf_len)
+{
+	int ret;
+	BUG_ON(!priv->sbus_ops);
+	priv->sbus_ops->lock(priv->sbus_priv);
+	{
+		int buf_id_tx = priv->buf_id_tx;
+		ret = __cw1200_reg_write(priv, ST90TDS_IN_OUT_QUEUE_REG_ID, buf,
+						buf_len, buf_id_tx);
+		if (!ret) {
+			buf_id_tx = (buf_id_tx + 1) & 31;
+			priv->buf_id_tx = buf_id_tx;
+		}
+	}
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
+int cw1200_indirect_read(struct cw1200_common *priv, u32 addr, void *buf,
+			 size_t buf_len, u32 prefetch, u16 port_addr)
+{
+	u32 val32 = 0;
+	int i, ret;
+
+	if ((buf_len / 2) >= 0x1000) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't read more than 0xfff words.\n",
+				__func__);
+		WARN_ON(1);
+		return -EINVAL;
+		goto out;
+	}
+
+	priv->sbus_ops->lock(priv->sbus_priv);
+	/* Write address */
+	ret = __cw1200_reg_write_32(priv, ST90TDS_SRAM_BASE_ADDR_REG_ID, addr);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't write address register.\n",
+				__func__);
+		goto out;
+	}
+
+	/* Read CONFIG Register Value - We will read 32 bits */
+	ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't read config register.\n",
+				__func__);
+		goto out;
+	}
+
+	/* Set PREFETCH bit */
+	ret = __cw1200_reg_write_32(priv, ST90TDS_CONFIG_REG_ID,
+					val32 | prefetch);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't write prefetch bit.\n",
+				__func__);
+		goto out;
+	}
+
+	/* Check for PRE-FETCH bit to be cleared */
+	for (i = 0; i < 20; i++) {
+		ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+		if (ret < 0) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+					"%s: Can't check prefetch bit.\n",
+					__func__);
+			goto out;
+		}
+		if (!(val32 & prefetch))
+			break;
+
+		mdelay(i);
+	}
+
+	if (val32 & prefetch) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Prefetch bit is not cleared.\n",
+				__func__);
+		goto out;
+	}
+
+	/* Read data port */
+	ret = __cw1200_reg_read(priv, port_addr, buf, buf_len, 0);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't read data port.\n",
+				__func__);
+		goto out;
+	}
+
+out:
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
+int cw1200_apb_write(struct cw1200_common *priv, u32 addr, const void *buf,
+			size_t buf_len)
+{
+	int ret;
+
+	if ((buf_len / 2) >= 0x1000) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't wrire more than 0xfff words.\n",
+				__func__);
+		WARN_ON(1);
+		return -EINVAL;
+	}
+
+	priv->sbus_ops->lock(priv->sbus_priv);
+
+	/* Write address */
+	ret = __cw1200_reg_write_32(priv, ST90TDS_SRAM_BASE_ADDR_REG_ID, addr);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: Can't write address register.\n",
+				__func__);
+		goto out;
+	}
+
+	/* Write data port */
+	ret = __cw1200_reg_write(priv, ST90TDS_SRAM_DPORT_REG_ID,
+					buf, buf_len, 0);
+	if (ret < 0) {
+		cw1200_dbg(CW1200_DBG_ERROR, "%s: Can't write data port.\n",
+				__func__);
+		goto out;
+	}
+
+out:
+	priv->sbus_ops->unlock(priv->sbus_priv);
+	return ret;
+}
+
diff --git a/drivers/staging/cw1200/hwio.h b/drivers/staging/cw1200/hwio.h
new file mode 100644
index 00000000000..59f3ca94eb1
--- /dev/null
+++ b/drivers/staging/cw1200/hwio.h
@@ -0,0 +1,236 @@
+/*
+ * Low-level API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_HWIO_H_INCLUDED
+#define CW1200_HWIO_H_INCLUDED
+
+/* extern */ struct cw1200_common;
+
+#define BUG_POWER_OF_TWO_BLOCKSIZE
+
+/* DPLL initial values */
+#define DPLL_INIT_VAL_9000		(0x00000191)
+#define DPLL_INIT_VAL_CW1200		(0x0EC4F121)
+
+/* Hardware Type Definitions */
+#define HIF_8601_VERSATILE		(0)
+#define HIF_8601_SILICON		(1)
+#define HIF_9000_SILICON_VERSTAILE	(2)
+
+#define CW1200_CUT_11_ID_STR		(0x302E3830)
+#define CW1200_CUT_ID_ADDR		(0xFFF17F90)
+
+/* Download control area */
+/* boot loader start address in SRAM */
+#define DOWNLOAD_BOOT_LOADER_OFFSET	(0x00000000)
+/* 32K, 0x4000 to 0xDFFF */
+#define DOWNLOAD_FIFO_OFFSET		(0x00004000)
+/* 32K */
+#define DOWNLOAD_FIFO_SIZE		(0x00008000)
+/* 128 bytes, 0xFF80 to 0xFFFF */
+#define DOWNLOAD_CTRL_OFFSET		(0x0000FF80)
+#define DOWNLOAD_CTRL_DATA_DWORDS	(32-6)
+
+struct download_cntl_t {
+	/* size of whole firmware file (including Cheksum), host init */
+	u32 ImageSize;
+	/* downloading flags */
+	u32 Flags;
+	/* No. of bytes put into the download, init & updated by host */
+	u32 Put;
+	/* last traced program counter, last ARM reg_pc */
+	u32 TracePc;
+	/* No. of bytes read from the download, host init, device updates */
+	u32 Get;
+	/* r0, boot losader status, host init to pending, device updates */
+	u32 Status;
+	/* Extra debug info, r1 to r14 if status=r0=DOWNLOAD_EXCEPTION */
+	u32 DebugData[DOWNLOAD_CTRL_DATA_DWORDS];
+};
+
+#define	DOWNLOAD_IMAGE_SIZE_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, ImageSize))
+#define	DOWNLOAD_FLAGS_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, Flags))
+#define DOWNLOAD_PUT_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, Put))
+#define DOWNLOAD_TRACE_PC_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, TracePc))
+#define	DOWNLOAD_GET_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, Get))
+#define	DOWNLOAD_STATUS_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, Status))
+#define DOWNLOAD_DEBUG_DATA_REG		\
+	(DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, DebugData))
+#define DOWNLOAD_DEBUG_DATA_LEN		(108)
+
+#define DOWNLOAD_BLOCK_SIZE		(1024)
+
+/* For boot loader detection */
+#define DOWNLOAD_ARE_YOU_HERE		(0x87654321)
+#define DOWNLOAD_I_AM_HERE		(0x12345678)
+
+/* Download error code */
+#define DOWNLOAD_PENDING		(0xFFFFFFFF)
+#define DOWNLOAD_SUCCESS		(0)
+#define DOWNLOAD_EXCEPTION		(1)
+#define DOWNLOAD_ERR_MEM_1		(2)
+#define DOWNLOAD_ERR_MEM_2		(3)
+#define DOWNLOAD_ERR_SOFTWARE		(4)
+#define DOWNLOAD_ERR_FILE_SIZE		(5)
+#define DOWNLOAD_ERR_CHECKSUM		(6)
+#define DOWNLOAD_ERR_OVERFLOW		(7)
+#define DOWNLOAD_ERR_IMAGE		(8)
+#define DOWNLOAD_ERR_HOST		(9)
+#define DOWNLOAD_ERR_ABORT		(10)
+
+
+#define SYS_BASE_ADDR_SILICON		(0)
+#define PAC_BASE_ADDRESS_SILICON	(SYS_BASE_ADDR_SILICON + 0x09000000)
+#define PAC_SHARED_MEMORY_SILICON	(PAC_BASE_ADDRESS_SILICON)
+
+#define CW12000_APB(addr)		(PAC_SHARED_MEMORY_SILICON + (addr))
+
+/* ***************************************************************
+*Device register definitions
+*************************************************************** */
+/* WBF - SPI Register Addresses */
+#define ST90TDS_ADDR_ID_BASE		(0x0000)
+/* 16/32 bits */
+#define ST90TDS_CONFIG_REG_ID		(0x0000)
+/* 16/32 bits */
+#define ST90TDS_CONTROL_REG_ID		(0x0001)
+/* 16 bits, Q mode W/R */
+#define ST90TDS_IN_OUT_QUEUE_REG_ID	(0x0002)
+/* 32 bits, AHB bus R/W */
+#define ST90TDS_AHB_DPORT_REG_ID	(0x0003)
+/* 16/32 bits */
+#define ST90TDS_SRAM_BASE_ADDR_REG_ID   (0x0004)
+/* 32 bits, APB bus R/W */
+#define ST90TDS_SRAM_DPORT_REG_ID	(0x0005)
+/* 32 bits, t_settle/general */
+#define ST90TDS_TSET_GEN_R_W_REG_ID	(0x0006)
+/* 16 bits, Q mode read, no length */
+#define ST90TDS_FRAME_OUT_REG_ID	(0x0007)
+#define ST90TDS_ADDR_ID_MAX		(ST90TDS_FRAME_OUT_REG_ID)
+
+/* WBF - Control register bit set */
+/* next o/p length, bit 11 to 0 */
+#define ST90TDS_CONT_NEXT_LEN_MASK	(0x0FFF)
+#define ST90TDS_CONT_WUP_BIT		(BIT(12))
+#define ST90TDS_CONT_RDY_BIT		(BIT(13))
+#define ST90TDS_CONT_IRQ_ENABLE		(BIT(14))
+#define ST90TDS_CONT_RDY_ENABLE		(BIT(15))
+#define ST90TDS_CONT_IRQ_RDY_ENABLE	(BIT(14)|BIT(15))
+
+/* SPI Config register bit set */
+#define ST90TDS_CONFIG_FRAME_BIT	(BIT(2))
+#define ST90TDS_CONFIG_WORD_MODE_BITS	(BIT(3)|BIT(4))
+#define ST90TDS_CONFIG_WORD_MODE_1	(BIT(3))
+#define ST90TDS_CONFIG_WORD_MODE_2	(BIT(4))
+#define ST90TDS_CONFIG_ERROR_0_BIT	(BIT(5))
+#define ST90TDS_CONFIG_ERROR_1_BIT	(BIT(6))
+#define ST90TDS_CONFIG_ERROR_2_BIT	(BIT(7))
+/* TBD: Sure??? */
+#define ST90TDS_CONFIG_CSN_FRAME_BIT	(BIT(7))
+#define ST90TDS_CONFIG_ERROR_3_BIT	(BIT(8))
+#define ST90TDS_CONFIG_ERROR_4_BIT	(BIT(9))
+/* QueueM */
+#define ST90TDS_CONFIG_ACCESS_MODE_BIT	(BIT(10))
+/* AHB bus */
+#define ST90TDS_CONFIG_AHB_PFETCH_BIT	(BIT(11))
+#define ST90TDS_CONFIG_CPU_CLK_DIS_BIT	(BIT(12))
+/* APB bus */
+#define ST90TDS_CONFIG_PFETCH_BIT	(BIT(13))
+/* cpu reset */
+#define ST90TDS_CONFIG_CPU_RESET_BIT	(BIT(14))
+#define ST90TDS_CONFIG_CLEAR_INT_BIT	(BIT(15))
+
+/* For CW1200 the IRQ Enable and Ready Bits are in CONFIG register */
+#define ST90TDS_CONF_IRQ_RDY_ENABLE	(BIT(16)|BIT(17))
+
+int cw1200_data_read(struct cw1200_common *priv,
+		     void *buf, size_t buf_len);
+int cw1200_data_write(struct cw1200_common *priv,
+		      const void *buf, size_t buf_len);
+
+int cw1200_reg_read(struct cw1200_common *priv, u16 addr,
+		    void *buf, size_t buf_len);
+int cw1200_reg_write(struct cw1200_common *priv, u16 addr,
+		     const void *buf, size_t buf_len);
+
+static inline int cw1200_reg_read_16(struct cw1200_common *priv,
+				     u16 addr, u16 *val)
+{
+	return cw1200_reg_read(priv, addr, val, sizeof(val));
+}
+
+static inline int cw1200_reg_write_16(struct cw1200_common *priv,
+				      u16 addr, u16 val)
+{
+	return cw1200_reg_write(priv, addr, &val, sizeof(val));
+}
+
+static inline int cw1200_reg_read_32(struct cw1200_common *priv,
+				     u16 addr, u32 *val)
+{
+	return cw1200_reg_read(priv, addr, val, sizeof(val));
+}
+
+static inline int cw1200_reg_write_32(struct cw1200_common *priv,
+				      u16 addr, u32 val)
+{
+	return cw1200_reg_write(priv, addr, &val, sizeof(val));
+}
+
+int cw1200_indirect_read(struct cw1200_common *priv, u32 addr, void *buf,
+			 size_t buf_len, u32 prefetch, u16 port_addr);
+int cw1200_apb_write(struct cw1200_common *priv, u32 addr, const void *buf,
+		     size_t buf_len);
+
+static inline int cw1200_apb_read(struct cw1200_common *priv, u32 addr,
+				  void *buf, size_t buf_len)
+{
+	return cw1200_indirect_read(priv, addr, buf, buf_len,
+		ST90TDS_CONFIG_PFETCH_BIT, ST90TDS_SRAM_DPORT_REG_ID);
+}
+
+static inline int cw1200_ahb_read(struct cw1200_common *priv, u32 addr,
+				  void *buf, size_t buf_len)
+{
+	return cw1200_indirect_read(priv, addr, buf, buf_len,
+		ST90TDS_CONFIG_AHB_PFETCH_BIT, ST90TDS_AHB_DPORT_REG_ID);
+}
+
+static inline int cw1200_apb_read_32(struct cw1200_common *priv,
+				     u32 addr, u32 *val)
+{
+	return cw1200_apb_read(priv, addr, val, sizeof(val));
+}
+
+static inline int cw1200_apb_write_32(struct cw1200_common *priv,
+				      u32 addr, u32 val)
+{
+	return cw1200_apb_write(priv, addr, &val, sizeof(val));
+}
+
+static inline int cw1200_ahb_read_32(struct cw1200_common *priv,
+				     u32 addr, u32 *val)
+{
+	return cw1200_ahb_read(priv, addr, val, sizeof(val));
+}
+
+#endif /* CW1200_HWIO_H_INCLUDED */
diff --git a/drivers/staging/cw1200/main.c b/drivers/staging/cw1200/main.c
new file mode 100644
index 00000000000..e1251b4e4e4
--- /dev/null
+++ b/drivers/staging/cw1200/main.c
@@ -0,0 +1,458 @@
+/*
+ * mac80211 glue code for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on:
+ * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
+ * Copyright (c) 2007-2009, Christian Lamparter <chunkeey@web.de>
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * Based on:
+ * - the islsm (softmac prism54) driver, which is:
+ *   Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
+ * - stlc45xx driver
+ *   Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/firmware.h>
+#include <linux/etherdevice.h>
+#include <linux/vmalloc.h>
+#include <linux/random.h>
+#include <linux/sched.h>
+
+#include <net/mac80211.h>
+
+#include "cw1200.h"
+#include "txrx.h"
+#include "sbus.h"
+#include "fwio.h"
+#include "hwio.h"
+#include "bh.h"
+#include "sta.h"
+#include "ap.h"
+#include "scan.h"
+
+MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>");
+MODULE_DESCRIPTION("Softmac ST-Ericsson CW1200 common code");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("cw1200_core");
+
+/* Accept MAC address of the form macaddr=0x00,0x80,0xE1,0x30,0x40,0x50 */
+static u8 cw1200_mac_template[ETH_ALEN] = {0x00, 0x80, 0xe1, 0x00, 0x00, 0x00};
+module_param_array_named(macaddr, cw1200_mac_template, byte, NULL, S_IRUGO);
+MODULE_PARM_DESC(macaddr, "MAC address");
+
+/* TODO: use rates and channels from the device */
+#define RATETAB_ENT(_rate, _rateid, _flags)		\
+	{						\
+		.bitrate	= (_rate),		\
+		.hw_value	= (_rateid),		\
+		.flags		= (_flags),		\
+	}
+
+static struct ieee80211_rate cw1200_rates[] = {
+	RATETAB_ENT(10,  0,   0),
+	RATETAB_ENT(20,  1,   0),
+	RATETAB_ENT(55,  2,   0),
+	RATETAB_ENT(110, 3,   0),
+	RATETAB_ENT(60,  6,  0),
+	RATETAB_ENT(90,  7,  0),
+	RATETAB_ENT(120, 8,  0),
+	RATETAB_ENT(180, 9,  0),
+	RATETAB_ENT(240, 10, 0),
+	RATETAB_ENT(360, 11, 0),
+	RATETAB_ENT(480, 12, 0),
+	RATETAB_ENT(540, 13, 0),
+	RATETAB_ENT(65,  14, 0),
+	RATETAB_ENT(130, 15, 0),
+	RATETAB_ENT(195, 16, 0),
+	RATETAB_ENT(260, 17, 0),
+	RATETAB_ENT(390, 18, 0),
+	RATETAB_ENT(520, 19, 0),
+	RATETAB_ENT(585, 20, 0),
+	RATETAB_ENT(650, 21, 0),
+};
+
+#define cw1200_a_rates		(cw1200_rates + 4)
+#define cw1200_a_rates_size	(ARRAY_SIZE(cw1200_rates) - 4)
+#define cw1200_g_rates		(cw1200_rates + 0)
+#define cw1200_g_rates_size	(ARRAY_SIZE(cw1200_rates))
+
+
+#define CHAN2G(_channel, _freq, _flags) {			\
+	.band			= IEEE80211_BAND_2GHZ,		\
+	.center_freq		= (_freq),			\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+#define CHAN5G(_channel, _flags) {				\
+	.band			= IEEE80211_BAND_5GHZ,		\
+	.center_freq	= 5000 + (5 * (_channel)),		\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+static struct ieee80211_channel cw1200_2ghz_chantable[] = {
+	CHAN2G(1, 2412, 0),
+	CHAN2G(2, 2417, 0),
+	CHAN2G(3, 2422, 0),
+	CHAN2G(4, 2427, 0),
+	CHAN2G(5, 2432, 0),
+	CHAN2G(6, 2437, 0),
+	CHAN2G(7, 2442, 0),
+	CHAN2G(8, 2447, 0),
+	CHAN2G(9, 2452, 0),
+	CHAN2G(10, 2457, 0),
+	CHAN2G(11, 2462, 0),
+	CHAN2G(12, 2467, 0),
+	CHAN2G(13, 2472, 0),
+	CHAN2G(14, 2484, 0),
+};
+
+static struct ieee80211_channel cw1200_5ghz_chantable[] = {
+	CHAN5G(34, 0),		CHAN5G(36, 0),
+	CHAN5G(38, 0),		CHAN5G(40, 0),
+	CHAN5G(42, 0),		CHAN5G(44, 0),
+	CHAN5G(46, 0),		CHAN5G(48, 0),
+	CHAN5G(52, 0),		CHAN5G(56, 0),
+	CHAN5G(60, 0),		CHAN5G(64, 0),
+	CHAN5G(100, 0),		CHAN5G(104, 0),
+	CHAN5G(108, 0),		CHAN5G(112, 0),
+	CHAN5G(116, 0),		CHAN5G(120, 0),
+	CHAN5G(124, 0),		CHAN5G(128, 0),
+	CHAN5G(132, 0),		CHAN5G(136, 0),
+	CHAN5G(140, 0),		CHAN5G(149, 0),
+	CHAN5G(153, 0),		CHAN5G(157, 0),
+	CHAN5G(161, 0),		CHAN5G(165, 0),
+	CHAN5G(184, 0),		CHAN5G(188, 0),
+	CHAN5G(192, 0),		CHAN5G(196, 0),
+	CHAN5G(200, 0),		CHAN5G(204, 0),
+	CHAN5G(208, 0),		CHAN5G(212, 0),
+	CHAN5G(216, 0),
+};
+
+static struct ieee80211_supported_band cw1200_band_2ghz = {
+	.channels = cw1200_2ghz_chantable,
+	.n_channels = ARRAY_SIZE(cw1200_2ghz_chantable),
+	.bitrates = cw1200_g_rates,
+	.n_bitrates = cw1200_g_rates_size,
+	.ht_cap = {
+		.cap = IEEE80211_HT_CAP_SM_PS |
+			IEEE80211_HT_CAP_GRN_FLD |
+			/* HT Rx STBC: Rx support of one spatial stream */
+			0x0100 |
+			IEEE80211_HT_CAP_DELAY_BA |
+			IEEE80211_HT_CAP_MAX_AMSDU,
+		.ht_supported = 1,
+		/* TODO: It was 4K for cut 1.1 HW, if I remember
+		 * it correctly. Needs to be verified on cut 2 HW. */
+		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K,
+		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE,
+		.mcs = {
+			.rx_mask[0] = 0xFF,
+			.rx_highest = __cpu_to_le16(0x41),
+			.tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+		},
+	},
+};
+
+static struct ieee80211_supported_band cw1200_band_5ghz = {
+	.channels = cw1200_5ghz_chantable,
+	.n_channels = ARRAY_SIZE(cw1200_5ghz_chantable),
+	.bitrates = cw1200_a_rates,
+	.n_bitrates = cw1200_a_rates_size,
+	.ht_cap = {
+		.cap = IEEE80211_HT_CAP_SM_PS |
+			IEEE80211_HT_CAP_GRN_FLD |
+			/* HT Rx STBC: Rx support of one spatial stream */
+			0x0100 |
+			IEEE80211_HT_CAP_DELAY_BA |
+			IEEE80211_HT_CAP_MAX_AMSDU,
+		.ht_supported = 1,
+		/* TODO: It was 4K for cut 1.1 HW, if I remember
+		* it correctly. Needs to be verified on cut 2 HW. */
+		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K,
+		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE,
+		.mcs = {
+			.rx_mask[0] = 0xFF,
+			.rx_highest = __cpu_to_le16(0x41),
+			.tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+		},
+	},
+};
+
+static const struct ieee80211_ops cw1200_ops = {
+	.start			= cw1200_start,
+	.stop			= cw1200_stop,
+	.add_interface		= cw1200_add_interface,
+	.remove_interface	= cw1200_remove_interface,
+	.tx			= cw1200_tx,
+	.hw_scan		= cw1200_hw_scan,
+	.set_tim		= cw1200_set_tim,
+	.sta_notify		= cw1200_sta_notify,
+	.sta_add		= cw1200_sta_add,
+	.sta_remove		= cw1200_sta_remove,
+	.set_key		= cw1200_set_key,
+	.set_rts_threshold	= cw1200_set_rts_threshold,
+	.config			= cw1200_config,
+	.bss_info_changed	= cw1200_bss_info_changed,
+	.configure_filter	= cw1200_configure_filter,
+	.conf_tx		= cw1200_conf_tx,
+	.get_stats		= cw1200_get_stats,
+	/* .get_tx_stats		= cw1200_get_tx_stats */
+};
+
+struct ieee80211_hw *cw1200_init_common(size_t priv_data_len)
+{
+	int i;
+	struct ieee80211_hw *hw;
+	struct cw1200_common *priv;
+
+	hw = ieee80211_alloc_hw(priv_data_len, &cw1200_ops);
+	if (!hw)
+		return NULL;
+
+	priv = hw->priv;
+	priv->hw = hw;
+	priv->mode = NL80211_IFTYPE_UNSPECIFIED;
+	priv->rates = cw1200_rates; /* TODO: fetch from FW */
+
+	hw->flags = IEEE80211_HW_SIGNAL_DBM |
+		    IEEE80211_HW_SUPPORTS_PS |
+		    /* IEEE80211_HW_SUPPORTS_UAPSD | */
+		    IEEE80211_HW_CONNECTION_MONITOR |
+		    IEEE80211_HW_SUPPORTS_CQM_RSSI |
+#ifdef USE_STE_EXTENSIONS
+		    IEEE80211_HW_SUPPORTS_CQM_BEACON_MISS |
+		    IEEE80211_HW_SUPPORTS_CQM_TX_FAIL |
+#endif
+		    IEEE80211_HW_BEACON_FILTER;
+
+	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+					  BIT(NL80211_IFTYPE_ADHOC) |
+					  BIT(NL80211_IFTYPE_AP) |
+					  BIT(NL80211_IFTYPE_MESH_POINT);
+
+	hw->channel_change_time = 1000;	/* TODO: find actual value */
+	/* priv->beacon_req_id = cpu_to_le32(0); */
+	hw->queues = 4;
+	priv->noise = -94;
+
+	hw->max_rates = 8;
+	hw->max_rate_tries = 15;
+	hw->extra_tx_headroom = WSM_TX_EXTRA_HEADROOM;
+
+	hw->sta_data_size = sizeof(struct cw1200_sta_priv);
+
+	/*
+	 * For now, disable PS by default because it affects
+	 * link stability significantly.
+	 */
+	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+	hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &cw1200_band_2ghz;
+	hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &cw1200_band_5ghz;
+
+	hw->wiphy->max_scan_ssids = 2;
+
+	/* TODO: You must fill in the @dev member of this structure */
+	/* using SET_IEEE80211_DEV() */
+	/* SET_IEEE80211_DEV(hw, &pdev->dev); */
+
+	SET_IEEE80211_PERM_ADDR(hw, cw1200_mac_template);
+
+	if (hw->wiphy->perm_addr[3] == 0 &&
+	    hw->wiphy->perm_addr[4] == 0 &&
+	    hw->wiphy->perm_addr[5] == 0) {
+		get_random_bytes(&hw->wiphy->perm_addr[3], 3);
+	}
+
+	mutex_init(&priv->wsm_cmd_mux);
+	mutex_init(&priv->conf_mutex);
+	priv->workqueue = create_singlethread_workqueue("cw1200_wq");
+	sema_init(&priv->scan.lock, 1);
+	INIT_WORK(&priv->scan.work, cw1200_scan_work);
+	INIT_DELAYED_WORK(&priv->scan.probe_work, cw1200_probe_work);
+	INIT_DELAYED_WORK(&priv->scan.timeout, cw1200_scan_timeout);
+	INIT_WORK(&priv->join_work, cw1200_join_work);
+	INIT_DELAYED_WORK(&priv->join_timeout, cw1200_join_timeout);
+	INIT_WORK(&priv->unjoin_work, cw1200_unjoin_work);
+	INIT_WORK(&priv->wep_key_work, cw1200_wep_key_work);
+	INIT_WORK(&priv->tx_policy_upload_work, tx_policy_upload_work);
+	INIT_LIST_HEAD(&priv->event_queue);
+	INIT_WORK(&priv->event_handler, cw1200_event_handler);
+	INIT_DELAYED_WORK(&priv->bss_loss_work, cw1200_bss_loss_work);
+	INIT_DELAYED_WORK(&priv->connection_loss_work,
+			  cw1200_connection_loss_work);
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+	INIT_DELAYED_WORK(&priv->keep_alive_work, cw1200_keep_alive_work);
+#endif
+	INIT_WORK(&priv->tx_failure_work, cw1200_tx_failure_work);
+	INIT_WORK(&priv->set_tim_work, cw1200_set_tim_work);
+	INIT_WORK(&priv->multicast_start_work, cw1200_multicast_start_work);
+	INIT_WORK(&priv->multicast_stop_work, cw1200_multicast_stop_work);
+
+	for (i = 0; i < 4; ++i) {
+		if (unlikely(cw1200_queue_init(&priv->tx_queue[i], i,
+				16, CW1200_LINK_ID_AFTER_DTIM + 1))) {
+			for (; i > 0; i--)
+				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
+			ieee80211_free_hw(hw);
+			return NULL;
+		}
+	}
+
+	init_waitqueue_head(&priv->channel_switch_done);
+	init_waitqueue_head(&priv->wsm_cmd_wq);
+	init_waitqueue_head(&priv->wsm_startup_done);
+	wsm_buf_init(&priv->wsm_cmd_buf);
+	tx_policy_init(priv);
+
+	return hw;
+}
+EXPORT_SYMBOL_GPL(cw1200_init_common);
+
+int cw1200_register_common(struct ieee80211_hw *dev)
+{
+	/* struct cw1200_common *priv = dev->priv; */
+	int err;
+
+	err = ieee80211_register_hw(dev);
+	if (err) {
+		cw1200_dbg(CW1200_DBG_ERROR, "Cannot register device (%d).\n",
+				err);
+		return err;
+	}
+
+#ifdef CONFIG_CW1200_LEDS
+	err = cw1200_init_leds(priv);
+	if (err)
+		return err;
+#endif /* CONFIG_CW1200_LEDS */
+
+	cw1200_dbg(CW1200_DBG_MSG, "is registered as '%s'\n",
+			wiphy_name(dev->wiphy));
+	return 0;
+}
+EXPORT_SYMBOL_GPL(cw1200_register_common);
+
+void cw1200_free_common(struct ieee80211_hw *dev)
+{
+	/* struct cw1200_common *priv = dev->priv; */
+	/* unsigned int i; */
+
+	ieee80211_free_hw(dev);
+}
+EXPORT_SYMBOL_GPL(cw1200_free_common);
+
+void cw1200_unregister_common(struct ieee80211_hw *dev)
+{
+	struct cw1200_common *priv = dev->priv;
+
+	priv->sbus_ops->irq_unsubscribe(priv->sbus_priv);
+	cw1200_unregister_bh(priv);
+
+#ifdef CONFIG_CW1200_LEDS
+	cw1200_unregister_leds(priv);
+#endif /* CONFIG_CW1200_LEDS */
+
+	ieee80211_unregister_hw(dev);
+	mutex_destroy(&priv->conf_mutex);
+	mutex_destroy(&priv->eeprom_mutex);
+
+	wsm_buf_deinit(&priv->wsm_cmd_buf);
+
+	kfree(priv->scan.ie);
+	priv->scan.ie = NULL;
+	priv->scan.ie_len = 0;
+	destroy_workqueue(priv->workqueue);
+	priv->workqueue = NULL;
+
+	if (priv->skb_cache) {
+		dev_kfree_skb(priv->skb_cache);
+		priv->skb_cache = NULL;
+	}
+}
+EXPORT_SYMBOL_GPL(cw1200_unregister_common);
+
+int cw1200_probe(const struct sbus_ops *sbus_ops,
+		 struct sbus_priv *sbus,
+		 struct device *pdev,
+		 struct cw1200_common **pself)
+{
+	int err = -ENOMEM;
+	struct ieee80211_hw *dev;
+	struct cw1200_common *priv;
+
+	dev = cw1200_init_common(sizeof(struct cw1200_common));
+	if (!dev)
+		goto err;
+
+	priv = dev->priv;
+
+	priv->sbus_ops = sbus_ops;
+	priv->sbus_priv = sbus;
+	priv->pdev = pdev;
+
+	/* WSM callbacks. */
+	priv->wsm_cbc.scan_complete = cw1200_scan_complete_cb;
+	priv->wsm_cbc.tx_confirm = cw1200_tx_confirm_cb;
+	priv->wsm_cbc.rx = cw1200_rx_cb;
+	priv->wsm_cbc.suspend_resume = cw1200_suspend_resume;
+	/* priv->wsm_cbc.set_pm_complete = cw1200_set_pm_complete_cb; */
+	/* priv->wsm_cbc.channel_switch = cw1200_channel_switch_cb; */
+
+	err = cw1200_register_bh(priv);
+	if (err)
+		goto err1;
+
+	err = cw1200_load_firmware(priv);
+	if (err)
+		goto err2;
+
+	if (wait_event_interruptible_timeout(priv->wsm_startup_done,
+				priv->wsm_caps.firmwareReady, 3*HZ) <= 0) {
+		/* TODO: Needs to find how to reset device */
+		/*       in QUEUE mode properly.           */
+		goto err3;
+	}
+
+	err = cw1200_register_common(dev);
+	if (err) {
+		priv->sbus_ops->irq_unsubscribe(priv->sbus_priv);
+		goto err3;
+	}
+
+	*pself = dev->priv;
+	return err;
+
+err3:
+	sbus_ops->reset(sbus);
+err2:
+	cw1200_unregister_bh(priv);
+err1:
+	cw1200_free_common(dev);
+err:
+	return err;
+}
+EXPORT_SYMBOL_GPL(cw1200_probe);
+
+void cw1200_release(struct cw1200_common *self)
+{
+	cw1200_unregister_common(self->hw);
+	cw1200_free_common(self->hw);
+	return;
+}
+EXPORT_SYMBOL_GPL(cw1200_release);
diff --git a/drivers/staging/cw1200/queue.c b/drivers/staging/cw1200/queue.c
new file mode 100644
index 00000000000..f21ff8f2f99
--- /dev/null
+++ b/drivers/staging/cw1200/queue.c
@@ -0,0 +1,409 @@
+/*
+ * O(1) TX queue with built-in allocator for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "net/mac80211.h"
+#include "queue.h"
+#include "wsm.h"
+#include "txrx.h"
+#include "cw1200.h"
+
+/* private */ struct cw1200_queue_item
+{
+	struct list_head	head;
+	struct sk_buff		*skb;
+	u32			packetID;
+	/* For safety purposes only. I do not trust device too much.
+	 * It was observed that it indicates TX for a packet several times,
+	 * so it's not enough to use offset or address as an uniquie ID in a
+	 * queue.
+	 */
+	u8			generation;
+	u8			link_id;
+	u8			reserved[2];
+};
+
+static inline void __cw1200_queue_lock(struct cw1200_queue *queue,
+						struct cw1200_common *cw1200)
+{
+	if (queue->tx_locked_cnt++ == 0) {
+		txrx_printk(KERN_DEBUG "[TX] Queue %d is locked.\n",
+				queue->queue_id);
+		ieee80211_stop_queue(cw1200->hw, queue->queue_id);
+	}
+}
+
+static inline void __cw1200_queue_unlock(struct cw1200_queue *queue,
+						struct cw1200_common *cw1200)
+{
+	BUG_ON(!queue->tx_locked_cnt);
+	if (--queue->tx_locked_cnt == 0) {
+		txrx_printk(KERN_DEBUG "[TX] Queue %d is unlocked.\n",
+				queue->queue_id);
+		ieee80211_wake_queue(cw1200->hw, queue->queue_id);
+	}
+}
+
+static inline void cw1200_queue_parse_id(u32 packetID, u8 *queue_generation,
+						u8 *queue_id,
+						u8 *item_generation,
+						u8 *item_id)
+{
+	*item_id		= (packetID >>  0) & 0xFF;
+	*item_generation	= (packetID >>  8) & 0xFF;
+	*queue_id		= (packetID >> 16) & 0xFF;
+	*queue_generation	= (packetID >> 24) & 0xFF;
+}
+
+static inline u32 cw1200_queue_make_packet_id(u8 queue_generation, u8 queue_id,
+						u8 item_generation, u8 item_id)
+{
+	return ((u32)item_id << 0) |
+		((u32)item_generation << 8) |
+		((u32)queue_id << 16) |
+		((u32)queue_generation << 24);
+}
+
+int cw1200_queue_init(struct cw1200_queue *queue, u8 queue_id,
+		      size_t capacity, size_t map_capacity)
+{
+	size_t i;
+
+	memset(queue, 0, sizeof(*queue));
+	queue->capacity = capacity;
+	queue->map_capacity = map_capacity;
+	queue->queue_id = queue_id;
+	INIT_LIST_HEAD(&queue->queue);
+	INIT_LIST_HEAD(&queue->pending);
+	INIT_LIST_HEAD(&queue->free_pool);
+	spin_lock_init(&queue->lock);
+
+	queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
+				GFP_KERNEL);
+	if (!queue->pool)
+		return -ENOMEM;
+
+	queue->link_map_cache = kzalloc(sizeof(int[map_capacity]),
+                                GFP_KERNEL);
+	if (!queue->link_map_cache) {
+		kfree(queue->pool);
+		queue->pool = NULL;
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < capacity; ++i)
+		list_add_tail(&queue->pool[i].head, &queue->free_pool);
+
+	return 0;
+}
+
+int cw1200_queue_clear(struct cw1200_queue *queue)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	queue->generation++;
+	list_splice_tail_init(&queue->queue, &queue->pending);
+	while (!list_empty(&queue->pending)) {
+		struct cw1200_queue_item *item = list_first_entry(
+			&queue->pending, struct cw1200_queue_item, head);
+		WARN_ON(!item->skb);
+		if (likely(item->skb)) {
+			dev_kfree_skb_any(item->skb);
+			item->skb = NULL;
+		}
+		list_move_tail(&item->head, &queue->free_pool);
+	}
+	queue->num_queued = 0;
+	queue->num_pending = 0;
+	queue->num_sent = 0;
+	memset(queue->link_map_cache, 0, sizeof(int[queue->map_capacity]));
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return 0;
+}
+
+int cw1200_queue_deinit(struct cw1200_queue *queue)
+{
+	cw1200_queue_clear(queue);
+	INIT_LIST_HEAD(&queue->free_pool);
+	kfree(queue->pool);
+	kfree(queue->link_map_cache);
+	queue->pool = NULL;
+	queue->capacity = 0;
+
+	return 0;
+}
+
+size_t cw1200_queue_get_num_queued(struct cw1200_queue *queue,
+				   u32 allowed_mask)
+{
+	unsigned long flags;
+	size_t ret;
+	int i, bit;
+
+	if (!allowed_mask)
+		return 0;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	if (likely(allowed_mask == (u32) -1))
+		ret = queue->num_queued - queue->num_pending;
+	else {
+		ret = 0;
+		for (i = 0, bit = 1; i < queue->map_capacity; ++i, bit <<= 1) {
+			if (allowed_mask & bit)
+				ret += queue->link_map_cache[i];
+		}
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return ret;
+}
+
+int cw1200_queue_put(struct cw1200_queue *queue, struct cw1200_common *priv,
+			struct sk_buff *skb, u8 link_id)
+{
+	int ret;
+	unsigned long flags;
+	struct wsm_tx *wsm;
+
+	wsm = (struct wsm_tx *)skb_push(skb, sizeof(struct wsm_tx));
+	ret = cw1200_skb_to_wsm(priv, skb, wsm);
+	if (ret)
+		return ret;
+
+	if (link_id >= queue->map_capacity)
+		return -EINVAL;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	if (!WARN_ON(list_empty(&queue->free_pool))) {
+		struct cw1200_queue_item *item = list_first_entry(
+			&queue->free_pool, struct cw1200_queue_item, head);
+		BUG_ON(item->skb);
+
+		list_move_tail(&item->head, &queue->queue);
+		item->skb = skb;
+		item->packetID = cw1200_queue_make_packet_id(
+			queue->generation, queue->queue_id,
+			item->generation, item - queue->pool);
+		wsm->packetID = __cpu_to_le32(item->packetID);
+		item->link_id = link_id;
+
+		++queue->num_queued;
+		++queue->link_map_cache[link_id];
+
+		if (queue->num_queued >= queue->capacity) {
+			queue->overfull = true;
+			__cw1200_queue_lock(queue, priv);
+		}
+	} else {
+		ret = -ENOENT;
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return ret;
+}
+
+int cw1200_queue_get(struct cw1200_queue *queue,
+		     u32 allowed_mask,
+		     struct wsm_tx **tx,
+		     struct ieee80211_tx_info **tx_info)
+{
+	int ret = -ENOENT;
+	unsigned long flags;
+	struct cw1200_queue_item *item;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	list_for_each_entry(item, &queue->queue, head) {
+		if (allowed_mask & (1 << item->link_id)) {
+			ret = 0;
+			break;
+		}
+	}
+
+	if (!WARN_ON(ret)) {
+		*tx = (struct wsm_tx *)item->skb->data;
+		*tx_info = IEEE80211_SKB_CB(item->skb);
+		list_move_tail(&item->head, &queue->pending);
+		++queue->num_pending;
+		--queue->link_map_cache[item->link_id];
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return ret;
+}
+
+int cw1200_queue_requeue(struct cw1200_queue *queue, u32 packetID)
+{
+	int ret = 0;
+	unsigned long flags;
+	u8 queue_generation, queue_id, item_generation, item_id;
+	struct cw1200_queue_item *item;
+	cw1200_queue_parse_id(packetID, &queue_generation, &queue_id,
+				&item_generation, &item_id);
+
+	item = &queue->pool[item_id];
+
+	spin_lock_irqsave(&queue->lock, flags);
+	BUG_ON(queue_id != queue->queue_id);
+	if (unlikely(queue_generation != queue->generation)) {
+		ret = -ENOENT;
+	} else if (unlikely(item_id >= (unsigned) queue->capacity)) {
+		WARN_ON(1);
+		ret = -EINVAL;
+	} else if (unlikely(item->generation != item_generation)) {
+		WARN_ON(1);
+		ret = -ENOENT;
+	} else {
+		struct wsm_tx *wsm = (struct wsm_tx *)item->skb->data;
+		--queue->num_pending;
+		++queue->link_map_cache[item->link_id];
+		item->generation = ++item_generation;
+		item->packetID = cw1200_queue_make_packet_id(
+			queue_generation, queue_id, item_generation, item_id);
+		wsm->packetID = __cpu_to_le32(item->packetID);
+		list_move_tail(&item->head, &queue->queue);
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return ret;
+}
+
+int cw1200_queue_requeue_all(struct cw1200_queue *queue)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	while (!list_empty(&queue->pending)) {
+		struct cw1200_queue_item *item = list_first_entry(
+			&queue->pending, struct cw1200_queue_item, head);
+		struct wsm_tx *wsm = (struct wsm_tx *)item->skb->data;
+
+		--queue->num_pending;
+		++queue->link_map_cache[item->link_id];
+		++item->generation;
+		item->packetID = cw1200_queue_make_packet_id(
+			queue->generation, queue->queue_id,
+			item->generation, item - queue->pool);
+		wsm->packetID = __cpu_to_le32(item->packetID);
+		list_move_tail(&item->head, &queue->queue);
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+
+	return 0;
+}
+
+int cw1200_queue_remove(struct cw1200_queue *queue, struct cw1200_common *priv,
+				u32 packetID)
+{
+	int ret = 0;
+	unsigned long flags;
+	u8 queue_generation, queue_id, item_generation, item_id;
+	struct cw1200_queue_item *item;
+	struct sk_buff *skb_to_free = NULL;
+	cw1200_queue_parse_id(packetID, &queue_generation, &queue_id,
+				&item_generation, &item_id);
+
+	item = &queue->pool[item_id];
+
+	spin_lock_irqsave(&queue->lock, flags);
+	BUG_ON(queue_id != queue->queue_id);
+	if (unlikely(queue_generation != queue->generation)) {
+		ret = -ENOENT;
+	} else if (unlikely(item_id >= (unsigned) queue->capacity)) {
+		WARN_ON(1);
+		ret = -EINVAL;
+	} else if (unlikely(item->generation != item_generation)) {
+		WARN_ON(1);
+		ret = -ENOENT;
+	} else {
+		--queue->num_pending;
+		--queue->num_queued;
+		++queue->num_sent;
+		++item->generation;
+		skb_to_free = item->skb;
+		item->skb = NULL;
+		/* Do not use list_move_tail here, but list_move:
+		 * try to utilize cache row.
+		 */
+		list_move(&item->head, &queue->free_pool);
+
+		if (unlikely(queue->overfull) &&
+		    (queue->num_queued <= (queue->capacity >> 1))) {
+			queue->overfull = false;
+			__cw1200_queue_unlock(queue, priv);
+		}
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+
+	if (skb_to_free)
+		dev_kfree_skb_any(item->skb);
+
+	return ret;
+}
+
+int cw1200_queue_get_skb(struct cw1200_queue *queue, u32 packetID,
+				struct sk_buff **skb)
+{
+	int ret = 0;
+	unsigned long flags;
+	u8 queue_generation, queue_id, item_generation, item_id;
+	struct cw1200_queue_item *item;
+	cw1200_queue_parse_id(packetID, &queue_generation, &queue_id,
+				&item_generation, &item_id);
+
+	item = &queue->pool[item_id];
+
+	spin_lock_irqsave(&queue->lock, flags);
+	BUG_ON(queue_id != queue->queue_id);
+	if (unlikely(queue_generation != queue->generation)) {
+		ret = -ENOENT;
+	} else if (unlikely(item_id >= (unsigned) queue->capacity)) {
+		WARN_ON(1);
+		ret = -EINVAL;
+	} else if (unlikely(item->generation != item_generation)) {
+		WARN_ON(1);
+		ret = -ENOENT;
+	} else {
+		*skb = item->skb;
+		item->skb = NULL;
+	}
+	spin_unlock_irqrestore(&queue->lock, flags);
+	return ret;
+}
+
+void cw1200_queue_lock(struct cw1200_queue *queue, struct cw1200_common *cw1200)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&queue->lock, flags);
+	__cw1200_queue_lock(queue, cw1200);
+	spin_unlock_irqrestore(&queue->lock, flags);
+}
+
+void cw1200_queue_unlock(struct cw1200_queue *queue,
+				struct cw1200_common *cw1200)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&queue->lock, flags);
+	__cw1200_queue_unlock(queue, cw1200);
+	spin_unlock_irqrestore(&queue->lock, flags);
+}
+
+/*
+int cw1200_queue_get_stats(struct cw1200_queue *queue,
+				struct ieee80211_tx_queue_stats *stats)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&queue->lock, flags);
+	stats->len = queue->num_queued;
+	stats->limit = queue->capacity;
+	stats->count = queue->num_sent;
+	spin_unlock_irqrestore(&queue->lock, flags);
+
+	return 0;
+}
+*/
+
diff --git a/drivers/staging/cw1200/queue.h b/drivers/staging/cw1200/queue.h
new file mode 100644
index 00000000000..a87505defba
--- /dev/null
+++ b/drivers/staging/cw1200/queue.h
@@ -0,0 +1,72 @@
+/*
+ * O(1) TX queue with built-in allocator for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_QUEUE_H_INCLUDED
+#define CW1200_QUEUE_H_INCLUDED
+
+/* private */ struct cw1200_queue_item;
+
+/* extern */ struct sk_buff;
+/* extern */ struct wsm_tx;
+/* extern */ struct cw1200_common;
+/* extern */ struct ieee80211_tx_queue_stats;
+
+struct cw1200_queue {
+	size_t			capacity;
+	size_t			num_queued;
+	size_t			num_pending;
+	size_t			num_sent;
+	struct cw1200_queue_item *pool;
+	struct list_head	queue;
+	struct list_head	free_pool;
+	struct list_head	pending;
+	int			tx_locked_cnt;
+	int			*link_map_cache;
+	size_t			map_capacity;
+	bool			overfull;
+	spinlock_t		lock;
+	u8			queue_id;
+	u8			generation;
+};
+
+int cw1200_queue_init(struct cw1200_queue *queue, u8 queue_id,
+		      size_t capacity, size_t map_capacity);
+int cw1200_queue_clear(struct cw1200_queue *queue);
+int cw1200_queue_deinit(struct cw1200_queue *queue);
+
+size_t cw1200_queue_get_num_queued(struct cw1200_queue *queue,
+				   u32 allowed_mask);
+int cw1200_queue_put(struct cw1200_queue *queue, struct cw1200_common *cw1200,
+			struct sk_buff *skb, u8 link_id);
+int cw1200_queue_get(struct cw1200_queue *queue,
+		     u32 allowed_mask,
+		     struct wsm_tx **tx,
+		     struct ieee80211_tx_info **tx_info);
+int cw1200_queue_requeue(struct cw1200_queue *queue, u32 packetID);
+int cw1200_queue_requeue_all(struct cw1200_queue *queue);
+int cw1200_queue_remove(struct cw1200_queue *queue, struct cw1200_common *priv,
+				u32 packetID);
+int cw1200_queue_get_skb(struct cw1200_queue *queue, u32 packetID,
+				struct sk_buff **skb);
+void cw1200_queue_lock(struct cw1200_queue *queue,
+			struct cw1200_common *cw1200);
+void cw1200_queue_unlock(struct cw1200_queue *queue,
+				struct cw1200_common *cw1200);
+
+/* int cw1200_queue_get_stats(struct cw1200_queue *queue,
+struct ieee80211_tx_queue_stats *stats); */
+
+static inline u8 cw1200_queue_get_queue_id(u32 packetID)
+{
+	return (packetID >> 16) & 0xFF;
+}
+
+#endif /* CW1200_QUEUE_H_INCLUDED */
diff --git a/drivers/staging/cw1200/sbus.h b/drivers/staging/cw1200/sbus.h
new file mode 100644
index 00000000000..c31a2f30a22
--- /dev/null
+++ b/drivers/staging/cw1200/sbus.h
@@ -0,0 +1,37 @@
+/*
+ * Common sbus abstraction layer interface for cw1200 wireless driver
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_SBUS_H
+#define CW1200_SBUS_H
+
+/*
+ * sbus priv forward definition.
+ * Implemented and instantiated in particular modules.
+ */
+struct sbus_priv;
+
+typedef void (*sbus_irq_handler)(void *priv);
+
+struct sbus_ops {
+	int (*sbus_memcpy_fromio)(struct sbus_priv *self, unsigned int addr,
+					void *dst, int count);
+	int (*sbus_memcpy_toio)(struct sbus_priv *self, unsigned int addr,
+					const void *src, int count);
+	void (*lock)(struct sbus_priv *self);
+	void (*unlock)(struct sbus_priv *self);
+	int (*irq_subscribe)(struct sbus_priv *self, sbus_irq_handler handler,
+				void *priv);
+	int (*irq_unsubscribe)(struct sbus_priv *self);
+	int (*reset)(struct sbus_priv *self);
+	size_t (*align_size)(struct sbus_priv *self, size_t size);
+};
+
+#endif /* CW1200_SBUS_H */
diff --git a/drivers/staging/cw1200/scan.c b/drivers/staging/cw1200/scan.c
new file mode 100644
index 00000000000..71268291181
--- /dev/null
+++ b/drivers/staging/cw1200/scan.c
@@ -0,0 +1,374 @@
+/*
+ * Scan implementation for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/sched.h>
+#include "cw1200.h"
+#include "scan.h"
+
+static int cw1200_scan_start(struct cw1200_common *priv, struct wsm_scan *scan)
+{
+	int ret, i;
+	int tmo = 1000;
+
+	for (i = 0; i < scan->numOfChannels; ++i)
+		tmo += scan->ch[i].maxChannelTime + 10;
+
+	atomic_set(&priv->scan.in_progress, 1);
+	queue_delayed_work(priv->workqueue, &priv->scan.timeout,
+		tmo * HZ / 1000);
+	ret = wsm_scan(priv, scan);
+	if (unlikely(ret)) {
+		atomic_set(&priv->scan.in_progress, 0);
+		cancel_delayed_work_sync(&priv->scan.timeout);
+	}
+	return ret;
+}
+
+int cw1200_hw_scan(struct ieee80211_hw *hw,
+		   struct ieee80211_vif *vif,
+		   struct cfg80211_scan_request *req)
+{
+	struct cw1200_common *priv = hw->priv;
+	struct wsm_template_frame frame = {
+		.frame_type = WSM_FRAME_TYPE_PROBE_REQUEST,
+	};
+	int i;
+
+	if (!priv->vif)
+		return -EINVAL;
+
+	if (req->n_ssids == 1 && !req->ssids[0].ssid_len)
+		req->n_ssids = 0;
+
+	printk(KERN_DEBUG "[SCAN] Scan request for %d SSIDs.\n",
+		req->n_ssids);
+
+	if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS)
+		return -EINVAL;
+
+	if (req->ie_len != priv->scan.ie_len ||
+	    memcmp(req->ie, priv->scan.ie, req->ie_len)) {
+		frame.skb = ieee80211_probereq_get(hw, priv->vif, NULL, 0,
+			req->ie, req->ie_len);
+		if (!frame.skb)
+			return -ENOMEM;
+		kfree(priv->scan.ie);
+		priv->scan.ie = NULL;
+		priv->scan.ie_len = 0;
+		if (req->ie_len) {
+			priv->scan.ie = kmalloc(req->ie_len, GFP_KERNEL);
+			if (priv->scan.ie) {
+				memcpy(priv->scan.ie, req->ie, req->ie_len);
+				priv->scan.ie_len = req->ie_len;
+			}
+		}
+	}
+
+	/* will be unlocked in cw1200_scan_work() */
+	down(&priv->scan.lock);
+	mutex_lock(&priv->conf_mutex);
+	if (frame.skb) {
+		int ret = wsm_set_template_frame(priv, &frame);
+		if (ret) {
+			mutex_unlock(&priv->conf_mutex);
+			up(&priv->scan.lock);
+			dev_kfree_skb(frame.skb);
+			return ret;
+		}
+	}
+
+	wsm_lock_tx(priv);
+
+	if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+			priv->powersave_mode.pmMode != WSM_PSM_PS) {
+		struct wsm_set_pm pm = priv->powersave_mode;
+		pm.pmMode = WSM_PSM_PS;
+		WARN_ON(wsm_set_pm(priv, &pm));
+	}
+
+	BUG_ON(priv->scan.req);
+	priv->scan.req = req;
+	priv->scan.n_ssids = 0;
+	priv->scan.status = 0;
+	priv->scan.begin = &req->channels[0];
+	priv->scan.end = &req->channels[req->n_channels];
+	priv->scan.output_power = priv->output_power;
+
+	for (i = 0; i < req->n_ssids; ++i) {
+		if (req->ssids[i].ssid_len) {
+			struct wsm_ssid *dst =
+				&priv->scan.ssids[priv->scan.n_ssids];
+			BUG_ON(req->ssids[i].ssid_len > sizeof(dst->ssid));
+			memcpy(&dst->ssid[0], req->ssids[i].ssid,
+				sizeof(dst->ssid));
+			dst->length = req->ssids[i].ssid_len;
+			++priv->scan.n_ssids;
+		}
+	}
+
+	mutex_unlock(&priv->conf_mutex);
+	if (frame.skb)
+		dev_kfree_skb(frame.skb);
+	queue_work(priv->workqueue, &priv->scan.work);
+	return 0;
+}
+
+void cw1200_scan_work(struct work_struct *work)
+{
+	struct cw1200_common *priv = container_of(work, struct cw1200_common,
+							scan.work);
+	struct ieee80211_channel **it;
+	struct wsm_scan scan = {
+		.scanType = WSM_SCAN_TYPE_FOREGROUND,
+		.scanFlags = WSM_SCAN_FLAG_SPLIT_METHOD,
+	};
+	int i;
+
+	mutex_lock(&priv->conf_mutex);
+
+	if (!priv->scan.req || (priv->scan.begin == priv->scan.end)) {
+		if (priv->scan.output_power != priv->output_power)
+			WARN_ON(wsm_set_output_power(priv,
+						priv->output_power * 10));
+		if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+				priv->powersave_mode.pmMode != WSM_PSM_PS)
+			WARN_ON(wsm_set_pm(priv, &priv->powersave_mode));
+
+		if (priv->scan.req)
+			printk(KERN_DEBUG "[SCAN] Scan completed.\n");
+		else
+			printk(KERN_DEBUG "[SCAN] Scan canceled.\n");
+
+		priv->scan.req = NULL;
+
+		if (priv->delayed_link_loss) {
+			priv->delayed_link_loss = 0;
+			/* Restart beacon loss timer and requeue
+			   BSS loss work. */
+			printk(KERN_DEBUG "[CQM] Requeue BSS loss in %d " \
+					"beacons.\n",
+				priv->cqm_beacon_loss_count);
+			cancel_delayed_work_sync(&priv->bss_loss_work);
+			queue_delayed_work(priv->workqueue,
+					&priv->bss_loss_work,
+					priv->cqm_beacon_loss_count * HZ / 10);
+		}
+
+		wsm_unlock_tx(priv);
+		mutex_unlock(&priv->conf_mutex);
+		ieee80211_scan_completed(priv->hw, priv->scan.status ? 1 : 0);
+		up(&priv->scan.lock);
+		return;
+	} else {
+		struct ieee80211_channel *first = *priv->scan.begin;
+		for (it = priv->scan.begin + 1, i = 1;
+		     it != priv->scan.end && i < WSM_SCAN_MAX_NUM_OF_CHANNELS;
+		     ++it, ++i) {
+			if ((*it)->band != first->band)
+				break;
+			if (((*it)->flags ^ first->flags) &
+					IEEE80211_CHAN_PASSIVE_SCAN)
+				break;
+			if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+			    (*it)->max_power != first->max_power)
+				break;
+		}
+		scan.band = first->band;
+		/* TODO: Is it optimal? */
+		scan.maxTransmitRate = WSM_TRANSMIT_RATE_1;
+		/* TODO: Is it optimal? */
+		scan.numOfProbeRequests =
+			(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) ? 0 : 2;
+		scan.numOfSSIDs = priv->scan.n_ssids;
+		scan.ssids = &priv->scan.ssids[0];
+		scan.numOfChannels = it - priv->scan.begin;
+		/* TODO: Is it optimal? */
+		scan.probeDelay = 100;
+		scan.ch = kzalloc(
+			sizeof(struct wsm_scan_ch[it - priv->scan.begin]),
+			GFP_KERNEL);
+		if (!scan.ch) {
+			priv->scan.status = -ENOMEM;
+			goto fail;
+		}
+		for (i = 0; i < scan.numOfChannels; ++i) {
+			scan.ch[i].number = priv->scan.begin[i]->hw_value;
+			scan.ch[i].minChannelTime = 50;
+			scan.ch[i].maxChannelTime = 110;
+		}
+		if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+		    priv->scan.output_power != first->max_power) {
+			priv->scan.output_power = first->max_power;
+			WARN_ON(wsm_set_output_power(priv,
+						priv->scan.output_power * 10));
+		}
+		priv->scan.status = cw1200_scan_start(priv, &scan);
+		kfree(scan.ch);
+		if (WARN_ON(priv->scan.status))
+			goto fail;
+		priv->scan.begin = it;
+	}
+	mutex_unlock(&priv->conf_mutex);
+	return;
+
+fail:
+	priv->scan.begin = priv->scan.end;
+	mutex_unlock(&priv->conf_mutex);
+	queue_work(priv->workqueue, &priv->scan.work);
+	return;
+}
+
+static void cw1200_scan_complete(struct cw1200_common *priv)
+{
+	if (priv->scan.direct_probe) {
+		printk(KERN_DEBUG "[SCAN] Direct probe complete.\n");
+		priv->scan.direct_probe = 0;
+
+		if (priv->delayed_link_loss) {
+			priv->delayed_link_loss = 0;
+			/* Requeue BSS loss work now. Direct probe does not
+			 * affect BSS loss subscription. */
+			printk(KERN_DEBUG "[CQM] Requeue BSS loss now.\n");
+			cancel_delayed_work_sync(&priv->bss_loss_work);
+			queue_delayed_work(priv->workqueue,
+						&priv->bss_loss_work, 0);
+		}
+
+		up(&priv->scan.lock);
+		wsm_unlock_tx(priv);
+	} else {
+		queue_work(priv->workqueue, &priv->scan.work);
+	}
+}
+
+void cw1200_scan_complete_cb(struct cw1200_common *priv,
+				struct wsm_scan_complete *arg)
+{
+	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED)) {
+		/* STA is stopped. */
+		return;
+	}
+
+	if (likely(atomic_xchg(&priv->scan.in_progress, 0))) {
+		cancel_delayed_work_sync(&priv->scan.timeout);
+		cw1200_scan_complete(priv);
+	}
+}
+
+void cw1200_scan_timeout(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, scan.timeout.work);
+	if (likely(atomic_xchg(&priv->scan.in_progress, 0))) {
+		cw1200_dbg(CW1200_DBG_ERROR,
+			"CW1200 FW: Timeout waiting for scan " \
+			"complete notification.\n");
+		cw1200_scan_complete(priv);
+	}
+}
+
+void cw1200_probe_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, scan.probe_work.work);
+	struct wsm_tx *wsm = (struct wsm_tx *)
+		priv->scan.probe_skb->data;
+	struct wsm_template_frame frame = {
+		.frame_type = WSM_FRAME_TYPE_PROBE_REQUEST,
+		.skb = priv->scan.probe_skb,
+	};
+	struct wsm_ssid ssids[1] = {{
+		.length = 0,
+	} };
+	struct wsm_scan_ch ch[1] = {{
+		.minChannelTime = 0,
+		.maxChannelTime = 10,
+	} };
+	struct wsm_scan scan = {
+		.scanType = WSM_SCAN_TYPE_FOREGROUND,
+		.maxTransmitRate = wsm->maxTxRate,
+		.numOfProbeRequests = 1,
+		.probeDelay = 0,
+		.numOfChannels = 1,
+		.ssids = ssids,
+		.ch = ch,
+	};
+	u8 *ies;
+	size_t ies_len;
+	int ret;
+
+	printk(KERN_DEBUG "[SCAN] Direct probe work.\n");
+
+	if (!priv->channel) {
+		dev_kfree_skb(priv->scan.probe_skb);
+		priv->scan.probe_skb = NULL;
+		wsm_unlock_tx(priv);
+		return;
+	}
+
+	if (unlikely(down_trylock(&priv->scan.lock))) {
+		/* Scan is already in progress. Requeue self. */
+		schedule();
+		queue_delayed_work(priv->workqueue,
+					&priv->scan.probe_work, HZ / 10);
+		return;
+	}
+
+	scan.band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+		WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G;
+	ch[0].number = priv->channel->hw_value;
+
+	skb_pull(frame.skb, sizeof(struct wsm_tx));
+
+	ies = &frame.skb->data[sizeof(struct ieee80211_hdr_3addr)];
+	ies_len = frame.skb->len - sizeof(struct ieee80211_hdr_3addr);
+
+	if (ies_len) {
+		u8 *ssidie =
+			(u8 *)cfg80211_find_ie(WLAN_EID_SSID, ies, ies_len);
+		if (ssidie && ssidie[1] && ssidie[1] <= sizeof(ssids[0].ssid)) {
+			u8 *nextie = &ssidie[2 + ssidie[1]];
+			/* Remove SSID from the IE list. It has to be provided
+			 * as a separate argument in cw1200_scan_start call */
+
+			/* Store SSID localy */
+			ssids[0].length = ssidie[1];
+			memcpy(ssids[0].ssid, &ssidie[2], ssids[0].length);
+			scan.numOfSSIDs = 1;
+
+			/* Remove SSID from IE list */
+			ssidie[1] = 0;
+			memmove(&ssidie[2], nextie, &ies[ies_len] - nextie);
+			skb_trim(frame.skb, frame.skb->len - ssids[0].length);
+		}
+	}
+
+	mutex_lock(&priv->conf_mutex);
+	ret = WARN_ON(wsm_set_template_frame(priv, &frame));
+	priv->scan.direct_probe = 1;
+	if (!ret) {
+		wsm_flush_tx(priv);
+		ret = WARN_ON(cw1200_scan_start(priv, &scan));
+	}
+	mutex_unlock(&priv->conf_mutex);
+
+	/* TODO: Report TX status to ieee80211 layer */
+	dev_kfree_skb(priv->scan.probe_skb);
+	priv->scan.probe_skb = NULL;
+
+	if (ret) {
+		priv->scan.direct_probe = 0;
+		up(&priv->scan.lock);
+		wsm_unlock_tx(priv);
+	}
+
+	return;
+}
diff --git a/drivers/staging/cw1200/scan.h b/drivers/staging/cw1200/scan.h
new file mode 100644
index 00000000000..3e7f6a42d6c
--- /dev/null
+++ b/drivers/staging/cw1200/scan.h
@@ -0,0 +1,56 @@
+/*
+ * Scan interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef SCAN_H_INCLUDED
+#define SCAN_H_INCLUDED
+
+#include <linux/semaphore.h>
+#include "wsm.h"
+
+/* external */ struct sk_buff;
+/* external */ struct cfg80211_scan_request;
+/* external */ struct ieee80211_channel;
+/* external */ struct ieee80211_hw;
+/* external */ struct work_struct;
+
+struct cw1200_scan {
+	struct semaphore lock;
+	struct work_struct work;
+	struct delayed_work timeout;
+	struct cfg80211_scan_request *req;
+	struct ieee80211_channel **begin;
+	struct ieee80211_channel **end;
+	struct wsm_ssid ssids[WSM_SCAN_MAX_NUM_OF_SSIDS];
+	u8 *ie;
+	size_t ie_len;
+	int output_power;
+	int n_ssids;
+	int status;
+	atomic_t in_progress;
+	/* Direct probe requests workaround */
+	struct delayed_work probe_work;
+	struct sk_buff *probe_skb;
+	int direct_probe;
+};
+
+int cw1200_hw_scan(struct ieee80211_hw *hw,
+			struct ieee80211_vif *vif,
+			struct cfg80211_scan_request *req);
+void cw1200_scan_work(struct work_struct *work);
+void cw1200_scan_timeout(struct work_struct *work);
+void cw1200_scan_complete_cb(struct cw1200_common *priv,
+				struct wsm_scan_complete *arg);
+
+/* ******************************************************************** */
+/* Raw probe requests TX workaround					*/
+void cw1200_probe_work(struct work_struct *work);
+
+#endif
diff --git a/drivers/staging/cw1200/sta.c b/drivers/staging/cw1200/sta.c
new file mode 100644
index 00000000000..3bb17b1e616
--- /dev/null
+++ b/drivers/staging/cw1200/sta.c
@@ -0,0 +1,1026 @@
+/*
+ * Mac80211 STA API for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/vmalloc.h>
+#include <linux/sched.h>
+#include <linux/firmware.h>
+
+#include "cw1200.h"
+#include "sta.h"
+#include "fwio.h"
+#include "bh.h"
+
+#ifdef CW1200_DEBUG_ENABLE_STA_LOGS
+#define sta_printk(...) printk(__VA_ARGS__)
+#else
+#define sta_printk(...)
+#endif
+
+
+static int cw1200_cancel_scan(struct cw1200_common *priv);
+
+static inline void __cw1200_free_event_queue(struct list_head *list)
+{
+	while (!list_empty(list)) {
+		struct cw1200_wsm_event *event =
+			list_first_entry(list, struct cw1200_wsm_event,
+			link);
+		list_del(&event->link);
+		kfree(event);
+	}
+}
+
+/* ******************************************************************** */
+/* STA API								*/
+
+int cw1200_start(struct ieee80211_hw *dev)
+{
+	struct cw1200_common *priv = dev->priv;
+	int ret = 0;
+
+	mutex_lock(&priv->conf_mutex);
+
+	/* default ECDA */
+	WSM_EDCA_SET(&priv->edca, 0, 0x0002, 0x0003, 0x0007, 47);
+	WSM_EDCA_SET(&priv->edca, 1, 0x0002, 0x0007, 0x000f, 94);
+	WSM_EDCA_SET(&priv->edca, 2, 0x0003, 0x000f, 0x03ff, 0);
+	WSM_EDCA_SET(&priv->edca, 3, 0x0007, 0x000f, 0x03ff, 0);
+	ret = wsm_set_edca_params(priv, &priv->edca);
+	if (WARN_ON(ret))
+		goto out;
+
+	memset(priv->bssid, ~0, ETH_ALEN);
+	memcpy(priv->mac_addr, dev->wiphy->perm_addr, ETH_ALEN);
+	priv->mode = NL80211_IFTYPE_MONITOR;
+	priv->softled_state = 0;
+	priv->wep_default_key_id = -1;
+
+	priv->cqm_link_loss_count = 60;
+	priv->cqm_beacon_loss_count = 20;
+
+	ret = cw1200_setup_mac(priv);
+	if (WARN_ON(ret))
+		goto out;
+
+	/* err = cw1200_set_leds(priv); */
+
+out:
+	mutex_unlock(&priv->conf_mutex);
+	return ret;
+}
+
+void cw1200_stop(struct ieee80211_hw *dev)
+{
+	struct cw1200_common *priv = dev->priv;
+	unsigned long flags;
+	LIST_HEAD(list);
+	int i;
+
+	struct wsm_reset reset = {
+		.reset_statistics = true,
+	};
+
+	wsm_lock_tx(priv);
+
+	while (down_trylock(&priv->scan.lock)) {
+		/* Scan is in progress. Force it to stop. */
+		priv->scan.req = NULL;
+		schedule();
+	}
+	up(&priv->scan.lock);
+
+	mutex_lock(&priv->conf_mutex);
+	cw1200_free_keys(priv);
+	priv->mode = NL80211_IFTYPE_UNSPECIFIED;
+	mutex_unlock(&priv->conf_mutex);
+
+	cancel_delayed_work_sync(&priv->scan.probe_work);
+	cancel_delayed_work_sync(&priv->scan.timeout);
+	cancel_delayed_work_sync(&priv->join_timeout);
+	cancel_delayed_work_sync(&priv->bss_loss_work);
+	cancel_delayed_work_sync(&priv->connection_loss_work);
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+	cancel_delayed_work_sync(&priv->keep_alive_work);
+#endif
+	switch (priv->join_status) {
+	case CW1200_JOIN_STATUS_STA:
+		queue_work(priv->workqueue, &priv->unjoin_work);
+		break;
+	case CW1200_JOIN_STATUS_AP:
+		/* If you see this warning please change the code to iterate
+		 * through the map and reset each link separately. */
+		WARN_ON(priv->link_id_map);
+		priv->sta_asleep_mask = 0;
+		priv->suspend_multicast = false;
+		wsm_reset(priv, &reset);
+		wsm_unlock_tx(priv);
+		break;
+	default:
+		wsm_unlock_tx(priv);
+	}
+	flush_workqueue(priv->workqueue);
+	mutex_lock(&priv->conf_mutex);
+
+	priv->softled_state = 0;
+	/* cw1200_set_leds(priv); */
+
+	spin_lock_irqsave(&priv->event_queue_lock, flags);
+	list_splice_init(&priv->event_queue, &list);
+	spin_unlock_irqrestore(&priv->event_queue_lock, flags);
+	__cw1200_free_event_queue(&list);
+
+	priv->delayed_link_loss = 0;
+
+	priv->link_id_map = 0;
+	priv->join_status = CW1200_JOIN_STATUS_MONITOR;
+
+	/* TODO: Complete deinitialization */
+
+	for (i = 0; i < 4; i++)
+		cw1200_queue_clear(&priv->tx_queue[i]);
+
+	/* HACK! */
+	if (atomic_xchg(&priv->tx_lock, 1) != 1)
+		sta_printk(KERN_DEBUG "[STA] TX is force-unlocked due to stop " \
+			"request.\n");
+
+	wsm_unlock_tx(priv);
+
+	mutex_unlock(&priv->conf_mutex);
+}
+
+int cw1200_add_interface(struct ieee80211_hw *dev,
+			 struct ieee80211_vif *vif)
+{
+	int ret;
+	struct cw1200_common *priv = dev->priv;
+	/* __le32 auto_calibration_mode = __cpu_to_le32(1); */
+
+	mutex_lock(&priv->conf_mutex);
+
+	if (priv->mode != NL80211_IFTYPE_MONITOR) {
+		mutex_unlock(&priv->conf_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	switch (vif->type) {
+	case NL80211_IFTYPE_STATION:
+	case NL80211_IFTYPE_ADHOC:
+	case NL80211_IFTYPE_MESH_POINT:
+	case NL80211_IFTYPE_AP:
+		priv->mode = vif->type;
+		break;
+	default:
+		mutex_unlock(&priv->conf_mutex);
+		return -EOPNOTSUPP;
+	}
+
+	priv->vif = vif;
+	memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
+
+	ret = WARN_ON(cw1200_setup_mac(priv));
+	/* Enable auto-calibration */
+	/* Exception in subsequent channel switch; disabled.
+	WARN_ON(wsm_write_mib(priv, WSM_MIB_ID_SET_AUTO_CALIBRATION_MODE,
+		&auto_calibration_mode, sizeof(auto_calibration_mode)));
+	*/
+
+	mutex_unlock(&priv->conf_mutex);
+	return ret;
+}
+
+void cw1200_remove_interface(struct ieee80211_hw *dev,
+			     struct ieee80211_vif *vif)
+{
+	struct cw1200_common *priv = dev->priv;
+
+	struct wsm_reset reset = {
+		.reset_statistics = true,
+	};
+
+	mutex_lock(&priv->conf_mutex);
+
+	priv->vif = NULL;
+	priv->mode = NL80211_IFTYPE_MONITOR;
+	memset(priv->mac_addr, 0, ETH_ALEN);
+	memset(priv->bssid, 0, ETH_ALEN);
+	WARN_ON(wsm_reset(priv, &reset));
+	cw1200_free_keys(priv);
+	cw1200_setup_mac(priv);
+
+	mutex_unlock(&priv->conf_mutex);
+}
+
+int cw1200_config(struct ieee80211_hw *dev, u32 changed)
+{
+	int ret = 0;
+	struct cw1200_common *priv = dev->priv;
+	struct ieee80211_conf *conf = &dev->conf;
+
+	mutex_lock(&priv->conf_mutex);
+	/* TODO: IEEE80211_CONF_CHANGE_QOS */
+	if (changed & IEEE80211_CONF_CHANGE_POWER) {
+		priv->output_power = conf->power_level;
+		sta_printk(KERN_DEBUG "[STA] TX power: %d\n", priv->output_power);
+		WARN_ON(wsm_set_output_power(priv, priv->output_power * 10));
+	}
+
+	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
+		/* TODO: Not sure. Needs to be verified. */
+		/* TODO: DTIM skipping */
+		int dtim_interval = conf->ps_dtim_period;
+		int listen_interval = conf->listen_interval;
+		if (dtim_interval < 1)
+			dtim_interval = 1;
+		if (listen_interval < dtim_interval)
+			listen_interval = 0;
+		/* TODO: max_sleep_period is not supported
+		 * and silently skipped. */
+		sta_printk(KERN_DEBUG "[STA] DTIM %d, listen %d\n",
+			dtim_interval, listen_interval);
+		WARN_ON(wsm_set_beacon_wakeup_period(priv,
+			dtim_interval, listen_interval));
+	}
+
+
+	if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) &&
+		(priv->channel != conf->channel)) {
+		struct wsm_switch_channel channel = {
+			.newChannelNumber = conf->channel->hw_value
+		};
+		cw1200_cancel_scan(priv);
+		sta_printk(KERN_DEBUG "[STA] Freq %d (wsm ch: %d).\n",
+			conf->channel->center_freq, conf->channel->hw_value);
+		WARN_ON(wait_event_interruptible_timeout(
+			priv->channel_switch_done,
+			!priv->channel_switch_in_progress, 3 * HZ) <= 0);
+		WARN_ON(wsm_switch_channel(priv, &channel));
+		priv->channel = conf->channel;
+	}
+
+	if (changed & IEEE80211_CONF_CHANGE_PS) {
+		priv->powersave_mode.pmMode =
+				(conf->flags & IEEE80211_CONF_PS) ?
+				WSM_PSM_PS : WSM_PSM_ACTIVE;
+		WARN_ON(wsm_set_pm(priv, &priv->powersave_mode));
+	}
+
+	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+		/* TBD: It looks like it's transparent
+		 * there's a monitor interface present -- use this
+		 * to determine for example whether to calculate
+		 * timestamps for packets or not, do not use instead
+		 * of filter flags! */
+	}
+
+	if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+		struct wsm_operational_mode mode = {
+			/* TODO: wsm_power_mode_quiescent is more efficient,
+			 *  but it requires AI to get device on again. */
+			.power_mode = (conf->flags & IEEE80211_CONF_IDLE) ?
+				wsm_power_mode_doze : wsm_power_mode_active
+		};
+		WARN_ON(wsm_set_operational_mode(priv, &mode));
+	}
+
+	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+		unsigned long flags;
+		sta_printk(KERN_DEBUG "[STA] Retry limits: %d (long), " \
+			"%d (short).\n",
+			conf->long_frame_max_tx_count,
+			conf->short_frame_max_tx_count);
+		spin_lock_irqsave(&priv->tx_policy_cache.lock, flags);
+		priv->long_frame_max_tx_count = conf->long_frame_max_tx_count;
+		priv->short_frame_max_tx_count =
+			(conf->short_frame_max_tx_count < 0x0F) ?
+			conf->short_frame_max_tx_count : 0x0F;
+		priv->hw->max_rate_tries = priv->short_frame_max_tx_count;
+		spin_unlock_irqrestore(&priv->tx_policy_cache.lock, flags);
+		/* TBD: I think we don't need tx_policy_force_upload().
+		 * Outdated policies will leave cache in a normal way. */
+		/* WARN_ON(tx_policy_force_upload(priv)); */
+	}
+	mutex_unlock(&priv->conf_mutex);
+	return ret;
+}
+
+void cw1200_configure_filter(struct ieee80211_hw *dev,
+			     unsigned int changed_flags,
+			     unsigned int *total_flags,
+			     u64 multicast)
+{
+#if 0
+	struct cw1200_common *priv = dev->priv;
+	struct wsm_rx_filter filter = {
+		.promiscuous = (*total_flags & FIF_PROMISC_IN_BSS) ? 1 : 0,
+		.bssid = (*total_flags & FIF_OTHER_BSS) ? 1 : 0,
+		.fcs = (*total_flags & FIF_FCSFAIL) ? 1 : 0,
+	};
+	struct wsm_beacon_filter_control bf_control = {
+		.enabled = 0,
+		.bcn_count = (*total_flags &
+			(FIF_BCN_PRBRESP_PROMISC | FIF_PROMISC_IN_BSS)) ?
+			1 : 0,
+	};
+#endif
+
+	*total_flags &= FIF_PROMISC_IN_BSS |
+			FIF_OTHER_BSS |
+			FIF_FCSFAIL |
+			FIF_BCN_PRBRESP_PROMISC;
+
+#if 0
+	/* FIXME: FW behaves strange if promiscuous mode is enabled. */
+	WARN_ON(wsm_set_rx_filter(priv, &filter));
+	WARN_ON(wsm_beacon_filter_control(priv, &bf_control));
+#endif
+}
+
+int cw1200_conf_tx(struct ieee80211_hw *dev, u16 queue,
+		   const struct ieee80211_tx_queue_params *params)
+{
+	struct cw1200_common *priv = dev->priv;
+	int ret = 0;
+
+	mutex_lock(&priv->conf_mutex);
+
+	if (queue < dev->queues) {
+		WSM_EDCA_SET(&priv->edca, queue, params->aifs,
+			params->cw_min, params->cw_max, params->txop);
+		ret = wsm_set_edca_params(priv, &priv->edca);
+	} else
+		ret = -EINVAL;
+
+	mutex_unlock(&priv->conf_mutex);
+	return ret;
+}
+
+int cw1200_get_stats(struct ieee80211_hw *dev,
+		     struct ieee80211_low_level_stats *stats)
+{
+	struct cw1200_common *priv = dev->priv;
+
+	memcpy(stats, &priv->stats, sizeof(*stats));
+	return 0;
+}
+
+/*
+int cw1200_get_tx_stats(struct ieee80211_hw *dev,
+			struct ieee80211_tx_queue_stats *stats)
+{
+	int i;
+	struct cw1200_common *priv = dev->priv;
+
+	for (i = 0; i < dev->queues; ++i)
+		cw1200_queue_get_stats(&priv->tx_queue[i], &stats[i]);
+
+	return 0;
+}
+*/
+
+int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
+		   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+		   struct ieee80211_key_conf *key)
+{
+	int ret = -EOPNOTSUPP;
+	struct cw1200_common *priv = dev->priv;
+
+	mutex_lock(&priv->conf_mutex);
+
+	if (cmd == SET_KEY) {
+		u8 *peer_addr = NULL;
+		int pairwise = (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ?
+			1 : 0;
+		int idx = cw1200_alloc_key(priv);
+		struct wsm_add_key *wsm_key = &priv->keys[idx];
+
+		if (idx < 0) {
+			ret = -EINVAL;
+			goto finally;
+		}
+
+		BUG_ON(pairwise && !sta);
+		if (sta)
+			peer_addr = sta->addr;
+
+		switch (key->cipher) {
+		case WLAN_CIPHER_SUITE_WEP40:
+		case WLAN_CIPHER_SUITE_WEP104:
+			if (key->keylen > 16) {
+				cw1200_free_key(priv, idx);
+				ret = -EINVAL;
+				goto finally;
+			}
+
+			if (pairwise) {
+				wsm_key->type = WSM_KEY_TYPE_WEP_PAIRWISE;
+				memcpy(wsm_key->wepPairwiseKey.peerAddress,
+					 peer_addr, ETH_ALEN);
+				memcpy(wsm_key->wepPairwiseKey.keyData,
+					&key->key[0], key->keylen);
+				wsm_key->wepPairwiseKey.keyLength = key->keylen;
+			} else {
+				wsm_key->type = WSM_KEY_TYPE_WEP_DEFAULT;
+				memcpy(wsm_key->wepGroupKey.keyData,
+					&key->key[0], key->keylen);
+				wsm_key->wepGroupKey.keyLength = key->keylen;
+				wsm_key->wepGroupKey.keyId = key->keyidx;
+			}
+			break;
+		case WLAN_CIPHER_SUITE_TKIP:
+			if (pairwise) {
+				wsm_key->type = WSM_KEY_TYPE_TKIP_PAIRWISE;
+				memcpy(wsm_key->tkipPairwiseKey.peerAddress,
+					peer_addr, ETH_ALEN);
+				memcpy(wsm_key->tkipPairwiseKey.tkipKeyData,
+					&key->key[0],  16);
+				memcpy(wsm_key->tkipPairwiseKey.txMicKey,
+					&key->key[16],  8);
+				memcpy(wsm_key->tkipPairwiseKey.rxMicKey,
+					&key->key[24],  8);
+			} else {
+				size_t mic_offset =
+					(priv->mode == NL80211_IFTYPE_AP) ?
+					16 : 24;
+				wsm_key->type = WSM_KEY_TYPE_TKIP_GROUP;
+				memcpy(wsm_key->tkipGroupKey.tkipKeyData,
+					&key->key[0],  16);
+				memcpy(wsm_key->tkipGroupKey.rxMicKey,
+					&key->key[mic_offset],  8);
+
+				/* TODO: Where can I find TKIP SEQ? */
+				memset(wsm_key->tkipGroupKey.rxSeqCounter,
+					0,		8);
+				wsm_key->tkipGroupKey.keyId = key->keyidx;
+
+				print_hex_dump_bytes("TKIP: ", DUMP_PREFIX_NONE,
+					key->key, key->keylen);
+			}
+			break;
+		case WLAN_CIPHER_SUITE_CCMP:
+			if (pairwise) {
+				wsm_key->type = WSM_KEY_TYPE_AES_PAIRWISE;
+				memcpy(wsm_key->aesPairwiseKey.peerAddress,
+					peer_addr, ETH_ALEN);
+				memcpy(wsm_key->aesPairwiseKey.aesKeyData,
+					&key->key[0],  16);
+			} else {
+				wsm_key->type = WSM_KEY_TYPE_AES_GROUP;
+				memcpy(wsm_key->aesGroupKey.aesKeyData,
+					&key->key[0],  16);
+				/* TODO: Where can I find AES SEQ? */
+				memset(wsm_key->aesGroupKey.rxSeqCounter,
+					0,              8);
+				wsm_key->aesGroupKey.keyId = key->keyidx;
+			}
+			break;
+#if 0
+		case WLAN_CIPHER_SUITE_WAPI:
+			if (pairwise) {
+				wsm_key->type = WSM_KEY_TYPE_WAPI_PAIRWISE;
+				memcpy(wsm_key->wapiPairwiseKey.peerAddress,
+					peer_addr, ETH_ALEN);
+				memcpy(wsm_key->wapiPairwiseKey.wapiKeyData,
+					&key->key[0],  16);
+				memcpy(wsm_key->wapiPairwiseKey.micKeyData,
+					&key->key[16], 16);
+				wsm_key->wapiPairwiseKey.keyId = key->keyidx;
+			} else {
+				wsm_key->type = WSM_KEY_TYPE_WAPI_GROUP;
+				memcpy(wsm_key->wapiGroupKey.wapiKeyData,
+					&key->key[0],  16);
+				memcpy(wsm_key->wapiGroupKey.micKeyData,
+					&key->key[16], 16);
+				wsm_key->wapiGroupKey.keyId = key->keyidx;
+			}
+			break;
+#endif
+		default:
+			WARN_ON(1);
+			cw1200_free_key(priv, idx);
+			ret = -EOPNOTSUPP;
+			goto finally;
+		}
+		ret = WARN_ON(wsm_add_key(priv, wsm_key));
+		if (!ret)
+			key->hw_key_idx = idx;
+		else
+			cw1200_free_key(priv, idx);
+	} else if (cmd == DISABLE_KEY) {
+		struct wsm_remove_key wsm_key = {
+			.entryIndex = key->hw_key_idx,
+		};
+
+		if (wsm_key.entryIndex > WSM_KEY_MAX_INDEX) {
+			ret = -EINVAL;
+			goto finally;
+		}
+
+		cw1200_free_key(priv, wsm_key.entryIndex);
+		ret = wsm_remove_key(priv, &wsm_key);
+	} else {
+		BUG_ON("Unsupported command");
+	}
+
+finally:
+	mutex_unlock(&priv->conf_mutex);
+	return ret;
+}
+
+void cw1200_wep_key_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, wep_key_work);
+	__le32 wep_default_key_id = __cpu_to_le32(
+		priv->wep_default_key_id);
+
+	sta_printk(KERN_DEBUG "[STA] Setting default WEP key: %d\n",
+		priv->wep_default_key_id);
+	wsm_flush_tx(priv);
+	WARN_ON(wsm_write_mib(priv, WSM_MIB_ID_DOT11_WEP_DEFAULT_KEY_ID,
+		&wep_default_key_id, sizeof(wep_default_key_id)));
+	wsm_unlock_tx(priv);
+}
+
+int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+	int ret;
+	__le32 val32;
+
+	if (value != (u32) -1)
+		val32 = __cpu_to_le32(value);
+	else
+		val32 = 0; /* disabled */
+
+	/* mutex_lock(&priv->conf_mutex); */
+	ret = WARN_ON(wsm_write_mib(hw->priv, WSM_MIB_ID_DOT11_RTS_THRESHOLD,
+		&val32, sizeof(val32)));
+	/* mutex_unlock(&priv->conf_mutex); */
+	return ret;
+}
+
+/* ******************************************************************** */
+/* WSM callbacks							*/
+
+/* TODO: move to txrx.c */
+void cw1200_rx_cb(struct cw1200_common *priv,
+		  struct wsm_rx *arg,
+		  struct sk_buff **skb_p)
+{
+	struct sk_buff *skb = *skb_p;
+	struct ieee80211_rx_status *hdr = IEEE80211_SKB_RXCB(skb);
+	hdr->flag = 0;
+
+	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED)) {
+		/* STA is stopped. */
+		return;
+	}
+
+	if (unlikely(arg->status)) {
+		if (arg->status == WSM_STATUS_MICFAILURE) {
+			sta_printk(KERN_DEBUG "[RX] MIC failure.\n");
+			hdr->flag |= RX_FLAG_MMIC_ERROR;
+		} else if (arg->status == WSM_STATUS_NO_KEY_FOUND) {
+			sta_printk(KERN_DEBUG "[RX] No key found.\n");
+			return;
+		} else {
+			sta_printk(KERN_DEBUG "[RX] Receive failure: %d.\n",
+				arg->status);
+			return;
+		}
+	}
+
+	hdr->mactime = 0; /* Not supported by WSM */
+	hdr->freq = ieee80211_channel_to_frequency(arg->channelNumber);
+	hdr->band = (hdr->freq >= 5000) ?
+		IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
+	hdr->rate_idx = arg->rxedRate;
+	if (hdr->rate_idx >= 4) /* TODO: Use common convert function. */
+		hdr->rate_idx -= 2;
+	hdr->signal = (s8)arg->rcpiRssi;
+	hdr->antenna = 0;
+
+	if (arg->flags & 0x07)
+		hdr->flag |= RX_FLAG_DECRYPTED;
+	if (arg->flags & BIT(14))
+		hdr->flag |= RX_FLAG_HT;
+#if 0
+	/* Wrong: ACK could be disable for this ACL */
+	if (arg->flags & BIT(16))
+		priv->last_activity_time = jiffies;
+#endif
+
+#if 0
+	print_hex_dump_bytes("RX: ", DUMP_PREFIX_NONE,
+		skb->data, skb->len);
+#endif
+
+	/* Not that we really need _irqsafe variant here,
+	 * but it offloads realtime bh thread and improve
+	 * system performance. */
+	ieee80211_rx_irqsafe(priv->hw, skb);
+	*skb_p = NULL;
+}
+
+void cw1200_free_event_queue(struct cw1200_common *priv)
+{
+	unsigned long flags;
+	LIST_HEAD(list);
+
+	spin_lock_irqsave(&priv->event_queue_lock, flags);
+	list_splice_init(&priv->event_queue, &list);
+	spin_unlock_irqrestore(&priv->event_queue_lock, flags);
+
+	__cw1200_free_event_queue(&list);
+}
+
+void cw1200_event_handler(struct work_struct *work)
+{
+	unsigned long flags;
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, event_handler);
+	struct cw1200_wsm_event *event;
+	LIST_HEAD(list);
+
+	spin_lock_irqsave(&priv->event_queue_lock, flags);
+	list_splice_init(&priv->event_queue, &list);
+	spin_unlock_irqrestore(&priv->event_queue_lock, flags);
+
+	list_for_each_entry(event, &list, link) {
+		switch (event->evt.eventId) {
+		case WSM_EVENT_ERROR:
+			/* I even don't know what is it about.. */
+			STUB();
+			break;
+		case WSM_EVENT_BSS_LOST:
+		{
+			sta_printk(KERN_DEBUG "[CQM] BSS lost.\n");
+			cancel_delayed_work_sync(&priv->bss_loss_work);
+			cancel_delayed_work_sync(&priv->connection_loss_work);
+			if (!down_trylock(&priv->scan.lock)) {
+				up(&priv->scan.lock);
+				priv->delayed_link_loss = 0;
+				queue_delayed_work(priv->workqueue,
+						&priv->bss_loss_work, 0);
+			} else {
+				/* Scan is in progress. Delay reporting. */
+				/* Scan complete will trigger bss_loss_work */
+				priv->delayed_link_loss = 1;
+				/* Also we're starting watchdog. */
+				queue_delayed_work(priv->workqueue,
+						&priv->bss_loss_work, 10 * HZ);
+			}
+			break;
+		}
+		case WSM_EVENT_BSS_REGAINED:
+		{
+			sta_printk(KERN_DEBUG "[CQM] BSS regained.\n");
+			priv->delayed_link_loss = 0;
+			cancel_delayed_work_sync(&priv->bss_loss_work);
+			cancel_delayed_work_sync(&priv->connection_loss_work);
+			break;
+		}
+		case WSM_EVENT_RADAR_DETECTED:
+			STUB();
+			break;
+		case WSM_EVENT_RCPI_RSSI:
+		{
+			int rssi = (int)(s8)(event->evt.eventData & 0xFF);
+			int cqm_evt = (rssi <= priv->cqm_rssi_thold) ?
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW :
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
+			sta_printk(KERN_DEBUG "[CQM] RSSI event: %d", rssi);
+			ieee80211_cqm_rssi_notify(priv->vif, cqm_evt,
+								GFP_KERNEL);
+			break;
+		}
+		case WSM_EVENT_BT_INACTIVE:
+			STUB();
+			break;
+		case WSM_EVENT_BT_ACTIVE:
+			STUB();
+			break;
+		}
+	}
+	__cw1200_free_event_queue(&list);
+}
+
+void cw1200_bss_loss_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, bss_loss_work.work);
+	int timeout; /* in beacons */
+
+	timeout = priv->cqm_link_loss_count -
+		priv->cqm_beacon_loss_count;
+
+	if (priv->cqm_beacon_loss_count) {
+		sta_printk(KERN_DEBUG "[CQM] Beacon loss.\n");
+		if (timeout <= 0)
+			timeout = 0;
+#ifdef USE_STE_EXTENSIONS
+		ieee80211_cqm_beacon_miss_notify(priv->vif, GFP_KERNEL);
+#endif
+	} else {
+		timeout = 0;
+	}
+
+	cancel_delayed_work_sync(&priv->connection_loss_work);
+	queue_delayed_work(priv->workqueue,
+		&priv->connection_loss_work,
+		timeout * HZ / 10);
+}
+
+void cw1200_connection_loss_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common,
+				connection_loss_work.work);
+	sta_printk(KERN_DEBUG "[CQM] Reporting connection loss.\n");
+	ieee80211_connection_loss(priv->vif);
+}
+
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+void cw1200_keep_alive_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, keep_alive_work.work);
+	unsigned long now = jiffies;
+	unsigned long delta = now - priv->last_activity_time;
+	unsigned long tmo = 30 * HZ;
+
+	if (delta >= tmo) {
+		sta_printk(KERN_DEBUG "[CQM] Keep-alive ping.\n");
+		STUB();
+		/* TODO: Do a keep-alive ping :) */
+		priv->last_activity_time = now;
+	} else {
+		tmo -= delta;
+	}
+	queue_delayed_work(priv->workqueue,
+		&priv->keep_alive_work, tmo);
+}
+#endif
+
+void cw1200_tx_failure_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, tx_failure_work);
+	sta_printk(KERN_DEBUG "[CQM] Reporting TX failure.\n");
+#ifdef USE_STE_EXTENSIONS
+	ieee80211_cqm_tx_fail_notify(priv->vif, GFP_KERNEL);
+#else
+	(void)priv;
+#endif
+}
+
+/* ******************************************************************** */
+/* Internal API								*/
+
+int cw1200_setup_mac(struct cw1200_common *priv)
+{
+	/* TBD: Do you know how to assing MAC address without
+	 * annoying uploading RX data? */
+	u8 prev_mac[ETH_ALEN];
+
+	/* NOTE: There is a bug in FW: it reports signal
+	* as RSSI if RSSI subscription is enabled.
+	* It's not enough to set WSM_RCPI_RSSI_USE_RSSI. */
+	struct wsm_rcpi_rssi_threshold threshold = {
+		.rssiRcpiMode = WSM_RCPI_RSSI_USE_RSSI |
+		WSM_RCPI_RSSI_THRESHOLD_ENABLE |
+		WSM_RCPI_RSSI_DONT_USE_UPPER |
+		WSM_RCPI_RSSI_DONT_USE_LOWER,
+		.rollingAverageCount = 16,
+	};
+	int ret = 0;
+
+	if (wsm_get_station_id(priv, &prev_mac[0])
+	    || memcmp(prev_mac, priv->mac_addr, ETH_ALEN)) {
+		const char *sdd_path = NULL;
+		const struct firmware *firmware = NULL;
+		struct wsm_configuration cfg = {
+			.dot11StationId = &priv->mac_addr[0],
+		};
+
+		switch (priv->hw_revision) {
+		case CW1200_HW_REV_CUT10:
+			sdd_path = SDD_FILE_10;
+			break;
+		case CW1200_HW_REV_CUT11:
+			sdd_path = SDD_FILE_11;
+			break;
+		case CW1200_HW_REV_CUT20:
+			sdd_path = SDD_FILE_20;
+			break;
+		default:
+			BUG_ON(1);
+		}
+
+		ret = request_firmware(&firmware,
+			sdd_path, priv->pdev);
+
+		if (unlikely(ret)) {
+			cw1200_dbg(CW1200_DBG_ERROR,
+				"%s: can't load sdd file %s.\n",
+				__func__, sdd_path);
+			return ret;
+		}
+
+		cfg.dpdData = firmware->data;
+		cfg.dpdData_size = firmware->size;
+		ret = WARN_ON(wsm_configuration(priv, &cfg));
+
+		release_firmware(firmware);
+	}
+	if (ret)
+		return ret;
+
+	/* Configure RSSI/SCPI reporting as RSSI. */
+	WARN_ON(wsm_set_rcpi_rssi_threshold(priv, &threshold));
+
+	/* TODO: */
+	switch (priv->mode) {
+	case NL80211_IFTYPE_STATION:
+	case NL80211_IFTYPE_MONITOR:
+	case NL80211_IFTYPE_AP:
+		break;
+	case NL80211_IFTYPE_ADHOC:
+	case NL80211_IFTYPE_MESH_POINT:
+		/* TODO: Not verified yet. */
+		STUB();
+		break;
+	}
+
+	return 0;
+}
+
+void cw1200_join_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, join_work);
+	const struct wsm_tx *wsm = priv->join_pending_frame;
+	const u8 *frame = (u8 *)&wsm[1];
+	const u8 *bssid = &frame[4]; /* AP SSID in a 802.11 frame */
+	struct cfg80211_bss *bss;
+	const u8 *ssidie;
+	const u8 *dtimie;
+	const struct ieee80211_tim_ie *tim = NULL;
+	u8 queueId = wsm_queue_id_to_linux(wsm->queueId);
+
+	cancel_delayed_work_sync(&priv->join_timeout);
+
+	bss = cfg80211_get_bss(priv->hw->wiphy, NULL, bssid, NULL, 0, 0, 0);
+	if (!bss) {
+		priv->join_pending_frame = NULL;
+		cw1200_queue_remove(&priv->tx_queue[queueId],
+			priv, __le32_to_cpu(wsm->packetID));
+		return;
+	}
+	ssidie = cfg80211_find_ie(WLAN_EID_SSID,
+		bss->information_elements,
+		bss->len_information_elements);
+	dtimie = cfg80211_find_ie(WLAN_EID_TIM,
+		bss->information_elements,
+		bss->len_information_elements);
+	if (dtimie)
+		tim = (struct ieee80211_tim_ie *)&dtimie[2];
+
+	mutex_lock(&priv->conf_mutex);
+	{
+		struct wsm_join join = {
+			.mode = (bss->capability & WLAN_CAPABILITY_IBSS) ?
+				WSM_JOIN_MODE_IBSS : WSM_JOIN_MODE_BSS,
+			.preambleType = WSM_JOIN_PREAMBLE_SHORT,
+			.probeForJoin = 1,
+			/* dtimPeriod will be updated after association */
+			.dtimPeriod = 1,
+			.beaconInterval = bss->beacon_interval,
+			/* basicRateSet will be updated after association */
+			.basicRateSet = 7,
+		};
+
+		if (tim && tim->dtim_period > 1) {
+			join.dtimPeriod = tim->dtim_period;
+			priv->join_dtim_period = tim->dtim_period;
+			sta_printk(KERN_DEBUG "[STA] Join DTIM: %d\n",
+				join.dtimPeriod);
+		}
+
+		priv->join_pending_frame = NULL;
+		BUG_ON(!wsm);
+		BUG_ON(!priv->channel);
+
+		join.channelNumber = priv->channel->hw_value;
+		join.band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+			WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G;
+
+		memcpy(&join.bssid[0], bssid, sizeof(join.bssid));
+		memcpy(&priv->join_bssid[0], bssid, sizeof(priv->join_bssid));
+
+		if (ssidie) {
+			join.ssidLength = ssidie[1];
+			if (WARN_ON(join.ssidLength > sizeof(join.ssid)))
+				join.ssidLength = sizeof(join.ssid);
+			memcpy(&join.ssid[0], &ssidie[2], join.ssidLength);
+		}
+
+		wsm_flush_tx(priv);
+
+		/* TX block_ack can use only 3 TX buffers,
+		 * which is /slightly/ :) unefficient => disabled.
+		 * RX block ACK is enabled for everything but voice.
+		 * TODO: Verify video lags, change 0x3F -> 0x0F
+		 * if necessary. */
+		WARN_ON(wsm_set_block_ack_policy(priv, 0x00, 0x3F));
+
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+		priv->last_activity_time = jiffies;
+		/* Queue keep-alive ping avery 30 sec. */
+		queue_delayed_work(priv->workqueue,
+			&priv->keep_alive_work, 30 * HZ);
+#endif
+		/* Queue unjoin if not associated in 3 sec. */
+		queue_delayed_work(priv->workqueue,
+			&priv->join_timeout, 3 * HZ);
+
+		if (wsm_join(priv, &join)) {
+			memset(&priv->join_bssid[0],
+				0, sizeof(priv->join_bssid));
+			cw1200_queue_remove(&priv->tx_queue[queueId],
+				priv, __le32_to_cpu(wsm->packetID));
+			cancel_delayed_work_sync(&priv->join_timeout);
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+			cancel_delayed_work_sync(&priv->keep_alive_work);
+#endif
+		} else {
+			WARN_ON(cw1200_upload_keys(priv));
+#ifndef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+			WARN_ON(wsm_keep_alive_period(priv, 30 /* sec */));
+#endif
+			cw1200_queue_requeue(&priv->tx_queue[queueId],
+				__le32_to_cpu(wsm->packetID));
+		}
+	}
+	mutex_unlock(&priv->conf_mutex);
+	cfg80211_put_bss(bss);
+}
+
+void cw1200_join_timeout(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, join_timeout.work);
+	sta_printk(KERN_DEBUG "[WSM] Issue unjoin command (TMO).\n");
+	wsm_lock_tx(priv);
+	cw1200_unjoin_work(&priv->unjoin_work);
+}
+
+void cw1200_unjoin_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, unjoin_work);
+
+	struct wsm_reset reset = {
+		.reset_statistics = true,
+	};
+
+	mutex_lock(&priv->conf_mutex);
+	BUG_ON(priv->join_status &&
+			priv->join_status != CW1200_JOIN_STATUS_STA);
+	if (priv->join_status == CW1200_JOIN_STATUS_STA) {
+		memset(&priv->join_bssid[0], 0, sizeof(priv->join_bssid));
+		priv->join_status = CW1200_JOIN_STATUS_MONITOR;
+
+		/* Unjoin is a reset. */
+		wsm_flush_tx(priv);
+		WARN_ON(wsm_reset(priv, &reset));
+		priv->join_dtim_period = 0;
+		WARN_ON(cw1200_setup_mac(priv));
+		cw1200_free_event_queue(priv);
+		cancel_work_sync(&priv->event_handler);
+		cancel_delayed_work_sync(&priv->connection_loss_work);
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+		cancel_delayed_work_sync(&priv->keep_alive_work);
+#endif
+		sta_printk(KERN_DEBUG "[STA] Unjoin.\n");
+	}
+	mutex_unlock(&priv->conf_mutex);
+	wsm_unlock_tx(priv);
+}
+
+/* ******************************************************************** */
+/* STA privates								*/
+
+static int cw1200_cancel_scan(struct cw1200_common *priv)
+{
+	/* STUB(); */
+	return 0;
+}
diff --git a/drivers/staging/cw1200/sta.h b/drivers/staging/cw1200/sta.h
new file mode 100644
index 00000000000..a36127b3843
--- /dev/null
+++ b/drivers/staging/cw1200/sta.h
@@ -0,0 +1,72 @@
+/*
+ * Mac80211 STA interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef STA_H_INCLUDED
+#define STA_H_INCLUDED
+
+/* ******************************************************************** */
+/* mac80211 API								*/
+
+int cw1200_start(struct ieee80211_hw *dev);
+void cw1200_stop(struct ieee80211_hw *dev);
+int cw1200_add_interface(struct ieee80211_hw *dev,
+			 struct ieee80211_vif *vif);
+void cw1200_remove_interface(struct ieee80211_hw *dev,
+			     struct ieee80211_vif *vif);
+int cw1200_config(struct ieee80211_hw *dev, u32 changed);
+void cw1200_configure_filter(struct ieee80211_hw *dev,
+			     unsigned int changed_flags,
+			     unsigned int *total_flags,
+			     u64 multicast);
+int cw1200_conf_tx(struct ieee80211_hw *dev, u16 queue,
+		   const struct ieee80211_tx_queue_params *params);
+int cw1200_get_stats(struct ieee80211_hw *dev,
+		     struct ieee80211_low_level_stats *stats);
+/* Not more a part of interface?
+int cw1200_get_tx_stats(struct ieee80211_hw *dev,
+			struct ieee80211_tx_queue_stats *stats);
+*/
+int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
+		   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+		   struct ieee80211_key_conf *key);
+
+int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
+
+/* ******************************************************************** */
+/* WSM callbacks							*/
+
+void cw1200_rx_cb(struct cw1200_common *priv,
+		  struct wsm_rx *arg,
+		  struct sk_buff **skb_p);
+/* void cw1200_set_pm_complete_cb(struct cw1200_common *priv,
+	struct wsm_set_pm_complete *arg); */
+/* void cw1200_channel_switch_cb(struct cw1200_common *priv); */
+
+/* ******************************************************************** */
+/* WSM events								*/
+
+void cw1200_free_event_queue(struct cw1200_common *priv);
+void cw1200_event_handler(struct work_struct *work);
+void cw1200_bss_loss_work(struct work_struct *work);
+void cw1200_connection_loss_work(struct work_struct *work);
+void cw1200_keep_alive_work(struct work_struct *work);
+void cw1200_tx_failure_work(struct work_struct *work);
+
+/* ******************************************************************** */
+/* Internal API								*/
+
+int cw1200_setup_mac(struct cw1200_common *priv);
+void cw1200_join_work(struct work_struct *work);
+void cw1200_join_timeout(struct work_struct *work);
+void cw1200_unjoin_work(struct work_struct *work);
+void cw1200_wep_key_work(struct work_struct *work);
+
+#endif
diff --git a/drivers/staging/cw1200/txrx.c b/drivers/staging/cw1200/txrx.c
new file mode 100644
index 00000000000..5c677556bd9
--- /dev/null
+++ b/drivers/staging/cw1200/txrx.c
@@ -0,0 +1,586 @@
+/*
+ * Datapath implementation for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/mac80211.h>
+
+#include "cw1200.h"
+#include "wsm.h"
+#include "bh.h"
+
+#ifdef CW1200_TX_POLICY_DEBUG
+#define tx_policy_printk(...) printk(__VA_ARGS__)
+#else
+#define tx_policy_printk(...)
+#endif
+
+/* ******************************************************************** */
+/* TX queue lock / unlock						*/
+
+static inline void cw1200_tx_queues_lock(struct cw1200_common *priv)
+{
+	int i;
+	for (i = 0; i < 4; ++i)
+		cw1200_queue_lock(&priv->tx_queue[i], priv);
+}
+
+static inline void cw1200_tx_queues_unlock(struct cw1200_common *priv)
+{
+	int i;
+	for (i = 0; i < 4; ++i)
+		cw1200_queue_unlock(&priv->tx_queue[i], priv);
+}
+
+/* ******************************************************************** */
+/* TX policy cache implementation					*/
+
+static void tx_policy_dump(struct tx_policy *policy)
+{
+	tx_policy_printk(KERN_DEBUG "[TX policy] "
+		"%.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X"
+		"%.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X"
+		"%.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X: %d\n",
+		policy->raw[0] & 0x0F,  policy->raw[0] >> 4,
+		policy->raw[1] & 0x0F,  policy->raw[1] >> 4,
+		policy->raw[2] & 0x0F,  policy->raw[2] >> 4,
+		policy->raw[3] & 0x0F,  policy->raw[3] >> 4,
+		policy->raw[4] & 0x0F,  policy->raw[4] >> 4,
+		policy->raw[5] & 0x0F,  policy->raw[5] >> 4,
+		policy->raw[6] & 0x0F,  policy->raw[6] >> 4,
+		policy->raw[7] & 0x0F,  policy->raw[7] >> 4,
+		policy->raw[8] & 0x0F,  policy->raw[8] >> 4,
+		policy->raw[9] & 0x0F,  policy->raw[9] >> 4,
+		policy->raw[10] & 0x0F,  policy->raw[10] >> 4,
+		policy->raw[11] & 0x0F,  policy->raw[11] >> 4,
+		policy->defined);
+}
+
+static void tx_policy_build(const struct cw1200_common *priv,
+	/* [out] */ struct tx_policy *policy,
+	struct ieee80211_tx_rate *rates, size_t count)
+{
+	int i;
+	const struct ieee80211_rate *rates_tbl = priv->rates;
+	unsigned limit = priv->short_frame_max_tx_count;
+	unsigned total = 0;
+	BUG_ON(rates[0].idx < 0);
+	memset(policy, 0, sizeof(*policy));
+
+	/* minstrel is buggy a little bit, so distille
+	 * incoming rates first. */
+	for (i = 0; i < count; ++i) {
+		if (rates[i].idx < 0)
+			break;
+		/* minstrel is buggy a little bit. */
+		if (i && (rates[i].idx == rates[i - 1].idx)) {
+			rates[i - 1].count += rates[i].count;
+			break;
+		}
+		total += rates[i].count;
+		if (i && (rates[i].idx > rates[i - 1].idx)) {
+			struct ieee80211_tx_rate tmp = rates[i - 1];
+			rates[i - 1] = rates[i];
+			rates[i] = tmp;
+		}
+	}
+	count = i;
+	if (limit < count)
+		limit = count;
+
+	if (total > limit) {
+		for (i = count - 1; i >= 0; --i) {
+			if (rates[i].count > limit - i)
+				rates[i].count = limit - i;
+			limit -= rates[i].count;
+		}
+	}
+	policy->defined = rates_tbl[rates[0].idx].hw_value + 1;
+
+	for (i = 0; i < count; ++i) {
+		register unsigned rateid, off, shift, retries;
+
+		rateid = rates_tbl[rates[i].idx].hw_value;
+		off = rateid >> 3;		/* eq. rateid / 8 */
+		shift = (rateid & 0x07) << 2;	/* eq. (rateid % 8) * 4 */
+
+		retries = rates[i].count;
+		if (unlikely(retries > 0x0F))
+			rates[i].count = retries = 0x0F;
+		policy->tbl[off] |= __cpu_to_le32(retries << shift);
+		policy->retry_count += retries;
+	}
+
+	tx_policy_printk(KERN_DEBUG "[TX policy] Policy (%d): " \
+		"%d:%d, %d:%d, %d:%d, %d:%d, %d:%d\n",
+		count,
+		rates[0].idx, rates[0].count,
+		rates[1].idx, rates[1].count,
+		rates[2].idx, rates[2].count,
+		rates[3].idx, rates[3].count,
+		rates[4].idx, rates[4].count);
+}
+
+static inline bool tx_policy_is_equal(const struct tx_policy *wanted,
+					const struct tx_policy *cached)
+{
+	size_t count = wanted->defined >> 1;
+	if (wanted->defined > cached->defined)
+		return false;
+	if (count) {
+		if (memcmp(wanted->raw, cached->raw, count))
+			return false;
+	}
+	if (wanted->defined & 1) {
+		if ((wanted->raw[count] & 0x0F) != (cached->raw[count] & 0x0F))
+			return false;
+	}
+	return true;
+}
+
+static int tx_policy_find(struct tx_policy_cache *cache,
+				const struct tx_policy *wanted)
+{
+	/* O(n) complexity. Not so good, but there's only 8 entries in
+	 * the cache.
+	 * Also lru helps to reduce search time. */
+	struct tx_policy_cache_entry *it;
+	/* First search for policy in "used" list */
+	list_for_each_entry(it, &cache->used, link) {
+		if (tx_policy_is_equal(wanted, &it->policy))
+			return it - cache->cache;
+	}
+	/* Then - in "free list" */
+	list_for_each_entry(it, &cache->free, link) {
+		if (tx_policy_is_equal(wanted, &it->policy))
+			return it - cache->cache;
+	}
+	return -1;
+}
+
+static inline void tx_policy_use(struct tx_policy_cache *cache,
+				 struct tx_policy_cache_entry *entry)
+{
+	++entry->policy.usage_count;
+	list_move(&entry->link, &cache->used);
+}
+
+static inline int tx_policy_release(struct tx_policy_cache *cache,
+				    struct tx_policy_cache_entry *entry)
+{
+	int ret = --entry->policy.usage_count;
+	if (!ret)
+		list_move(&entry->link, &cache->free);
+	return ret;
+}
+
+/* ******************************************************************** */
+/* External TX policy cache API						*/
+
+void tx_policy_init(struct cw1200_common *priv)
+{
+	struct tx_policy_cache *cache = &priv->tx_policy_cache;
+	int i;
+
+	memset(cache, 0, sizeof(*cache));
+
+	spin_lock_init(&cache->lock);
+	INIT_LIST_HEAD(&cache->used);
+	INIT_LIST_HEAD(&cache->free);
+
+	for (i = 0; i < TX_POLICY_CACHE_SIZE; ++i)
+		list_add(&cache->cache[i].link, &cache->free);
+}
+
+static int tx_policy_get(struct cw1200_common *priv,
+		  struct ieee80211_tx_rate *rates,
+		  size_t count, bool *renew)
+{
+	int idx;
+	struct tx_policy_cache *cache = &priv->tx_policy_cache;
+	struct tx_policy wanted;
+	unsigned long flags;
+
+	tx_policy_build(priv, &wanted, rates, count);
+
+	spin_lock_irqsave(&cache->lock, flags);
+	BUG_ON(list_empty(&cache->free));
+	idx = tx_policy_find(cache, &wanted);
+	if (idx >= 0) {
+		tx_policy_printk(KERN_DEBUG "[TX policy] Used TX policy: %d\n",
+					idx);
+		*renew = false;
+	} else {
+		struct tx_policy_cache_entry *entry;
+		*renew = true;
+		/* If policy is not found create a new one
+		 * using the oldest entry in "free" list */
+		entry = list_entry(cache->free.prev,
+			struct tx_policy_cache_entry, link);
+		entry->policy = wanted;
+		idx = entry - cache->cache;
+		tx_policy_printk(KERN_DEBUG "[TX policy] New TX policy: %d\n",
+					idx);
+		tx_policy_dump(&entry->policy);
+	}
+	tx_policy_use(cache, &cache->cache[idx]);
+	if (unlikely(list_empty(&cache->free))) {
+		/* Lock TX queues. */
+		cw1200_tx_queues_lock(priv);
+	}
+	spin_unlock_irqrestore(&cache->lock, flags);
+	return idx;
+}
+
+void tx_policy_put(struct cw1200_common *priv, int idx)
+{
+	int usage, locked;
+	struct tx_policy_cache *cache = &priv->tx_policy_cache;
+	unsigned long flags;
+
+	spin_lock_irqsave(&cache->lock, flags);
+	locked = list_empty(&cache->free);
+	usage = tx_policy_release(cache, &cache->cache[idx]);
+	if (unlikely(locked) && !usage) {
+		/* Unlock TX queues. */
+		cw1200_tx_queues_unlock(priv);
+	}
+	spin_unlock_irqrestore(&cache->lock, flags);
+}
+
+/*
+bool tx_policy_cache_full(struct cw1200_common *priv)
+{
+	bool ret;
+	unsigned long flags;
+	struct tx_policy_cache *cache = &priv->tx_policy_cache;
+	spin_lock_irqsave(&cache->lock, flags);
+	ret = list_empty(&cache->free);
+	spin_unlock_irqrestore(&cache->lock, flags);
+	return ret;
+}
+*/
+
+static int tx_policy_upload(struct cw1200_common *priv)
+{
+	struct tx_policy_cache *cache = &priv->tx_policy_cache;
+	unsigned long flags;
+	int i;
+	struct wsm_set_tx_rate_retry_policy arg = {
+		.hdr = {
+			.numTxRatePolicies = 0,
+		}
+	};
+	spin_lock_irqsave(&cache->lock, flags);
+
+	/* Upload only modified entries. */
+	for (i = 0; i < TX_POLICY_CACHE_SIZE; ++i) {
+		struct tx_policy *src = &cache->cache[i].policy;
+		if (src->retry_count && !src->uploaded) {
+			struct wsm_set_tx_rate_retry_policy_policy *dst =
+				&arg.tbl[arg.hdr.numTxRatePolicies];
+			dst->policyIndex = i;
+			dst->shortRetryCount = priv->short_frame_max_tx_count;
+			dst->longRetryCount = priv->long_frame_max_tx_count;
+
+			/* BIT(2) - Terminate retries when Tx rate retry policy
+			 *          finishes.
+			 * BIT(3) - Count initial frame transmission as part of
+			 *          rate retry counting but not as a retry
+			 *          attempt */
+			dst->policyFlags = BIT(2) | BIT(3);
+
+			memcpy(dst->rateCountIndices, src->tbl,
+					sizeof(dst->rateCountIndices));
+			src->uploaded = 1;
+			++arg.hdr.numTxRatePolicies;
+		}
+	}
+	spin_unlock_irqrestore(&cache->lock, flags);
+	tx_policy_printk(KERN_DEBUG "[TX policy] Upload %d policies\n",
+				arg.hdr.numTxRatePolicies);
+	return wsm_set_tx_rate_retry_policy(priv, &arg);
+}
+
+void tx_policy_upload_work(struct work_struct *work)
+{
+	struct cw1200_common *priv =
+		container_of(work, struct cw1200_common, tx_policy_upload_work);
+
+	tx_policy_printk(KERN_DEBUG "[TX] TX policy upload.\n");
+	WARN_ON(tx_policy_upload(priv));
+
+	wsm_unlock_tx(priv);
+	cw1200_tx_queues_unlock(priv);
+}
+
+/* ******************************************************************** */
+/* cw1200 TX implementation						*/
+
+u32 cw1200_rate_mask_to_wsm(struct cw1200_common *priv, u32 rates)
+{
+	u32 ret = 0;
+	int i;
+	for (i = 0; i < 32; ++i) {
+		if (rates & (1 << i))
+			ret |= 1 << priv->rates[i].hw_value;
+	}
+	return ret;
+}
+
+/* NOTE: cw1200_skb_to_wsm executes in atomic context. */
+int cw1200_skb_to_wsm(struct cw1200_common *priv, struct sk_buff *skb,
+			struct wsm_tx *wsm)
+{
+	bool tx_policy_renew = false;
+	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_rate *rate = ieee80211_get_tx_rate(priv->hw, tx_info);
+
+	memset(wsm, 0, sizeof(*wsm));
+	wsm->hdr.len = __cpu_to_le16(skb->len);
+	wsm->hdr.id = __cpu_to_le16(0x0004);
+	if (rate) {
+		wsm->maxTxRate = rate->hw_value;
+		if (rate->flags & IEEE80211_TX_RC_MCS) {
+			if (cw1200_ht_greenfield(&priv->ht_info))
+				wsm->htTxParameters |=
+					__cpu_to_le32(WSM_HT_TX_GREENFIELD);
+			else
+				wsm->htTxParameters |=
+					__cpu_to_le32(WSM_HT_TX_MIXED);
+		}
+	}
+	wsm->flags = tx_policy_get(priv,
+		tx_info->control.rates, IEEE80211_TX_MAX_RATES,
+		&tx_policy_renew) << 4;
+
+	if (tx_policy_renew) {
+		tx_policy_printk(KERN_DEBUG "[TX] TX policy renew.\n");
+		/* It's not so optimal to stop TX queues every now and then.
+		 * Maybe it's better to reimplement task scheduling with
+		 * a counter. */
+		/* cw1200_tx_queues_lock(priv); */
+		/* Definetly better. TODO. */
+		wsm_lock_tx_async(priv);
+		cw1200_tx_queues_lock(priv);
+		queue_work(priv->workqueue, &priv->tx_policy_upload_work);
+	}
+
+	wsm->queueId = wsm_queue_id_to_wsm(skb_get_queue_mapping(skb));
+	return 0;
+}
+
+/* ******************************************************************** */
+
+int cw1200_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+{
+	struct cw1200_common *priv = dev->priv;
+	unsigned queue = skb_get_queue_mapping(skb);
+	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_hdr *hdr =
+		(struct ieee80211_hdr *)skb->data;
+	struct cw1200_sta_priv *sta_priv =
+		(struct cw1200_sta_priv *)&tx_info->control.sta->drv_priv;
+	int link_id = 0;
+	int ret;
+
+	if (tx_info->flags | IEEE80211_TX_CTL_SEND_AFTER_DTIM)
+		link_id = CW1200_LINK_ID_AFTER_DTIM;
+	else if (tx_info->control.sta)
+		link_id = sta_priv->link_id;
+
+	txrx_printk(KERN_DEBUG "[TX] TX %d bytes (queue: %d, link_id: %d).\n",
+			skb->len, queue, link_id);
+
+	if (WARN_ON(queue >= 4))
+		goto err;
+
+#if 0
+	{
+		/* HACK!!!
+		* Workarounnd against a bug in WSM_A21.05.0288 firmware.
+		* In AP mode FW calculates FCS incorrectly when DA
+		* is FF:FF:FF:FF:FF:FF. Just for verification,
+		* do not enable this code in the real live. */
+		static const u8 mac_ff[] =
+			{0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+		static const u8 mac_mc[] =
+			{0x01, 0x00, 0x5e, 0x00, 0x00, 0x16};
+		if (!memcmp(&skb->data[4], mac_ff, sizeof(mac_ff)))
+			memcpy(&skb->data[4], mac_mc, sizeof(mac_mc));
+	}
+#endif
+
+
+	/* IV/ICV injection. */
+	/* TODO: Quite unoptimal. It's better co modify mac80211
+	 * to reserve space for IV */
+	if (tx_info->control.hw_key &&
+	    (hdr->frame_control &
+	     __cpu_to_le32(IEEE80211_FCTL_PROTECTED))) {
+		size_t hdrlen = ieee80211_hdrlen(hdr->frame_control);
+		size_t iv_len = tx_info->control.hw_key->iv_len;
+		size_t icv_len = tx_info->control.hw_key->icv_len;
+		u8 *icv;
+		u8 *newhdr;
+
+		if (tx_info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+			icv_len += 8; /* MIC */
+		}
+
+		if (WARN_ON(skb_headroom(skb) < iv_len + WSM_TX_EXTRA_HEADROOM
+				|| skb_tailroom(skb) < icv_len)) {
+			printk(KERN_ERR "Bug: no space allocated "
+				"for crypto headers.\n"
+				"headroom: %d, tailroom: %d, "
+				"req_headroom: %d, req_tailroom: %d\n"
+				"Please fix it in cw1200_get_skb().\n",
+				skb_headroom(skb), skb_tailroom(skb),
+				iv_len + WSM_TX_EXTRA_HEADROOM, icv_len);
+			goto err;
+		}
+
+		newhdr = skb_push(skb, iv_len);
+		memmove(newhdr, newhdr + iv_len, hdrlen);
+		memset(&newhdr[hdrlen], 0, iv_len);
+		icv = skb_put(skb, icv_len);
+		memset(icv, 0, icv_len);
+	}
+
+	ret = cw1200_queue_put(&priv->tx_queue[queue], priv, skb,
+			link_id);
+	if (!WARN_ON(ret))
+		cw1200_bh_wakeup(priv);
+	else
+		goto err;
+
+	return NETDEV_TX_OK;
+
+err:
+	/* TODO: Update TX failure counters */
+	dev_kfree_skb_any(skb);
+	return NETDEV_TX_OK;
+}
+
+/* ******************************************************************** */
+
+void cw1200_tx_confirm_cb(struct cw1200_common *priv,
+				struct wsm_tx_confirm *arg)
+{
+	u8 queue_id = cw1200_queue_get_queue_id(arg->packetID);
+	struct cw1200_queue *queue = &priv->tx_queue[queue_id];
+	struct sk_buff *skb;
+
+	txrx_printk(KERN_DEBUG "[TX] TX confirm.\n");
+
+	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED)) {
+		/* STA is stopped. */
+		return;
+	}
+
+	if (WARN_ON(queue_id >= 4))
+		return;
+
+	if ((arg->status == WSM_REQUEUE) &&
+	    (arg->flags & WSM_TX_STATUS_REQUEUE)) {
+		WARN_ON(cw1200_queue_requeue(queue, arg->packetID));
+	} else if (!WARN_ON(cw1200_queue_get_skb(queue, arg->packetID, &skb))) {
+		struct ieee80211_tx_info *tx = IEEE80211_SKB_CB(skb);
+		struct wsm_tx *wsm_tx = (struct wsm_tx *)skb->data;
+		int rate_id = (wsm_tx->flags >> 4) & 0x07;
+		int tx_count = arg->ackFailures;
+		u8 ht_flags = 0;
+		int i;
+
+		if (cw1200_ht_greenfield(&priv->ht_info))
+			ht_flags |= IEEE80211_TX_RC_GREEN_FIELD;
+
+		/* Release used TX rate policy */
+		tx_policy_put(priv, rate_id);
+
+		if (likely(!arg->status)) {
+			tx->flags |= IEEE80211_TX_STAT_ACK;
+#ifdef CW1200_FIRMWARE_DOES_NOT_SUPPORT_KEEPALIVE
+			priv->last_activity_time = jiffies;
+#endif
+			priv->cqm_tx_failure_count = 0;
+			++tx_count;
+		} else {
+			/* TODO: Update TX failure counters */
+			if (unlikely(priv->cqm_tx_failure_thold &&
+			     (++priv->cqm_tx_failure_count >
+			      priv->cqm_tx_failure_thold))) {
+				priv->cqm_tx_failure_thold = 0;
+				queue_work(priv->workqueue,
+						&priv->tx_failure_work);
+			}
+		}
+
+		for (i = 0; i < IEEE80211_TX_MAX_RATES; ++i) {
+			if (tx->status.rates[i].count >= tx_count) {
+				tx->status.rates[i].count = tx_count;
+				break;
+			}
+			tx_count -= tx->status.rates[i].count;
+			if (tx->status.rates[i].flags & IEEE80211_TX_RC_MCS)
+				tx->status.rates[i].flags |= ht_flags;
+		}
+
+		for (++i; i < IEEE80211_TX_MAX_RATES; ++i) {
+			tx->status.rates[i].count = 0;
+			tx->status.rates[i].idx = -1;
+		}
+
+		skb_pull(skb, sizeof(struct wsm_tx));
+		ieee80211_tx_status(priv->hw, skb);
+
+		WARN_ON(cw1200_queue_remove(queue, priv, arg->packetID));
+	}
+}
+
+/* ******************************************************************** */
+/* Security								*/
+
+int cw1200_alloc_key(struct cw1200_common *priv)
+{
+	int idx;
+
+	idx = ffs(~priv->key_map) - 1;
+	if (idx < 0 || idx > WSM_KEY_MAX_INDEX)
+		return -1;
+
+	priv->key_map |= 1 << idx;
+	priv->keys[idx].entryIndex = idx;
+	return idx;
+}
+
+void cw1200_free_key(struct cw1200_common *priv, int idx)
+{
+	BUG_ON(!(priv->key_map & (1 << idx)));
+	memset(&priv->keys[idx], 0, sizeof(priv->keys[idx]));
+	priv->key_map &= ~(1 << idx);
+}
+
+void cw1200_free_keys(struct cw1200_common *priv)
+{
+	memset(&priv->keys, 0, sizeof(priv->keys));
+	priv->key_map = 0;
+}
+
+int cw1200_upload_keys(struct cw1200_common *priv)
+{
+	int idx, ret = 0;
+	for (idx = 0; idx <= WSM_KEY_MAX_INDEX; ++idx)
+		if (priv->key_map & (1 << idx)) {
+			ret = wsm_add_key(priv, &priv->keys[idx]);
+			if (ret < 0)
+				break;
+		}
+	return ret;
+}
diff --git a/drivers/staging/cw1200/txrx.h b/drivers/staging/cw1200/txrx.h
new file mode 100644
index 00000000000..2be3af99d03
--- /dev/null
+++ b/drivers/staging/cw1200/txrx.h
@@ -0,0 +1,84 @@
+/*
+ * Datapath interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_TXRX_H
+#define CW1200_TXRX_H
+
+#include <linux/list.h>
+
+/* extern */ struct ieee80211_hw;
+/* extern */ struct sk_buff;
+/* extern */ struct wsm_tx;
+/* extern */ struct wsm_tx_confirm;
+
+struct tx_policy {
+	union {
+		__le32 tbl[3];
+		u8 raw[12];
+	};
+	u8  defined;		/* TODO: u32 or u8, profile and select best */
+	u8  usage_count;	/* --// -- */
+	u8  retry_count;	/* --// -- */
+	u8  uploaded;
+};
+
+struct tx_policy_cache_entry {
+	struct tx_policy policy;
+	struct list_head link;
+};
+
+#define TX_POLICY_CACHE_SIZE	(8)
+struct tx_policy_cache {
+	struct tx_policy_cache_entry cache[TX_POLICY_CACHE_SIZE];
+	struct list_head used;
+	struct list_head free;
+	spinlock_t lock;
+};
+
+/* ******************************************************************** */
+/* TX policy cache							*/
+/* Intention of TX policy cache is an overcomplicated WSM API.
+ * Device does not accept per-PDU tx retry sequence.
+ * It uses "tx retry policy id" instead, so driver code has to sync
+ * linux tx retry sequences with a retry policy table in the device.
+ */
+void tx_policy_init(struct cw1200_common *priv);
+void tx_policy_upload_work(struct work_struct *work);
+void tx_policy_put(struct cw1200_common *priv, int idx);
+
+/* ******************************************************************** */
+/* TX implementation							*/
+
+u32 cw1200_rate_mask_to_wsm(struct cw1200_common *priv,
+			       u32 rates);
+int cw1200_skb_to_wsm(struct cw1200_common *priv,
+		      struct sk_buff *skb, struct wsm_tx *wsm);
+int cw1200_tx(struct ieee80211_hw *dev, struct sk_buff *skb);
+
+/* ******************************************************************** */
+/* WSM callbacks							*/
+
+void cw1200_tx_confirm_cb(struct cw1200_common *priv,
+			  struct wsm_tx_confirm *arg);
+
+/* ******************************************************************** */
+/* Timeout								*/
+
+void cw1200_tx_timeout(struct work_struct *work);
+
+/* ******************************************************************** */
+/* Security								*/
+int cw1200_alloc_key(struct cw1200_common *priv);
+void cw1200_free_key(struct cw1200_common *priv, int idx);
+void cw1200_free_keys(struct cw1200_common *priv);
+int cw1200_upload_keys(struct cw1200_common *priv);
+
+#endif /* CW1200_TXRX_H */
diff --git a/drivers/staging/cw1200/wsm.c b/drivers/staging/cw1200/wsm.c
new file mode 100644
index 00000000000..37723cc88a1
--- /dev/null
+++ b/drivers/staging/cw1200/wsm.c
@@ -0,0 +1,1530 @@
+/*
+ * WSM host interface (HI) implementation for
+ * ST-Ericsson CW1200 mac80211 drivers.
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/skbuff.h>
+#include <linux/wait.h>
+#include <linux/skbuff.h>
+#include <linux/delay.h>
+#include <linux/sched.h>
+
+#include "cw1200.h"
+#include "wsm.h"
+#include "bh.h"
+
+#ifdef CW1200_DEBUG_ENABLE_WSM_LOGS
+#define wsm_printk(...) printk(__VA_ARGS__)
+#else
+#define wsm_printk(...)
+#endif
+
+#define WSM_CMD_TIMEOUT		(1 * HZ)
+#define WSM_CMD_JOIN_TIMEOUT	(7 * HZ) /* Join timeout is 5 sec. in FW */
+#define WSM_CMD_START_TIMEOUT	(7 * HZ)
+#define WSM_TX_TIMEOUT		(1 * HZ)
+#define WSM_CMD_LAST_CHANCE_TIMEOUT (10 * HZ)
+
+#define WSM_SKIP(buf, size)						\
+	do {								\
+		if (unlikely(buf->data + size > buf->end))		\
+			goto underflow;					\
+		buf->data += size;					\
+	} while (0)
+
+#define WSM_GET(buf, ptr, size)						\
+	do {								\
+		if (unlikely(buf->data + size > buf->end))		\
+			goto underflow;					\
+		memcpy(ptr, buf->data, size);				\
+		buf->data += size;					\
+	} while (0)
+
+#define __WSM_GET(buf, type, cvt)					\
+	({								\
+		type val;						\
+		if (unlikely(buf->data + sizeof(type) > buf->end))	\
+			goto underflow;					\
+		val = cvt(*(type *)buf->data);				\
+		buf->data += sizeof(type);				\
+		val;							\
+	})
+
+#define WSM_GET8(buf)  __WSM_GET(buf, u8, (u8))
+#define WSM_GET16(buf) __WSM_GET(buf, u16, __le16_to_cpu)
+#define WSM_GET32(buf) __WSM_GET(buf, u32, __le32_to_cpu)
+
+#define WSM_PUT(buf, ptr, size)						\
+	do {								\
+		if (unlikely(buf->data + size > buf->end))		\
+			if (unlikely(wsm_buf_reserve(buf, size)))	\
+				goto nomem;				\
+		memcpy(buf->data, ptr, size);				\
+		buf->data += size;					\
+	} while (0)
+
+#define __WSM_PUT(buf, val, type, cvt)					  \
+	do {								  \
+		if (unlikely(buf->data + sizeof(type) > buf->end))	  \
+			if (unlikely(wsm_buf_reserve(buf, sizeof(type)))) \
+				goto nomem;				  \
+		*(type *)buf->data = cvt(val);				  \
+		buf->data += sizeof(type);				  \
+	} while (0)
+
+#define WSM_PUT8(buf, val)  __WSM_PUT(buf, val, u8, (u8))
+#define WSM_PUT16(buf, val) __WSM_PUT(buf, val, u16, __cpu_to_le16)
+#define WSM_PUT32(buf, val) __WSM_PUT(buf, val, u32, __cpu_to_le32)
+
+static void wsm_buf_reset(struct wsm_buf *buf);
+static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size);
+
+static int wsm_cmd_send(struct cw1200_common *priv,
+			struct wsm_buf *buf,
+			void *arg, u16 cmd, long tmo);
+
+static inline void wsm_cmd_lock(struct cw1200_common *priv)
+{
+	mutex_lock(&priv->wsm_cmd_mux);
+}
+
+static inline void wsm_cmd_unlock(struct cw1200_common *priv)
+{
+	mutex_unlock(&priv->wsm_cmd_mux);
+}
+
+/* ******************************************************************** */
+/* WSM API implementation						*/
+
+static int wsm_generic_confirm(struct cw1200_common *priv,
+			     void *arg,
+			     struct wsm_buf *buf)
+{
+	u32 status = WSM_GET32(buf);
+	if (status != WSM_STATUS_SUCCESS)
+		return -EINVAL;
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+int wsm_configuration(struct cw1200_common *priv, struct wsm_configuration *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT32(buf, arg->dot11MaxTransmitMsduLifeTime);
+	WSM_PUT32(buf, arg->dot11MaxReceiveLifeTime);
+	WSM_PUT32(buf, arg->dot11RtsThreshold);
+
+	/* DPD block. */
+	WSM_PUT16(buf, arg->dpdData_size + 12);
+	WSM_PUT16(buf, 1); /* DPD version */
+	WSM_PUT(buf, arg->dot11StationId, ETH_ALEN);
+	WSM_PUT16(buf, 5); /* DPD flags */
+	WSM_PUT(buf, arg->dpdData, arg->dpdData_size);
+
+	ret = wsm_cmd_send(priv, buf, arg, 0x0009, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+static int wsm_configuration_confirm(struct cw1200_common *priv,
+				     struct wsm_configuration *arg,
+				     struct wsm_buf *buf)
+{
+	int i;
+	int status;
+
+	status = WSM_GET32(buf);
+	if (WARN_ON(status != WSM_STATUS_SUCCESS))
+		return -EINVAL;
+
+	WSM_GET(buf, arg->dot11StationId, ETH_ALEN);
+	arg->dot11FrequencyBandsSupported = WSM_GET8(buf);
+	WSM_SKIP(buf, 1);
+	arg->supportedRateMask = WSM_GET32(buf);
+	for (i = 0; i < 2; ++i) {
+		arg->txPowerRange[i].min_power_level = WSM_GET32(buf);
+		arg->txPowerRange[i].max_power_level = WSM_GET32(buf);
+		arg->txPowerRange[i].stepping = WSM_GET32(buf);
+	}
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+int wsm_reset(struct cw1200_common *priv, const struct wsm_reset *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	u16 cmd = 0x000A | ((arg->link_id & 0x0F) << 6);
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT32(buf, arg->reset_statistics ? 0 : 1);
+	ret = wsm_cmd_send(priv, buf, NULL, cmd, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+struct wsm_mib {
+	u16 mibId;
+	void *buf;
+	size_t buf_size;
+};
+
+int wsm_read_mib(struct cw1200_common *priv, u16 mibId, void *_buf,
+			size_t buf_size)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	struct wsm_mib mib_buf = {
+		.mibId = mibId,
+		.buf = _buf,
+		.buf_size = buf_size,
+	};
+	wsm_cmd_lock(priv);
+
+	WSM_PUT16(buf, mibId);
+	WSM_PUT16(buf, 0);
+
+	ret = wsm_cmd_send(priv, buf, &mib_buf, 0x0005, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+static int wsm_read_mib_confirm(struct cw1200_common *priv,
+				struct wsm_mib *arg,
+				struct wsm_buf *buf)
+{
+	u16 size;
+	if (WARN_ON(WSM_GET32(buf) != WSM_STATUS_SUCCESS))
+		return -EINVAL;
+
+	if (WARN_ON(WSM_GET16(buf) != arg->mibId))
+		return -EINVAL;
+
+	size = WSM_GET16(buf);
+	if (size > arg->buf_size)
+		size = arg->buf_size;
+
+	WSM_GET(buf, arg->buf, size);
+	arg->buf_size = size;
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+int wsm_write_mib(struct cw1200_common *priv, u16 mibId, void *_buf,
+			size_t buf_size)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	wsm_cmd_lock(priv);
+
+	WSM_PUT16(buf, mibId);
+	WSM_PUT16(buf, buf_size);
+	WSM_PUT(buf, _buf, buf_size);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0006, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_scan(struct cw1200_common *priv, const struct wsm_scan *arg)
+{
+	int i;
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	if (unlikely(arg->numOfChannels > 48))
+		return -EINVAL;
+
+	if (unlikely(arg->numOfSSIDs > 2))
+		return -EINVAL;
+
+	if (unlikely(arg->band > 1))
+		return -EINVAL;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, arg->band);
+	WSM_PUT8(buf, arg->scanType);
+	WSM_PUT8(buf, arg->scanFlags);
+	WSM_PUT8(buf, arg->maxTransmitRate);
+	WSM_PUT32(buf, arg->autoScanInterval);
+	WSM_PUT8(buf, arg->numOfProbeRequests);
+	WSM_PUT8(buf, arg->numOfChannels);
+	WSM_PUT8(buf, arg->numOfSSIDs);
+	WSM_PUT8(buf, arg->probeDelay);
+
+	for (i = 0; i < arg->numOfChannels; ++i) {
+		WSM_PUT16(buf, arg->ch[i].number);
+		WSM_PUT16(buf, 0);
+		WSM_PUT32(buf, arg->ch[i].minChannelTime);
+		WSM_PUT32(buf, arg->ch[i].maxChannelTime);
+		WSM_PUT32(buf, 0);
+	}
+
+	for (i = 0; i < arg->numOfSSIDs; ++i) {
+		WSM_PUT32(buf, arg->ssids[i].length);
+		WSM_PUT(buf, &arg->ssids[i].ssid[0],
+				sizeof(arg->ssids[i].ssid));
+	}
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0007, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_stop_scan(struct cw1200_common *priv)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	wsm_cmd_lock(priv);
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0008, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+}
+
+
+static int wsm_tx_confirm(struct cw1200_common *priv, struct wsm_buf *buf)
+{
+	if (priv->wsm_cbc.tx_confirm) {
+		struct wsm_tx_confirm tx_confirm;
+
+		tx_confirm.packetID = WSM_GET32(buf);
+		tx_confirm.status = WSM_GET32(buf);
+		tx_confirm.txedRate = WSM_GET8(buf);
+		tx_confirm.ackFailures = WSM_GET8(buf);
+		tx_confirm.flags = WSM_GET16(buf);
+		tx_confirm.mediaDelay = WSM_GET32(buf);
+		tx_confirm.txQueueDelay = WSM_GET32(buf);
+		priv->wsm_cbc.tx_confirm(priv, &tx_confirm);
+	}
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+static int wsm_join_confirm(struct cw1200_common *priv,
+			    struct wsm_join *arg,
+			    struct wsm_buf *buf)
+{
+	if (WARN_ON(WSM_GET32(buf) != WSM_STATUS_SUCCESS)) {
+		priv->join_status = CW1200_JOIN_STATUS_MONITOR;
+		wsm_unlock_tx(priv);
+		return -EINVAL;
+	}
+
+	arg->minPowerLevel = WSM_GET32(buf);
+	arg->maxPowerLevel = WSM_GET32(buf);
+
+	priv->join_status = CW1200_JOIN_STATUS_STA;
+	wsm_unlock_tx(priv);
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	priv->join_status = CW1200_JOIN_STATUS_MONITOR;
+	wsm_unlock_tx(priv);
+	return -EINVAL;
+}
+
+int wsm_join(struct cw1200_common *priv, struct wsm_join *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, arg->mode);
+	WSM_PUT8(buf, arg->band);
+	WSM_PUT16(buf, arg->channelNumber);
+	WSM_PUT(buf, &arg->bssid[0], sizeof(arg->bssid));
+	WSM_PUT16(buf, arg->atimWindow);
+	WSM_PUT8(buf, arg->preambleType);
+	WSM_PUT8(buf, arg->probeForJoin);
+	WSM_PUT8(buf, arg->dtimPeriod);
+	WSM_PUT8(buf, arg->flags);
+	WSM_PUT32(buf, arg->ssidLength);
+	WSM_PUT(buf, &arg->ssid[0], sizeof(arg->ssid));
+	WSM_PUT32(buf, arg->beaconInterval);
+	WSM_PUT32(buf, arg->basicRateSet);
+
+	ret = wsm_cmd_send(priv, buf, arg, 0x000B, WSM_CMD_JOIN_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_bss_params(struct cw1200_common *priv,
+			const struct wsm_set_bss_params *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, 0);
+	WSM_PUT8(buf, arg->beaconLostCount);
+	WSM_PUT16(buf, arg->aid);
+	WSM_PUT32(buf, arg->operationalRateSet);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0011, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_add_key(struct cw1200_common *priv, const struct wsm_add_key *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT(buf, arg, sizeof(*arg));
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x000C, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_remove_key(struct cw1200_common *priv, const struct wsm_remove_key *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, arg->entryIndex);
+	WSM_PUT8(buf, 0);
+	WSM_PUT16(buf, 0);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x000D, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_tx_queue_params(struct cw1200_common *priv,
+				const struct wsm_set_tx_queue_params *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	/* TODO: verify me. */
+	WSM_PUT8(buf, arg->queueId);
+	WSM_PUT8(buf, 0);
+	WSM_PUT8(buf, arg->ackPolicy);
+	WSM_PUT8(buf, 0);
+	WSM_PUT32(buf, arg->maxTransmitLifetime);
+	WSM_PUT16(buf, arg->allowedMediumTime);
+	WSM_PUT16(buf, 0);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0012, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_edca_params(struct cw1200_common *priv,
+				const struct wsm_edca_params *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	/* TODO: verify me. */
+	/* Implemented according to specification. Note that there is a
+	 * mismatch in BK and BE mapping. */
+
+	WSM_PUT16(buf, arg->params[1].cwMin);
+	WSM_PUT16(buf, arg->params[0].cwMin);
+	WSM_PUT16(buf, arg->params[2].cwMin);
+	WSM_PUT16(buf, arg->params[3].cwMin);
+
+	WSM_PUT16(buf, arg->params[1].cwMax);
+	WSM_PUT16(buf, arg->params[0].cwMax);
+	WSM_PUT16(buf, arg->params[2].cwMax);
+	WSM_PUT16(buf, arg->params[3].cwMax);
+
+	WSM_PUT8(buf, arg->params[1].aifns);
+	WSM_PUT8(buf, arg->params[0].aifns);
+	WSM_PUT8(buf, arg->params[2].aifns);
+	WSM_PUT8(buf, arg->params[3].aifns);
+
+	WSM_PUT16(buf, arg->params[1].txOpLimit);
+	WSM_PUT16(buf, arg->params[0].txOpLimit);
+	WSM_PUT16(buf, arg->params[2].txOpLimit);
+	WSM_PUT16(buf, arg->params[3].txOpLimit);
+
+	WSM_PUT32(buf, arg->params[1].maxReceiveLifetime);
+	WSM_PUT32(buf, arg->params[0].maxReceiveLifetime);
+	WSM_PUT32(buf, arg->params[2].maxReceiveLifetime);
+	WSM_PUT32(buf, arg->params[3].maxReceiveLifetime);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0013, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_switch_channel(struct cw1200_common *priv,
+			const struct wsm_switch_channel *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_lock_tx(priv);
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, arg->channelMode);
+	WSM_PUT8(buf, arg->channelSwitchCount);
+	WSM_PUT16(buf, arg->newChannelNumber);
+
+	priv->channel_switch_in_progress = 1;
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0016, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	if (ret) {
+		wsm_unlock_tx(priv);
+		priv->channel_switch_in_progress = 0;
+	}
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	wsm_unlock_tx(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT32(buf, arg->pmMode);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0010, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_start(struct cw1200_common *priv, const struct wsm_start *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT8(buf, arg->mode);
+	WSM_PUT8(buf, arg->band);
+	WSM_PUT16(buf, arg->channelNumber);
+	WSM_PUT32(buf, arg->CTWindow);
+	WSM_PUT32(buf, arg->beaconInterval);
+	WSM_PUT8(buf, arg->DTIMPeriod);
+	WSM_PUT8(buf, arg->preambleType);
+	WSM_PUT8(buf, arg->probeDelay);
+	WSM_PUT8(buf, arg->ssidLength);
+	WSM_PUT(buf, arg->ssid, sizeof(arg->ssid));
+	WSM_PUT32(buf, arg->basicRateSet);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0017, WSM_CMD_START_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_beacon_transmit(struct cw1200_common *priv,
+			const struct wsm_beacon_transmit *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT32(buf, arg->enableBeaconing ? 1 : 0);
+
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0018, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_start_find(struct cw1200_common *priv)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+	ret = wsm_cmd_send(priv, buf, NULL, 0x0019, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+}
+
+/* ******************************************************************** */
+
+int wsm_stop_find(struct cw1200_common *priv)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+	wsm_cmd_lock(priv);
+	ret = wsm_cmd_send(priv, buf, NULL, 0x001A, WSM_CMD_TIMEOUT);
+	wsm_cmd_unlock(priv);
+	return ret;
+}
+
+/* ******************************************************************** */
+
+int wsm_map_link(struct cw1200_common *priv, const struct wsm_map_link *arg)
+{
+	int ret;
+	struct wsm_buf *buf = &priv->wsm_cmd_buf;
+	u16 cmd = 0x001C | ((arg->link_id & 0x0F) << 6);
+
+	wsm_cmd_lock(priv);
+
+	WSM_PUT(buf, &arg->mac_addr[0], sizeof(arg->mac_addr));
+	WSM_PUT16(buf, 0);
+
+	ret = wsm_cmd_send(priv, buf, NULL, cmd, WSM_CMD_TIMEOUT);
+
+	wsm_cmd_unlock(priv);
+	return ret;
+
+nomem:
+	wsm_cmd_unlock(priv);
+	return -ENOMEM;
+}
+
+
+/* ******************************************************************** */
+/* WSM indication events implementation					*/
+
+static int wsm_startup_indication(struct cw1200_common *priv,
+					struct wsm_buf *buf)
+{
+	u16 status;
+	char fw_label[129];
+	static const char * const fw_types[] = {
+		"ETF",
+		"WFM",
+		"WSM",
+		"HI test",
+		"Platform test"
+	};
+
+	priv->wsm_caps.numInpChBufs	= WSM_GET16(buf);
+	priv->wsm_caps.sizeInpChBuf	= WSM_GET16(buf);
+	priv->wsm_caps.hardwareId	= WSM_GET16(buf);
+	priv->wsm_caps.hardwareSubId	= WSM_GET16(buf);
+	status				= WSM_GET16(buf);
+	priv->wsm_caps.firmwareCap	= WSM_GET16(buf);
+	priv->wsm_caps.firmwareType	= WSM_GET16(buf);
+	priv->wsm_caps.firmwareApiVer	= WSM_GET16(buf);
+	priv->wsm_caps.firmwareBuildNumber = WSM_GET16(buf);
+	priv->wsm_caps.firmwareVersion	= WSM_GET16(buf);
+	WSM_GET(buf, &fw_label[0], sizeof(fw_label) - 1);
+	fw_label[sizeof(fw_label) - 1] = 0; /* Do not trust FW too much. */
+
+	if (WARN_ON(status))
+		return -EINVAL;
+
+	if (WARN_ON(priv->wsm_caps.firmwareType > 4))
+		return -EINVAL;
+
+	printk(KERN_INFO "CW1200 WSM init done.\n"
+		"   Input buffers: %d x %d bytes\n"
+		"   Hardware: %d.%d\n"
+		"   %s firmware [%s], ver: %d, build: %d,"
+		    " api: %d, cap: 0x%.4X\n",
+		priv->wsm_caps.numInpChBufs, priv->wsm_caps.sizeInpChBuf,
+		priv->wsm_caps.hardwareId, priv->wsm_caps.hardwareSubId,
+		fw_types[priv->wsm_caps.firmwareType],
+		&fw_label[0], priv->wsm_caps.firmwareVersion,
+		priv->wsm_caps.firmwareBuildNumber,
+		priv->wsm_caps.firmwareApiVer, priv->wsm_caps.firmwareCap);
+
+	priv->wsm_caps.firmwareReady = 1;
+
+	wake_up_interruptible(&priv->wsm_startup_done);
+	return 0;
+
+underflow:
+	WARN_ON(1);
+	return -EINVAL;
+}
+
+static int wsm_receive_indication(struct cw1200_common *priv,
+					struct wsm_buf *buf,
+					struct sk_buff **skb_p)
+{
+	priv->rx_timestamp = jiffies;
+	if (priv->wsm_cbc.rx) {
+		struct wsm_rx rx;
+		size_t hdr_len;
+		__le16 fctl;
+
+		rx.status = WSM_GET32(buf);
+		rx.channelNumber = WSM_GET16(buf);
+		rx.rxedRate = WSM_GET8(buf);
+		rx.rcpiRssi = WSM_GET8(buf);
+		rx.flags = WSM_GET32(buf);
+		fctl = *(__le16 *)buf->data;
+		hdr_len = buf->data - buf->begin;
+		skb_pull(*skb_p, hdr_len);
+		if (!rx.status && unlikely(ieee80211_is_deauth(fctl))) {
+			if (priv->join_status == CW1200_JOIN_STATUS_STA) {
+				/* Shedule unjoin work */
+				wsm_printk(KERN_DEBUG \
+					"[WSM] Issue unjoin command (RX).\n");
+				wsm_lock_tx_async(priv);
+				queue_work(priv->workqueue, &priv->unjoin_work);
+			}
+		}
+		priv->wsm_cbc.rx(priv, &rx, skb_p);
+		if (*skb_p)
+			skb_push(*skb_p, hdr_len);
+	}
+	return 0;
+
+underflow:
+	return -EINVAL;
+}
+
+static int wsm_event_indication(struct cw1200_common *priv, struct wsm_buf *buf)
+{
+	int first;
+	unsigned long flags;
+	struct cw1200_wsm_event *event;
+
+	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED)) {
+		/* STA is stopped. */
+		return 0;
+	}
+
+	event = kzalloc(sizeof(struct cw1200_wsm_event), GFP_KERNEL);
+
+	event->evt.eventId = __le32_to_cpu(WSM_GET32(buf));
+	event->evt.eventData = __le32_to_cpu(WSM_GET32(buf));
+
+	wsm_printk(KERN_DEBUG "[WSM] Event: %d(%d)\n",
+		event->evt.eventId, event->evt.eventData);
+
+	spin_lock_irqsave(&priv->event_queue_lock, flags);
+	first = list_empty(&priv->event_queue);
+	list_add_tail(&event->link, &priv->event_queue);
+	spin_unlock_irqrestore(&priv->event_queue_lock, flags);
+
+	if (first)
+		queue_work(priv->workqueue, &priv->event_handler);
+
+	return 0;
+
+underflow:
+	kfree(event);
+	return -EINVAL;
+}
+
+static int wsm_channel_switch_indication(struct cw1200_common *priv,
+						struct wsm_buf *buf)
+{
+	wsm_unlock_tx(priv); /* Re-enable datapath */
+	WARN_ON(WSM_GET32(buf));
+
+	priv->channel_switch_in_progress = 0;
+	wake_up_interruptible(&priv->channel_switch_done);
+
+	if (priv->wsm_cbc.channel_switch)
+		priv->wsm_cbc.channel_switch(priv);
+	return 0;
+
+underflow:
+	return -EINVAL;
+}
+
+static int wsm_set_pm_indication(struct cw1200_common *priv,
+					struct wsm_buf *buf)
+{
+	return 0;
+}
+
+static int wsm_scan_complete_indication(struct cw1200_common *priv,
+					struct wsm_buf *buf)
+{
+	if (priv->wsm_cbc.scan_complete) {
+		struct wsm_scan_complete arg;
+		arg.status = WSM_GET32(buf);
+		arg.psm = WSM_GET8(buf);
+		arg.numChannels = WSM_GET8(buf);
+		priv->wsm_cbc.scan_complete(priv, &arg);
+	}
+	return 0;
+
+underflow:
+	return -EINVAL;
+}
+
+static int wsm_find_complete_indication(struct cw1200_common *priv,
+					struct wsm_buf *buf)
+{
+	/* TODO: Implement me. */
+	STUB();
+	return 0;
+}
+
+static int wsm_suspend_resume_indication(struct cw1200_common *priv,
+					 int link_id, struct wsm_buf *buf)
+{
+	if (priv->wsm_cbc.suspend_resume) {
+		u32 flags;
+		struct wsm_suspend_resume arg;
+
+		flags = WSM_GET32(buf);
+		arg.link_id = link_id;
+		arg.stop = !(flags & 1);
+		arg.multicast = !!(flags & 8);
+		arg.queue = (flags >> 1) & 3;
+
+		priv->wsm_cbc.suspend_resume(priv, &arg);
+	}
+	return 0;
+
+underflow:
+	return -EINVAL;
+}
+
+
+/* ******************************************************************** */
+/* WSM TX								*/
+
+int wsm_cmd_send(struct cw1200_common *priv,
+		 struct wsm_buf *buf,
+		 void *arg, u16 cmd, long tmo)
+{
+	unsigned long flags;
+	size_t buf_len = buf->data - buf->begin;
+	int ret;
+
+	if (cmd == 0x0006) /* Write MIB */
+		wsm_printk(KERN_DEBUG "[WSM] >>> 0x%.4X [MIB: 0x%.4X] (%d)\n",
+			cmd, __le16_to_cpu(((__le16 *)buf->begin)[2]),
+			buf_len);
+	else
+		wsm_printk(KERN_DEBUG "[WSM] >>> 0x%.4X (%d)\n", cmd, buf_len);
+
+	/* Fill HI message header */
+	/* BH will add sequence number */
+	((__le16 *)buf->begin)[0] = __cpu_to_le16(buf_len);
+	((__le16 *)buf->begin)[1] = __cpu_to_le16(cmd);
+
+	spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+	BUG_ON(priv->wsm_cmd.ptr);
+	priv->wsm_cmd.done = 0;
+	priv->wsm_cmd.ptr = buf->begin;
+	priv->wsm_cmd.len = buf_len;
+	priv->wsm_cmd.arg = arg;
+	priv->wsm_cmd.cmd = cmd;
+	spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+
+	cw1200_bh_wakeup(priv);
+
+	if (unlikely(priv->bh_error)) {
+		/* Do not wait for timeout if BH is dead. Exit immediately. */
+		ret = 0;
+	} else {
+		long rx_timestamp;
+		/* Firmware prioritizes data traffic over control confirm.
+		 * Loop below checks if data was RXed and increases timeout
+		 * accordingly. */
+		do {
+			/* It's safe to use unprotected access to
+			 * wsm_cmd.done here */
+			ret = wait_event_interruptible_timeout(
+					priv->wsm_cmd_wq,
+					priv->wsm_cmd.done, tmo);
+			rx_timestamp = jiffies - priv->rx_timestamp;
+			if (unlikely(rx_timestamp < 0))
+				rx_timestamp = tmo + 1;
+		} while (!ret && rx_timestamp <= tmo);
+	}
+
+	if (unlikely(ret == 0)) {
+		u16 raceCheck;
+
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		raceCheck = priv->wsm_cmd.cmd;
+		priv->wsm_cmd.arg = NULL;
+		priv->wsm_cmd.ptr = NULL;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+
+		/* Race condition check to make sure _confirm is not called
+		 * after exit of _send */
+		if (raceCheck == 0xFFFF) {
+			/* If wsm_handle_rx got stuck in _confirm we will hang
+			 * system there. It's better than silently currupt
+			 * stack or heap, isn't it? */
+			BUG_ON(wait_event_interruptible_timeout(
+					priv->wsm_cmd_wq, priv->wsm_cmd.done,
+					WSM_CMD_LAST_CHANCE_TIMEOUT) <= 0);
+		}
+		ret = -ETIMEDOUT;
+	} else {
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		BUG_ON(!priv->wsm_cmd.done);
+		ret = priv->wsm_cmd.ret;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+	}
+	wsm_buf_reset(buf);
+	return ret;
+}
+
+/* ******************************************************************** */
+/* WSM TX port control							*/
+
+void wsm_lock_tx(struct cw1200_common *priv)
+{
+	wsm_cmd_lock(priv);
+	if (atomic_add_return(1, &priv->tx_lock) == 1) {
+		WARN_ON(wait_event_interruptible_timeout(priv->hw_bufs_used_wq,
+			!priv->hw_bufs_used, WSM_CMD_LAST_CHANCE_TIMEOUT) <= 0);
+		wsm_printk(KERN_DEBUG "[WSM] TX is locked.\n");
+	}
+	wsm_cmd_unlock(priv);
+}
+
+void wsm_lock_tx_async(struct cw1200_common *priv)
+{
+	if (atomic_add_return(1, &priv->tx_lock) == 1)
+		wsm_printk(KERN_DEBUG "[WSM] TX is locked.\n");
+}
+
+void wsm_flush_tx(struct cw1200_common *priv)
+{
+	BUG_ON(!atomic_read(&priv->tx_lock));
+	WARN_ON(wait_event_interruptible_timeout(priv->hw_bufs_used_wq,
+		!priv->hw_bufs_used, WSM_CMD_LAST_CHANCE_TIMEOUT) <= 0);
+}
+
+void wsm_unlock_tx(struct cw1200_common *priv)
+{
+	int tx_lock;
+	tx_lock = atomic_sub_return(1, &priv->tx_lock);
+	if (tx_lock < 0) {
+		BUG_ON(1);
+	} else if (tx_lock == 0) {
+		cw1200_bh_wakeup(priv);
+		wsm_printk(KERN_DEBUG "[WSM] TX is unlocked.\n");
+	}
+}
+
+/* ******************************************************************** */
+/* WSM RX								*/
+
+int wsm_handle_exception(struct cw1200_common *priv, u8 *data, size_t len)
+{
+	STUB();
+	return 0;
+}
+
+int wsm_handle_rx(struct cw1200_common *priv, int id,
+		  struct wsm_hdr *wsm, struct sk_buff **skb_p)
+{
+	int ret = 0;
+	unsigned long flags;
+	struct wsm_buf wsm_buf;
+	int link_id = (id >> 6) & 0x0F;
+
+	/* Strip link id. */
+	id &= ~(0x0F << 6);
+
+	wsm_buf.begin = (u8 *)&wsm[0];
+	wsm_buf.data = (u8 *)&wsm[1];
+	wsm_buf.end = &wsm_buf.begin[__le32_to_cpu(wsm->len)];
+
+	wsm_printk(KERN_DEBUG "[WSM] <<< 0x%.4X (%d)\n", id,
+			wsm_buf.end - wsm_buf.begin);
+
+	if (id == 0x404) {
+		ret = wsm_tx_confirm(priv, &wsm_buf);
+		cw1200_bh_wakeup(priv);
+	} else if (id & 0x0400) {
+		void *wsm_arg;
+		u16 wsm_cmd;
+
+		/* Do not trust FW too much. Protection against repeated
+		 * response and race condition removal (see above). */
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		wsm_arg = priv->wsm_cmd.arg;
+		wsm_cmd = priv->wsm_cmd.cmd & ~(0x0F << 6);
+		priv->wsm_cmd.cmd = 0xFFFF;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+
+		if (WARN_ON((id & ~0x0400) != wsm_cmd)) {
+			/* Note that any non-zero is a fatal retcode. */
+			ret = -EINVAL;
+			goto out;
+		}
+
+		switch (id) {
+		case 0x0409:
+			/* Note that wsm_arg can be NULL in case of timeout in
+			 * wsm_cmd_send(). */
+			if (likely(wsm_arg))
+				ret = wsm_configuration_confirm(priv, wsm_arg,
+								&wsm_buf);
+			break;
+		case 0x0405:
+			if (likely(wsm_arg))
+				ret = wsm_read_mib_confirm(priv, wsm_arg,
+								&wsm_buf);
+			break;
+		case 0x040B:
+			if (likely(wsm_arg))
+				ret = wsm_join_confirm(priv, wsm_arg, &wsm_buf);
+			break;
+		case 0x0406: /* write_mib */
+		case 0x0407: /* start-scan */
+		case 0x0408: /* stop-scan */
+		case 0x040A: /* wsm_reset */
+		case 0x040C: /* add_key */
+		case 0x040D: /* remove_key */
+		case 0x0410: /* wsm_set_pm */
+		case 0x0411: /* set_bss_params */
+		case 0x0412: /* set_tx_queue_params */
+		case 0x0413: /* set_edca_params */
+		case 0x0416: /* switch_channel */
+		case 0x0417: /* start */
+		case 0x0418: /* beacon_transmit */
+		case 0x0419: /* start_find */
+		case 0x041A: /* stop_find */
+		case 0x041C: /* map_link */
+			WARN_ON(wsm_arg != NULL);
+			ret = wsm_generic_confirm(priv, wsm_arg, &wsm_buf);
+			if (ret)
+				printk(KERN_ERR
+					"[WSM] wsm_generic_confirm "
+					"failed for request 0x%.4X.\n",
+					id);
+			break;
+		default:
+			BUG_ON(1);
+		}
+
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		priv->wsm_cmd.ret = ret;
+		priv->wsm_cmd.done = 1;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+		ret = 0; /* Error response from device should ne stop BH. */
+
+		wake_up_interruptible(&priv->wsm_cmd_wq);
+	} else if (id & 0x0800) {
+		switch (id) {
+		case 0x0801:
+			ret = wsm_startup_indication(priv, &wsm_buf);
+			break;
+		case 0x0804:
+			ret = wsm_receive_indication(priv, &wsm_buf, skb_p);
+			break;
+		case 0x0805:
+			ret = wsm_event_indication(priv, &wsm_buf);
+			break;
+		case 0x080A:
+			ret = wsm_channel_switch_indication(priv, &wsm_buf);
+			break;
+		case 0x0809:
+			ret = wsm_set_pm_indication(priv, &wsm_buf);
+			break;
+		case 0x0806:
+			ret = wsm_scan_complete_indication(priv, &wsm_buf);
+			break;
+		case 0x080B:
+			ret = wsm_find_complete_indication(priv, &wsm_buf);
+			break;
+		case 0x080C:
+			ret = wsm_suspend_resume_indication(priv, link_id, &wsm_buf);
+			break;
+		default:
+			STUB();
+		}
+	} else {
+		WARN_ON(1);
+		ret = -EINVAL;
+	}
+out:
+	return ret;
+}
+
+static bool wsm_handle_tx_data(struct cw1200_common *priv,
+			       const struct wsm_tx *wsm,
+			       const struct ieee80211_tx_info *tx_info)
+{
+	bool handled = false;
+	const struct ieee80211_hdr *frame =
+		(struct ieee80211_hdr *)&wsm[1];
+	__le16 fctl = frame->frame_control;
+	enum {
+		doProbe,
+		doDrop,
+		doJoin,
+		doWep,
+		doTx,
+	} action = doTx;
+
+	switch (priv->mode) {
+	case NL80211_IFTYPE_STATION:
+		if (unlikely(!priv->join_status ||
+			memcmp(frame->addr1, priv->join_bssid,
+				sizeof(priv->join_bssid)))) {
+			if (ieee80211_is_auth(fctl))
+				action = doJoin;
+			else
+				action = doDrop;
+		}
+		break;
+	case NL80211_IFTYPE_AP:
+		if (unlikely(!priv->join_status))
+			action = doDrop;
+		break;
+	case NL80211_IFTYPE_ADHOC:
+	case NL80211_IFTYPE_MESH_POINT:
+		STUB();
+	case NL80211_IFTYPE_MONITOR:
+	default:
+		action = doDrop;
+		break;
+	}
+
+	if (action == doTx) {
+		if (unlikely(ieee80211_is_probe_req(fctl)))
+			action = doProbe;
+		else if ((fctl & __cpu_to_le32(IEEE80211_FCTL_PROTECTED)) &&
+			tx_info->control.hw_key &&
+			unlikely(tx_info->control.hw_key->keyidx !=
+					priv->wep_default_key_id) &&
+			(tx_info->control.hw_key->cipher ==
+					WLAN_CIPHER_SUITE_WEP40 ||
+			 tx_info->control.hw_key->cipher ==
+					WLAN_CIPHER_SUITE_WEP104))
+			action = doWep;
+	}
+
+	switch (action) {
+	case doProbe:
+	{
+		/* An interesting FW "feature". Device filters
+		 * probe responses.
+		 * The easiest way to get it back is to convert
+		 * probe request into WSM start_scan command. */
+		int rate_id = (wsm->flags >> 4) & 0x07;
+		struct cw1200_queue *queue =
+			&priv->tx_queue[cw1200_queue_get_queue_id(
+				wsm->packetID)];
+		wsm_printk(KERN_DEBUG \
+			"[WSM] Convert probe request to scan.\n");
+		wsm_lock_tx_async(priv);
+		BUG_ON(priv->scan.probe_skb);
+		BUG_ON(cw1200_queue_get_skb(queue,
+					wsm->packetID,
+					&priv->scan.probe_skb));
+		BUG_ON(cw1200_queue_remove(queue, priv,
+						wsm->packetID));
+		/* Release used TX rate policy */
+		tx_policy_put(priv, rate_id);
+		queue_delayed_work(priv->workqueue,
+				&priv->scan.probe_work, 0);
+		handled = true;
+	}
+	break;
+	case doDrop:
+	{
+		/* See detailed description of "join" below.
+		 * We are dropping everything except AUTH in non-joined mode. */
+		struct sk_buff *skb;
+		int rate_id = (wsm->flags >> 4) & 0x07;
+		struct cw1200_queue *queue =
+			&priv->tx_queue[cw1200_queue_get_queue_id(
+				wsm->packetID)];
+		wsm_printk(KERN_DEBUG "[WSM] Drop frame (0x%.4X):"
+			" not joined.\n", fctl);
+		BUG_ON(cw1200_queue_get_skb(queue, wsm->packetID, &skb));
+		BUG_ON(cw1200_queue_remove(queue, priv, wsm->packetID));
+		/* Release used TX rate policy */
+		tx_policy_put(priv, rate_id);
+		/* Release SKB. TODO: report TX failure. */
+		dev_kfree_skb(skb);
+		handled = true;
+	}
+	break;
+	case doJoin:
+	{
+		/* There is one more interesting "feature"
+		 * in FW: it can't do RX/TX before "join".
+		 * "Join" here is not an association,
+		 * but just a syncronization between AP and STA.
+		 * BTW that means device can't receive frames
+		 * in monitor mode.
+		 * priv->join_status is used only in bh thread and does
+		 * not require protection */
+		wsm_printk(KERN_DEBUG "[WSM] Issue join command.\n");
+		wsm_lock_tx_async(priv);
+		BUG_ON(priv->join_pending_frame);
+		priv->join_pending_frame = wsm;
+		queue_work(priv->workqueue, &priv->join_work);
+		handled = true;
+	}
+	break;
+	case doWep:
+	{
+		wsm_printk(KERN_DEBUG "[WSM] Issue set_default_wep_key.\n");
+		wsm_lock_tx_async(priv);
+		priv->wep_default_key_id = tx_info->control.hw_key->keyidx;
+		queue_work(priv->workqueue, &priv->wep_key_work);
+		handled = true;
+	}
+	break;
+	case doTx:
+	{
+#if 0
+		/* Kept for history. If you want to implement wsm->more,
+		 * make sure you are able to send a frame after that. */
+		wsm->more = (count > 1) ? 1 : 0;
+		if (wsm->more) {
+			/* HACK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+			 * It's undocumented in WSM spec, but CW1200 hangs
+			 * if 'more' is set and no TX is performed due to TX
+			 * buffers limitation. */
+			if (priv->hw_bufs_used + 1 ==
+					priv->wsm_caps.numInpChBufs)
+				wsm->more = 0;
+		}
+
+		/* BUG!!! FIXME: we can't use 'more' at all: we don't know
+		 * future. It could be a request from upper layer with TX lock
+		 * requirements (scan, for example). If "more" is set device
+		 * will not send data and wsm_tx_lock() will fail...
+		 * It's not obvious how to fix this deadlock. Any ideas?
+		 * As a workaround more is set to 0. */
+		wsm->more = 0;
+#endif /* 0 */
+
+		if (ieee80211_is_deauth(fctl) &&
+				priv->mode != NL80211_IFTYPE_AP) {
+			/* Shedule unjoin work */
+			wsm_printk(KERN_DEBUG "[WSM] Issue unjoin command"
+				" (TX).\n");
+#if 0
+			wsm->more = 0;
+#endif /* 0 */
+			wsm_lock_tx_async(priv);
+			queue_work(priv->workqueue, &priv->unjoin_work);
+		}
+	}
+	break;
+	}
+	return handled;
+}
+
+static int wsm_get_tx_queue_and_mask(struct cw1200_common *priv,
+				     struct cw1200_queue **queue_p,
+				     u32* tx_allowed_mask_p,
+				     bool *more)
+{
+	int i;
+	struct cw1200_queue *queue = NULL;
+	u32 tx_allowed_mask;
+	int mcasts = 0;
+
+	/* Search for a queue with multicast frames buffered */
+	if (priv->sta_asleep_mask && !priv->suspend_multicast) {
+		tx_allowed_mask = 1 << CW1200_LINK_ID_AFTER_DTIM;
+		for (i = 0; i < 4; ++i) {
+			mcasts += cw1200_queue_get_num_queued(
+					&priv->tx_queue[i], tx_allowed_mask);
+			if (!queue && mcasts)
+				queue = &priv->tx_queue[i];
+			if (mcasts > 1)
+				break;
+		}
+		if (mcasts)
+			goto found;
+	}
+
+	/* Search for unicast traffic */
+	for (i = 0; i < 4; ++i) {
+		queue = &priv->tx_queue[i];
+		tx_allowed_mask = ~priv->sta_asleep_mask;
+		if (priv->sta_asleep_mask) {
+			tx_allowed_mask |= ~priv->tx_suspend_mask[i];
+		} else {
+			tx_allowed_mask |= 1 << CW1200_LINK_ID_AFTER_DTIM;
+		}
+		if (cw1200_queue_get_num_queued(
+				queue, tx_allowed_mask))
+			goto found;
+	}
+	return -ENOENT;
+
+found:
+	*queue_p = queue;
+	*tx_allowed_mask_p = tx_allowed_mask;
+	*more = mcasts > 1;
+	return 0;
+}
+
+int wsm_get_tx(struct cw1200_common *priv, u8 **data,
+	       size_t *tx_len)
+{
+	unsigned long flags;
+	struct wsm_tx *wsm = NULL;
+	struct ieee80211_tx_info *tx_info;
+	struct cw1200_queue *queue;
+	struct cw1200_sta_priv *sta_priv;
+	u32 tx_allowed_mask = 0;
+	/*
+	 * Count was intended as an input for wsm->more flag.
+	 * During implementation it was found that wsm->more
+	 * is not usable, see details above. It is kept just
+	 * in case you would like to try to implement it again.
+	 */
+	int count = 0;
+
+	/* More is used only for broadcasts. */
+	bool more;
+
+	if (priv->wsm_cmd.ptr) {
+		++count;
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		BUG_ON(!priv->wsm_cmd.ptr);
+		*data = priv->wsm_cmd.ptr;
+		*tx_len = priv->wsm_cmd.len;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+	} else {
+		for (;;) {
+			if (atomic_add_return(0, &priv->tx_lock))
+				break;
+
+			if (wsm_get_tx_queue_and_mask(priv, &queue,
+					&tx_allowed_mask, &more))
+				break;
+
+			if (cw1200_queue_get(queue,
+					tx_allowed_mask,
+					&wsm, &tx_info))
+				continue;
+
+			if (wsm_handle_tx_data(priv, wsm, tx_info))
+				continue;  /* Handled by WSM */
+
+			if (tx_info->control.sta) {
+				/* Update link id */
+				sta_priv = (struct cw1200_sta_priv *)
+					&tx_info->control.sta->drv_priv;
+				wsm->hdr.id &= __cpu_to_le16(~(0x0F << 6));
+				wsm->hdr.id |=
+					cpu_to_le16(sta_priv->link_id << 6);
+			}
+
+			*data = (u8 *)wsm;
+			*tx_len = __le16_to_cpu(wsm->hdr.len);
+			if (more) {
+				struct ieee80211_hdr *hdr =
+					(struct ieee80211_hdr *) &wsm[1];
+				/* more buffered multicast/broadcast frames
+				 *  ==> set MoreData flag in IEEE 802.11 header
+				 *  to inform PS STAs */
+				hdr->frame_control |=
+					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+			} else if (priv->mode == NL80211_IFTYPE_AP &&
+					!priv->suspend_multicast) {
+				priv->suspend_multicast = true;
+				queue_work(priv->workqueue,
+					&priv->multicast_stop_work);
+			}
+
+			wsm_printk(KERN_DEBUG "[WSM] >>> 0x%.4X (%d) %p %c\n",
+				0x0004, *tx_len, *data,
+				wsm->more ? 'M' : ' ');
+			++count;
+			break;
+		}
+	}
+
+	return count;
+}
+
+void wsm_txed(struct cw1200_common *priv, u8 *data)
+{
+	unsigned long flags;
+	if (data == priv->wsm_cmd.ptr) {
+		spin_lock_irqsave(&priv->wsm_cmd.lock, flags);
+		priv->wsm_cmd.ptr = NULL;
+		spin_unlock_irqrestore(&priv->wsm_cmd.lock, flags);
+	}
+
+	/* TODO: data queues */
+}
+
+/* ******************************************************************** */
+/* WSM buffer								*/
+
+void wsm_buf_init(struct wsm_buf *buf)
+{
+	BUG_ON(buf->begin);
+	buf->begin = kmalloc(SDIO_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
+	buf->end = buf->begin ? &buf->begin[SDIO_BLOCK_SIZE] : buf->begin;
+	wsm_buf_reset(buf);
+}
+
+void wsm_buf_deinit(struct wsm_buf *buf)
+{
+	kfree(buf->begin);
+	buf->begin = buf->data = buf->end = NULL;
+}
+
+static void wsm_buf_reset(struct wsm_buf *buf)
+{
+	if (buf->begin) {
+		buf->data = &buf->begin[4];
+		*(u32 *)buf->begin = 0;
+	} else
+		buf->data = buf->begin;
+}
+
+static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size)
+{
+	size_t pos = buf->data - buf->begin;
+	size_t size = pos + extra_size;
+
+
+	if (size & (SDIO_BLOCK_SIZE - 1)) {
+		size &= SDIO_BLOCK_SIZE;
+		size += SDIO_BLOCK_SIZE;
+	}
+
+	buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA);
+	if (buf->begin) {
+		buf->data = &buf->begin[pos];
+		buf->end = &buf->begin[size];
+		return 0;
+	} else {
+		buf->end = buf->data = buf->begin;
+		return -ENOMEM;
+	}
+}
+
+
diff --git a/drivers/staging/cw1200/wsm.h b/drivers/staging/cw1200/wsm.h
new file mode 100644
index 00000000000..f80e60fdc89
--- /dev/null
+++ b/drivers/staging/cw1200/wsm.h
@@ -0,0 +1,1512 @@
+/*
+ * WSM host interface (HI) interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ *
+ * Based on CW1200 UMAC WSM API, which is
+ * Copyright (C) ST-Ericsson SA 2010
+ * Author: Stewart Mathers <stewart.mathers@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_WSM_H_INCLUDED
+#define CW1200_WSM_H_INCLUDED
+
+#include <linux/spinlock.h>
+
+struct cw1200_common;
+
+/* Bands */
+/* Radio band 2.412 -2.484 GHz. */
+#define WSM_PHY_BAND_2_4G		(0)
+
+/* Radio band 4.9375-5.8250 GHz. */
+#define WSM_PHY_BAND_5G			(1)
+
+/* Transmit rates */
+/* 1   Mbps            ERP-DSSS */
+#define WSM_TRANSMIT_RATE_1		(0)
+
+/* 2   Mbps            ERP-DSSS */
+#define WSM_TRANSMIT_RATE_2		(1)
+
+/* 5.5 Mbps            ERP-CCK, ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_5		(2) */
+
+/* 11  Mbps            ERP-CCK, ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_11		(3) */
+
+/* 22  Mbps            ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_22		(4) */
+
+/* 33  Mbps            ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_33		(5) */
+
+/* 6   Mbps   (3 Mbps) ERP-OFDM, BPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_6		(6)
+
+/* 9   Mbps (4.5 Mbps) ERP-OFDM, BPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_9		(7)
+
+/* 12  Mbps  (6 Mbps)  ERP-OFDM, QPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_12		(8)
+
+/* 18  Mbps  (9 Mbps)  ERP-OFDM, QPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_18		(9)
+
+/* 24  Mbps (12 Mbps)  ERP-OFDM, 16QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_24		(10)
+
+/* 36  Mbps (18 Mbps)  ERP-OFDM, 16QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_36		(11)
+
+/* 48  Mbps (24 Mbps)  ERP-OFDM, 64QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_48		(12)
+
+/* 54  Mbps (27 Mbps)  ERP-OFDM, 64QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_54		(13)
+
+/* 6.5 Mbps            HT-OFDM, BPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_6		(14)
+
+/* 13  Mbps            HT-OFDM, QPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_13		(15)
+
+/* 19.5 Mbps           HT-OFDM, QPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_19		(16)
+
+/* 26  Mbps            HT-OFDM, 16QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_26		(17)
+
+/* 39  Mbps            HT-OFDM, 16QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_39		(18)
+
+/* 52  Mbps            HT-OFDM, 64QAM coding rate 2/3 */
+#define WSM_TRANSMIT_RATE_HT_52		(19)
+
+/* 58.5 Mbps           HT-OFDM, 64QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_58		(20)
+
+/* 65  Mbps            HT-OFDM, 64QAM coding rate 5/6 */
+#define WSM_TRANSMIT_RATE_HT_65		(21)
+
+/* Scan types */
+/* Foreground scan */
+#define WSM_SCAN_TYPE_FOREGROUND	(0)
+
+/* Background scan */
+#define WSM_SCAN_TYPE_BACKGROUND	(1)
+
+/* Auto scan */
+#define WSM_SCAN_TYPE_AUTO		(2)
+
+/* Scan flags */
+/* Forced background scan means if the station cannot */
+/* enter the power-save mode, it shall force to perform a */
+/* background scan. Only valid when ScanType is */
+/* background scan. */
+#define WSM_SCAN_FLAG_FORCE_BACKGROUND	(BIT(0))
+
+/* The WLAN device scans one channel at a time so */
+/* that disturbance to the data traffic is minimized. */
+#define WSM_SCAN_FLAG_SPLIT_METHOD	(BIT(1))
+
+/* Preamble Type. Long if not set. */
+#define WSM_SCAN_FLAG_SHORT_PREAMBLE	(BIT(2))
+
+/* 11n Tx Mode. Mixed if not set. */
+#define WSM_SCAN_FLAG_11N_GREENFIELD	(BIT(3))
+
+/* Scan constraints */
+/* Maximum number of channels to be scanned. */
+#define WSM_SCAN_MAX_NUM_OF_CHANNELS	(48)
+
+/* The maximum number of SSIDs that the device can scan for. */
+#define WSM_SCAN_MAX_NUM_OF_SSIDS	(2)
+
+/* Power management modes */
+/* 802.11 Active mode */
+#define WSM_PSM_ACTIVE			(0)
+
+/* 802.11 PS mode */
+#define WSM_PSM_PS			(1)
+
+/* Undetermined */
+/* Note : Undetermined status is reported when the */
+/* NULL data frame used to advertise the PM mode to */
+/* the AP at Pre or Post Background Scan is not Acknowledged */
+#define WSM_PSM_UNKNOWN			(2)
+
+/* Use this flag to enable the fast power-saving mode */
+#define WSM_PM_F_FAST_PSM_ENABLE	(0x80)
+
+/* Queue IDs */
+/* best effort/legacy */
+#define WSM_QUEUE_BEST_EFFORT		(0)
+
+/* background */
+#define WSM_QUEUE_BACKGROUND		(1)
+
+/* video */
+#define WSM_QUEUE_VIDEO			(2)
+
+/* voice */
+#define WSM_QUEUE_VOICE			(3)
+
+/* HT TX parameters */
+/* Non-HT */
+#define WSM_HT_TX_NON_HT		(0)
+
+/* Mixed format */
+#define WSM_HT_TX_MIXED			(1)
+
+/* Greenfield format */
+#define WSM_HT_TX_GREENFIELD		(2)
+
+/* STBC allowed */
+#define WSM_HT_TX_STBC			(BIT(7))
+
+/* TX status */
+/* Frame was sent aggregated */
+/* Only valid for WSM_SUCCESS status. */
+#define WSM_TX_STATUS_AGGREGATION	(BIT(0))
+
+/* Host should requeue this frame later. */
+/* Valid only when status is WSM_REQUEUE. */
+#define WSM_TX_STATUS_REQUEUE		(BIT(1))
+
+/* Normal Ack */
+#define WSM_TX_STATUS_NORMAL_ACK	(0<<2)
+
+/* No Ack */
+#define WSM_TX_STATUS_NO_ACK		(1<<2)
+
+/* No explicit acknowledgement */
+#define WSM_TX_STATUS_NO_EXPLICIT_ACK	(2<<2)
+
+/* Block Ack */
+/* Only valid for WSM_SUCCESS status. */
+#define WSM_TX_STATUS_BLOCK_ACK		(3<<2)
+
+/* RX status */
+/* Unencrypted */
+#define WSM_RX_STATUS_UNENCRYPTED	(0<<0)
+
+/* WEP */
+#define WSM_RX_STATUS_WEP		(1<<0)
+
+/* TKIP */
+#define WSM_RX_STATUS_TKIP		(2<<0)
+
+/* AES */
+#define WSM_RX_STATUS_AES		(3<<0)
+
+/* WAPI */
+#define WSM_RX_STATUS_WAPI		(4<<0)
+
+/* Macro to fetch encryption subfield. */
+#define WSM_RX_STATUS_ENCRYPTION(status) ((status) & 0x07)
+
+/* Frame was part of an aggregation */
+#define WSM_RX_STATUS_AGGREGATE		(BIT(3))
+
+/* Frame was first in the aggregation */
+#define WSM_RX_STATUS_AGGREGATE_FIRST	(BIT(4))
+
+/* Frame was last in the aggregation */
+#define WSM_RX_STATUS_AGGREGATE_LAST	(BIT(5))
+
+/* Indicates a defragmented frame */
+#define WSM_RX_STATUS_DEFRAGMENTED	(BIT(6))
+
+/* Indicates a Beacon frame */
+#define WSM_RX_STATUS_BEACON		(BIT(7))
+
+/* Indicates STA bit beacon TIM field */
+#define WSM_RX_STATUS_TIM		(BIT(8))
+
+/* Indicates Beacon frame's virtual bitmap contains multicast bit */
+#define WSM_RX_STATUS_MULTICAST		(BIT(9))
+
+/* Indicates frame contains a matching SSID */
+#define WSM_RX_STATUS_MATCHING_SSID	(BIT(10))
+
+/* Indicates frame contains a matching BSSI */
+#define WSM_RX_STATUS_MATCHING_BSSI	(BIT(11))
+
+/* Indicates More bit set in Framectl field */
+#define WSM_RX_STATUS_MORE_DATA		(BIT(12))
+
+/* Indicates frame received during a measurement process */
+#define WSM_RX_STATUS_MEASUREMENT	(BIT(13))
+
+/* Indicates frame received as an HT packet */
+#define WSM_RX_STATUS_HT		(BIT(14))
+
+/* Indicates frame received with STBC */
+#define WSM_RX_STATUS_STBC		(BIT(15))
+
+/* Indicates Address 1 field matches dot11StationId */
+#define WSM_RX_STATUS_ADDRESS1		(BIT(16))
+
+/* Indicates Group address present in the Address 1 field */
+#define WSM_RX_STATUS_GROUP		(BIT(17))
+
+/* Indicates Broadcast address present in the Address 1 field */
+#define WSM_RX_STATUS_BROADCAST		(BIT(18))
+
+/* Indicates group key used with encrypted frames */
+#define WSM_RX_STATUS_GROUP_KEY		(BIT(19))
+
+/* Macro to fetch encryption key index. */
+#define WSM_RX_STATUS_KEY_IDX(status)	(((status >> 20)) & 0x0F)
+
+/* Join mode */
+/* IBSS */
+#define WSM_JOIN_MODE_IBSS		(0)
+
+/* BSS */
+#define WSM_JOIN_MODE_BSS		(1)
+
+/* PLCP preamble type */
+/* For long preamble */
+#define WSM_JOIN_PREAMBLE_LONG		(0)
+
+/* For short preamble (Long for 1Mbps) */
+#define WSM_JOIN_PREAMBLE_SHORT		(1)
+
+/* For short preamble (Long for 1 and 2Mbps) */
+#define WSM_JOIN_PREAMBLE_SHORT_2	(2)
+
+/* Join flags */
+/* Unsynchronized */
+#define WSM_JOIN_FLAGS_UNSYNCRONIZED	(1)
+
+/* Key types */
+#define WSM_KEY_TYPE_WEP_DEFAULT	(0)
+#define WSM_KEY_TYPE_WEP_PAIRWISE	(1)
+#define WSM_KEY_TYPE_TKIP_GROUP		(2)
+#define WSM_KEY_TYPE_TKIP_PAIRWISE	(3)
+#define WSM_KEY_TYPE_AES_GROUP		(4)
+#define WSM_KEY_TYPE_AES_PAIRWISE	(5)
+#define WSM_KEY_TYPE_WAPI_GROUP		(6)
+#define WSM_KEY_TYPE_WAPI_PAIRWISE	(7)
+
+/* Key indexes */
+#define WSM_KEY_MAX_INDEX		(10)
+
+/* ACK policy */
+#define WSM_ACK_POLICY_NORMAL		(0)
+#define WSM_ACK_POLICY_NO_ACK		(1)
+
+/* Start modes */
+#define WSM_START_MODE_AP		(0)	/* Mini AP */
+#define WSM_START_MODE_P2P		(1)	/* P2P */
+
+/* SetAssociationMode MIB flags */
+#define WSM_ASSOCIATION_MODE_USE_PREAMBLE_TYPE		(BIT(0))
+#define WSM_ASSOCIATION_MODE_USE_HT_MODE		(BIT(1))
+#define WSM_ASSOCIATION_MODE_USE_BASIC_RATE_SET		(BIT(2))
+#define WSM_ASSOCIATION_MODE_USE_MPDU_START_SPACING	(BIT(3))
+#define WSM_ASSOCIATION_MODE_SNOOP_ASSOC_FRAMES		(BIT(4))
+
+/* RcpiRssiThreshold MIB flags */
+#define WSM_RCPI_RSSI_THRESHOLD_ENABLE	(BIT(0))
+#define WSM_RCPI_RSSI_USE_RSSI		(BIT(1))
+#define WSM_RCPI_RSSI_DONT_USE_UPPER	(BIT(2))
+#define WSM_RCPI_RSSI_DONT_USE_LOWER	(BIT(3))
+
+/* WSM events */
+/* Error */
+#define WSM_EVENT_ERROR			(0)
+
+/* BSS lost */
+#define WSM_EVENT_BSS_LOST		(1)
+
+/* BSS regained */
+#define WSM_EVENT_BSS_REGAINED		(2)
+
+/* Radar detected */
+#define WSM_EVENT_RADAR_DETECTED	(3)
+
+/* RCPI or RSSI threshold triggered */
+#define WSM_EVENT_RCPI_RSSI		(4)
+
+/* BT inactive */
+#define WSM_EVENT_BT_INACTIVE		(5)
+
+/* BT active */
+#define WSM_EVENT_BT_ACTIVE		(6)
+
+/* MIB IDs */
+/* 4.1  dot11StationId */
+#define WSM_MIB_ID_DOT11_STATION_ID		0x0000
+
+/* 4.2  dot11MaxtransmitMsduLifeTime */
+#define WSM_MIB_ID_DOT11_MAX_TRANSMIT_LIFTIME	0x0001
+
+/* 4.3  dot11MaxReceiveLifeTime */
+#define WSM_MIB_ID_DOT11_MAX_RECEIVE_LIFETIME	0x0002
+
+/* 4.4  dot11SlotTime */
+#define WSM_MIB_ID_DOT11_SLOT_TIME		0x0003
+
+/* 4.5  dot11GroupAddressesTable */
+#define WSM_MIB_ID_DOT11_GROUP_ADDRESSES_TABLE	0x0004
+
+/* 4.6  dot11WepDefaultKeyId */
+#define WSM_MIB_ID_DOT11_WEP_DEFAULT_KEY_ID	0x0005
+
+/* 4.7  dot11CurrentTxPowerLevel */
+#define WSM_MIB_ID_DOT11_CURRENT_TX_POWER_LEVEL	0x0006
+
+/* 4.8  dot11RTSThreshold */
+#define WSM_MIB_ID_DOT11_RTS_THRESHOLD		0x0007
+
+/* 4.9  NonErpProtection */
+#define WSM_MIB_ID_NON_ERP_PROTECTION		0x1000
+
+/* 4.10 ArpIpAddressesTable */
+#define WSM_MIB_ID_ARP_IP_ADDRESSES_TABLE	0x1001
+
+/* 4.11 TemplateFrame */
+#define WSM_MIB_ID_TEMPLATE_FRAME		0x1002
+
+/* 4.12 RxFilter */
+#define WSM_MIB_ID_RX_FILTER			0x1003
+
+/* 4.13 BeaconFilterTable */
+#define WSM_MIB_ID_BEACON_FILTER_TABLE		0x1004
+
+/* 4.14 BeaconFilterEnable */
+#define WSM_MIB_ID_BEACON_FILTER_ENABLE		0x1005
+
+/* 4.15 OperationalPowerMode */
+#define WSM_MIB_ID_OPERATIONAL_POWER_MODE	0x1006
+
+/* 4.16 BeaconWakeUpPeriod */
+#define WSM_MIB_ID_BEACON_WAKEUP_PERIOD		0x1007
+
+/* 4.17 RcpiRssiThreshold */
+#define WSM_MIB_ID_RCPI_RSSI_THRESHOLD		0x1009
+
+/* 4.18 StatisticsTable */
+#define WSM_MIB_ID_STATISTICS_TABLE		0x100A
+
+/* 4.19 IbssPsConfig */
+#define WSM_MIB_ID_IBSS_PS_CONFIG		0x100B
+
+/* 4.20 CountersTable */
+#define WSM_MIB_ID_COUNTERS_TABLE		0x100C
+
+/* 4.21 BlockAckPolicy */
+#define WSM_MIB_ID_BLOCK_ACK_POLICY		0x100E
+
+/* 4.22 OverrideInternalTxRate */
+#define WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE	0x100F
+
+/* 4.23 SetAssociationMode */
+#define WSM_MIB_ID_SET_ASSOCIATION_MODE		0x1010
+
+/* 4.24 UpdateEptaConfigData */
+#define WSM_MIB_ID_UPDATE_EPTA_CONFIG_DATA	0x1011
+
+/* 4.25 SelectCcaMethod */
+#define WSM_MIB_ID_SELECT_CCA_METHOD		0x1012
+
+/* 4.26 SetUpasdInformation */
+#define WSM_MIB_ID_SET_UAPSD_INFORMATION	0x1013
+
+/* 4.27 SetAutoCalibrationMode  WBF00004073 */
+#define WSM_MIB_ID_SET_AUTO_CALIBRATION_MODE	0x1015
+
+/* 4.28 SetTxRateRetryPolicy */
+#define WSM_MIB_ID_SET_TX_RATE_RETRY_POLICY	0x1016
+
+/* 4.29 SetHostMessageTypeFilter */
+#define WSM_MIB_ID_SET_HOST_MSG_TYPE_FILTER	0x1017
+
+/* 4.30 P2PFindInfo */
+#define WSM_MIB_ID_P2P_FIND_INFO		0x1018
+
+/* 4.31 P2PPsModeInfo */
+#define WSM_MIB_ID_P2P_PS_MODE_INFO		0x1019
+
+/* 4.32 SetEtherTypeDataFrameFilter */
+#define WSM_MIB_ID_SET_ETHERTYPE_DATAFRAME_FILTER 0x101A
+
+/* 4.33 SetUDPPortDataFrameFilter */
+#define WSM_MIB_ID_SET_UDPPORT_DATAFRAME_FILTER	0x101B
+
+/* 4.34 SetMagicDataFrameFilter */
+#define WSM_MIB_ID_SET_MAGIC_DATAFRAME_FILTER	0x101C
+
+/* This is the end of specification. */
+
+/* 4.35 P2PDeviceInfo */
+#define WSM_MIB_ID_P2P_DEVICE_INFO		0x101D
+
+/* 4.36 SetWCDMABand */
+#define WSM_MIB_ID_SET_WCDMA_BAND		0x101E
+
+/* 4.37 GroupTxSequenceCounter */
+#define WSM_MIB_ID_GRP_SEQ_COUNTER		0x101F
+
+/* 1020 4.38 ProtectedMgmtPolicy */
+
+/* 4.39 SetHtProtection */
+#define WSM_MID_ID_SET_HT_PROTECTION		0x1021
+
+/* 4.40 GPIO Command */
+#define WSM_MIB_ID_GPIO_COMMAND			0x1022
+
+/* 4.41 TSF Counter Value */
+#define WSM_MIB_ID_TSF_COUNTER			0x1023
+
+/* Test Purposes Only */
+#define WSM_MIB_ID_BLOCK_ACK_INFO		0x100D
+
+/* 4.43 Keep-alive period */
+#define WSM_MIB_ID_KEEP_ALIVE_PERIOD		0x1025
+
+/* 4.44 Disable BSSID filter */
+#define WSM_MIB_ID_DISABLE_BSSID_FILTER		0x1026
+
+/* Frame template types */
+#define WSM_FRAME_TYPE_PROBE_REQUEST	(0)
+#define WSM_FRAME_TYPE_BEACON		(1)
+#define WSM_FRAME_TYPE_NULL		(2)
+#define WSM_FRAME_TYPE_QOS_NULL		(3)
+#define WSM_FRAME_TYPE_PS_POLL		(4)
+#define WSM_FRAME_TYPE_PROBE_RESPONSE	(5)
+
+#define WSM_FRAME_GREENFIELD		(0x80)	/* See 4.11 */
+
+/* Status */
+/* The WSM firmware has completed a request */
+/* successfully. */
+#define WSM_STATUS_SUCCESS              (0)
+
+/* This is a generic failure code if other error codes do */
+/* not apply. */
+#define WSM_STATUS_FAILURE              (1)
+
+/* A request contains one or more invalid parameters. */
+#define WSM_INVALID_PARAMETER           (2)
+
+/* The request cannot perform because the device is in */
+/* an inappropriate mode. */
+#define WSM_ACCESS_DENIED               (3)
+
+/* The frame received includes a decryption error. */
+#define WSM_STATUS_DECRYPTFAILURE       (4)
+
+/* A MIC failure is detected in the received packets. */
+#define WSM_STATUS_MICFAILURE           (5)
+
+/* The transmit request failed due to retry limit being */
+/* exceeded. */
+#define WSM_STATUS_RETRY_EXCEEDED       (6)
+
+/* The transmit request failed due to MSDU life time */
+/* being exceeded. */
+#define WSM_STATUS_TX_LIFETIME_EXCEEDED (7)
+
+/* The link to the AP is lost. */
+#define WSM_STATUS_LINK_LOST            (8)
+
+/* No key was found for the encrypted frame */
+#define WSM_STATUS_NO_KEY_FOUND         (9)
+
+/* Jammer was detected when transmitting this frame */
+#define WSM_STATUS_JAMMER_DETECTED      (10)
+
+/* The message should be requeued later. */
+/* This is applicable only to Transmit */
+#define WSM_REQUEUE                     (11)
+
+
+struct wsm_hdr {
+	__le16 len;
+	__le16 id;
+};
+
+/* ******************************************************************** */
+/* WSM capcbility							*/
+
+struct wsm_caps {
+	u16 numInpChBufs;
+	u16 sizeInpChBuf;
+	u16 hardwareId;
+	u16 hardwareSubId;
+	u16 firmwareCap;
+	u16 firmwareType;
+	u16 firmwareApiVer;
+	u16 firmwareBuildNumber;
+	u16 firmwareVersion;
+	int firmwareReady;
+};
+
+/* ******************************************************************** */
+/* WSM commands								*/
+
+struct wsm_tx_power_range {
+	int min_power_level;
+	int max_power_level;
+	u32 stepping;
+};
+
+/* 3.1 */
+struct wsm_configuration {
+	/* [in] */ u32 dot11MaxTransmitMsduLifeTime;
+	/* [in] */ u32 dot11MaxReceiveLifeTime;
+	/* [in] */ u32 dot11RtsThreshold;
+	/* [in, out] */ u8 *dot11StationId;
+	/* [in] */ const void *dpdData;
+	/* [in] */ size_t dpdData_size;
+	/* [out] */ u8 dot11FrequencyBandsSupported;
+	/* [out] */ u32 supportedRateMask;
+	/* [out] */ struct wsm_tx_power_range txPowerRange[2];
+};
+
+int wsm_configuration(struct cw1200_common *priv,
+		      struct wsm_configuration *arg);
+
+/* 3.3 */
+struct wsm_reset {
+	/* [in] */ int link_id;
+	/* [in] */ bool reset_statistics;
+};
+
+int wsm_reset(struct cw1200_common *priv, const struct wsm_reset *arg);
+
+/* 3.5 */
+int wsm_read_mib(struct cw1200_common *priv, u16 mibId, void *buf,
+		 size_t buf_size);
+
+/* 3.7 */
+int wsm_write_mib(struct cw1200_common *priv, u16 mibId, void *buf,
+		  size_t buf_size);
+
+/* 3.9 */
+struct wsm_ssid {
+	u8 ssid[32];
+	u32 length;
+};
+
+struct wsm_scan_ch {
+	u16 number;
+	u32 minChannelTime;
+	u32 maxChannelTime;
+	u32 txPowerLevel;
+};
+
+/* 3.13 */
+struct wsm_scan_complete {
+	/* WSM_STATUS_... */
+	u32 status;
+
+	/* WSM_PSM_... */
+	u8 psm;
+
+	/* Number of channels that the scan operation completed. */
+	u8 numChannels;
+};
+
+typedef void (*wsm_scan_complete_cb) (struct cw1200_common *priv,
+				      struct wsm_scan_complete *arg);
+
+/* 3.9 */
+struct wsm_scan {
+	/* WSM_PHY_BAND_... */
+	/* [in] */ u8 band;
+
+	/* WSM_SCAN_TYPE_... */
+	/* [in] */ u8 scanType;
+
+	/* WSM_SCAN_FLAG_... */
+	/* [in] */ u8 scanFlags;
+
+	/* WSM_TRANSMIT_RATE_... */
+	/* [in] */ u8 maxTransmitRate;
+
+	/* Interval period in TUs that the device shall the re- */
+	/* execute the requested scan. Max value supported by the device */
+	/* is 256s. */
+	/* [in] */ u32 autoScanInterval;
+
+	/* Number of probe requests (per SSID) sent to one (1) */
+	/* channel. Zero (0) means that none is send, which */
+	/* means that a passive scan is to be done. Value */
+	/* greater than zero (0) means that an active scan is to */
+	/* be done. */
+	/* [in] */ u32 numOfProbeRequests;
+
+	/* Number of channels to be scanned. */
+	/* Maximum value is WSM_SCAN_MAX_NUM_OF_CHANNELS. */
+	/* [in] */ u8 numOfChannels;
+
+	/* Number of SSID provided in the scan command (this */
+	/* is zero (0) in broadcast scan) */
+	/* The maximum number of SSIDs is WSM_SCAN_MAX_NUM_OF_SSIDS. */
+	/* [in] */ u8 numOfSSIDs;
+
+	/* The delay time (in microseconds) period */
+	/* before sending a probe-request. */
+	/* [in] */ u8 probeDelay;
+
+	/* SSIDs to be scanned [numOfSSIDs]; */
+	/* [in] */ struct wsm_ssid *ssids;
+
+	/* Channels to be scanned [numOfChannels]; */
+	/* [in] */ struct wsm_scan_ch *ch;
+};
+
+int wsm_scan(struct cw1200_common *priv, const struct wsm_scan *arg);
+
+/* 3.11 */
+int wsm_stop_scan(struct cw1200_common *priv);
+
+/* 3.14 */
+struct wsm_tx_confirm {
+	/* Packet identifier used in wsm_tx. */
+	/* [out] */ u32 packetID;
+
+	/* WSM_STATUS_... */
+	/* [out] */ u32 status;
+
+	/* WSM_TRANSMIT_RATE_... */
+	/* [out] */ u8 txedRate;
+
+	/* The number of times the frame was transmitted */
+	/* without receiving an acknowledgement. */
+	/* [out] */ u8 ackFailures;
+
+	/* WSM_TX_STATUS_... */
+	/* [out] */ u16 flags;
+
+	/* The total time in microseconds that the frame spent in */
+	/* the WLAN device before transmission as completed. */
+	/* [out] */ u32 mediaDelay;
+
+	/* The total time in microseconds that the frame spent in */
+	/* the WLAN device before transmission was started. */
+	/* [out] */ u32 txQueueDelay;
+};
+
+/* 3.15 */
+typedef void (*wsm_tx_confirm_cb) (struct cw1200_common *priv,
+				   struct wsm_tx_confirm *arg);
+
+/* Note that ideology of wsm_tx struct is different against the rest of
+ * WSM API. wsm_hdr is /not/ a caller-adapted struct to be used as an input
+ * argument for WSM call, but a prepared bytestream to be sent to firmware.
+ * It is filled partly in cw1200_skb_to_wsm, partly in low-level WSM code.
+ * Please pay attention once again: ideology is different.
+ *
+ * Legend:
+ * - [in]: cw1200_skb_to_wsm must fill this field.
+ * - [wsm]: the field is filled by low-level WSM.
+ */
+struct wsm_tx {
+	/* common WSM header */
+	/* [in/wsm] */ struct wsm_hdr hdr;
+
+	/* Packet identifier that meant to be used in completion. */
+	/* [in] */ __le32 packetID;
+
+	/* WSM_TRANSMIT_RATE_... */
+	/* [in] */ u8 maxTxRate;
+
+	/* WSM_QUEUE_... */
+	/* [in] */ u8 queueId;
+
+	/* True: another packet is pending on the host for transmission. */
+	/* [wsm] */ u8 more;
+
+	/* Bit 0 = 0 - Start expiry time from first Tx attempt (default) */
+	/* Bit 0 = 1 - Start expiry time from receipt of Tx Request */
+	/* Bits 3:1  - PTA Priority */
+	/* Bits 6:4  - Tx Rate Retry Policy */
+	/* Bit 7 - Reserved */
+	/* [in] */ u8 flags;
+
+	/* Should be 0. */
+	/* [in] */ __le32 reserved;
+
+	/* The elapsed time in TUs, after the initial transmission */
+	/* of an MSDU, after which further attempts to transmit */
+	/* the MSDU shall be terminated. Overrides the global */
+	/* dot11MaxTransmitMsduLifeTime setting [optional] */
+	/* Device will set the default value if this is 0. */
+	/* [wsm] */ __le32 expireTime;
+
+	/* WSM_HT_TX_... */
+	/* [in] */ __le32 htTxParameters;
+};
+
+/* = sizeof(generic hi hdr) + sizeof(wsm hdr) + sizeof(alignment) */
+#define WSM_TX_EXTRA_HEADROOM (28)
+
+/* 3.16 */
+struct wsm_rx {
+	/* WSM_STATUS_... */
+	/* [out] */ u32 status;
+
+	/* Specifies the channel of the received packet. */
+	/* [out] */ u16 channelNumber;
+
+	/* WSM_TRANSMIT_RATE_... */
+	/* [out] */ u8 rxedRate;
+
+	/* This value is expressed in signed Q8.0 format for */
+	/* RSSI and unsigned Q7.1 format for RCPI. */
+	/* [out] */ u8 rcpiRssi;
+
+	/* WSM_RX_STATUS_... */
+	/* [out] */ u32 flags;
+
+	/* An 802.11 frame. */
+	/* [out] */ void *frame;
+
+	/* Size of the frame */
+	/* [out] */ size_t frame_size;
+};
+
+/* = sizeof(generic hi hdr) + sizeof(wsm hdr) */
+#define WSM_RX_EXTRA_HEADROOM (16)
+
+typedef void (*wsm_rx_cb) (struct cw1200_common *priv, struct wsm_rx *arg,
+			   struct sk_buff **skb_p);
+
+/* 3.17 */
+struct wsm_event {
+	/* WSM_STATUS_... */
+	/* [out] */ u32 eventId;
+
+	/* Indication parameters. */
+	/* For error indication, this shall be a 32-bit WSM status. */
+	/* For RCPI or RSSI indication, this should be an 8-bit */
+	/* RCPI or RSSI value. */
+	/* [out] */ u32 eventData;
+};
+
+struct cw1200_wsm_event {
+	struct list_head link;
+	struct wsm_event evt;
+};
+
+/* 3.18 - 3.22 */
+/* Measurement. Skipped for now. Irrelevent. */
+
+typedef void (*wsm_event_cb) (struct cw1200_common *priv,
+			      struct wsm_event *arg);
+
+/* 3.23 */
+struct wsm_join {
+	/* WSM_JOIN_MODE_... */
+	/* [in] */ u8 mode;
+
+	/* WSM_PHY_BAND_... */
+	/* [in] */ u8 band;
+
+	/* Specifies the channel number to join. The channel */
+	/* number will be mapped to an actual frequency */
+	/* according to the band */
+	/* [in] */ u16 channelNumber;
+
+	/* Specifies the BSSID of the BSS or IBSS to be joined */
+	/* or the IBSS to be started. */
+	/* [in] */ u8 bssid[6];
+
+	/* ATIM window of IBSS */
+	/* When ATIM window is zero the initiated IBSS does */
+	/* not support power saving. */
+	/* [in] */ u16 atimWindow;
+
+	/* WSM_JOIN_PREAMBLE_... */
+	/* [in] */ u8 preambleType;
+
+	/* Specifies if a probe request should be send with the */
+	/* specified SSID when joining to the network. */
+	/* [in] */ u8 probeForJoin;
+
+	/* DTIM Period (In multiples of beacon interval) */
+	/* [in] */ u8 dtimPeriod;
+
+	/* WSM_JOIN_FLAGS_... */
+	/* [in] */ u8 flags;
+
+	/* Length of the SSID */
+	/* [in] */ u32 ssidLength;
+
+	/* Specifies the SSID of the IBSS to join or start */
+	/* [in] */ u8 ssid[32];
+
+	/* Specifies the time between TBTTs in TUs */
+	/* [in] */ u32 beaconInterval;
+
+	/* A bit mask that defines the BSS basic rate set. */
+	/* [in] */ u32 basicRateSet;
+
+	/* Minimum transmission power level in units of 0.1dBm */
+	/* [out] */ int minPowerLevel;
+
+	/* Maximum transmission power level in units of 0.1dBm */
+	/* [out] */ int maxPowerLevel;
+};
+
+int wsm_join(struct cw1200_common *priv, struct wsm_join *arg);
+
+/* 3.25 */
+struct wsm_set_pm {
+	/* WSM_PSM_... */
+	/* [in] */ u8 pmMode;
+
+	/* in unit of 500us; 0 to use default */
+	/* [in] */ u8 fastPsmIdlePeriod;
+
+	/* in unit of 500us; 0 to use default */
+	/* [in] */ u8 apPsmChangePeriod;
+
+	/* in unit of 500us; 0 to disable auto-pspoll */
+	/* [in] */ u8 minAutoPsPollPeriod;
+};
+
+int wsm_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg);
+
+/* 3.27 */
+struct wsm_set_pm_complete {
+	u8 psm;			/* WSM_PSM_... */
+};
+
+typedef void (*wsm_set_pm_complete_cb) (struct cw1200_common *priv,
+					struct wsm_set_pm_complete *arg);
+
+/* 3.28 */
+struct wsm_set_bss_params {
+	/* The number of lost consecutive beacons after which */
+	/* the WLAN device should indicate the BSS-Lost event */
+	/* to the WLAN host driver. */
+	u8 beaconLostCount;
+
+	/* The AID received during the association process. */
+	u16 aid;
+
+	/* The operational rate set mask */
+	u32 operationalRateSet;
+};
+
+int wsm_set_bss_params(struct cw1200_common *priv,
+		       const struct wsm_set_bss_params *arg);
+
+/* 3.30 */
+struct wsm_add_key {
+	u8 type;		/* WSM_KEY_TYPE_... */
+	u8 entryIndex;		/* Key entry index: 0 -- WSM_KEY_MAX_INDEX */
+	u16 reserved;
+	union {
+		struct {
+			u8 peerAddress[6];	/* MAC address of the
+						 * peer station */
+			u8 reserved;
+			u8 keyLength;		/* Key length in bytes */
+			u8 keyData[16];		/* Key data */
+		} __packed wepPairwiseKey;
+		struct {
+			u8 keyId;		/* Unique per key identifier
+						 * (0..3) */
+			u8 keyLength;		/* Key length in bytes */
+			u16 reserved;
+			u8 keyData[16];		/* Key data */
+		} __packed wepGroupKey;
+		struct {
+			u8 peerAddress[6];	/* MAC address of the
+						 * peer station */
+			u8 reserved[2];
+			u8 tkipKeyData[16];	/* TKIP key data */
+			u8 rxMicKey[8];		/* Rx MIC key */
+			u8 txMicKey[8];		/* Tx MIC key */
+		} __packed tkipPairwiseKey;
+		struct {
+			u8 tkipKeyData[16];	/* TKIP key data */
+			u8 rxMicKey[8];		/* Rx MIC key */
+			u8 keyId;		/* Key ID */
+			u8 reserved[3];
+			u8 rxSeqCounter[8];	/* Receive Sequence Counter */
+		} __packed tkipGroupKey;
+		struct {
+			u8 peerAddress[6];	/* MAC address of the
+						 * peer station */
+			u16 reserved;
+			u8 aesKeyData[16];	/* AES key data */
+		} __packed aesPairwiseKey;
+		struct {
+			u8 aesKeyData[16];	/* AES key data */
+			u8 keyId;		/* Key ID */
+			u8 reserved[3];
+			u8 rxSeqCounter[8];	/* Receive Sequence Counter */
+		} __packed aesGroupKey;
+		struct {
+			u8 peerAddress[6];	/* MAC address of the
+						 * peer station */
+			u8 keyId;		/* Key ID */
+			u8 reserved;
+			u8 wapiKeyData[16];	/* WAPI key data */
+			u8 micKeyData[16];	/* MIC key data */
+		} __packed wapiPairwiseKey;
+		struct {
+			u8 wapiKeyData[16];	/* WAPI key data */
+			u8 micKeyData[16];	/* MIC key data */
+			u8 keyId;		/* Key ID */
+			u8 reserved[3];
+		} __packed wapiGroupKey;
+	} __packed;
+} __packed;
+
+int wsm_add_key(struct cw1200_common *priv, const struct wsm_add_key *arg);
+
+/* 3.32 */
+struct wsm_remove_key {
+	/* Key entry index : 0-10 */
+	u8 entryIndex;
+};
+
+int wsm_remove_key(struct cw1200_common *priv,
+		   const struct wsm_remove_key *arg);
+
+/* 3.34 */
+struct wsm_set_tx_queue_params {
+	/* 0 best effort/legacy */
+	/* 1 background */
+	/* 2 video */
+	/* 3 voice */
+	u8 queueId;
+
+	/* WSM_ACK_POLICY_... */
+	u8 ackPolicy;
+
+	/* Medium Time of TSPEC (in 32us units) allowed per */
+	/* One Second Averaging Period for this queue. */
+	u16 allowedMediumTime;
+
+	/* dot11MaxTransmitMsduLifetime to be used for the */
+	/* specified queue. */
+	u32 maxTransmitLifetime;
+};
+
+int wsm_set_tx_queue_params(struct cw1200_common *priv,
+			    const struct wsm_set_tx_queue_params *arg);
+
+/* 3.36 */
+struct wsm_edca_queue_params {
+	/* CWmin (in slots) for the access class. */
+	/* [in] */ u16 cwMin;
+
+	/* CWmax (in slots) for the access class. */
+	/* [in] */ u16 cwMax;
+
+	/* AIFS (in slots) for the access class. */
+	/* [in] */ u8 aifns;
+
+	/* TX OP Limit (in microseconds) for the access class. */
+	/* [in] */ u16 txOpLimit;
+
+	/* dot11MaxReceiveLifetime to be used for the specified */
+	/* the access class. Overrides the global */
+	/* dot11MaxReceiveLifetime value */
+	/* [in] */ u32 maxReceiveLifetime;
+};
+
+struct wsm_edca_params {
+	/* NOTE: index is a linux queue id. */
+	struct wsm_edca_queue_params params[4];
+};
+
+#define WSM_EDCA_SET(edca, queue, aifs, cw_min, cw_max, txop)	\
+	do {							\
+		struct wsm_edca_queue_params *p = &(edca)->params[queue]; \
+		p->cwMin = (cw_min);				\
+		p->cwMax = (cw_max);				\
+		p->aifns = (aifs);				\
+		p->txOpLimit = (txop);				\
+	} while (0)
+
+int wsm_set_edca_params(struct cw1200_common *priv,
+			const struct wsm_edca_params *arg);
+
+/* 3.38 */
+/* Set-System info. Skipped for now. Irrelevent. */
+
+/* 3.40 */
+struct wsm_switch_channel {
+	/* 1 - means the STA shall not transmit any further */
+	/* frames until the channel switch has completed */
+	/* [in] */ u8 channelMode;
+
+	/* Number of TBTTs until channel switch occurs. */
+	/* 0 - indicates switch shall occur at any time */
+	/* 1 - occurs immediately before the next TBTT */
+	/* [in] */ u8 channelSwitchCount;
+
+	/* The new channel number to switch to. */
+	/* Note this is defined as per section 2.7. */
+	/* [in] */ u16 newChannelNumber;
+};
+
+int wsm_switch_channel(struct cw1200_common *priv,
+		       const struct wsm_switch_channel *arg);
+
+typedef void (*wsm_channel_switch_cb) (struct cw1200_common *priv);
+
+struct wsm_start {
+	/* WSM_START_MODE_... */
+	/* [in] */ u8 mode;
+
+	/* WSM_PHY_BAND_... */
+	/* [in] */ u8 band;
+
+	/* Channel number */
+	/* [in] */ u16 channelNumber;
+
+	/* Client Traffic window in units of TU */
+	/* Valid only when mode == ..._P2P */
+	/* [in] */ u32 CTWindow;
+
+	/* Interval between two consecutive */
+	/* beacon transmissions in TU. */
+	/* [in] */ u32 beaconInterval;
+
+	/* DTIM period in terms of beacon intervals */
+	/* [in] */ u8 DTIMPeriod;
+
+	/* WSM_JOIN_PREAMBLE_... */
+	/* [in] */ u8 preambleType;
+
+	/* The delay time (in microseconds) period */
+	/* before sending a probe-request. */
+	/* [in] */ u8 probeDelay;
+
+	/* Length of the SSID */
+	/* [in] */ u8 ssidLength;
+
+	/* SSID of the BSS or P2P_GO to be started now. */
+	/* [in] */ u8 ssid[32];
+
+	/* The basic supported rates for the MiniAP. */
+	/* [in] */ u32 basicRateSet;
+};
+
+int wsm_start(struct cw1200_common *priv, const struct wsm_start *arg);
+
+struct wsm_beacon_transmit {
+	/* 1: enable; 0: disable */
+	/* [in] */ u8 enableBeaconing;
+};
+
+int wsm_beacon_transmit(struct cw1200_common *priv,
+			const struct wsm_beacon_transmit *arg);
+
+int wsm_start_find(struct cw1200_common *priv);
+
+int wsm_stop_find(struct cw1200_common *priv);
+
+typedef void (*wsm_find_complete_cb) (struct cw1200_common *priv, u32 status);
+
+struct wsm_suspend_resume {
+	/* See 3.52 */
+	/* Link ID */
+	/* [out] */ int link_id;
+	/* Stop sending further Tx requests down to device for this link */
+	/* [out] */ bool stop;
+	/* Transmit multicast Frames */
+	/* [out] */ bool multicast;
+	/* The AC on which Tx to be suspended /resumed. */
+	/* This is applicable only for U-APSD */
+	/* WSM_QUEUE_... */
+	/* [out] */ int queue;
+};
+
+typedef void (*wsm_suspend_resume_cb) (struct cw1200_common *priv,
+				       struct wsm_suspend_resume *arg);
+
+/* 3.53 Update-IE request: Not implemented: not relevant. */
+
+/* 3.56 */
+struct wsm_map_link {
+	/* MAC address of the remote device */
+	/* [in] */ u8 mac_addr[6];
+	/* [in] */ u8 link_id;
+};
+
+int wsm_map_link(struct cw1200_common *priv, const struct wsm_map_link *arg);
+
+struct wsm_cbc {
+	wsm_scan_complete_cb scan_complete;
+	wsm_tx_confirm_cb tx_confirm;
+	wsm_rx_cb rx;
+	wsm_event_cb event;
+	wsm_set_pm_complete_cb set_pm_complete;
+	wsm_channel_switch_cb channel_switch;
+	wsm_find_complete_cb find_complete;
+	wsm_suspend_resume_cb suspend_resume;
+};
+
+/* ******************************************************************** */
+/* MIB shortcats							*/
+
+static inline int wsm_set_output_power(struct cw1200_common *priv,
+				       int power_level)
+{
+	__le32 val = __cpu_to_le32(power_level);
+	return wsm_write_mib(priv, WSM_MIB_ID_DOT11_CURRENT_TX_POWER_LEVEL,
+			     &val, sizeof(val));
+}
+
+static inline int wsm_set_beacon_wakeup_period(struct cw1200_common *priv,
+					       unsigned dtim_interval,
+					       unsigned listen_interval)
+{
+	struct {
+		u8 numBeaconPeriods;
+		u8 reserved;
+		__le16 listenInterval;
+	} val = {
+	dtim_interval, 0, __cpu_to_le16(listen_interval)};
+	if (dtim_interval > 0xFF || listen_interval > 0xFFFF)
+		return -EINVAL;
+	else
+		return wsm_write_mib(priv, WSM_MIB_ID_BEACON_WAKEUP_PERIOD,
+				     &val, sizeof(val));
+}
+
+struct wsm_rcpi_rssi_threshold {
+	u8 rssiRcpiMode;	/* WSM_RCPI_RSSI_... */
+	u8 lowerThreshold;
+	u8 upperThreshold;
+	u8 rollingAverageCount;
+};
+
+static inline int wsm_set_rcpi_rssi_threshold(struct cw1200_common *priv,
+					struct wsm_rcpi_rssi_threshold *arg)
+{
+	return wsm_write_mib(priv, WSM_MIB_ID_RCPI_RSSI_THRESHOLD, arg,
+			     sizeof(*arg));
+}
+
+static inline int wsm_get_station_id(struct cw1200_common *priv, u8 * mac)
+{
+	return wsm_read_mib(priv, WSM_MIB_ID_DOT11_STATION_ID, mac, ETH_ALEN);
+}
+
+struct wsm_rx_filter {
+	bool promiscuous;
+	bool bssid;
+	bool fcs;
+};
+
+static inline int wsm_set_rx_filter(struct cw1200_common *priv,
+				    const struct wsm_rx_filter *arg)
+{
+	__le32 val = 0;
+	if (arg->promiscuous)
+		val |= __cpu_to_le32(BIT(0));
+	if (arg->bssid)
+		val |= __cpu_to_le32(BIT(1));
+	if (arg->fcs)
+		val |= __cpu_to_le32(BIT(2));
+	return wsm_write_mib(priv, WSM_MIB_ID_RX_FILTER, &val, sizeof(val));
+}
+
+struct wsm_beacon_filter_control {
+	int enabled;
+	int bcn_count;
+};
+
+static inline int wsm_beacon_filter_control(struct cw1200_common *priv,
+					struct wsm_beacon_filter_control *arg)
+{
+	struct {
+		__le32 enabled;
+		__le32 bcn_count;
+	} val;
+	val.enabled = __cpu_to_le32(arg->enabled);
+	val.bcn_count = __cpu_to_le32(arg->bcn_count);
+	return wsm_write_mib(priv, WSM_MIB_ID_BEACON_FILTER_ENABLE, &val,
+			     sizeof(val));
+}
+
+enum wsm_power_mode {
+	wsm_power_mode_active = 0,
+	wsm_power_mode_doze = 1,
+	wsm_power_mode_quiescent = 2,
+};
+
+struct wsm_operational_mode {
+	enum wsm_power_mode power_mode;
+	int disableMoreFlagUsage;
+	int performAntDiversity;
+};
+
+static inline int wsm_set_operational_mode(struct cw1200_common *priv,
+					const struct wsm_operational_mode *arg)
+{
+	u8 val = arg->power_mode;
+	if (arg->disableMoreFlagUsage)
+		val |= BIT(4);
+	if (arg->performAntDiversity)
+		val |= BIT(5);
+	return wsm_write_mib(priv, WSM_MIB_ID_OPERATIONAL_POWER_MODE, &val,
+			     sizeof(val));
+}
+
+struct wsm_template_frame {
+	u8 frame_type;
+	u8 rate;
+	struct sk_buff *skb;
+};
+
+static inline int wsm_set_template_frame(struct cw1200_common *priv,
+					 struct wsm_template_frame *arg)
+{
+	int ret;
+	u8 *p = skb_push(arg->skb, 4);
+	p[0] = arg->frame_type;
+	p[1] = arg->rate;
+	((u16 *) p)[1] = __cpu_to_le32(arg->skb->len - 4);
+	ret = wsm_write_mib(priv, WSM_MIB_ID_TEMPLATE_FRAME, p, arg->skb->len);
+	skb_pull(arg->skb, 4);
+	return ret;
+}
+
+static inline int wsm_set_block_ack_policy(struct cw1200_common *priv,
+					   u8 blockAckTxTidPolicy,
+					   u8 blockAckRxTidPolicy)
+{
+	struct {
+		u8 blockAckTxTidPolicy;
+		u8 reserved1;
+		u8 blockAckRxTidPolicy;
+		u8 reserved2;
+	} val = {
+		.blockAckTxTidPolicy = blockAckTxTidPolicy,
+		.blockAckRxTidPolicy = blockAckRxTidPolicy,
+	};
+	return wsm_write_mib(priv, WSM_MIB_ID_BLOCK_ACK_POLICY, &val,
+			     sizeof(val));
+}
+
+struct wsm_association_mode {
+	u8 flags;		/* WSM_ASSOCIATION_MODE_... */
+	u8 preambleType;	/* WSM_JOIN_PREAMBLE_... */
+	u8 greenfieldMode;	/* 1 for greenfield */
+	u8 mpduStartSpacing;
+	__le32 basicRateSet;
+};
+
+static inline int wsm_set_association_mode(struct cw1200_common *priv,
+					   struct wsm_association_mode *arg)
+{
+	return wsm_write_mib(priv, WSM_MIB_ID_SET_ASSOCIATION_MODE, arg,
+			     sizeof(*arg));
+}
+
+struct wsm_set_tx_rate_retry_policy_header {
+	u8 numTxRatePolicies;
+	u8 reserved[3];
+} __packed;
+
+struct wsm_set_tx_rate_retry_policy_policy {
+	u8 policyIndex;
+	u8 shortRetryCount;
+	u8 longRetryCount;
+	u8 policyFlags;
+	u8 rateRecoveryCount;
+	u8 reserved[3];
+	__le32 rateCountIndices[3];
+} __packed;
+
+struct wsm_set_tx_rate_retry_policy {
+	struct wsm_set_tx_rate_retry_policy_header hdr;
+	struct wsm_set_tx_rate_retry_policy_policy tbl[8];
+} __packed;
+
+static inline int wsm_set_tx_rate_retry_policy(struct cw1200_common *priv,
+				struct wsm_set_tx_rate_retry_policy *arg)
+{
+	size_t size = sizeof(struct wsm_set_tx_rate_retry_policy_header) +
+	    arg->hdr.numTxRatePolicies *
+	    sizeof(struct wsm_set_tx_rate_retry_policy_policy);
+	return wsm_write_mib(priv, WSM_MIB_ID_SET_TX_RATE_RETRY_POLICY, arg,
+			     size);
+}
+
+/* Undocumented MIBs: */
+/* 4.35 P2PDeviceInfo */
+#define D11_MAX_SSID_LEN		(32)
+
+struct wsm_p2p_device_type {
+	__le16 categoryId;
+	u8 oui[4];
+	__le16 subCategoryId;
+} __packed;
+
+struct wsm_p2p_device_info {
+	struct wsm_p2p_device_type primaryDevice;
+	u8 reserved1[3];
+	u8 devNameSize;
+	u8 localDevName[D11_MAX_SSID_LEN];
+	u8 reserved2[3];
+	u8 numSecDevSupported;
+	struct wsm_p2p_device_type secondaryDevices[0];
+} __packed;
+
+/* 4.36 SetWCDMABand - WO */
+struct wsm_cdma_band {
+	u8 WCDMA_Band;
+	u8 reserved[3];
+} __packed;
+
+/* 4.37 GroupTxSequenceCounter - RO */
+struct wsm_group_tx_seq {
+	__le32 bits_47_16;
+	__le16 bits_15_00;
+	__le16 reserved;
+} __packed;
+
+/* 4.39 SetHtProtection - WO */
+#define WSM_DUAL_CTS_PROT_ENB		(1 << 0)
+#define WSM_NON_GREENFIELD_STA		PRESENT(1 << 1)
+#define WSM_HT_PROT_MODE__NO_PROT	(0 << 2)
+#define WSM_HT_PROT_MODE__NON_MEMBER	(1 << 2)
+#define WSM_HT_PROT_MODE__20_MHZ	(2 << 2)
+#define WSM_HT_PROT_MODE__NON_HT_MIXED	(3 << 2)
+#define WSM_LSIG_TXOP_PROT_FULL		(1 << 4)
+#define WSM_LARGE_L_LENGTH_PROT		(1 << 5)
+
+struct wsm_ht_protection {
+	__le32 flags;
+} __packed;
+
+/* 4.40 GPIO Command - R/W */
+#define WSM_GPIO_COMMAND_SETUP	0
+#define WSM_GPIO_COMMAND_READ	1
+#define WSM_GPIO_COMMAND_WRITE	2
+#define WSM_GPIO_COMMAND_RESET	3
+#define WSM_GPIO_ALL_PINS	0xFF
+
+struct wsm_gpio_command {
+	u8 GPIO_Command;
+	u8 pin;
+	__le16 config;
+} __packed;
+
+/* 4.41 TSFCounter - RO */
+struct wsm_tsf_counter {
+	__le64 TSF_Counter;
+} __packed;
+
+/* 4.43 Keep alive period */
+struct wsm_keep_alive_period {
+	__le16 keepAlivePeriod;
+	u8 reserved[2];
+} __packed;
+
+static inline int wsm_keep_alive_period(struct cw1200_common *priv,
+					int period)
+{
+	struct wsm_keep_alive_period arg = {
+		.keepAlivePeriod = period,
+	};
+	return wsm_write_mib(priv, WSM_MIB_ID_KEEP_ALIVE_PERIOD,
+			&arg, sizeof(arg));
+};
+
+/* BSSID filtering */
+struct wsm_set_bssid_filtering {
+	u8 filter;
+	u8 reserved[3];
+} __packed;
+
+static inline int wsm_set_bssid_filtering(struct cw1200_common *priv,
+					  bool enabled)
+{
+	struct wsm_set_bssid_filtering arg = {
+		.filter = !enabled,
+	};
+	return wsm_write_mib(priv, WSM_MIB_ID_DISABLE_BSSID_FILTER,
+			&arg, sizeof(arg));
+}
+
+/* ******************************************************************** */
+/* WSM TX port control							*/
+
+void wsm_lock_tx(struct cw1200_common *priv);
+void wsm_lock_tx_async(struct cw1200_common *priv);
+void wsm_flush_tx(struct cw1200_common *priv);
+void wsm_unlock_tx(struct cw1200_common *priv);
+
+/* ******************************************************************** */
+/* WSM / BH API								*/
+
+int wsm_handle_exception(struct cw1200_common *priv, u8 * data, size_t len);
+int wsm_handle_rx(struct cw1200_common *priv, int id, struct wsm_hdr *wsm,
+		  struct sk_buff **skb_p);
+
+/* ******************************************************************** */
+/* wsm_buf API								*/
+
+struct wsm_buf {
+	u8 *begin;
+	u8 *data;
+	u8 *end;
+};
+
+void wsm_buf_init(struct wsm_buf *buf);
+void wsm_buf_deinit(struct wsm_buf *buf);
+
+/* ******************************************************************** */
+/* wsm_cmd API								*/
+
+struct wsm_cmd {
+	spinlock_t lock;
+	int done;
+	u8 *ptr;
+	size_t len;
+	void *arg;
+	int ret;
+	u16 cmd;
+};
+
+/* ******************************************************************** */
+/* WSM TX buffer access							*/
+
+int wsm_get_tx(struct cw1200_common *priv, u8 ** data, size_t * tx_len);
+void wsm_txed(struct cw1200_common *priv, u8 * data);
+
+/* ******************************************************************** */
+/* Queue mapping: WSM <---> linux					*/
+/* Linux: VO VI BE BK							*/
+/* WSM:   BE BK VI VO							*/
+
+static inline u8 wsm_queue_id_to_linux(u8 queueId)
+{
+	static const u8 queue_mapping[] = {
+		2, 3, 1, 0
+	};
+	return queue_mapping[queueId];
+}
+
+static inline u8 wsm_queue_id_to_wsm(u8 queueId)
+{
+	static const u8 queue_mapping[] = {
+		3, 2, 0, 1
+	};
+	return queue_mapping[queueId];
+}
+
+#endif /* CW1200_HWIO_H_INCLUDED */