mac80211: b43: backport b43 patches from wireless testing

This brings b43 up to wireless-testing/master master-2014-07-15

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 41668

6 files changed, 1745 insertions, 129 deletions

diff --git a/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch b/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
index 4dce8e1e3e..8ba481fa5f 100644
--- a/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
+++ b/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
@@ -1,6 +1,6 @@
 backport b43 patches from wireless testing
 
-This brings b43 up to wireless-testing/master master-2014-07-10
+This brings b43 up to wireless-testing/master master-2014-07-15
 
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
@@ -16,7 +16,32 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	BCMA_CORETABLE_END
  };
  MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
-@@ -2201,52 +2205,82 @@ err_format:
+@@ -206,6 +210,9 @@ static struct ieee80211_channel b43_2ghz
+ 	CHAN2G(13, 2472, 0),
+ 	CHAN2G(14, 2484, 0),
+ };
++
++/* No support for the last 3 channels (12, 13, 14) */
++#define b43_2ghz_chantable_limited_size		11
+ #undef CHAN2G
+ 
+ #define CHAN4G(_channel, _flags) {				\
+@@ -331,6 +338,14 @@ static struct ieee80211_supported_band b
+ 	.n_bitrates	= b43_g_ratetable_size,
+ };
+ 
++static struct ieee80211_supported_band b43_band_2ghz_limited = {
++	.band		= IEEE80211_BAND_2GHZ,
++	.channels	= b43_2ghz_chantable,
++	.n_channels	= b43_2ghz_chantable_limited_size,
++	.bitrates	= b43_g_ratetable,
++	.n_bitrates	= b43_g_ratetable_size,
++};
++
+ static void b43_wireless_core_exit(struct b43_wldev *dev);
+ static int b43_wireless_core_init(struct b43_wldev *dev);
+ static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
+@@ -2201,52 +2216,82 @@ err_format:
  	return -EPROTO;
  }
  
@@ -134,7 +159,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
  	if (err)
  		goto err_load;
-@@ -2268,117 +2302,121 @@ static int b43_try_request_fw(struct b43
+@@ -2268,117 +2313,121 @@ static int b43_try_request_fw(struct b43
  		goto err_load;
  
  	/* Get initvals */
@@ -320,7 +345,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
  	if (err)
  		goto err_load;
-@@ -3742,7 +3780,9 @@ static int b43_switch_band(struct b43_wl
+@@ -3742,7 +3791,9 @@ static int b43_switch_band(struct b43_wl
  	b43dbg(dev->wl, "Switching to %s GHz band\n",
  	       band_to_string(chan->band));
  
@@ -331,7 +356,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	phy->gmode = gmode;
  	b43_phy_put_into_reset(dev);
-@@ -3796,38 +3836,29 @@ static void b43_set_retry_limits(struct
+@@ -3796,38 +3847,29 @@ static void b43_set_retry_limits(struct
  static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
  {
  	struct b43_wl *wl = hw_to_b43_wl(hw);
@@ -384,7 +409,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
  		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
-@@ -3836,11 +3867,6 @@ static int b43_op_config(struct ieee8021
+@@ -3836,11 +3878,6 @@ static int b43_op_config(struct ieee8021
  	if (!changed)
  		goto out_mac_enable;
  
@@ -396,7 +421,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
  
  	/* Adjust the desired TX power level. */
-@@ -3876,12 +3902,8 @@ static int b43_op_config(struct ieee8021
+@@ -3876,12 +3913,8 @@ static int b43_op_config(struct ieee8021
  
  out_mac_enable:
  	b43_mac_enable(dev);
@@ -409,7 +434,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	return err;
  }
  
-@@ -4307,6 +4329,7 @@ static char *b43_phy_name(struct b43_wld
+@@ -4307,6 +4340,7 @@ static char *b43_phy_name(struct b43_wld
  static int b43_phy_versioning(struct b43_wldev *dev)
  {
  	struct b43_phy *phy = &dev->phy;
@@ -417,7 +442,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	u32 tmp;
  	u8 analog_type;
  	u8 phy_type;
-@@ -4321,20 +4344,20 @@ static int b43_phy_versioning(struct b43
+@@ -4321,23 +4355,23 @@ static int b43_phy_versioning(struct b43
  	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
  	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
  	phy_rev = (tmp & B43_PHYVER_VERSION);
@@ -446,8 +471,12 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +#endif
  #ifdef CPTCFG_B43_PHY_N
  	case B43_PHYTYPE_N:
- 		if (phy_rev > 9)
-@@ -4372,7 +4395,15 @@ static int b43_phy_versioning(struct b43
+-		if (phy_rev > 9)
++		if (phy_rev >= 19)
+ 			unsupported = 1;
+ 		break;
+ #endif
+@@ -4372,7 +4406,15 @@ static int b43_phy_versioning(struct b43
  		analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
  
  	/* Get RADIO versioning */
@@ -464,7 +493,54 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		u16 radio24[3];
  
  		for (tmp = 0; tmp < 3; tmp++) {
-@@ -5164,6 +5195,7 @@ static void b43_supported_bands(struct b
+@@ -4428,7 +4470,10 @@ static int b43_phy_versioning(struct b43
+ 			unsupported = 1;
+ 		break;
+ 	case B43_PHYTYPE_N:
+-		if (radio_ver != 0x2055 && radio_ver != 0x2056)
++		if (radio_ver != 0x2055 && radio_ver != 0x2056 &&
++		    radio_ver != 0x2057)
++			unsupported = 1;
++		if (radio_ver == 0x2057 && !(radio_rev == 9))
+ 			unsupported = 1;
+ 		break;
+ 	case B43_PHYTYPE_LP:
+@@ -4447,13 +4492,13 @@ static int b43_phy_versioning(struct b43
+ 		B43_WARN_ON(1);
+ 	}
+ 	if (unsupported) {
+-		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
+-		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
++		b43err(dev->wl,
++		       "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u)\n",
+ 		       radio_manuf, radio_ver, radio_rev);
+ 		return -EOPNOTSUPP;
+ 	}
+-	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
+-	       radio_manuf, radio_ver, radio_rev);
++	b43info(dev->wl, "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u\n",
++		radio_manuf, radio_ver, radio_rev);
+ 
+ 	phy->radio_manuf = radio_manuf;
+ 	phy->radio_ver = radio_ver;
+@@ -5064,9 +5109,15 @@ static int b43_setup_bands(struct b43_wl
+ 			   bool have_2ghz_phy, bool have_5ghz_phy)
+ {
+ 	struct ieee80211_hw *hw = dev->wl->hw;
++	struct b43_phy *phy = &dev->phy;
++	bool limited_2g;
++
++	/* We don't support all 2 GHz channels on some devices */
++	limited_2g = phy->radio_ver == 0x2057 && phy->radio_rev == 9;
+ 
+ 	if (have_2ghz_phy)
+-		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
++		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = limited_2g ?
++			&b43_band_2ghz_limited : &b43_band_2GHz;
+ 	if (dev->phy.type == B43_PHYTYPE_N) {
+ 		if (have_5ghz_phy)
+ 			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
+@@ -5164,6 +5215,7 @@ static void b43_supported_bands(struct b
  static int b43_wireless_core_attach(struct b43_wldev *dev)
  {
  	struct b43_wl *wl = dev->wl;
@@ -472,7 +548,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	int err;
  	u32 tmp;
  	bool have_2ghz_phy = false, have_5ghz_phy = false;
-@@ -5181,6 +5213,8 @@ static int b43_wireless_core_attach(stru
+@@ -5181,6 +5233,8 @@ static int b43_wireless_core_attach(stru
  		goto out;
  	}
  
@@ -481,6 +557,31 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	/* Try to guess supported bands for the first init needs */
  	switch (dev->dev->bus_type) {
  #ifdef CPTCFG_B43_BCMA
+@@ -5214,14 +5268,16 @@ static int b43_wireless_core_attach(stru
+ 	b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
+ 
+ 	/* We don't support 5 GHz on some PHYs yet */
+-	switch (dev->phy.type) {
+-	case B43_PHYTYPE_A:
+-	case B43_PHYTYPE_G:
+-	case B43_PHYTYPE_N:
+-	case B43_PHYTYPE_LP:
+-	case B43_PHYTYPE_HT:
+-		b43warn(wl, "5 GHz band is unsupported on this PHY\n");
+-		have_5ghz_phy = false;
++	if (have_5ghz_phy) {
++		switch (dev->phy.type) {
++		case B43_PHYTYPE_A:
++		case B43_PHYTYPE_G:
++		case B43_PHYTYPE_N:
++		case B43_PHYTYPE_LP:
++		case B43_PHYTYPE_HT:
++			b43warn(wl, "5 GHz band is unsupported on this PHY\n");
++			have_5ghz_phy = false;
++		}
+ 	}
+ 
+ 	if (!have_2ghz_phy && !have_5ghz_phy) {
 --- a/drivers/net/wireless/b43/phy_common.c
 +++ b/drivers/net/wireless/b43/phy_common.c
 @@ -45,11 +45,10 @@ int b43_phy_allocate(struct b43_wldev *d
@@ -625,7 +726,145 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
 --- a/drivers/net/wireless/b43/phy_n.c
 +++ b/drivers/net/wireless/b43/phy_n.c
-@@ -590,7 +590,103 @@ static void b43_nphy_set_rf_sequence(str
+@@ -36,6 +36,7 @@
+ #include "main.h"
+ 
+ struct nphy_txgains {
++	u16 tx_lpf[2];
+ 	u16 txgm[2];
+ 	u16 pga[2];
+ 	u16 pad[2];
+@@ -43,6 +44,7 @@ struct nphy_txgains {
+ };
+ 
+ struct nphy_iqcal_params {
++	u16 tx_lpf;
+ 	u16 txgm;
+ 	u16 pga;
+ 	u16 pad;
+@@ -69,6 +71,14 @@ enum b43_nphy_rf_sequence {
+ 	B43_RFSEQ_UPDATE_GAINU,
+ };
+ 
++enum n_rf_ctl_over_cmd {
++	N_RF_CTL_OVER_CMD_RXRF_PU = 0,
++	N_RF_CTL_OVER_CMD_RX_PU = 1,
++	N_RF_CTL_OVER_CMD_TX_PU = 2,
++	N_RF_CTL_OVER_CMD_RX_GAIN = 3,
++	N_RF_CTL_OVER_CMD_TX_GAIN = 4,
++};
++
+ enum n_intc_override {
+ 	N_INTC_OVERRIDE_OFF = 0,
+ 	N_INTC_OVERRIDE_TRSW = 1,
+@@ -140,11 +150,19 @@ ok:
+ 	b43_phy_write(dev, B43_NPHY_RFSEQMODE, seq_mode);
+ }
+ 
++static void b43_nphy_rf_ctl_override_rev19(struct b43_wldev *dev, u16 field,
++					   u16 value, u8 core, bool off,
++					   u8 override_id)
++{
++	/* TODO */
++}
++
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlOverrideRev7 */
+ static void b43_nphy_rf_ctl_override_rev7(struct b43_wldev *dev, u16 field,
+ 					  u16 value, u8 core, bool off,
+ 					  u8 override)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	const struct nphy_rf_control_override_rev7 *e;
+ 	u16 en_addrs[3][2] = {
+ 		{ 0x0E7, 0x0EC }, { 0x342, 0x343 }, { 0x346, 0x347 }
+@@ -154,6 +172,11 @@ static void b43_nphy_rf_ctl_override_rev
+ 	u16 val_addr;
+ 	u8 i;
+ 
++	if (phy->rev >= 19 || phy->rev < 3) {
++		B43_WARN_ON(1);
++		return;
++	}
++
+ 	/* Remember: we can get NULL! */
+ 	e = b43_nphy_get_rf_ctl_over_rev7(dev, field, override);
+ 
+@@ -181,6 +204,50 @@ static void b43_nphy_rf_ctl_override_rev
+ 	}
+ }
+ 
++/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlOverideOneToMany */
++static void b43_nphy_rf_ctl_override_one_to_many(struct b43_wldev *dev,
++						 enum n_rf_ctl_over_cmd cmd,
++						 u16 value, u8 core, bool off)
++{
++	struct b43_phy *phy = &dev->phy;
++	u16 tmp;
++
++	B43_WARN_ON(phy->rev < 7);
++
++	switch (cmd) {
++	case N_RF_CTL_OVER_CMD_RXRF_PU:
++		b43_nphy_rf_ctl_override_rev7(dev, 0x20, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x10, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x08, value, core, off, 1);
++		break;
++	case N_RF_CTL_OVER_CMD_RX_PU:
++		b43_nphy_rf_ctl_override_rev7(dev, 0x4, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x2, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x1, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x2, value, core, off, 2);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x0800, value, core, off, 1);
++		break;
++	case N_RF_CTL_OVER_CMD_TX_PU:
++		b43_nphy_rf_ctl_override_rev7(dev, 0x4, value, core, off, 0);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x2, value, core, off, 1);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x1, value, core, off, 2);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x0800, value, core, off, 1);
++		break;
++	case N_RF_CTL_OVER_CMD_RX_GAIN:
++		tmp = value & 0xFF;
++		b43_nphy_rf_ctl_override_rev7(dev, 0x0800, tmp, core, off, 0);
++		tmp = value >> 8;
++		b43_nphy_rf_ctl_override_rev7(dev, 0x6000, tmp, core, off, 0);
++		break;
++	case N_RF_CTL_OVER_CMD_TX_GAIN:
++		tmp = value & 0x7FFF;
++		b43_nphy_rf_ctl_override_rev7(dev, 0x1000, tmp, core, off, 0);
++		tmp = value >> 14;
++		b43_nphy_rf_ctl_override_rev7(dev, 0x4000, tmp, core, off, 0);
++		break;
++	}
++}
++
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlOverride */
+ static void b43_nphy_rf_ctl_override(struct b43_wldev *dev, u16 field,
+ 				     u16 value, u8 core, bool off)
+@@ -264,6 +331,8 @@ static void b43_nphy_rf_ctl_intc_overrid
+ 	u16 reg, tmp, tmp2, val;
+ 	int core;
+ 
++	/* TODO: What about rev19+? Revs 3+ and 7+ are a bit similar */
++
+ 	for (core = 0; core < 2; core++) {
+ 		if ((core_sel == 1 && core != 0) ||
+ 		    (core_sel == 2 && core != 1))
+@@ -505,6 +574,14 @@ static void b43_nphy_stay_in_carrier_sea
+ 	}
+ }
+ 
++/* http://bcm-v4.sipsolutions.net/PHY/N/Read_Lpf_Bw_Ctl */
++static u16 b43_nphy_read_lpf_ctl(struct b43_wldev *dev, u16 offset)
++{
++	if (!offset)
++		offset = b43_is_40mhz(dev) ? 0x159 : 0x154;
++	return b43_ntab_read(dev, B43_NTAB16(7, offset)) & 0x7;
++}
++
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/AdjustLnaGainTbl */
+ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
+ {
+@@ -590,7 +667,148 @@ static void b43_nphy_set_rf_sequence(str
   * Radio 0x2057
   **************************************************/
  
@@ -709,10 +948,55 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +			b43_radio_write(dev, R2057_RFPLL_LOOPFILTER_C2, 0x8);
 +		}
 +		break;
++	case 9: /* e.g. PHY rev 16 */
++		b43_radio_write(dev, R2057_LOGEN_PTAT_RESETS, 0x20);
++		b43_radio_write(dev, R2057_VCOBUF_IDACS, 0x18);
++		if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
++			b43_radio_write(dev, R2057_LOGEN_PTAT_RESETS, 0x38);
++			b43_radio_write(dev, R2057_VCOBUF_IDACS, 0x0f);
++
++			if (b43_is_40mhz(dev)) {
++				/* TODO */
++			} else {
++				b43_radio_write(dev,
++						R2057_PAD_BIAS_FILTER_BWS_CORE0,
++						0x3c);
++				b43_radio_write(dev,
++						R2057_PAD_BIAS_FILTER_BWS_CORE1,
++						0x3c);
++			}
++		}
++		break;
 +	/* TODO */
 +	}
 +
-+	/* TODO */
++	if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
++		u16 txmix2g_tune_boost_pu = 0;
++		u16 pad2g_tune_pus = 0;
++
++		if (b43_nphy_ipa(dev)) {
++			switch (phy->radio_rev) {
++			case 9:
++				txmix2g_tune_boost_pu = 0x0041;
++				/* TODO */
++				break;
++			}
++			/* TODO */
++		}
++
++		if (txmix2g_tune_boost_pu)
++			b43_radio_write(dev, R2057_TXMIX2G_TUNE_BOOST_PU_CORE0,
++					txmix2g_tune_boost_pu);
++		if (pad2g_tune_pus)
++			b43_radio_write(dev, R2057_PAD2G_TUNE_PUS_CORE0,
++					pad2g_tune_pus);
++		if (txmix2g_tune_boost_pu)
++			b43_radio_write(dev, R2057_TXMIX2G_TUNE_BOOST_PU_CORE1,
++					txmix2g_tune_boost_pu);
++		if (pad2g_tune_pus)
++			b43_radio_write(dev, R2057_PAD2G_TUNE_PUS_CORE1,
++					pad2g_tune_pus);
++	}
 +
 +	usleep_range(50, 100);
 +
@@ -730,7 +1014,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  static u8 b43_radio_2057_rcal(struct b43_wldev *dev)
  {
  	struct b43_phy *phy = &dev->phy;
-@@ -603,15 +699,25 @@ static u8 b43_radio_2057_rcal(struct b43
+@@ -603,15 +821,25 @@ static u8 b43_radio_2057_rcal(struct b43
  		b43_radio_maskset(dev, 0x1ca, ~0x2, 0x1);
  	}
  
@@ -759,7 +1043,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	b43_radio_mask(dev, R2057_RCAL_CONFIG, ~0x1);
  
  	if (phy->radio_rev == 5) {
-@@ -627,7 +733,9 @@ static u8 b43_radio_2057_rcal(struct b43
+@@ -627,7 +855,9 @@ static u8 b43_radio_2057_rcal(struct b43
  	return tmp & 0x3e;
  }
  
@@ -770,7 +1054,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  static u16 b43_radio_2057_rccal(struct b43_wldev *dev)
  {
  	struct b43_phy *phy = &dev->phy;
-@@ -635,49 +743,76 @@ static u16 b43_radio_2057_rccal(struct b
+@@ -635,49 +865,76 @@ static u16 b43_radio_2057_rccal(struct b
  			phy->radio_rev == 6);
  	u16 tmp;
  
@@ -853,7 +1137,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	return tmp;
  }
  
-@@ -700,13 +835,11 @@ static void b43_radio_2057_init_post(str
+@@ -700,13 +957,11 @@ static void b43_radio_2057_init_post(str
  	b43_radio_mask(dev, R2057_RFPLL_MISC_CAL_RESETN, ~0x78);
  	b43_radio_mask(dev, R2057_XTAL_CONFIG2, ~0x80);
  
@@ -868,7 +1152,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  }
  
  /* http://bcm-v4.sipsolutions.net/802.11/Radio/2057/Init */
-@@ -800,6 +933,7 @@ static void b43_chantab_radio_2056_uploa
+@@ -800,6 +1055,7 @@ static void b43_chantab_radio_2056_uploa
  static void b43_radio_2056_setup(struct b43_wldev *dev,
  				const struct b43_nphy_channeltab_entry_rev3 *e)
  {
@@ -876,7 +1160,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	struct ssb_sprom *sprom = dev->dev->bus_sprom;
  	enum ieee80211_band band = b43_current_band(dev->wl);
  	u16 offset;
-@@ -897,7 +1031,7 @@ static void b43_radio_2056_setup(struct
+@@ -897,7 +1153,7 @@ static void b43_radio_2056_setup(struct
  					offset | B2056_TX_MIXG_BOOST_TUNE,
  					mixg_boost);
  			} else {
@@ -885,7 +1169,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  				b43_radio_write(dev,
  					offset | B2056_TX_INTPAG_IMAIN_STAT,
  					bias);
-@@ -911,7 +1045,7 @@ static void b43_radio_2056_setup(struct
+@@ -911,7 +1167,7 @@ static void b43_radio_2056_setup(struct
  			b43_radio_write(dev, offset | B2056_TX_PA_SPARE1, 0xee);
  		}
  	} else if (dev->phy.n->ipa5g_on && band == IEEE80211_BAND_5GHZ) {
@@ -894,7 +1178,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		if (freq < 5100) {
  			paa_boost = 0xA;
  			pada_boost = 0x77;
-@@ -1028,7 +1162,7 @@ static void b43_radio_init2056_post(stru
+@@ -1028,7 +1284,7 @@ static void b43_radio_init2056_post(stru
  	b43_radio_mask(dev, B2056_SYN_COM_RESET, ~0x2);
  	b43_radio_mask(dev, B2056_SYN_PLL_MAST2, ~0xFC);
  	b43_radio_mask(dev, B2056_SYN_RCCAL_CTRL0, ~0x1);
@@ -903,7 +1187,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		b43_radio_2056_rcal(dev);
  }
  
-@@ -1041,8 +1175,6 @@ static void b43_radio_init2056(struct b4
+@@ -1041,8 +1297,6 @@ static void b43_radio_init2056(struct b4
  	b43_radio_init2056_pre(dev);
  	b2056_upload_inittabs(dev, 0, 0);
  	b43_radio_init2056_post(dev);
@@ -912,7 +1196,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  }
  
  /**************************************************
-@@ -1214,8 +1346,7 @@ static u16 b43_nphy_gen_load_samples(str
+@@ -1214,8 +1468,7 @@ static u16 b43_nphy_gen_load_samples(str
  	u16 bw, len, rot, angle;
  	struct b43_c32 *samples;
  
@@ -922,7 +1206,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	len = bw << 3;
  
  	if (test) {
-@@ -1224,7 +1355,7 @@ static u16 b43_nphy_gen_load_samples(str
+@@ -1224,7 +1477,7 @@ static u16 b43_nphy_gen_load_samples(str
  		else
  			bw = 80;
  
@@ -931,7 +1215,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			bw <<= 1;
  
  		len = bw << 1;
-@@ -1252,7 +1383,8 @@ static u16 b43_nphy_gen_load_samples(str
+@@ -1252,8 +1505,10 @@ static u16 b43_nphy_gen_load_samples(str
  
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RunSamples */
  static void b43_nphy_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
@@ -939,9 +1223,36 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +				 u16 wait, bool iqmode, bool dac_test,
 +				 bool modify_bbmult)
  {
++	struct b43_phy *phy = &dev->phy;
  	struct b43_phy_n *nphy = dev->phy.n;
  	int i;
-@@ -1266,12 +1398,10 @@ static void b43_nphy_run_samples(struct
+ 	u16 seq_mode;
+@@ -1261,17 +1516,35 @@ static void b43_nphy_run_samples(struct
+ 
+ 	b43_nphy_stay_in_carrier_search(dev, true);
+ 
++	if (phy->rev >= 7) {
++		bool lpf_bw3, lpf_bw4;
++
++		lpf_bw3 = b43_phy_read(dev, B43_NPHY_REV7_RF_CTL_OVER3) & 0x80;
++		lpf_bw4 = b43_phy_read(dev, B43_NPHY_REV7_RF_CTL_OVER3) & 0x80;
++
++		if (lpf_bw3 || lpf_bw4) {
++			/* TODO */
++		} else {
++			u16 value = b43_nphy_read_lpf_ctl(dev, 0);
++			if (phy->rev >= 19)
++				b43_nphy_rf_ctl_override_rev19(dev, 0x80, value,
++							       0, false, 1);
++			else
++				b43_nphy_rf_ctl_override_rev7(dev, 0x80, value,
++							      0, false, 1);
++			nphy->lpf_bw_overrode_for_sample_play = true;
++		}
++	}
++
+ 	if ((nphy->bb_mult_save & 0x80000000) == 0) {
+ 		tmp = b43_ntab_read(dev, B43_NTAB16(15, 87));
  		nphy->bb_mult_save = (tmp & 0xFFFF) | 0x80000000;
  	}
  
@@ -958,7 +1269,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	b43_phy_write(dev, B43_NPHY_SAMP_DEPCNT, (samps - 1));
  
-@@ -1289,10 +1419,8 @@ static void b43_nphy_run_samples(struct
+@@ -1289,10 +1562,8 @@ static void b43_nphy_run_samples(struct
  		b43_phy_mask(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x7FFF);
  		b43_phy_set(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8000);
  	} else {
@@ -971,7 +1282,63 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	}
  	for (i = 0; i < 100; i++) {
  		if (!(b43_phy_read(dev, B43_NPHY_RFSEQST) & 1)) {
-@@ -1679,6 +1807,7 @@ static int b43_nphy_poll_rssi(struct b43
+@@ -1392,6 +1663,12 @@ static void b43_nphy_scale_offset_rssi(s
+ 	}
+ }
+ 
++static void b43_nphy_rssi_select_rev19(struct b43_wldev *dev, u8 code,
++				       enum n_rssi_type rssi_type)
++{
++	/* TODO */
++}
++
+ static void b43_nphy_rev3_rssi_select(struct b43_wldev *dev, u8 code,
+ 				      enum n_rssi_type rssi_type)
+ {
+@@ -1461,13 +1738,15 @@ static void b43_nphy_rev3_rssi_select(st
+ 					enum ieee80211_band band =
+ 						b43_current_band(dev->wl);
+ 
+-					if (b43_nphy_ipa(dev))
+-						val = (band == IEEE80211_BAND_5GHZ) ? 0xC : 0xE;
+-					else
+-						val = 0x11;
+-					reg = (i == 0) ? 0x2000 : 0x3000;
+-					reg |= B2055_PADDRV;
+-					b43_radio_write(dev, reg, val);
++					if (dev->phy.rev < 7) {
++						if (b43_nphy_ipa(dev))
++							val = (band == IEEE80211_BAND_5GHZ) ? 0xC : 0xE;
++						else
++							val = 0x11;
++						reg = (i == 0) ? B2056_TX0 : B2056_TX1;
++						reg |= B2056_TX_TX_SSI_MUX;
++						b43_radio_write(dev, reg, val);
++					}
+ 
+ 					reg = (i == 0) ?
+ 						B43_NPHY_AFECTL_OVER1 :
+@@ -1554,7 +1833,9 @@ static void b43_nphy_rev2_rssi_select(st
+ static void b43_nphy_rssi_select(struct b43_wldev *dev, u8 code,
+ 				 enum n_rssi_type type)
+ {
+-	if (dev->phy.rev >= 3)
++	if (dev->phy.rev >= 19)
++		b43_nphy_rssi_select_rev19(dev, code, type);
++	else if (dev->phy.rev >= 3)
+ 		b43_nphy_rev3_rssi_select(dev, code, type);
+ 	else
+ 		b43_nphy_rev2_rssi_select(dev, code, type);
+@@ -1598,6 +1879,8 @@ static int b43_nphy_poll_rssi(struct b43
+ 	u16 save_regs_phy[9];
+ 	u16 s[2];
+ 
++	/* TODO: rev7+ is treated like rev3+, what about rev19+? */
++
+ 	if (dev->phy.rev >= 3) {
+ 		save_regs_phy[0] = b43_phy_read(dev, B43_NPHY_AFECTL_C1);
+ 		save_regs_phy[1] = b43_phy_read(dev, B43_NPHY_AFECTL_C2);
+@@ -1679,6 +1962,7 @@ static int b43_nphy_poll_rssi(struct b43
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RSSICalRev3 */
  static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
  {
@@ -979,7 +1346,85 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	struct b43_phy_n *nphy = dev->phy.n;
  
  	u16 saved_regs_phy_rfctl[2];
-@@ -1901,9 +2030,9 @@ static void b43_nphy_rev3_rssi_cal(struc
+@@ -1696,12 +1980,14 @@ static void b43_nphy_rev3_rssi_cal(struc
+ 		B43_NPHY_AFECTL_OVER1, B43_NPHY_AFECTL_OVER,
+ 		B43_NPHY_AFECTL_C1, B43_NPHY_AFECTL_C2,
+ 		B43_NPHY_TXF_40CO_B1S1, B43_NPHY_RFCTL_OVER,
+-		0x342, 0x343, 0x346, 0x347,
++		B43_NPHY_REV7_RF_CTL_OVER3, B43_NPHY_REV7_RF_CTL_OVER4,
++		B43_NPHY_REV7_RF_CTL_OVER5, B43_NPHY_REV7_RF_CTL_OVER6,
+ 		0x2ff,
+ 		B43_NPHY_TXF_40CO_B1S0, B43_NPHY_TXF_40CO_B32S1,
+ 		B43_NPHY_RFCTL_CMD,
+ 		B43_NPHY_RFCTL_LUT_TRSW_UP1, B43_NPHY_RFCTL_LUT_TRSW_UP2,
+-		0x340, 0x341, 0x344, 0x345,
++		B43_NPHY_REV7_RF_CTL_MISC_REG3, B43_NPHY_REV7_RF_CTL_MISC_REG4,
++		B43_NPHY_REV7_RF_CTL_MISC_REG5, B43_NPHY_REV7_RF_CTL_MISC_REG6,
+ 		B43_NPHY_RFCTL_RSSIO1, B43_NPHY_RFCTL_RSSIO2
+ 	};
+ 	u16 *regs_to_store;
+@@ -1748,9 +2034,24 @@ static void b43_nphy_rev3_rssi_cal(struc
+ 	b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_TRSW, 1, 7);
+ 
+ 	if (dev->phy.rev >= 7) {
+-		/* TODO */
++		b43_nphy_rf_ctl_override_one_to_many(dev,
++						     N_RF_CTL_OVER_CMD_RXRF_PU,
++						     0, 0, false);
++		b43_nphy_rf_ctl_override_one_to_many(dev,
++						     N_RF_CTL_OVER_CMD_RX_PU,
++						     1, 0, false);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x80, 1, 0, false, 0);
++		b43_nphy_rf_ctl_override_rev7(dev, 0x80, 1, 0, false, 0);
+ 		if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
++			b43_nphy_rf_ctl_override_rev7(dev, 0x20, 0, 0, false,
++						      0);
++			b43_nphy_rf_ctl_override_rev7(dev, 0x10, 1, 0, false,
++						      0);
+ 		} else {
++			b43_nphy_rf_ctl_override_rev7(dev, 0x10, 0, 0, false,
++						      0);
++			b43_nphy_rf_ctl_override_rev7(dev, 0x20, 1, 0, false,
++						      0);
+ 		}
+ 	} else {
+ 		b43_nphy_rf_ctl_override(dev, 0x1, 0, 0, false);
+@@ -1779,7 +2080,10 @@ static void b43_nphy_rev3_rssi_cal(struc
+ 		/* Grab RSSI results for every possible VCM */
+ 		for (vcm = 0; vcm < 8; vcm++) {
+ 			if (dev->phy.rev >= 7)
+-				;
++				b43_radio_maskset(dev,
++						  core ? R2057_NB_MASTER_CORE1 :
++							 R2057_NB_MASTER_CORE0,
++						  ~R2057_VCM_MASK, vcm);
+ 			else
+ 				b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC,
+ 						  0xE3, vcm << 2);
+@@ -1810,7 +2114,10 @@ static void b43_nphy_rev3_rssi_cal(struc
+ 
+ 		/* Select the best VCM */
+ 		if (dev->phy.rev >= 7)
+-			;
++			b43_radio_maskset(dev,
++					  core ? R2057_NB_MASTER_CORE1 :
++						 R2057_NB_MASTER_CORE0,
++					  ~R2057_VCM_MASK, vcm);
+ 		else
+ 			b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC,
+ 					  0xE3, vcm_final << 2);
+@@ -1880,6 +2187,10 @@ static void b43_nphy_rev3_rssi_cal(struc
+ 		rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_5G;
+ 	}
+ 	if (dev->phy.rev >= 7) {
++		rssical_radio_regs[0] = b43_radio_read(dev,
++						       R2057_NB_MASTER_CORE0);
++		rssical_radio_regs[1] = b43_radio_read(dev,
++						       R2057_NB_MASTER_CORE1);
+ 	} else {
+ 		rssical_radio_regs[0] = b43_radio_read(dev, B2056_RX0 |
+ 						       B2056_RX_RSSI_MISC);
+@@ -1901,9 +2212,9 @@ static void b43_nphy_rev3_rssi_cal(struc
  
  	/* Remember for which channel we store configuration */
  	if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
@@ -991,7 +1436,41 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	/* End of calibration, restore configuration */
  	b43_nphy_classifier(dev, 7, class);
-@@ -2196,7 +2325,7 @@ static void b43_nphy_gain_ctl_workaround
+@@ -2080,7 +2391,9 @@ static void b43_nphy_rev2_rssi_cal(struc
+  */
+ static void b43_nphy_rssi_cal(struct b43_wldev *dev)
+ {
+-	if (dev->phy.rev >= 3) {
++	if (dev->phy.rev >= 19) {
++		/* TODO */
++	} else if (dev->phy.rev >= 3) {
+ 		b43_nphy_rev3_rssi_cal(dev);
+ 	} else {
+ 		b43_nphy_rev2_rssi_cal(dev, N_RSSI_NB);
+@@ -2093,7 +2406,21 @@ static void b43_nphy_rssi_cal(struct b43
+  * Workarounds
+  **************************************************/
+ 
+-static void b43_nphy_gain_ctl_workarounds_rev3plus(struct b43_wldev *dev)
++static void b43_nphy_gain_ctl_workarounds_rev19(struct b43_wldev *dev)
++{
++	/* TODO */
++}
++
++static void b43_nphy_gain_ctl_workarounds_rev7(struct b43_wldev *dev)
++{
++	struct b43_phy *phy = &dev->phy;
++
++	switch (phy->rev) {
++	/* TODO */
++	}
++}
++
++static void b43_nphy_gain_ctl_workarounds_rev3(struct b43_wldev *dev)
+ {
+ 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
+ 
+@@ -2196,7 +2523,7 @@ static void b43_nphy_gain_ctl_workaround
  	b43_phy_write(dev, B43_NPHY_C1_NBCLIPTHRES, 0x84);
  	b43_phy_write(dev, B43_NPHY_C2_NBCLIPTHRES, 0x84);
  
@@ -1000,7 +1479,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		/* Set dwell lengths */
  		b43_phy_write(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 0x002B);
  		b43_phy_write(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 0x002B);
-@@ -2210,7 +2339,7 @@ static void b43_nphy_gain_ctl_workaround
+@@ -2210,7 +2537,7 @@ static void b43_nphy_gain_ctl_workaround
  	b43_phy_maskset(dev, B43_NPHY_C2_CLIPWBTHRES,
  			~B43_NPHY_C2_CLIPWBTHRES_CLIP2, 21);
  
@@ -1009,7 +1488,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		b43_phy_maskset(dev, B43_NPHY_C1_CGAINI,
  			~B43_NPHY_C1_CGAINI_GAINBKOFF, 0x1);
  		b43_phy_maskset(dev, B43_NPHY_C2_CGAINI,
-@@ -2225,12 +2354,12 @@ static void b43_nphy_gain_ctl_workaround
+@@ -2225,12 +2552,12 @@ static void b43_nphy_gain_ctl_workaround
  
  	if (nphy->gain_boost) {
  		if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ &&
@@ -1024,16 +1503,35 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	}
  
  	/* Set HPVGA2 index */
-@@ -2302,7 +2431,7 @@ static void b43_nphy_gain_ctl_workaround
- static u16 b43_nphy_read_lpf_ctl(struct b43_wldev *dev, u16 offset)
+@@ -2290,22 +2617,16 @@ static void b43_nphy_gain_ctl_workaround
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/WorkaroundsGainCtrl */
+ static void b43_nphy_gain_ctl_workarounds(struct b43_wldev *dev)
  {
- 	if (!offset)
--		offset = (dev->phy.is_40mhz) ? 0x159 : 0x154;
-+		offset = b43_is_40mhz(dev) ? 0x159 : 0x154;
- 	return b43_ntab_read(dev, B43_NTAB16(7, offset)) & 0x7;
+-	if (dev->phy.rev >= 7)
+-		; /* TODO */
++	if (dev->phy.rev >= 19)
++		b43_nphy_gain_ctl_workarounds_rev19(dev);
++	else if (dev->phy.rev >= 7)
++		b43_nphy_gain_ctl_workarounds_rev7(dev);
+ 	else if (dev->phy.rev >= 3)
+-		b43_nphy_gain_ctl_workarounds_rev3plus(dev);
++		b43_nphy_gain_ctl_workarounds_rev3(dev);
+ 	else
+ 		b43_nphy_gain_ctl_workarounds_rev1_2(dev);
  }
  
-@@ -2375,13 +2504,13 @@ static void b43_nphy_workarounds_rev7plu
+-/* http://bcm-v4.sipsolutions.net/PHY/N/Read_Lpf_Bw_Ctl */
+-static u16 b43_nphy_read_lpf_ctl(struct b43_wldev *dev, u16 offset)
+-{
+-	if (!offset)
+-		offset = (dev->phy.is_40mhz) ? 0x159 : 0x154;
+-	return b43_ntab_read(dev, B43_NTAB16(7, offset)) & 0x7;
+-}
+-
+ static void b43_nphy_workarounds_rev7plus(struct b43_wldev *dev)
+ {
+ 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
+@@ -2375,13 +2696,13 @@ static void b43_nphy_workarounds_rev7plu
  	lpf_40 = b43_nphy_read_lpf_ctl(dev, 0x159);
  	lpf_11b = b43_nphy_read_lpf_ctl(dev, 0x152);
  	if (b43_nphy_ipa(dev)) {
@@ -1049,7 +1547,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  				scap_val_11n_20 = scap_val;
  				bcap_val_11n_20 = bcap_val;
  				scap_val_11n_40 = bcap_val_11n_40 = 0xc;
-@@ -2523,7 +2652,7 @@ static void b43_nphy_workarounds_rev7plu
+@@ -2523,7 +2844,7 @@ static void b43_nphy_workarounds_rev7plu
  					}
  				}
  			} else if (phy->radio_rev == 7 || phy->radio_rev == 8) {
@@ -1058,7 +1556,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  					b43_radio_write(dev, 0x5F, 0x14);
  					b43_radio_write(dev, 0xE8, 0x12);
  				} else {
-@@ -2532,7 +2661,7 @@ static void b43_nphy_workarounds_rev7plu
+@@ -2532,7 +2853,7 @@ static void b43_nphy_workarounds_rev7plu
  				}
  			}
  		} else {
@@ -1067,7 +1565,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			if ((freq >= 5180 && freq <= 5230) ||
  			    (freq >= 5745 && freq <= 5805)) {
  				b43_radio_write(dev, 0x7D, 0xFF);
-@@ -2596,7 +2725,7 @@ static void b43_nphy_workarounds_rev7plu
+@@ -2596,7 +2917,7 @@ static void b43_nphy_workarounds_rev7plu
  	b43_ntab_write(dev, B43_NTAB16(7, 0x123), 0x77);
  	b43_ntab_write(dev, B43_NTAB16(7, 0x12A), 0x77);
  
@@ -1076,7 +1574,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		b43_ntab_write(dev, B43_NTAB32(16, 0x03), 0x18D);
  		b43_ntab_write(dev, B43_NTAB32(16, 0x7F), 0x18D);
  	} else {
-@@ -2695,7 +2824,7 @@ static void b43_nphy_workarounds_rev3plu
+@@ -2695,7 +3016,7 @@ static void b43_nphy_workarounds_rev3plu
  
  	b43_phy_maskset(dev, B43_NPHY_SGILTRNOFFSET, 0xF0FF, 0x0700);
  
@@ -1085,7 +1583,15 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		b43_ntab_write(dev, B43_NTAB32(16, 3), 0x18D);
  		b43_ntab_write(dev, B43_NTAB32(16, 127), 0x18D);
  	} else {
-@@ -2950,12 +3079,13 @@ static void b43_nphy_workarounds(struct
+@@ -2930,6 +3251,7 @@ static void b43_nphy_workarounds(struct
+ 	b43_phy_set(dev, B43_NPHY_IQFLIP,
+ 		    B43_NPHY_IQFLIP_ADC1 | B43_NPHY_IQFLIP_ADC2);
+ 
++	/* TODO: rev19+ */
+ 	if (dev->phy.rev >= 7)
+ 		b43_nphy_workarounds_rev7plus(dev);
+ 	else if (dev->phy.rev >= 3)
+@@ -2950,12 +3272,13 @@ static void b43_nphy_workarounds(struct
   * http://bcm-v4.sipsolutions.net/802.11/PHY/N/TXTone
   */
  static int b43_nphy_tx_tone(struct b43_wldev *dev, u32 freq, u16 max_val,
@@ -1101,7 +1607,65 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	return 0;
  }
  
-@@ -3118,7 +3248,7 @@ static void b43_nphy_tx_power_ctrl(struc
+@@ -2990,6 +3313,7 @@ static void b43_nphy_update_txrx_chain(s
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/stop-playback */
+ static void b43_nphy_stop_playback(struct b43_wldev *dev)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	struct b43_phy_n *nphy = dev->phy.n;
+ 	u16 tmp;
+ 
+@@ -3010,6 +3334,15 @@ static void b43_nphy_stop_playback(struc
+ 		nphy->bb_mult_save = 0;
+ 	}
+ 
++	if (phy->rev >= 7) {
++		if (phy->rev >= 19)
++			b43_nphy_rf_ctl_override_rev19(dev, 0x80, 0, 0, true,
++						       1);
++		else
++			b43_nphy_rf_ctl_override_rev7(dev, 0x80, 0, 0, true, 1);
++		nphy->lpf_bw_overrode_for_sample_play = false;
++	}
++
+ 	if (nphy->hang_avoid)
+ 		b43_nphy_stay_in_carrier_search(dev, 0);
+ }
+@@ -3019,16 +3352,23 @@ static void b43_nphy_iq_cal_gain_params(
+ 					struct nphy_txgains target,
+ 					struct nphy_iqcal_params *params)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	int i, j, indx;
+ 	u16 gain;
+ 
+ 	if (dev->phy.rev >= 3) {
++		params->tx_lpf = target.tx_lpf[core]; /* Rev 7+ */
+ 		params->txgm = target.txgm[core];
+ 		params->pga = target.pga[core];
+ 		params->pad = target.pad[core];
+ 		params->ipa = target.ipa[core];
+-		params->cal_gain = (params->txgm << 12) | (params->pga << 8) |
+-					(params->pad << 4) | (params->ipa);
++		if (phy->rev >= 19) {
++			/* TODO */
++		} else if (phy->rev >= 7) {
++			params->cal_gain = (params->txgm << 12) | (params->pga << 8) | (params->pad << 3) | (params->ipa) | (params->tx_lpf << 15);
++		} else {
++			params->cal_gain = (params->txgm << 12) | (params->pga << 8) | (params->pad << 4) | (params->ipa);
++		}
+ 		for (j = 0; j < 5; j++)
+ 			params->ncorr[j] = 0x79;
+ 	} else {
+@@ -3069,6 +3409,7 @@ static enum b43_txpwr_result b43_nphy_op
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxPwrCtrlEnable */
+ static void b43_nphy_tx_power_ctrl(struct b43_wldev *dev, bool enable)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	struct b43_phy_n *nphy = dev->phy.n;
+ 	u8 i;
+ 	u16 bmask, val, tmp;
+@@ -3118,7 +3459,7 @@ static void b43_nphy_tx_power_ctrl(struc
  			b43_phy_maskset(dev, B43_NPHY_BPHY_CTL3,
  				~B43_NPHY_BPHY_CTL3_SCALE, 0x5A);
  
@@ -1110,7 +1674,47 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_TSSIRPSMW);
  	} else {
  		b43_ntab_write_bulk(dev, B43_NTAB16(26, 64), 84,
-@@ -3172,7 +3302,7 @@ static void b43_nphy_tx_power_ctrl(struc
+@@ -3138,12 +3479,25 @@ static void b43_nphy_tx_power_ctrl(struc
+ 		b43_phy_maskset(dev, B43_NPHY_TXPCTL_CMD, ~(bmask), val);
+ 
+ 		if (band == IEEE80211_BAND_5GHZ) {
+-			b43_phy_maskset(dev, B43_NPHY_TXPCTL_CMD,
+-					~B43_NPHY_TXPCTL_CMD_INIT, 0x64);
+-			if (dev->phy.rev > 1)
++			if (phy->rev >= 19) {
++				/* TODO */
++			} else if (phy->rev >= 7) {
++				b43_phy_maskset(dev, B43_NPHY_TXPCTL_CMD,
++						~B43_NPHY_TXPCTL_CMD_INIT,
++						0x32);
+ 				b43_phy_maskset(dev, B43_NPHY_TXPCTL_INIT,
+ 						~B43_NPHY_TXPCTL_INIT_PIDXI1,
++						0x32);
++			} else {
++				b43_phy_maskset(dev, B43_NPHY_TXPCTL_CMD,
++						~B43_NPHY_TXPCTL_CMD_INIT,
+ 						0x64);
++				if (phy->rev > 1)
++					b43_phy_maskset(dev,
++							B43_NPHY_TXPCTL_INIT,
++							~B43_NPHY_TXPCTL_INIT_PIDXI1,
++							0x64);
++			}
+ 		}
+ 
+ 		if (dev->phy.rev >= 3) {
+@@ -3160,6 +3514,10 @@ static void b43_nphy_tx_power_ctrl(struc
+ 			}
+ 		}
+ 
++		if (phy->rev >= 7) {
++			/* TODO */
++		}
++
+ 		if (dev->phy.rev >= 3) {
+ 			b43_phy_mask(dev, B43_NPHY_AFECTL_OVER1, ~0x100);
+ 			b43_phy_mask(dev, B43_NPHY_AFECTL_OVER, ~0x100);
+@@ -3172,7 +3530,7 @@ static void b43_nphy_tx_power_ctrl(struc
  		else if (dev->phy.rev < 2)
  			b43_phy_maskset(dev, B43_NPHY_BPHY_CTL3, ~0xFF, 0x40);
  
@@ -1119,7 +1723,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_TSSIRPSMW);
  
  		if (b43_nphy_ipa(dev)) {
-@@ -3188,12 +3318,13 @@ static void b43_nphy_tx_power_ctrl(struc
+@@ -3188,18 +3546,20 @@ static void b43_nphy_tx_power_ctrl(struc
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxPwrFix */
  static void b43_nphy_tx_power_fix(struct b43_wldev *dev)
  {
@@ -1134,7 +1738,14 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	u32 txgain;
  	/* u32 gaintbl; rev3+ */
  
-@@ -3238,7 +3369,11 @@ static void b43_nphy_tx_power_fix(struct
+ 	if (nphy->hang_avoid)
+ 		b43_nphy_stay_in_carrier_search(dev, 1);
+ 
++	/* TODO: rev19+ */
+ 	if (dev->phy.rev >= 7) {
+ 		txpi[0] = txpi[1] = 30;
+ 	} else if (dev->phy.rev >= 3) {
+@@ -3238,7 +3598,11 @@ static void b43_nphy_tx_power_fix(struct
  	*/
  
  	for (i = 0; i < 2; i++) {
@@ -1147,7 +1758,27 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  		if (dev->phy.rev >= 3)
  			radio_gain = (txgain >> 16) & 0x1FFFF;
-@@ -3392,7 +3527,7 @@ static void b43_nphy_tx_power_ctl_idle_t
+@@ -3298,7 +3662,9 @@ static void b43_nphy_ipa_internal_tssi_s
+ 	u8 core;
+ 	u16 r; /* routing */
+ 
+-	if (phy->rev >= 7) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
+ 		for (core = 0; core < 2; core++) {
+ 			r = core ? 0x190 : 0x170;
+ 			if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+@@ -3386,24 +3752,32 @@ static void b43_nphy_tx_power_ctl_idle_t
+ 	if (b43_nphy_ipa(dev))
+ 		b43_nphy_ipa_internal_tssi_setup(dev);
+ 
+-	if (phy->rev >= 7)
++	if (phy->rev >= 19)
++		b43_nphy_rf_ctl_override_rev19(dev, 0x2000, 0, 3, false, 0);
++	else if (phy->rev >= 7)
+ 		b43_nphy_rf_ctl_override_rev7(dev, 0x2000, 0, 3, false, 0);
+ 	else if (phy->rev >= 3)
  		b43_nphy_rf_ctl_override(dev, 0x2000, 0, 3, false);
  
  	b43_nphy_stop_playback(dev);
@@ -1156,7 +1787,26 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	udelay(20);
  	tmp = b43_nphy_poll_rssi(dev, N_RSSI_TSSI_2G, rssi, 1);
  	b43_nphy_stop_playback(dev);
-@@ -3443,21 +3578,21 @@ static void b43_nphy_tx_prepare_adjusted
++
+ 	b43_nphy_rssi_select(dev, 0, N_RSSI_W1);
+ 
+-	if (phy->rev >= 7)
++	if (phy->rev >= 19)
++		b43_nphy_rf_ctl_override_rev19(dev, 0x2000, 0, 3, true, 0);
++	else if (phy->rev >= 7)
+ 		b43_nphy_rf_ctl_override_rev7(dev, 0x2000, 0, 3, true, 0);
+ 	else if (phy->rev >= 3)
+ 		b43_nphy_rf_ctl_override(dev, 0x2000, 0, 3, true);
+ 
+-	if (phy->rev >= 3) {
++	if (phy->rev >= 19) {
++		/* TODO */
++		return;
++	} else if (phy->rev >= 3) {
+ 		nphy->pwr_ctl_info[0].idle_tssi_5g = (tmp >> 24) & 0xFF;
+ 		nphy->pwr_ctl_info[1].idle_tssi_5g = (tmp >> 8) & 0xFF;
+ 	} else {
+@@ -3443,21 +3817,21 @@ static void b43_nphy_tx_prepare_adjusted
  		delta = 0;
  		switch (stf_mode) {
  		case 0:
@@ -1183,7 +1833,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			break;
  		}
  
-@@ -3478,6 +3613,7 @@ static void b43_nphy_tx_prepare_adjusted
+@@ -3478,6 +3852,7 @@ static void b43_nphy_tx_prepare_adjusted
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxPwrCtrlSetup */
  static void b43_nphy_tx_power_ctl_setup(struct b43_wldev *dev)
  {
@@ -1191,7 +1841,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	struct b43_phy_n *nphy = dev->phy.n;
  	struct ssb_sprom *sprom = dev->dev->bus_sprom;
  
-@@ -3487,7 +3623,7 @@ static void b43_nphy_tx_power_ctl_setup(
+@@ -3487,7 +3862,7 @@ static void b43_nphy_tx_power_ctl_setup(
  	s32 num, den, pwr;
  	u32 regval[64];
  
@@ -1200,7 +1850,18 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	u16 tmp;
  	u16 r; /* routing */
  	u8 i, c;
-@@ -3651,6 +3787,9 @@ static void b43_nphy_tx_gain_table_uploa
+@@ -3594,7 +3969,9 @@ static void b43_nphy_tx_power_ctl_setup(
+ 		udelay(1);
+ 	}
+ 
+-	if (dev->phy.rev >= 7) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
+ 		b43_phy_maskset(dev, B43_NPHY_TXPCTL_CMD,
+ 				~B43_NPHY_TXPCTL_CMD_INIT, 0x19);
+ 		b43_phy_maskset(dev, B43_NPHY_TXPCTL_INIT,
+@@ -3651,27 +4028,36 @@ static void b43_nphy_tx_gain_table_uploa
  	int i;
  
  	table = b43_nphy_get_tx_gain_table(dev);
@@ -1210,7 +1871,56 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	b43_ntab_write_bulk(dev, B43_NTAB32(26, 192), 128, table);
  	b43_ntab_write_bulk(dev, B43_NTAB32(27, 192), 128, table);
  
-@@ -3709,21 +3848,28 @@ static void b43_nphy_pa_override(struct
+-	if (phy->rev >= 3) {
++	if (phy->rev < 3)
++		return;
++
+ #if 0
+-		nphy->gmval = (table[0] >> 16) & 0x7000;
++	nphy->gmval = (table[0] >> 16) & 0x7000;
+ #endif
+ 
+-		for (i = 0; i < 128; i++) {
++	for (i = 0; i < 128; i++) {
++		if (phy->rev >= 19) {
++			/* TODO */
++			return;
++		} else if (phy->rev >= 7) {
++			/* TODO */
++			return;
++		} else {
+ 			pga_gain = (table[i] >> 24) & 0xF;
+ 			if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+-				rfpwr_offset =
+-				 b43_ntab_papd_pga_gain_delta_ipa_2g[pga_gain];
++				rfpwr_offset = b43_ntab_papd_pga_gain_delta_ipa_2g[pga_gain];
+ 			else
+-				rfpwr_offset =
+-				 0; /* FIXME */
+-			b43_ntab_write(dev, B43_NTAB32(26, 576 + i),
+-				       rfpwr_offset);
+-			b43_ntab_write(dev, B43_NTAB32(27, 576 + i),
+-				       rfpwr_offset);
++				rfpwr_offset = 0; /* FIXME */
+ 		}
++
++		b43_ntab_write(dev, B43_NTAB32(26, 576 + i), rfpwr_offset);
++		b43_ntab_write(dev, B43_NTAB32(27, 576 + i), rfpwr_offset);
+ 	}
+ }
+ 
+@@ -3688,7 +4074,9 @@ static void b43_nphy_pa_override(struct
+ 		nphy->rfctrl_intc2_save = b43_phy_read(dev,
+ 						       B43_NPHY_RFCTL_INTC2);
+ 		band = b43_current_band(dev->wl);
+-		if (dev->phy.rev >= 3) {
++		if (dev->phy.rev >= 7) {
++			tmp = 0x1480;
++		} else if (dev->phy.rev >= 3) {
+ 			if (band == IEEE80211_BAND_5GHZ)
+ 				tmp = 0x600;
+ 			else
+@@ -3709,21 +4097,28 @@ static void b43_nphy_pa_override(struct
  	}
  }
  
@@ -1232,15 +1942,15 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 -		}
 +	if (dev->phy.rev < 3 || dev->phy.rev >= 7)
 +		return;
- 
--		tmp = 1;
++
 +	if (b43_nphy_ipa(dev))
 +		tmp = b43_is_40mhz(dev) ? 5 : 4;
 +	else
 +		tmp = b43_is_40mhz(dev) ? 3 : 1;
 +	b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S2,
 +		      (tmp << 9) | (tmp << 6) | (tmp << 3) | tmp);
-+
+ 
+-		tmp = 1;
 +	if (b43_nphy_ipa(dev)) {
 +		tmp = b43_is_40mhz(dev) ? 4 : 1;
  		b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S2,
@@ -1249,7 +1959,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	}
  }
  
-@@ -3996,7 +4142,7 @@ static void b43_nphy_spur_workaround(str
+@@ -3996,7 +4391,7 @@ static void b43_nphy_spur_workaround(str
  
  	if (nphy->gband_spurwar_en) {
  		/* TODO: N PHY Adjust Analog Pfbw (7) */
@@ -1258,7 +1968,102 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			; /* TODO: N PHY Adjust Min Noise Var(2, tone, noise)*/
  		else
  			; /* TODO: N PHY Adjust Min Noise Var(0, NULL, NULL)*/
-@@ -4290,7 +4436,7 @@ static void b43_nphy_int_pa_set_tx_dig_f
+@@ -4128,7 +4523,13 @@ static void b43_nphy_restore_rssi_cal(st
+ 		rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_5G;
+ 	}
+ 
+-	if (dev->phy.rev >= 7) {
++	if (dev->phy.rev >= 19) {
++		/* TODO */
++	} else if (dev->phy.rev >= 7) {
++		b43_radio_maskset(dev, R2057_NB_MASTER_CORE0, ~R2057_VCM_MASK,
++				  rssical_radio_regs[0]);
++		b43_radio_maskset(dev, R2057_NB_MASTER_CORE1, ~R2057_VCM_MASK,
++				  rssical_radio_regs[1]);
+ 	} else {
+ 		b43_radio_maskset(dev, B2056_RX0 | B2056_RX_RSSI_MISC, 0xE3,
+ 				  rssical_radio_regs[0]);
+@@ -4152,15 +4553,78 @@ static void b43_nphy_restore_rssi_cal(st
+ 	b43_phy_write(dev, B43_NPHY_RSSIMC_1Q_RSSI_Y, rssical_phy_regs[11]);
+ }
+ 
++static void b43_nphy_tx_cal_radio_setup_rev19(struct b43_wldev *dev)
++{
++	/* TODO */
++}
++
++static void b43_nphy_tx_cal_radio_setup_rev7(struct b43_wldev *dev)
++{
++	struct b43_phy *phy = &dev->phy;
++	struct b43_phy_n *nphy = dev->phy.n;
++	u16 *save = nphy->tx_rx_cal_radio_saveregs;
++	int core, off;
++	u16 r, tmp;
++
++	for (core = 0; core < 2; core++) {
++		r = core ? 0x20 : 0;
++		off = core * 11;
++
++		save[off + 0] = b43_radio_read(dev, r + R2057_TX0_TX_SSI_MASTER);
++		save[off + 1] = b43_radio_read(dev, r + R2057_TX0_IQCAL_VCM_HG);
++		save[off + 2] = b43_radio_read(dev, r + R2057_TX0_IQCAL_IDAC);
++		save[off + 3] = b43_radio_read(dev, r + R2057_TX0_TSSI_VCM);
++		save[off + 4] = 0;
++		save[off + 5] = b43_radio_read(dev, r + R2057_TX0_TX_SSI_MUX);
++		if (phy->radio_rev != 5)
++			save[off + 6] = b43_radio_read(dev, r + R2057_TX0_TSSIA);
++		save[off + 7] = b43_radio_read(dev, r + R2057_TX0_TSSIG);
++		save[off + 8] = b43_radio_read(dev, r + R2057_TX0_TSSI_MISC1);
++
++		if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
++			b43_radio_write(dev, r + R2057_TX0_TX_SSI_MASTER, 0xA);
++			b43_radio_write(dev, r + R2057_TX0_IQCAL_VCM_HG, 0x43);
++			b43_radio_write(dev, r + R2057_TX0_IQCAL_IDAC, 0x55);
++			b43_radio_write(dev, r + R2057_TX0_TSSI_VCM, 0);
++			b43_radio_write(dev, r + R2057_TX0_TSSIG, 0);
++			if (nphy->use_int_tx_iq_lo_cal) {
++				b43_radio_write(dev, r + R2057_TX0_TX_SSI_MUX, 0x4);
++				tmp = true ? 0x31 : 0x21; /* TODO */
++				b43_radio_write(dev, r + R2057_TX0_TSSIA, tmp);
++			}
++			b43_radio_write(dev, r + R2057_TX0_TSSI_MISC1, 0x00);
++		} else {
++			b43_radio_write(dev, r + R2057_TX0_TX_SSI_MASTER, 0x6);
++			b43_radio_write(dev, r + R2057_TX0_IQCAL_VCM_HG, 0x43);
++			b43_radio_write(dev, r + R2057_TX0_IQCAL_IDAC, 0x55);
++			b43_radio_write(dev, r + R2057_TX0_TSSI_VCM, 0);
++
++			if (phy->radio_rev != 5)
++				b43_radio_write(dev, r + R2057_TX0_TSSIA, 0);
++			if (nphy->use_int_tx_iq_lo_cal) {
++				b43_radio_write(dev, r + R2057_TX0_TX_SSI_MUX, 0x6);
++				tmp = true ? 0x31 : 0x21; /* TODO */
++				b43_radio_write(dev, r + R2057_TX0_TSSIG, tmp);
++			}
++			b43_radio_write(dev, r + R2057_TX0_TSSI_MISC1, 0);
++		}
++	}
++}
++
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxCalRadioSetup */
+ static void b43_nphy_tx_cal_radio_setup(struct b43_wldev *dev)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	struct b43_phy_n *nphy = dev->phy.n;
+ 	u16 *save = nphy->tx_rx_cal_radio_saveregs;
+ 	u16 tmp;
+ 	u8 offset, i;
+ 
+-	if (dev->phy.rev >= 3) {
++	if (phy->rev >= 19) {
++		b43_nphy_tx_cal_radio_setup_rev19(dev);
++	} else if (phy->rev >= 7) {
++		b43_nphy_tx_cal_radio_setup_rev7(dev);
++	} else if (phy->rev >= 3) {
+ 	    for (i = 0; i < 2; i++) {
+ 		tmp = (i == 0) ? 0x2000 : 0x3000;
+ 		offset = i * 11;
+@@ -4290,7 +4754,7 @@ static void b43_nphy_int_pa_set_tx_dig_f
  			b43_phy_write(dev, B43_PHY_N(offset[i] + j),
  					tbl_tx_filter_coef_rev4[i][j]);
  
@@ -1267,17 +2072,133 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		for (j = 0; j < 15; j++)
  			b43_phy_write(dev, B43_PHY_N(offset[0] + j),
  					tbl_tx_filter_coef_rev4[3][j]);
-@@ -4349,6 +4495,9 @@ static struct nphy_txgains b43_nphy_get_
+@@ -4325,7 +4789,13 @@ static struct nphy_txgains b43_nphy_get_
+ 			b43_nphy_stay_in_carrier_search(dev, false);
+ 
+ 		for (i = 0; i < 2; ++i) {
+-			if (dev->phy.rev >= 3) {
++			if (dev->phy.rev >= 7) {
++				target.ipa[i] = curr_gain[i] & 0x0007;
++				target.pad[i] = (curr_gain[i] & 0x00F8) >> 3;
++				target.pga[i] = (curr_gain[i] & 0x0F00) >> 8;
++				target.txgm[i] = (curr_gain[i] & 0x7000) >> 12;
++				target.tx_lpf[i] = (curr_gain[i] & 0x8000) >> 15;
++			} else if (dev->phy.rev >= 3) {
+ 				target.ipa[i] = curr_gain[i] & 0x000F;
+ 				target.pad[i] = (curr_gain[i] & 0x00F0) >> 4;
+ 				target.pga[i] = (curr_gain[i] & 0x0F00) >> 8;
+@@ -4349,7 +4819,16 @@ static struct nphy_txgains b43_nphy_get_
  
  		for (i = 0; i < 2; ++i) {
  			table = b43_nphy_get_tx_gain_table(dev);
+-			if (dev->phy.rev >= 3) {
 +			if (!table)
 +				break;
 +
- 			if (dev->phy.rev >= 3) {
++			if (dev->phy.rev >= 7) {
++				target.ipa[i] = (table[index[i]] >> 16) & 0x7;
++				target.pad[i] = (table[index[i]] >> 19) & 0x1F;
++				target.pga[i] = (table[index[i]] >> 24) & 0xF;
++				target.txgm[i] = (table[index[i]] >> 28) & 0x7;
++				target.tx_lpf[i] = (table[index[i]] >> 31) & 0x1;
++			} else if (dev->phy.rev >= 3) {
  				target.ipa[i] = (table[index[i]] >> 16) & 0xF;
  				target.pad[i] = (table[index[i]] >> 20) & 0xF;
-@@ -4504,8 +4653,9 @@ static void b43_nphy_save_cal(struct b43
+ 				target.pga[i] = (table[index[i]] >> 24) & 0xF;
+@@ -4398,6 +4877,8 @@ static void b43_nphy_tx_cal_phy_cleanup(
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/TxCalPhySetup */
+ static void b43_nphy_tx_cal_phy_setup(struct b43_wldev *dev)
+ {
++	struct b43_phy *phy = &dev->phy;
++	struct b43_phy_n *nphy = dev->phy.n;
+ 	u16 *regs = dev->phy.n->tx_rx_cal_phy_saveregs;
+ 	u16 tmp;
+ 
+@@ -4429,7 +4910,12 @@ static void b43_nphy_tx_cal_phy_setup(st
+ 		regs[7] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
+ 		regs[8] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
+ 
+-		b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_PA, 1, 3);
++		if (!nphy->use_int_tx_iq_lo_cal)
++			b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_PA,
++						      1, 3);
++		else
++			b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_PA,
++						      0, 3);
+ 		b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_TRSW, 2, 1);
+ 		b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_TRSW, 8, 2);
+ 
+@@ -4437,6 +4923,33 @@ static void b43_nphy_tx_cal_phy_setup(st
+ 		regs[10] = b43_phy_read(dev, B43_NPHY_PAPD_EN1);
+ 		b43_phy_mask(dev, B43_NPHY_PAPD_EN0, ~0x0001);
+ 		b43_phy_mask(dev, B43_NPHY_PAPD_EN1, ~0x0001);
++
++		tmp = b43_nphy_read_lpf_ctl(dev, 0);
++		if (phy->rev >= 19)
++			b43_nphy_rf_ctl_override_rev19(dev, 0x80, tmp, 0, false,
++						       1);
++		else if (phy->rev >= 7)
++			b43_nphy_rf_ctl_override_rev7(dev, 0x80, tmp, 0, false,
++						      1);
++
++		if (nphy->use_int_tx_iq_lo_cal && true /* FIXME */) {
++			if (phy->rev >= 19) {
++				b43_nphy_rf_ctl_override_rev19(dev, 0x8, 0, 0x3,
++							       false, 0);
++			} else if (phy->rev >= 8) {
++				b43_nphy_rf_ctl_override_rev7(dev, 0x8, 0, 0x3,
++							      false, 0);
++			} else if (phy->rev == 7) {
++				b43_radio_maskset(dev, R2057_OVR_REG0, 1 << 4, 1 << 4);
++				if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
++					b43_radio_maskset(dev, R2057_PAD2G_TUNE_PUS_CORE0, ~1, 0);
++					b43_radio_maskset(dev, R2057_PAD2G_TUNE_PUS_CORE1, ~1, 0);
++				} else {
++					b43_radio_maskset(dev, R2057_IPA5G_CASCOFFV_PU_CORE0, ~1, 0);
++					b43_radio_maskset(dev, R2057_IPA5G_CASCOFFV_PU_CORE1, ~1, 0);
++				}
++			}
++		}
+ 	} else {
+ 		b43_phy_maskset(dev, B43_NPHY_AFECTL_C1, 0x0FFF, 0xA000);
+ 		b43_phy_maskset(dev, B43_NPHY_AFECTL_C2, 0x0FFF, 0xA000);
+@@ -4465,6 +4978,7 @@ static void b43_nphy_tx_cal_phy_setup(st
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SaveCal */
+ static void b43_nphy_save_cal(struct b43_wldev *dev)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	struct b43_phy_n *nphy = dev->phy.n;
+ 
+ 	struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
+@@ -4489,7 +5003,26 @@ static void b43_nphy_save_cal(struct b43
+ 
+ 	b43_nphy_rx_iq_coeffs(dev, false, rxcal_coeffs);
+ 	/* TODO use some definitions */
+-	if (dev->phy.rev >= 3) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
++		txcal_radio_regs[0] = b43_radio_read(dev,
++						     R2057_TX0_LOFT_FINE_I);
++		txcal_radio_regs[1] = b43_radio_read(dev,
++						     R2057_TX0_LOFT_FINE_Q);
++		txcal_radio_regs[4] = b43_radio_read(dev,
++						     R2057_TX0_LOFT_COARSE_I);
++		txcal_radio_regs[5] = b43_radio_read(dev,
++						     R2057_TX0_LOFT_COARSE_Q);
++		txcal_radio_regs[2] = b43_radio_read(dev,
++						     R2057_TX1_LOFT_FINE_I);
++		txcal_radio_regs[3] = b43_radio_read(dev,
++						     R2057_TX1_LOFT_FINE_Q);
++		txcal_radio_regs[6] = b43_radio_read(dev,
++						     R2057_TX1_LOFT_COARSE_I);
++		txcal_radio_regs[7] = b43_radio_read(dev,
++						     R2057_TX1_LOFT_COARSE_Q);
++	} else if (phy->rev >= 3) {
+ 		txcal_radio_regs[0] = b43_radio_read(dev, 0x2021);
+ 		txcal_radio_regs[1] = b43_radio_read(dev, 0x2022);
+ 		txcal_radio_regs[2] = b43_radio_read(dev, 0x3021);
+@@ -4504,8 +5037,9 @@ static void b43_nphy_save_cal(struct b43
  		txcal_radio_regs[2] = b43_radio_read(dev, 0x8D);
  		txcal_radio_regs[3] = b43_radio_read(dev, 0xBC);
  	}
@@ -1289,7 +2210,43 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 8, table);
  
  	if (nphy->hang_avoid)
-@@ -4585,6 +4735,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4515,6 +5049,7 @@ static void b43_nphy_save_cal(struct b43
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal */
+ static void b43_nphy_restore_cal(struct b43_wldev *dev)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	struct b43_phy_n *nphy = dev->phy.n;
+ 
+ 	u16 coef[4];
+@@ -4562,7 +5097,26 @@ static void b43_nphy_restore_cal(struct
+ 	}
+ 
+ 	/* TODO use some definitions */
+-	if (dev->phy.rev >= 3) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
++		b43_radio_write(dev, R2057_TX0_LOFT_FINE_I,
++				txcal_radio_regs[0]);
++		b43_radio_write(dev, R2057_TX0_LOFT_FINE_Q,
++				txcal_radio_regs[1]);
++		b43_radio_write(dev, R2057_TX0_LOFT_COARSE_I,
++				txcal_radio_regs[4]);
++		b43_radio_write(dev, R2057_TX0_LOFT_COARSE_Q,
++				txcal_radio_regs[5]);
++		b43_radio_write(dev, R2057_TX1_LOFT_FINE_I,
++				txcal_radio_regs[2]);
++		b43_radio_write(dev, R2057_TX1_LOFT_FINE_Q,
++				txcal_radio_regs[3]);
++		b43_radio_write(dev, R2057_TX1_LOFT_COARSE_I,
++				txcal_radio_regs[6]);
++		b43_radio_write(dev, R2057_TX1_LOFT_COARSE_Q,
++				txcal_radio_regs[7]);
++	} else if (phy->rev >= 3) {
+ 		b43_radio_write(dev, 0x2021, txcal_radio_regs[0]);
+ 		b43_radio_write(dev, 0x2022, txcal_radio_regs[1]);
+ 		b43_radio_write(dev, 0x3021, txcal_radio_regs[2]);
+@@ -4585,6 +5139,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
  				struct nphy_txgains target,
  				bool full, bool mphase)
  {
@@ -1297,7 +2254,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	struct b43_phy_n *nphy = dev->phy.n;
  	int i;
  	int error = 0;
-@@ -4625,7 +4776,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4625,7 +5180,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
  		(dev->phy.rev == 5 && nphy->ipa2g_on &&
  		b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ);
  	if (phy6or5x) {
@@ -1306,9 +2263,18 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			b43_ntab_write_bulk(dev, B43_NTAB16(15, 0), 18,
  					tbl_tx_iqlo_cal_loft_ladder_40);
  			b43_ntab_write_bulk(dev, B43_NTAB16(15, 32), 18,
-@@ -4640,16 +4791,16 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4638,18 +5193,24 @@ static int b43_nphy_cal_tx_iq_lo(struct
+ 		}
+ 	}
  
- 	b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8AA9);
+-	b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8AA9);
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
++		b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8AD9);
++	} else {
++		b43_phy_write(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8AA9);
++	}
  
 -	if (!dev->phy.is_40mhz)
 +	if (!b43_is_40mhz(dev))
@@ -1327,7 +2293,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	if (error == 0) {
  		if (nphy->mphase_cal_phase_id > 2) {
-@@ -4777,9 +4928,9 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4777,9 +5338,9 @@ static int b43_nphy_cal_tx_iq_lo(struct
  						nphy->txiqlocal_bestc);
  			nphy->txiqlocal_coeffsvalid = true;
  			nphy->txiqlocal_chanspec.center_freq =
@@ -1339,7 +2305,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		} else {
  			length = 11;
  			if (dev->phy.rev < 3)
-@@ -4815,8 +4966,8 @@ static void b43_nphy_reapply_tx_cal_coef
+@@ -4815,8 +5376,8 @@ static void b43_nphy_reapply_tx_cal_coef
  	bool equal = true;
  
  	if (!nphy->txiqlocal_coeffsvalid ||
@@ -1350,7 +2316,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		return;
  
  	b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
-@@ -4972,11 +5123,11 @@ static int b43_nphy_rev2_cal_rx_iq(struc
+@@ -4972,11 +5533,11 @@ static int b43_nphy_rev2_cal_rx_iq(struc
  			if (playtone) {
  				ret = b43_nphy_tx_tone(dev, 4000,
  						(nphy->rxcalparams & 0xFFFF),
@@ -1365,7 +2331,83 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			}
  
  			if (ret == 0) {
-@@ -5348,7 +5499,7 @@ static int b43_phy_initn(struct b43_wlde
+@@ -5032,6 +5593,9 @@ static int b43_nphy_rev3_cal_rx_iq(struc
+ static int b43_nphy_cal_rx_iq(struct b43_wldev *dev,
+ 			struct nphy_txgains target, u8 type, bool debug)
+ {
++	if (dev->phy.rev >= 7)
++		type = 0;
++
+ 	if (dev->phy.rev >= 3)
+ 		return b43_nphy_rev3_cal_rx_iq(dev, target, type, debug);
+ 	else
+@@ -5118,6 +5682,9 @@ static void b43_nphy_bphy_init(struct b4
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SuperSwitchInit */
+ static void b43_nphy_superswitch_init(struct b43_wldev *dev, bool init)
+ {
++	if (dev->phy.rev >= 7)
++		return;
++
+ 	if (dev->phy.rev >= 3) {
+ 		if (!init)
+ 			return;
+@@ -5193,6 +5760,10 @@ static int b43_phy_initn(struct b43_wlde
+ #endif
+ 		}
+ 	}
++	nphy->use_int_tx_iq_lo_cal = b43_nphy_ipa(dev) ||
++		phy->rev >= 7 ||
++		(phy->rev >= 5 &&
++		 sprom->boardflags2_hi & B43_BFH2_INTERNDET_TXIQCAL);
+ 	nphy->deaf_count = 0;
+ 	b43_nphy_tables_init(dev);
+ 	nphy->crsminpwr_adjusted = false;
+@@ -5202,6 +5773,16 @@ static int b43_phy_initn(struct b43_wlde
+ 	if (dev->phy.rev >= 3) {
+ 		b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S1, 0);
+ 		b43_phy_write(dev, B43_NPHY_RFCTL_OVER, 0);
++		if (phy->rev >= 7) {
++			b43_phy_write(dev, B43_NPHY_REV7_RF_CTL_OVER3, 0);
++			b43_phy_write(dev, B43_NPHY_REV7_RF_CTL_OVER4, 0);
++			b43_phy_write(dev, B43_NPHY_REV7_RF_CTL_OVER5, 0);
++			b43_phy_write(dev, B43_NPHY_REV7_RF_CTL_OVER6, 0);
++		}
++		if (phy->rev >= 19) {
++			/* TODO */
++		}
++
+ 		b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S0, 0);
+ 		b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S1, 0);
+ 	} else {
+@@ -5239,7 +5820,9 @@ static int b43_phy_initn(struct b43_wlde
+ 	b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x50);
+ 	b43_phy_write(dev, B43_NPHY_TXRIFS_FRDEL, 0x30);
+ 
+-	b43_nphy_update_mimo_config(dev, nphy->preamble_override);
++	if (phy->rev < 8)
++		b43_nphy_update_mimo_config(dev, nphy->preamble_override);
++
+ 	b43_nphy_update_txrx_chain(dev);
+ 
+ 	if (phy->rev < 2) {
+@@ -5271,10 +5854,12 @@ static int b43_phy_initn(struct b43_wlde
+ 
+ 	b43_mac_phy_clock_set(dev, true);
+ 
+-	b43_nphy_pa_override(dev, false);
+-	b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
+-	b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+-	b43_nphy_pa_override(dev, true);
++	if (phy->rev < 7) {
++		b43_nphy_pa_override(dev, false);
++		b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
++		b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
++		b43_nphy_pa_override(dev, true);
++	}
+ 
+ 	b43_nphy_classifier(dev, 0, 0);
+ 	b43_nphy_read_clip_detection(dev, clip);
+@@ -5348,7 +5933,7 @@ static int b43_phy_initn(struct b43_wlde
  	b43_phy_write(dev, B43_NPHY_TXMACDELAY, 0x0320);
  	if (phy->rev >= 3 && phy->rev <= 6)
  		b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x0032);
@@ -1374,7 +2416,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	if (phy->rev >= 3)
  		b43_nphy_spur_workaround(dev);
  
-@@ -5434,14 +5585,14 @@ static void b43_nphy_channel_setup(struc
+@@ -5434,14 +6019,14 @@ static void b43_nphy_channel_setup(struc
  	if (dev->phy.rev < 3)
  		b43_nphy_adjust_lna_gain_table(dev);
  
@@ -1391,7 +2433,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  			if ((ch >= 5 && ch <= 8) || ch == 13 || ch == 14)
  				avoid = true;
  		} else { /* 40MHz */
-@@ -5488,10 +5639,17 @@ static int b43_nphy_set_channel(struct b
+@@ -5488,10 +6073,20 @@ static int b43_nphy_set_channel(struct b
  
  	const struct b43_nphy_channeltab_entry_rev2 *tabent_r2 = NULL;
  	const struct b43_nphy_channeltab_entry_rev3 *tabent_r3 = NULL;
@@ -1401,7 +2443,10 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	u8 tmp;
  
 -	if (dev->phy.rev >= 3) {
-+	if (phy->rev >= 7) {
++	if (phy->rev >= 19) {
++		return -ESRCH;
++		/* TODO */
++	} else if (phy->rev >= 7) {
 +		r2057_get_chantabent_rev7(dev, channel->center_freq,
 +					  &tabent_r7, &tabent_r7_2g);
 +		if (!tabent_r7 && !tabent_r7_2g)
@@ -1410,7 +2455,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		tabent_r3 = b43_nphy_get_chantabent_rev3(dev,
  							channel->center_freq);
  		if (!tabent_r3)
-@@ -5506,20 +5664,36 @@ static int b43_nphy_set_channel(struct b
+@@ -5506,20 +6101,38 @@ static int b43_nphy_set_channel(struct b
  	/* Channel is set later in common code, but we need to set it on our
  	   own to let this function's subcalls work properly. */
  	phy->channel = channel->hw_value;
@@ -1439,7 +2484,9 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +	}
  
 -	if (dev->phy.rev >= 3) {
-+	if (phy->rev >= 7) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 7) {
 +		const struct b43_phy_n_sfo_cfg *phy_regs = tabent_r7 ?
 +			&(tabent_r7->phy_regs) : &(tabent_r7_2g->phy_regs);
 +
@@ -1455,7 +2502,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		tmp = (channel->band == IEEE80211_BAND_5GHZ) ? 4 : 0;
  		b43_radio_maskset(dev, 0x08, 0xFFFB, tmp);
  		b43_radio_2056_setup(dev, tabent_r3);
-@@ -5561,7 +5735,6 @@ static void b43_nphy_op_prepare_structs(
+@@ -5561,7 +6174,6 @@ static void b43_nphy_op_prepare_structs(
  	nphy->hang_avoid = (phy->rev == 3 || phy->rev == 4);
  	nphy->spur_avoid = (phy->rev >= 3) ?
  				B43_SPUR_AVOID_AUTO : B43_SPUR_AVOID_DISABLE;
@@ -1463,7 +2510,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	nphy->gain_boost = true; /* this way we follow wl, assume it is true */
  	nphy->txrx_chain = 2; /* sth different than 0 and 1 for now */
  	nphy->phyrxchain = 3; /* to avoid b43_nphy_set_rx_core_state like wl */
-@@ -5602,8 +5775,6 @@ static void b43_nphy_op_prepare_structs(
+@@ -5602,8 +6214,6 @@ static void b43_nphy_op_prepare_structs(
  		nphy->ipa2g_on = sprom->fem.ghz2.extpa_gain == 2;
  		nphy->ipa5g_on = sprom->fem.ghz5.extpa_gain == 2;
  	}
@@ -1472,24 +2519,106 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  }
  
  static void b43_nphy_op_free(struct b43_wldev *dev)
-@@ -5714,10 +5885,12 @@ static void b43_nphy_op_software_rfkill(
+@@ -5663,7 +6273,7 @@ static void b43_nphy_op_maskset(struct b
+ static u16 b43_nphy_op_radio_read(struct b43_wldev *dev, u16 reg)
+ {
+ 	/* Register 1 is a 32-bit register. */
+-	B43_WARN_ON(reg == 1);
++	B43_WARN_ON(dev->phy.rev < 7 && reg == 1);
+ 
+ 	if (dev->phy.rev >= 7)
+ 		reg |= 0x200; /* Radio 0x2057 */
+@@ -5677,7 +6287,7 @@ static u16 b43_nphy_op_radio_read(struct
+ static void b43_nphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
+ {
+ 	/* Register 1 is a 32-bit register. */
+-	B43_WARN_ON(reg == 1);
++	B43_WARN_ON(dev->phy.rev < 7 && reg == 1);
+ 
+ 	b43_write16(dev, B43_MMIO_RADIO_CONTROL, reg);
+ 	b43_write16(dev, B43_MMIO_RADIO_DATA_LOW, value);
+@@ -5687,15 +6297,23 @@ static void b43_nphy_op_radio_write(stru
+ static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
+ 					bool blocked)
+ {
++	struct b43_phy *phy = &dev->phy;
++
+ 	if (b43_read32(dev, B43_MMIO_MACCTL) & B43_MACCTL_ENABLED)
+ 		b43err(dev->wl, "MAC not suspended\n");
+ 
+ 	if (blocked) {
+-		b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
+-				~B43_NPHY_RFCTL_CMD_CHIP0PU);
+-		if (dev->phy.rev >= 7) {
++		if (phy->rev >= 19) {
+ 			/* TODO */
+-		} else if (dev->phy.rev >= 3) {
++		} else if (phy->rev >= 8) {
++			b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
++				     ~B43_NPHY_RFCTL_CMD_CHIP0PU);
++		} else if (phy->rev >= 7) {
++			/* Nothing needed */
++		} else if (phy->rev >= 3) {
++			b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
++				     ~B43_NPHY_RFCTL_CMD_CHIP0PU);
++
+ 			b43_radio_mask(dev, 0x09, ~0x2);
+ 
+ 			b43_radio_write(dev, 0x204D, 0);
+@@ -5713,11 +6331,15 @@ static void b43_nphy_op_software_rfkill(
+ 			b43_radio_write(dev, 0x3064, 0);
  		}
  	} else {
- 		if (dev->phy.rev >= 7) {
+-		if (dev->phy.rev >= 7) {
 -			b43_radio_2057_init(dev);
++		if (phy->rev >= 19) {
++			/* TODO */
++		} else if (phy->rev >= 7) {
 +			if (!dev->phy.radio_on)
 +				b43_radio_2057_init(dev);
  			b43_switch_channel(dev, dev->phy.channel);
- 		} else if (dev->phy.rev >= 3) {
+-		} else if (dev->phy.rev >= 3) {
 -			b43_radio_init2056(dev);
++		} else if (phy->rev >= 3) {
 +			if (!dev->phy.radio_on)
 +				b43_radio_init2056(dev);
  			b43_switch_channel(dev, dev->phy.channel);
  		} else {
  			b43_radio_init2055(dev);
+@@ -5728,10 +6350,13 @@ static void b43_nphy_op_software_rfkill(
+ /* http://bcm-v4.sipsolutions.net/802.11/PHY/Anacore */
+ static void b43_nphy_op_switch_analog(struct b43_wldev *dev, bool on)
+ {
++	struct b43_phy *phy = &dev->phy;
+ 	u16 override = on ? 0x0 : 0x7FFF;
+ 	u16 core = on ? 0xD : 0x00FD;
+ 
+-	if (dev->phy.rev >= 3) {
++	if (phy->rev >= 19) {
++		/* TODO */
++	} else if (phy->rev >= 3) {
+ 		if (on) {
+ 			b43_phy_write(dev, B43_NPHY_AFECTL_C1, core);
+ 			b43_phy_write(dev, B43_NPHY_AFECTL_OVER1, override);
 --- a/drivers/net/wireless/b43/phy_n.h
 +++ b/drivers/net/wireless/b43/phy_n.h
-@@ -931,7 +931,6 @@ struct b43_phy_n {
+@@ -857,6 +857,15 @@
+ #define B43_NPHY_REV3_C2_CLIP2_GAIN_A		B43_PHY_N(0x2AF)
+ #define B43_NPHY_REV3_C2_CLIP2_GAIN_B		B43_PHY_N(0x2B0)
+ 
++#define B43_NPHY_REV7_RF_CTL_MISC_REG3		B43_PHY_N(0x340)
++#define B43_NPHY_REV7_RF_CTL_MISC_REG4		B43_PHY_N(0x341)
++#define B43_NPHY_REV7_RF_CTL_OVER3		B43_PHY_N(0x342)
++#define B43_NPHY_REV7_RF_CTL_OVER4		B43_PHY_N(0x343)
++#define B43_NPHY_REV7_RF_CTL_MISC_REG5		B43_PHY_N(0x344)
++#define B43_NPHY_REV7_RF_CTL_MISC_REG6		B43_PHY_N(0x345)
++#define B43_NPHY_REV7_RF_CTL_OVER5		B43_PHY_N(0x346)
++#define B43_NPHY_REV7_RF_CTL_OVER6		B43_PHY_N(0x347)
++
+ #define B43_PHY_B_BBCFG				B43_PHY_N_BMODE(0x001) /* BB config */
+ #define B43_PHY_B_TEST				B43_PHY_N_BMODE(0x00A)
+ 
+@@ -931,11 +940,12 @@ struct b43_phy_n {
  	u16 papd_epsilon_offset[2];
  	s32 preamble_override;
  	u32 bb_mult_save;
@@ -1497,6 +2626,12 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	bool gain_boost;
  	bool elna_gain_config;
+ 	bool band5g_pwrgain;
++	bool use_int_tx_iq_lo_cal;
++	bool lpf_bw_overrode_for_sample_play;
+ 
+ 	u8 mphase_cal_phase_id;
+ 	u16 mphase_txcal_cmdidx;
 --- a/drivers/net/wireless/b43/tables_nphy.c
 +++ b/drivers/net/wireless/b43/tables_nphy.c
 @@ -2146,7 +2146,196 @@ static const u16 b43_ntab_antswctl_r3[4]
@@ -1708,18 +2843,53 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x1f410044, 0x1f410042, 0x1f410040, 0x1f41003e,
  	0x1f41003c, 0x1f41003b, 0x1f410039, 0x1f410037,
  	0x1e410044, 0x1e410042, 0x1e410040, 0x1e41003e,
-@@ -2217,7 +2408,9 @@ static const u32 b43_ntab_tx_gain_rev3pl
+@@ -2217,7 +2408,44 @@ static const u32 b43_ntab_tx_gain_rev3pl
  	0x1041003c, 0x1041003b, 0x10410039, 0x10410037,
  };
  
 -static const u32 b43_ntab_tx_gain_rev3_5ghz[] = {
++static const u32 b43_ntab_tx_gain_epa_rev3_hi_pwr_2g[] = {
++	0x0f410044, 0x0f410042, 0x0f410040, 0x0f41003e,
++	0x0f41003c, 0x0f41003b, 0x0f410039, 0x0f410037,
++	0x0e410044, 0x0e410042, 0x0e410040, 0x0e41003e,
++	0x0e41003c, 0x0e41003b, 0x0e410039, 0x0e410037,
++	0x0d410044, 0x0d410042, 0x0d410040, 0x0d41003e,
++	0x0d41003c, 0x0d41003b, 0x0d410039, 0x0d410037,
++	0x0c410044, 0x0c410042, 0x0c410040, 0x0c41003e,
++	0x0c41003c, 0x0c41003b, 0x0c410039, 0x0c410037,
++	0x0b410044, 0x0b410042, 0x0b410040, 0x0b41003e,
++	0x0b41003c, 0x0b41003b, 0x0b410039, 0x0b410037,
++	0x0a410044, 0x0a410042, 0x0a410040, 0x0a41003e,
++	0x0a41003c, 0x0a41003b, 0x0a410039, 0x0a410037,
++	0x09410044, 0x09410042, 0x09410040, 0x0941003e,
++	0x0941003c, 0x0941003b, 0x09410039, 0x09410037,
++	0x08410044, 0x08410042, 0x08410040, 0x0841003e,
++	0x0841003c, 0x0841003b, 0x08410039, 0x08410037,
++	0x07410044, 0x07410042, 0x07410040, 0x0741003e,
++	0x0741003c, 0x0741003b, 0x07410039, 0x07410037,
++	0x06410044, 0x06410042, 0x06410040, 0x0641003e,
++	0x0641003c, 0x0641003b, 0x06410039, 0x06410037,
++	0x05410044, 0x05410042, 0x05410040, 0x0541003e,
++	0x0541003c, 0x0541003b, 0x05410039, 0x05410037,
++	0x04410044, 0x04410042, 0x04410040, 0x0441003e,
++	0x0441003c, 0x0441003b, 0x04410039, 0x04410037,
++	0x03410044, 0x03410042, 0x03410040, 0x0341003e,
++	0x0341003c, 0x0341003b, 0x03410039, 0x03410037,
++	0x02410044, 0x02410042, 0x02410040, 0x0241003e,
++	0x0241003c, 0x0241003b, 0x02410039, 0x02410037,
++	0x01410044, 0x01410042, 0x01410040, 0x0141003e,
++	0x0141003c, 0x0141003b, 0x01410039, 0x01410037,
++	0x00410044, 0x00410042, 0x00410040, 0x0041003e,
++	0x0041003c, 0x0041003b, 0x00410039, 0x00410037
++};
++
 +/* EPA 5 GHz */
 +
 +static const u32 b43_ntab_tx_gain_epa_rev3_5g[] = {
  	0xcff70044, 0xcff70042, 0xcff70040, 0xcff7003e,
  	0xcff7003c, 0xcff7003b, 0xcff70039, 0xcff70037,
  	0xcef70044, 0xcef70042, 0xcef70040, 0xcef7003e,
-@@ -2252,7 +2445,7 @@ static const u32 b43_ntab_tx_gain_rev3_5
+@@ -2252,7 +2480,7 @@ static const u32 b43_ntab_tx_gain_rev3_5
  	0xc0f7003c, 0xc0f7003b, 0xc0f70039, 0xc0f70037,
  };
  
@@ -1728,16 +2898,51 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x2ff20044, 0x2ff20042, 0x2ff20040, 0x2ff2003e,
  	0x2ff2003c, 0x2ff2003b, 0x2ff20039, 0x2ff20037,
  	0x2ef20044, 0x2ef20042, 0x2ef20040, 0x2ef2003e,
-@@ -2287,7 +2480,7 @@ static const u32 b43_ntab_tx_gain_rev4_5
+@@ -2287,7 +2515,42 @@ static const u32 b43_ntab_tx_gain_rev4_5
  	0x20d2003a, 0x20d20038, 0x20d20036, 0x20d20034,
  };
  
 -static const u32 b43_ntab_tx_gain_rev5plus_5ghz[] = {
++static const u32 b43_ntab_tx_gain_epa_rev4_hi_pwr_5g[] = {
++	0x2ff10044, 0x2ff10042, 0x2ff10040, 0x2ff1003e,
++	0x2ff1003c, 0x2ff1003b, 0x2ff10039, 0x2ff10037,
++	0x2ef10044, 0x2ef10042, 0x2ef10040, 0x2ef1003e,
++	0x2ef1003c, 0x2ef1003b, 0x2ef10039, 0x2ef10037,
++	0x2df10044, 0x2df10042, 0x2df10040, 0x2df1003e,
++	0x2df1003c, 0x2df1003b, 0x2df10039, 0x2df10037,
++	0x2cf10044, 0x2cf10042, 0x2cf10040, 0x2cf1003e,
++	0x2cf1003c, 0x2cf1003b, 0x2cf10039, 0x2cf10037,
++	0x2bf10044, 0x2bf10042, 0x2bf10040, 0x2bf1003e,
++	0x2bf1003c, 0x2bf1003b, 0x2bf10039, 0x2bf10037,
++	0x2af10044, 0x2af10042, 0x2af10040, 0x2af1003e,
++	0x2af1003c, 0x2af1003b, 0x2af10039, 0x2af10037,
++	0x29f10044, 0x29f10042, 0x29f10040, 0x29f1003e,
++	0x29f1003c, 0x29f1003b, 0x29f10039, 0x29f10037,
++	0x28f10044, 0x28f10042, 0x28f10040, 0x28f1003e,
++	0x28f1003c, 0x28f1003b, 0x28f10039, 0x28f10037,
++	0x27f10044, 0x27f10042, 0x27f10040, 0x27f1003e,
++	0x27f1003c, 0x27f1003b, 0x27f10039, 0x27f10037,
++	0x26f10044, 0x26f10042, 0x26f10040, 0x26f1003e,
++	0x26f1003c, 0x26f1003b, 0x26f10039, 0x26f10037,
++	0x25f10044, 0x25f10042, 0x25f10040, 0x25f1003e,
++	0x25f1003c, 0x25f1003b, 0x25f10039, 0x25f10037,
++	0x24f10044, 0x24f10042, 0x24f10040, 0x24f1003e,
++	0x24f1003c, 0x24f1003b, 0x24f10039, 0x24f10038,
++	0x23f10041, 0x23f10040, 0x23f1003f, 0x23f1003e,
++	0x23f1003c, 0x23f1003b, 0x23f10039, 0x23f10037,
++	0x22f10044, 0x22f10042, 0x22f10040, 0x22f1003e,
++	0x22f1003c, 0x22f1003b, 0x22f10039, 0x22f10037,
++	0x21f10044, 0x21f10042, 0x21f10040, 0x21f1003e,
++	0x21f1003c, 0x21f1003b, 0x21f10039, 0x21f10037,
++	0x20d10043, 0x20d10041, 0x20d1003e, 0x20d1003c,
++	0x20d1003a, 0x20d10038, 0x20d10036, 0x20d10034
++};
++
 +static const u32 b43_ntab_tx_gain_epa_rev5_5g[] = {
  	0x0f62004a, 0x0f620048, 0x0f620046, 0x0f620044,
  	0x0f620042, 0x0f620040, 0x0f62003e, 0x0f62003c,
  	0x0e620044, 0x0e620042, 0x0e620040, 0x0e62003e,
-@@ -2322,7 +2515,9 @@ static const u32 b43_ntab_tx_gain_rev5pl
+@@ -2322,7 +2585,9 @@ static const u32 b43_ntab_tx_gain_rev5pl
  	0x0062003b, 0x00620039, 0x00620037, 0x00620035,
  };
  
@@ -1748,7 +2953,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x5ff7002d, 0x5ff7002b, 0x5ff7002a, 0x5ff70029,
  	0x5ff70028, 0x5ff70027, 0x5ff70026, 0x5ff70025,
  	0x5ef7002d, 0x5ef7002b, 0x5ef7002a, 0x5ef70029,
-@@ -2357,7 +2552,7 @@ static const u32 txpwrctrl_tx_gain_ipa[]
+@@ -2357,7 +2622,7 @@ static const u32 txpwrctrl_tx_gain_ipa[]
  	0x50f70028, 0x50f70027, 0x50f70026, 0x50f70025,
  };
  
@@ -1757,7 +2962,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x1ff7002d, 0x1ff7002b, 0x1ff7002a, 0x1ff70029,
  	0x1ff70028, 0x1ff70027, 0x1ff70026, 0x1ff70025,
  	0x1ef7002d, 0x1ef7002b, 0x1ef7002a, 0x1ef70029,
-@@ -2392,7 +2587,7 @@ static const u32 txpwrctrl_tx_gain_ipa_r
+@@ -2392,7 +2657,7 @@ static const u32 txpwrctrl_tx_gain_ipa_r
  	0x10f70028, 0x10f70027, 0x10f70026, 0x10f70025,
  };
  
@@ -1766,11 +2971,47 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x0ff7002d, 0x0ff7002b, 0x0ff7002a, 0x0ff70029,
  	0x0ff70028, 0x0ff70027, 0x0ff70026, 0x0ff70025,
  	0x0ef7002d, 0x0ef7002b, 0x0ef7002a, 0x0ef70029,
-@@ -2427,7 +2622,45 @@ static const u32 txpwrctrl_tx_gain_ipa_r
+@@ -2427,7 +2692,81 @@ static const u32 txpwrctrl_tx_gain_ipa_r
  	0x00f70028, 0x00f70027, 0x00f70026, 0x00f70025,
  };
  
 -static const u32 txpwrctrl_tx_gain_ipa_5g[] = {
++/* Copied from brcmsmac (5.75.11): nphy_tpc_txgain_ipa_2g_2057rev5 */
++static const u32 b43_ntab_tx_gain_ipa_2057_rev5_2g[] = {
++	0x30ff0031, 0x30e70031, 0x30e7002e, 0x30cf002e,
++	0x30bf002e, 0x30af002e, 0x309f002f, 0x307f0033,
++	0x307f0031, 0x307f002e, 0x3077002e, 0x306f002e,
++	0x3067002e, 0x305f002f, 0x30570030, 0x3057002d,
++	0x304f002e, 0x30470031, 0x3047002e, 0x3047002c,
++	0x30470029, 0x303f002c, 0x303f0029, 0x3037002d,
++	0x3037002a, 0x30370028, 0x302f002c, 0x302f002a,
++	0x302f0028, 0x302f0026, 0x3027002c, 0x30270029,
++	0x30270027, 0x30270025, 0x30270023, 0x301f002c,
++	0x301f002a, 0x301f0028, 0x301f0025, 0x301f0024,
++	0x301f0022, 0x301f001f, 0x3017002d, 0x3017002b,
++	0x30170028, 0x30170026, 0x30170024, 0x30170022,
++	0x30170020, 0x3017001e, 0x3017001d, 0x3017001b,
++	0x3017001a, 0x30170018, 0x30170017, 0x30170015,
++	0x300f002c, 0x300f0029, 0x300f0027, 0x300f0024,
++	0x300f0022, 0x300f0021, 0x300f001f, 0x300f001d,
++	0x300f001b, 0x300f001a, 0x300f0018, 0x300f0017,
++	0x300f0016, 0x300f0015, 0x300f0115, 0x300f0215,
++	0x300f0315, 0x300f0415, 0x300f0515, 0x300f0615,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++	0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
++};
++
 +/* Extracted from MMIO dump of 6.30.223.141 */
 +static const u32 b43_ntab_tx_gain_ipa_2057_rev9_2g[] = {
 +	0x60ff0031, 0x60e7002c, 0x60cf002a, 0x60c70029,
@@ -1813,7 +3054,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	0x7ff70035, 0x7ff70033, 0x7ff70032, 0x7ff70031,
  	0x7ff7002f, 0x7ff7002e, 0x7ff7002d, 0x7ff7002b,
  	0x7ff7002a, 0x7ff70029, 0x7ff70028, 0x7ff70027,
-@@ -2462,6 +2695,42 @@ static const u32 txpwrctrl_tx_gain_ipa_5
+@@ -2462,6 +2801,42 @@ static const u32 txpwrctrl_tx_gain_ipa_5
  	0x70f70021, 0x70f70020, 0x70f70020, 0x70f7001f,
  };
  
@@ -1856,7 +3097,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  const s8 b43_ntab_papd_pga_gain_delta_ipa_2g[] = {
  	-114, -108, -98, -91, -84, -78, -70, -62,
  	-54, -46, -39, -31, -23, -15, -8, 0
-@@ -3031,31 +3300,8 @@ void b43_ntab_write_bulk(struct b43_wlde
+@@ -3031,31 +3406,8 @@ void b43_ntab_write_bulk(struct b43_wlde
  		b43_ntab_write_bulk(dev, offset, ARRAY_SIZE(data), data); \
  	} while (0)
  
@@ -1889,7 +3130,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	ntab_upload(dev, B43_NTAB_C0_ESTPLT_R3, b43_ntab_estimatepowerlt0_r3);
  	ntab_upload(dev, B43_NTAB_C1_ESTPLT_R3, b43_ntab_estimatepowerlt1_r3);
  	ntab_upload(dev, B43_NTAB_C0_ADJPLT_R3, b43_ntab_adjustpower0_r3);
-@@ -3066,6 +3312,107 @@ static void b43_nphy_tables_init_rev3(st
+@@ -3066,6 +3418,107 @@ static void b43_nphy_tables_init_rev3(st
  	ntab_upload(dev, B43_NTAB_C1_IQLT_R3, b43_ntab_iqlt1_r3);
  	ntab_upload(dev, B43_NTAB_C0_LOFEEDTH_R3, b43_ntab_loftlt0_r3);
  	ntab_upload(dev, B43_NTAB_C1_LOFEEDTH_R3, b43_ntab_loftlt1_r3);
@@ -1997,7 +3238,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	/* Volatile tables */
  	if (antswlut < ARRAY_SIZE(b43_ntab_antswctl_r3))
-@@ -3078,20 +3425,22 @@ static void b43_nphy_tables_init_rev3(st
+@@ -3078,20 +3531,22 @@ static void b43_nphy_tables_init_rev3(st
  static void b43_nphy_tables_init_rev0(struct b43_wldev *dev)
  {
  	/* Static tables */
@@ -2034,7 +3275,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  
  	/* Volatile tables */
  	ntab_upload(dev, B43_NTAB_BDI, b43_ntab_bdi);
-@@ -3111,7 +3460,11 @@ static void b43_nphy_tables_init_rev0(st
+@@ -3111,7 +3566,11 @@ static void b43_nphy_tables_init_rev0(st
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/InitTables */
  void b43_nphy_tables_init(struct b43_wldev *dev)
  {
@@ -2047,7 +3288,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  		b43_nphy_tables_init_rev3(dev);
  	else
  		b43_nphy_tables_init_rev0(dev);
-@@ -3120,23 +3473,45 @@ void b43_nphy_tables_init(struct b43_wld
+@@ -3120,23 +3579,51 @@ void b43_nphy_tables_init(struct b43_wld
  /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/GetIpaGainTbl */
  static const u32 *b43_nphy_get_ipa_gain_table(struct b43_wldev *dev)
  {
@@ -2066,6 +3307,11 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +		case 16:
 +			if (phy->radio_rev == 9)
 +				return b43_ntab_tx_gain_ipa_2057_rev9_2g;
++			break;
++		case 8:
++			if (phy->radio_rev == 5)
++				return b43_ntab_tx_gain_ipa_2057_rev5_2g;
++			break;
 +		case 6:
 +			if (dev->dev->chip_id == BCMA_CHIP_ID_BCM47162)
 +				return b43_ntab_tx_gain_ipa_rev5_2g;
@@ -2075,24 +3321,25 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +		case 4:
 +		case 3:
 +			return b43_ntab_tx_gain_ipa_rev3_2g;
-+		default:
-+			b43err(dev->wl,
-+			       "No 2GHz IPA gain table available for this device\n");
-+			return NULL;
  		}
++
++		b43err(dev->wl,
++		       "No 2GHz IPA gain table available for this device\n");
++		return NULL;
  	} else {
 -		return txpwrctrl_tx_gain_ipa_5g;
 +		switch (phy->rev) {
 +		case 16:
 +			if (phy->radio_rev == 9)
 +				return b43_ntab_tx_gain_ipa_2057_rev9_5g;
++			break;
 +		case 3 ... 6:
 +			return b43_ntab_tx_gain_ipa_rev3_5g;
-+		default:
-+			b43err(dev->wl,
-+			       "No 5GHz IPA gain table available for this device\n");
-+			return NULL;
 +		}
++
++		b43err(dev->wl,
++		       "No 5GHz IPA gain table available for this device\n");
++		return NULL;
  	}
  }
  
@@ -2102,7 +3349,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	enum ieee80211_band band = b43_current_band(dev->wl);
  	struct ssb_sprom *sprom = dev->dev->bus_sprom;
  
-@@ -3148,19 +3523,36 @@ const u32 *b43_nphy_get_tx_gain_table(st
+@@ -3148,19 +3635,36 @@ const u32 *b43_nphy_get_tx_gain_table(st
  	    (dev->phy.n->ipa5g_on && band == IEEE80211_BAND_5GHZ)) {
  		return b43_nphy_get_ipa_gain_table(dev);
  	} else if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
@@ -2120,7 +3367,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 -		else
 -			return b43_ntab_tx_gain_rev5plus_5ghz;
 +				b43_ntab_tx_gain_epa_rev4_5g :
-+				b43_ntab_tx_gain_epa_rev4_5g; /* FIXME */
++				b43_ntab_tx_gain_epa_rev4_hi_pwr_5g;
 +		case 3:
 +			return b43_ntab_tx_gain_epa_rev3_5g;
 +		default:
@@ -2137,7 +3384,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +		case 6:
 +		case 5:
 +			if (sprom->fem.ghz5.extpa_gain == 3)
-+				return b43_ntab_tx_gain_epa_rev3_2g; /* FIXME */
++				return b43_ntab_tx_gain_epa_rev3_hi_pwr_2g;
 +			/* fall through */
 +		case 4:
 +		case 3:
@@ -2150,7 +3397,7 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	}
  }
  
-@@ -3187,7 +3579,7 @@ struct nphy_gain_ctl_workaround_entry *b
+@@ -3187,7 +3691,7 @@ struct nphy_gain_ctl_workaround_entry *b
  	/* Some workarounds to the workarounds... */
  	if (ghz5 && dev->phy.rev >= 6) {
  		if (dev->phy.radio_rev == 11 &&
@@ -2293,12 +3540,24 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  	{ 0x00, 0x08 }, { 0x01, 0x57 }, { 0x02, 0x20 }, { 0x31, 0x00 },
  	{ 0x32, 0x00 }, { 0x33, 0x00 }, { 0x51, 0x70 }, { 0x59, 0x88 },
  	{ 0x5C, 0x20 }, { 0x62, 0x33 }, { 0x63, 0x0f }, { 0x64, 0x0f },
-@@ -102,6 +103,47 @@ static u16 r2057_rev8_init[54][2] = {
+@@ -102,6 +103,346 @@ static u16 r2057_rev8_init[54][2] = {
  	{ 0x1A6, 0x00 }, { 0x1AA, 0x00 }, { 0x1AB, 0x00 }, { 0x1AC, 0x00 },
  	{ 0x1B7, 0x05 }, { 0x1C2, 0xa0 },
  };
 +*/
 +
++/* Extracted from MMIO dump of 6.30.223.141 */
++static u16 r2057_rev9_init[][2] = {
++	{ 0x27, 0x1f }, { 0x28, 0x0a }, { 0x29, 0x2f }, { 0x42, 0x1f },
++	{ 0x48, 0x3f }, { 0x5c, 0x41 }, { 0x63, 0x14 }, { 0x64, 0x12 },
++	{ 0x66, 0xff }, { 0x74, 0xa3 }, { 0x7b, 0x14 }, { 0x7c, 0x14 },
++	{ 0x7d, 0xee }, { 0x86, 0xc0 }, { 0xc4, 0x10 }, { 0xc9, 0x01 },
++	{ 0xe1, 0x41 }, { 0xe8, 0x14 }, { 0xe9, 0x12 }, { 0xeb, 0xff },
++	{ 0xf5, 0x0a }, { 0xf8, 0x09 }, { 0xf9, 0xa3 }, { 0x100, 0x14 },
++	{ 0x101, 0x10 }, { 0x102, 0xee }, { 0x10b, 0xc0 }, { 0x149, 0x10 },
++	{ 0x14e, 0x01 }, { 0x1b7, 0x05 }, { 0x1c2, 0xa0 },
++};
++
 +#define RADIOREGS7(r00, r01, r02, r03, r04, r05, r06, r07, r08, r09, \
 +		   r10, r11, r12, r13, r14, r15, r16, r17, r18, r19, \
 +		   r20, r21, r22, r23, r24, r25, r26, r27) \
@@ -2331,6 +3590,27 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +	.radio_lna2g_tune_core1			= r26,	\
 +	.radio_lna5g_tune_core1			= r27
 +
++#define RADIOREGS7_2G(r00, r01, r02, r03, r04, r05, r06, r07, r08, r09, \
++		      r10, r11, r12, r13, r14, r15, r16, r17) \
++	.radio_vcocal_countval0			= r00,	\
++	.radio_vcocal_countval1			= r01,	\
++	.radio_rfpll_refmaster_sparextalsize	= r02,	\
++	.radio_rfpll_loopfilter_r1		= r03,	\
++	.radio_rfpll_loopfilter_c2		= r04,	\
++	.radio_rfpll_loopfilter_c1		= r05,	\
++	.radio_cp_kpd_idac			= r06,	\
++	.radio_rfpll_mmd0			= r07,	\
++	.radio_rfpll_mmd1			= r08,	\
++	.radio_vcobuf_tune			= r09,	\
++	.radio_logen_mx2g_tune			= r10,	\
++	.radio_logen_indbuf2g_tune		= r11,	\
++	.radio_lna2g_tune_core0			= r12,	\
++	.radio_txmix2g_tune_boost_pu_core0	= r13,	\
++	.radio_pad2g_tune_pus_core0		= r14,	\
++	.radio_lna2g_tune_core1			= r15,	\
++	.radio_txmix2g_tune_boost_pu_core1	= r16,	\
++	.radio_pad2g_tune_pus_core1		= r17
++
 +#define PHYREGS(r0, r1, r2, r3, r4, r5)	\
 +	.phy_regs.phy_bw1a	= r0,	\
 +	.phy_regs.phy_bw2	= r1,	\
@@ -2338,10 +3618,276 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +	.phy_regs.phy_bw4	= r3,	\
 +	.phy_regs.phy_bw5	= r4,	\
 +	.phy_regs.phy_bw6	= r5
++
++/* Copied from brcmsmac (5.75.11): chan_info_nphyrev8_2057_rev5 */
++static const struct b43_nphy_chantabent_rev7_2g b43_nphy_chantab_phy_rev8_radio_rev5[] = {
++	{
++		.freq			= 2412,
++		RADIOREGS7_2G(0x48, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x6c,
++			      0x09, 0x0d, 0x08, 0x0e, 0x61, 0x03, 0xff, 0x61,
++			      0x03, 0xff),
++		PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
++	},
++	{
++		.freq			= 2417,
++		RADIOREGS7_2G(0x4b, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x71,
++			      0x09, 0x0d, 0x08, 0x0e, 0x61, 0x03, 0xff, 0x61,
++			      0x03, 0xff),
++		PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
++	},
++	{
++		.freq			= 2422,
++		RADIOREGS7_2G(0x4e, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x76,
++			      0x09, 0x0d, 0x08, 0x0e, 0x61, 0x03, 0xef, 0x61,
++			      0x03, 0xef),
++		PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
++	},
++	{
++		.freq			= 2427,
++		RADIOREGS7_2G(0x52, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x7b,
++			      0x09, 0x0c, 0x08, 0x0e, 0x61, 0x03, 0xdf, 0x61,
++			      0x03, 0xdf),
++		PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
++	},
++	{
++		.freq			= 2432,
++		RADIOREGS7_2G(0x55, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x80,
++			      0x09, 0x0c, 0x07, 0x0d, 0x61, 0x03, 0xcf, 0x61,
++			      0x03, 0xcf),
++		PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
++	},
++	{
++		.freq			= 2437,
++		RADIOREGS7_2G(0x58, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x85,
++			      0x09, 0x0c, 0x07, 0x0d, 0x61, 0x03, 0xbf, 0x61,
++			      0x03, 0xbf),
++		PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
++	},
++	{
++		.freq			= 2442,
++		RADIOREGS7_2G(0x5c, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8a,
++			      0x09, 0x0b, 0x07, 0x0d, 0x61, 0x03, 0xaf, 0x61,
++			      0x03, 0xaf),
++		PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
++	},
++	{
++		.freq			= 2447,
++		RADIOREGS7_2G(0x5f, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8f,
++			      0x09, 0x0b, 0x07, 0x0d, 0x61, 0x03, 0x9f, 0x61,
++			      0x03, 0x9f),
++		PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
++	},
++	{
++		.freq			= 2452,
++		RADIOREGS7_2G(0x62, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x94,
++			      0x09, 0x0b, 0x07, 0x0d, 0x61, 0x03, 0x8f, 0x61,
++			      0x03, 0x8f),
++		PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
++	},
++	{
++		.freq			= 2457,
++		RADIOREGS7_2G(0x66, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x99,
++			      0x09, 0x0b, 0x07, 0x0c, 0x61, 0x03, 0x7f, 0x61,
++			      0x03, 0x7f),
++		PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
++	},
++	{
++		.freq			= 2462,
++		RADIOREGS7_2G(0x69, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x9e,
++			      0x09, 0x0b, 0x07, 0x0c, 0x61, 0x03, 0x6f, 0x61,
++			      0x03, 0x6f),
++		PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
++	},
++	{
++		.freq			= 2467,
++		RADIOREGS7_2G(0x6c, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xa3,
++			      0x09, 0x0b, 0x06, 0x0c, 0x61, 0x03, 0x5f, 0x61,
++			      0x03, 0x5f),
++		PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
++	},
++	{
++		.freq			= 2472,
++		RADIOREGS7_2G(0x70, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xa8,
++			      0x09, 0x0a, 0x06, 0x0b, 0x61, 0x03, 0x4f, 0x61,
++			      0x03, 0x4f),
++		PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
++	},
++	{
++		.freq			= 2484,
++		RADIOREGS7_2G(0x78, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xb4,
++			      0x09, 0x0a, 0x06, 0x0b, 0x61, 0x03, 0x3f, 0x61,
++			      0x03, 0x3f),
++		PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
++	}
++};
++
++/* Extracted from MMIO dump of 6.30.223.141 */
++static const struct b43_nphy_chantabent_rev7 b43_nphy_chantab_phy_rev16_radio_rev9[] = {
++	{
++		.freq			= 2412,
++		RADIOREGS7(0x48, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x6c,
++			   0x09, 0x0f, 0x0a, 0x00, 0x0a, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
++	},
++	{
++		.freq			= 2417,
++		RADIOREGS7(0x4b, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x71,
++			   0x09, 0x0f, 0x0a, 0x00, 0x0a, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
++	},
++	{
++		.freq			= 2422,
++		RADIOREGS7(0x4e, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x76,
++			   0x09, 0x0f, 0x09, 0x00, 0x09, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
++	},
++	{
++		.freq			= 2427,
++		RADIOREGS7(0x52, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x7b,
++			   0x09, 0x0f, 0x09, 0x00, 0x09, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
++	},
++	{
++		.freq			= 2432,
++		RADIOREGS7(0x55, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x80,
++			   0x09, 0x0f, 0x08, 0x00, 0x08, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
++	},
++	{
++		.freq			= 2437,
++		RADIOREGS7(0x58, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x85,
++			   0x09, 0x0f, 0x08, 0x00, 0x08, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
++	},
++	{
++		.freq			= 2442,
++		RADIOREGS7(0x5c, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8a,
++			   0x09, 0x0f, 0x07, 0x00, 0x07, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
++	},
++	{
++		.freq			= 2447,
++		RADIOREGS7(0x5f, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8f,
++			   0x09, 0x0f, 0x07, 0x00, 0x07, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
++	},
++	{
++		.freq			= 2452,
++		RADIOREGS7(0x62, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x94,
++			   0x09, 0x0f, 0x07, 0x00, 0x07, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
++	},
++	{
++		.freq			= 2457,
++		RADIOREGS7(0x66, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x99,
++			   0x09, 0x0f, 0x06, 0x00, 0x06, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
++	},
++	{
++		.freq			= 2462,
++		RADIOREGS7(0x69, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x9e,
++			   0x09, 0x0f, 0x06, 0x00, 0x06, 0x00, 0x41, 0x63,
++			   0x00, 0x00, 0x00, 0xf0, 0x00, 0x41, 0x63, 0x00,
++			   0x00, 0x00, 0xf0, 0x00),
++		PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
++	},
++	{
++		.freq			= 5180,
++		RADIOREGS7(0xbe, 0x16, 0x10, 0x1f, 0x08, 0x08, 0x3f, 0x06,
++			   0x02, 0x0e, 0x00, 0x0e, 0x00, 0x9e, 0x00, 0x00,
++			   0x9f, 0x2f, 0xa3, 0x00, 0xfc, 0x00, 0x00, 0x4f,
++			   0x3a, 0x83, 0x00, 0xfc),
++		PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
++	},
++	{
++		.freq			= 5200,
++		RADIOREGS7(0xc5, 0x16, 0x10, 0x1f, 0x08, 0x08, 0x3f, 0x08,
++			   0x02, 0x0e, 0x00, 0x0e, 0x00, 0x9e, 0x00, 0x00,
++			   0x7f, 0x2f, 0x83, 0x00, 0xf8, 0x00, 0x00, 0x4c,
++			   0x4a, 0x83, 0x00, 0xf8),
++		PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
++	},
++	{
++		.freq			= 5220,
++		RADIOREGS7(0xcc, 0x16, 0x10, 0x1f, 0x08, 0x08, 0x3f, 0x0a,
++			   0x02, 0x0e, 0x00, 0x0e, 0x00, 0x9e, 0x00, 0x00,
++			   0x6d, 0x3d, 0x83, 0x00, 0xf8, 0x00, 0x00, 0x2d,
++			   0x2a, 0x73, 0x00, 0xf8),
++		PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
++	},
++	{
++		.freq			= 5240,
++		RADIOREGS7(0xd2, 0x16, 0x10, 0x1f, 0x08, 0x08, 0x3f, 0x0c,
++			   0x02, 0x0d, 0x00, 0x0d, 0x00, 0x8d, 0x00, 0x00,
++			   0x4d, 0x1c, 0x73, 0x00, 0xf8, 0x00, 0x00, 0x4d,
++			   0x2b, 0x73, 0x00, 0xf8),
++		PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
++	},
++	{
++		.freq			= 5745,
++		RADIOREGS7(0x7b, 0x17, 0x20, 0x1f, 0x08, 0x08, 0x3f, 0x7d,
++			   0x04, 0x08, 0x00, 0x06, 0x00, 0x15, 0x00, 0x00,
++			   0x08, 0x03, 0x03, 0x00, 0x30, 0x00, 0x00, 0x06,
++			   0x02, 0x03, 0x00, 0x30),
++		PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
++	},
++	{
++		.freq			= 5765,
++		RADIOREGS7(0x81, 0x17, 0x20, 0x1f, 0x08, 0x08, 0x3f, 0x81,
++			   0x04, 0x08, 0x00, 0x06, 0x00, 0x15, 0x00, 0x00,
++			   0x06, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x05,
++			   0x02, 0x03, 0x00, 0x00),
++		PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
++	},
++	{
++		.freq			= 5785,
++		RADIOREGS7(0x88, 0x17, 0x20, 0x1f, 0x08, 0x08, 0x3f, 0x85,
++			   0x04, 0x08, 0x00, 0x06, 0x00, 0x15, 0x00, 0x00,
++			   0x08, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x05,
++			   0x21, 0x03, 0x00, 0x00),
++		PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
++	},
++	{
++		.freq			= 5805,
++		RADIOREGS7(0x8f, 0x17, 0x20, 0x1f, 0x08, 0x08, 0x3f, 0x89,
++			   0x04, 0x07, 0x00, 0x06, 0x00, 0x04, 0x00, 0x00,
++			   0x06, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x03,
++			   0x00, 0x03, 0x00, 0x00),
++		PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
++	},
++	{
++		.freq			= 5825,
++		RADIOREGS7(0x95, 0x17, 0x20, 0x1f, 0x08, 0x08, 0x3f, 0x8d,
++			   0x04, 0x07, 0x00, 0x05, 0x00, 0x03, 0x00, 0x00,
++			   0x05, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x03,
++			   0x00, 0x03, 0x00, 0x00),
++		PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
++	},
++};
  
  void r2057_upload_inittabs(struct b43_wldev *dev)
  {
-@@ -109,33 +151,69 @@ void r2057_upload_inittabs(struct b43_wl
+@@ -109,33 +450,87 @@ void r2057_upload_inittabs(struct b43_wl
  	u16 *table = NULL;
  	u16 size, i;
  
@@ -2377,6 +3923,12 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +			size = ARRAY_SIZE(r2057_rev5a_init);
 +		}
 +		break;
++	case 16:
++		if (phy->radio_rev == 9) {
++			table = r2057_rev9_init[0];
++			size = ARRAY_SIZE(r2057_rev9_init);
++		}
++		break;
  	}
  
 +	B43_WARN_ON(!table);
@@ -2406,6 +3958,18 @@ This brings b43 up to wireless-testing/master master-2014-07-10
 +
 +	/* TODO */
 +	switch (phy->rev) {
++	case 8:
++		if (phy->radio_rev == 5) {
++			e_r7_2g = b43_nphy_chantab_phy_rev8_radio_rev5;
++			len = ARRAY_SIZE(b43_nphy_chantab_phy_rev8_radio_rev5);
++		}
++		break;
++	case 16:
++		if (phy->radio_rev == 9) {
++			e_r7 = b43_nphy_chantab_phy_rev16_radio_rev9;
++			len = ARRAY_SIZE(b43_nphy_chantab_phy_rev16_radio_rev9);
++		}
++		break;
 +	default:
 +		break;
 +	}
@@ -2430,7 +3994,59 @@ This brings b43 up to wireless-testing/master master-2014-07-10
  }
 --- a/drivers/net/wireless/b43/radio_2057.h
 +++ b/drivers/net/wireless/b43/radio_2057.h
-@@ -425,6 +425,72 @@
+@@ -84,6 +84,8 @@
+ #define R2057_CMOSBUF_RX_RCCR			0x04c
+ #define R2057_LOGEN_SEL_PKDET			0x04d
+ #define R2057_CMOSBUF_SHAREIQ_PTAT		0x04e
++
++/* MISC core 0 */
+ #define R2057_RXTXBIAS_CONFIG_CORE0		0x04f
+ #define R2057_TXGM_TXRF_PUS_CORE0		0x050
+ #define R2057_TXGM_IDAC_BLEED_CORE0		0x051
+@@ -204,6 +206,8 @@
+ #define R2057_RXBB_GPAIOSEL_RXLPF_RCCAL_CORE0	0x0d1
+ #define R2057_LPF_GAIN_CORE0			0x0d2
+ #define R2057_DACBUF_IDACS_BW_CORE0		0x0d3
++
++/* MISC core 1 */
+ #define R2057_RXTXBIAS_CONFIG_CORE1		0x0d4
+ #define R2057_TXGM_TXRF_PUS_CORE1		0x0d5
+ #define R2057_TXGM_IDAC_BLEED_CORE1		0x0d6
+@@ -324,6 +328,7 @@
+ #define R2057_RXBB_GPAIOSEL_RXLPF_RCCAL_CORE1	0x156
+ #define R2057_LPF_GAIN_CORE1			0x157
+ #define R2057_DACBUF_IDACS_BW_CORE1		0x158
++
+ #define R2057_DACBUF_VINCM_CORE1		0x159
+ #define R2057_RCCAL_START_R1_Q1_P1		0x15a
+ #define R2057_RCCAL_X1				0x15b
+@@ -345,6 +350,8 @@
+ #define R2057_RCCAL_BCAP_VAL			0x16b
+ #define R2057_RCCAL_HPC_VAL			0x16c
+ #define R2057_RCCAL_OVERRIDES			0x16d
++
++/* TX core 0 */
+ #define R2057_TX0_IQCAL_GAIN_BW			0x170
+ #define R2057_TX0_LOFT_FINE_I			0x171
+ #define R2057_TX0_LOFT_FINE_Q			0x172
+@@ -362,6 +369,8 @@
+ #define R2057_TX0_TXRXCOUPLE_2G_PWRUP		0x17e
+ #define R2057_TX0_TXRXCOUPLE_5G_ATTEN		0x17f
+ #define R2057_TX0_TXRXCOUPLE_5G_PWRUP		0x180
++
++/* TX core 1 */
+ #define R2057_TX1_IQCAL_GAIN_BW			0x190
+ #define R2057_TX1_LOFT_FINE_I			0x191
+ #define R2057_TX1_LOFT_FINE_Q			0x192
+@@ -379,6 +388,7 @@
+ #define R2057_TX1_TXRXCOUPLE_2G_PWRUP		0x19e
+ #define R2057_TX1_TXRXCOUPLE_5G_ATTEN		0x19f
+ #define R2057_TX1_TXRXCOUPLE_5G_PWRUP		0x1a0
++
+ #define R2057_AFE_VCM_CAL_MASTER_CORE0		0x1a1
+ #define R2057_AFE_SET_VCM_I_CORE0		0x1a2
+ #define R2057_AFE_SET_VCM_Q_CORE0		0x1a3
+@@ -425,6 +435,72 @@
  
  #define R2057_VCM_MASK				0x7
  
diff --git a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
index ec0103cc25..c5bb975cae 100644
--- a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
+++ b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
@@ -22,7 +22,7 @@
  static int modparam_bad_frames_preempt;
  module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  MODULE_PARM_DESC(bad_frames_preempt,
-@@ -2787,10 +2792,10 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2798,10 +2803,10 @@ static int b43_gpio_init(struct b43_wlde
  	u32 mask, set;
  
  	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
diff --git a/package/kernel/mac80211/patches/810-b43_no_pio.patch b/package/kernel/mac80211/patches/810-b43_no_pio.patch
index 2cea894ceb..6d4b298e47 100644
--- a/package/kernel/mac80211/patches/810-b43_no_pio.patch
+++ b/package/kernel/mac80211/patches/810-b43_no_pio.patch
@@ -11,7 +11,7 @@
  b43-$(CPTCFG_B43_PCMCIA)	+= pcmcia.o
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -1913,10 +1913,12 @@ static void b43_do_interrupt_thread(stru
+@@ -1924,10 +1924,12 @@ static void b43_do_interrupt_thread(stru
  			dma_reason[0], dma_reason[1],
  			dma_reason[2], dma_reason[3],
  			dma_reason[4], dma_reason[5]);
diff --git a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
index deecc59f00..2924e6636f 100644
--- a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -1560,7 +1560,7 @@ static void b43_write_beacon_template(st
+@@ -1571,7 +1571,7 @@ static void b43_write_beacon_template(st
  				  len, ram_offset, shm_size_offset, rate);
  
  	/* Write the PHY TX control parameters. */
@@ -9,7 +9,7 @@
  	antenna = b43_antenna_to_phyctl(antenna);
  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
  	/* We can't send beacons with short preamble. Would get PHY errors. */
-@@ -3151,8 +3151,8 @@ static int b43_chip_init(struct b43_wlde
+@@ -3162,8 +3162,8 @@ static int b43_chip_init(struct b43_wlde
  
  	/* Select the antennae */
  	if (phy->ops->set_rx_antenna)
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3846,7 +3846,6 @@ static int b43_op_config(struct ieee8021
+@@ -3857,7 +3857,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev = wl->current_dev;
  	struct b43_phy *phy = &dev->phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  
  	mutex_lock(&wl->mutex);
-@@ -3886,11 +3885,9 @@ static int b43_op_config(struct ieee8021
+@@ -3897,11 +3896,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5019,6 +5016,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5033,6 +5030,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5040,6 +5078,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5054,6 +5092,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5330,6 +5370,8 @@ static int b43_one_core_attach(struct b4
+@@ -5352,6 +5392,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5420,6 +5462,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5442,6 +5484,9 @@ static struct b43_wl *b43_wireless_init(
  
  	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
  
diff --git a/package/kernel/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch b/package/kernel/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
index 35e891c53d..39985fb7c9 100644
--- a/package/kernel/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
+++ b/package/kernel/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
@@ -74,7 +74,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  struct b43_bus_dev *b43_bus_dev_ssb_init(struct ssb_device *sdev);
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -4411,7 +4411,7 @@ static int b43_phy_versioning(struct b43
+@@ -4422,7 +4422,7 @@ static int b43_phy_versioning(struct b43
  		u16 radio24[3];
  
  		for (tmp = 0; tmp < 3; tmp++) {
@@ -83,7 +83,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  			radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
  		}
  
-@@ -4430,10 +4430,10 @@ static int b43_phy_versioning(struct b43
+@@ -4441,10 +4441,10 @@ static int b43_phy_versioning(struct b43
  			else
  				tmp = 0x5205017F;
  		} else {
@@ -199,7 +199,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
 --- a/drivers/net/wireless/b43/phy_n.c
 +++ b/drivers/net/wireless/b43/phy_n.c
-@@ -5812,14 +5812,14 @@ static inline void check_phyreg(struct b
+@@ -6251,14 +6251,14 @@ static inline void check_phyreg(struct b
  static u16 b43_nphy_op_read(struct b43_wldev *dev, u16 reg)
  {
  	check_phyreg(dev, reg);
@@ -216,7 +216,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_write16(dev, B43_MMIO_PHY_DATA, value);
  }
  
-@@ -5827,7 +5827,7 @@ static void b43_nphy_op_maskset(struct b
+@@ -6266,7 +6266,7 @@ static void b43_nphy_op_maskset(struct b
  				 u16 set)
  {
  	check_phyreg(dev, reg);
@@ -225,7 +225,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_maskset16(dev, B43_MMIO_PHY_DATA, mask, set);
  }
  
-@@ -5841,7 +5841,7 @@ static u16 b43_nphy_op_radio_read(struct
+@@ -6280,7 +6280,7 @@ static u16 b43_nphy_op_radio_read(struct
  	else
  		reg |= 0x100;
  
@@ -234,9 +234,9 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	return b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
  }
  
-@@ -5850,7 +5850,7 @@ static void b43_nphy_op_radio_write(stru
+@@ -6289,7 +6289,7 @@ static void b43_nphy_op_radio_write(stru
  	/* Register 1 is a 32-bit register. */
- 	B43_WARN_ON(reg == 1);
+ 	B43_WARN_ON(dev->phy.rev < 7 && reg == 1);
  
 -	b43_write16(dev, B43_MMIO_RADIO_CONTROL, reg);
 +	b43_wflush16(dev, B43_MMIO_RADIO_CONTROL, reg);
diff --git a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
index 3e62591406..bafabb3e92 100644
--- a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
+++ b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -2804,6 +2804,14 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2815,6 +2815,14 @@ static int b43_gpio_init(struct b43_wlde
  	} else if (dev->dev->chip_id == 0x5354) {
  		/* Don't allow overtaking buttons GPIOs */
  		set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */