51 files changed, 2304 insertions, 1334 deletions
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index b16b06c2031..dc8ed152766 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -1,14 +1,8 @@
 config IWLWIFI
        tristate "Intel Wireless Wifi"
-        depends on PCI && MAC80211 && EXPERIMENTAL
+        depends on PCI && MAC80211
        select FW_LOADER
-config IWLWIFI_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwlagn driver"
-        depends on IWLWIFI
-        ---help---
-          This option will enable spectrum measurement for the iwlagn driver.
 config IWLWIFI_DEBUG
        bool "Enable full debugging output in iwlagn and iwl3945 drivers"
        depends on IWLWIFI
@@ -120,9 +114,3 @@ config IWL3945
          inserted in and removed from the running kernel whenever you want),
          say M here and read <file:Documentation/kbuild/modules.txt>.  The
          module will be called iwl3945.
-config IWL3945_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwl3945 driver"
-        depends on IWL3945
-        ---help---
-          This option will enable spectrum measurement for the iwl3945 driver.
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 7f82044af24..4e378faee65 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -3,7 +3,6 @@ iwlcore-objs 		:= iwl-core.o iwl-eeprom.o iwl-hcmd.o iwl-power.o
 iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o iwl-calib.o
 iwlcore-objs            += iwl-scan.o iwl-led.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
-iwlcore-$(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) += iwl-spectrum.o
 iwlcore-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
 CFLAGS_iwl-devtrace.o := -I$(src)
@@ -20,3 +19,5 @@ iwlagn-$(CONFIG_IWL5000) += iwl-1000.o
 # 3945
 obj-$(CONFIG_IWL3945)   += iwl3945.o
 iwl3945-objs            := iwl3945-base.o iwl-3945.o iwl-3945-rs.o iwl-3945-led.o
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 8414178bcff..694ceef8859 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2008-2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -89,8 +89,78 @@ static void iwl1000_nic_config(struct iwl_priv *priv)
                                ~APMG_SVR_VOLTAGE_CONFIG_BIT_MSK);
 }
+static struct iwl_sensitivity_ranges iwl1000_sensitivity = {
+        .min_nrg_cck = 95,
+        .max_nrg_cck = 0, /* not used, set to 0 */
+        .auto_corr_min_ofdm = 90,
+        .auto_corr_min_ofdm_mrc = 170,
+        .auto_corr_min_ofdm_x1 = 120,
+        .auto_corr_min_ofdm_mrc_x1 = 240,
+        .auto_corr_max_ofdm = 120,
+        .auto_corr_max_ofdm_mrc = 210,
+        .auto_corr_max_ofdm_x1 = 155,
+        .auto_corr_max_ofdm_mrc_x1 = 290,
+        .auto_corr_min_cck = 125,
+        .auto_corr_max_cck = 200,
+        .auto_corr_min_cck_mrc = 170,
+        .auto_corr_max_cck_mrc = 400,
+        .nrg_th_cck = 95,
+        .nrg_th_ofdm = 95,
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
+};
+static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl1000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_LO)               |
+                        BIT(IWL_CALIB_TX_IQ)            |
+                        BIT(IWL_CALIB_TX_IQ_PERD)       |
+                        BIT(IWL_CALIB_BASE_BAND);
+        return 0;
+}
 static struct iwl_lib_ops iwl1000_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
+        .set_hw_params = iwl1000_hw_set_hw_params,
        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
        .txq_set_sched = iwl5000_txq_set_sched,
@@ -105,6 +175,8 @@ static struct iwl_lib_ops iwl1000_lib = {
        .load_ucode = iwl5000_load_ucode,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
@@ -138,9 +210,10 @@ static struct iwl_lib_ops iwl1000_lib = {
                .temperature = iwl5000_temperature,
                .set_ct_kill = iwl1000_set_ct_threshold,
         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
-static struct iwl_ops iwl1000_ops = {
+static const struct iwl_ops iwl1000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl1000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -173,7 +246,8 @@ struct iwl_cfg iwl1000_bgn_cfg = {
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl1000_bg_cfg = {
@@ -200,6 +274,8 @@ struct iwl_cfg iwl1000_bg_cfg = {
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-fh.h b/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
index 08ce259a0e6..042f6bc0df1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-fh.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 6fd10d443ba..3a876a8ece3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index a871d09d598..abe2b739c4d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.h b/drivers/net/wireless/iwlwifi/iwl-3945-led.h
index 5a1033ca7aa..ce990adc51e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index d4b49883b30..47909f94271 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 234891d8cc1..6940f086823 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -1951,11 +1951,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
        }
        /* Add the broadcast address so we can send broadcast frames */
-        if (iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL) ==
+        priv->cfg->ops->lib->add_bcast_station(priv);
-            IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
-                return -EIO;
-        }
        /* If we have set the ASSOC_MSK and we are in BSS mode then
         * add the IWL_AP_ID to the station rate table */
@@ -2796,6 +2792,7 @@ static struct iwl_lib_ops iwl3945_lib = {
        .post_associate = iwl3945_post_associate,
        .isr = iwl_isr_legacy,
        .config_ap = iwl3945_config_ap,
+        .add_bcast_station = iwl3945_add_bcast_station,
 };
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
@@ -2804,7 +2801,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
 };
-static struct iwl_ops iwl3945_ops = {
+static const struct iwl_ops iwl3945_ops = {
        .ucode = &iwl3945_ucode,
        .lib = &iwl3945_lib,
        .hcmd = &iwl3945_hcmd,
@@ -2830,6 +2827,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
        .ht_greenfield_support = false,
        .led_compensation = 64,
        .broken_powersave = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2847,9 +2845,10 @@ static struct iwl_cfg iwl3945_abg_cfg = {
        .ht_greenfield_support = false,
        .led_compensation = 64,
        .broken_powersave = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
-struct pci_device_id iwl3945_hw_card_ids[] = {
+DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x4222, 0x1005, iwl3945_bg_cfg)},
        {IWL_PCI_DEVICE(0x4222, 0x1034, iwl3945_bg_cfg)},
        {IWL_PCI_DEVICE(0x4222, 0x1044, iwl3945_bg_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 531fa125f5a..8f553f36d27 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -37,7 +37,7 @@
 #include <net/ieee80211_radiotap.h>
 /* Hardware specific file defines the PCI IDs table for that hardware module */
-extern struct pci_device_id iwl3945_hw_card_ids[];
+extern const struct pci_device_id iwl3945_hw_card_ids[];
 #include "iwl-csr.h"
 #include "iwl-prph.h"
@@ -226,7 +226,8 @@ extern void iwl3945_rx_replenish(void *data);
 extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 extern unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
                                        struct ieee80211_hdr *hdr,int left);
-extern void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log);
+extern int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                                       char **buf, bool display);
 extern void iwl3945_dump_nic_error_log(struct iwl_priv *priv);
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index c606366b582..67ef562e8db 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 9b4b8b5c757..aebe8c51d3e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -2206,9 +2206,10 @@ static struct iwl_lib_ops iwl4965_lib = {
                .temperature = iwl4965_temperature_calib,
                .set_ct_kill = iwl4965_set_ct_threshold,
        },
+        .add_bcast_station = iwl_add_bcast_station,
 };
-static struct iwl_ops iwl4965_ops = {
+static const struct iwl_ops iwl4965_ops = {
        .ucode = &iwl4965_ucode,
        .lib = &iwl4965_lib,
        .hcmd = &iwl4965_hcmd,
@@ -2239,7 +2240,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
        .broken_powersave = true,
        .led_compensation = 61,
        .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
 };
 /* Module firmware */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index bc056e9ab85..714e032f621 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index de45f308b74..f3d662c8cbc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -179,14 +179,24 @@ static void iwl5000_gain_computation(struct iwl_priv *priv,
                        data->delta_gain_code[i] = 0;
                        continue;
                }
-                delta_g = (1000 * ((s32)average_noise[default_chain] -
+                delta_g = (priv->cfg->chain_noise_scale *
+                        ((s32)average_noise[default_chain] -
                        (s32)average_noise[i])) / 1500;
                /* bound gain by 2 bits value max, 3rd bit is sign */
                data->delta_gain_code[i] =
                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
                if (delta_g < 0)
-                        /* set negative sign */
+                        /*
+                         * set negative sign ...
+                         * note to Intel developers:  This is uCode API format,
+                         *   not the format of any internal device registers.
+                         *   Do not change this format for e.g. 6050 or similar
+                         *   devices.  Change format only if more resolution
+                         *   (i.e. more than 2 bits magnitude) is needed.
+                         */
                        data->delta_gain_code[i] |= (1 << 2);
        }
@@ -263,8 +273,8 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
        .auto_corr_max_ofdm = 120,
        .auto_corr_max_ofdm_mrc = 210,
-        .auto_corr_max_ofdm_x1 = 155,
+        .auto_corr_max_ofdm_x1 = 120,
-        .auto_corr_max_ofdm_mrc_x1 = 290,
+        .auto_corr_max_ofdm_mrc_x1 = 240,
        .auto_corr_min_cck = 125,
        .auto_corr_max_cck = 200,
@@ -412,12 +422,14 @@ static void iwl5000_rx_calib_complete(struct iwl_priv *priv,
 /*
 * ucode
 */
-static int iwl5000_load_section(struct iwl_priv *priv,
+static int iwl5000_load_section(struct iwl_priv *priv, const char *name,
-                                struct fw_desc *image,
+                                struct fw_desc *image, u32 dst_addr)
-                                u32 dst_addr)
 {
        dma_addr_t phy_addr = image->p_addr;
        u32 byte_cnt = image->len;
+        int ret;
+        priv->ucode_write_complete = 0;
        iwl_write_direct32(priv,
                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
@@ -447,57 +459,36 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
-        return 0;
+        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
-}
-static int iwl5000_load_given_ucode(struct iwl_priv *priv,
-                struct fw_desc *inst_image,
-                struct fw_desc *data_image)
-{
-        int ret = 0;
-        ret = iwl5000_load_section(priv, inst_image,
-                                   IWL50_RTC_INST_LOWER_BOUND);
-        if (ret)
-                return ret;
-        IWL_DEBUG_INFO(priv, "INST uCode section being loaded...\n");
        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
                                        priv->ucode_write_complete, 5 * HZ);
        if (ret == -ERESTARTSYS) {
-                IWL_ERR(priv, "Could not load the INST uCode section due "
+                IWL_ERR(priv, "Could not load the %s uCode section due "
-                        "to interrupt\n");
+                        "to interrupt\n", name);
                return ret;
        }
        if (!ret) {
-                IWL_ERR(priv, "Could not load the INST uCode section\n");
+                IWL_ERR(priv, "Could not load the %s uCode section\n",
+                        name);
                return -ETIMEDOUT;
        }
-        priv->ucode_write_complete = 0;
+        return 0;
+}
-        ret = iwl5000_load_section(
-                priv, data_image, IWL50_RTC_DATA_LOWER_BOUND);
-        if (ret)
-                return ret;
-        IWL_DEBUG_INFO(priv, "DATA uCode section being loaded...\n");
+static int iwl5000_load_given_ucode(struct iwl_priv *priv,
+                struct fw_desc *inst_image,
+                struct fw_desc *data_image)
+{
+        int ret = 0;
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = iwl5000_load_section(priv, "INST", inst_image,
-                                priv->ucode_write_complete, 5 * HZ);
+                                   IWL50_RTC_INST_LOWER_BOUND);
-        if (ret == -ERESTARTSYS) {
+        if (ret)
-                IWL_ERR(priv, "Could not load the INST uCode section due "
-                        "to interrupt\n");
                return ret;
-        } else if (!ret) {
-                IWL_ERR(priv, "Could not load the DATA uCode section\n");
-                return -ETIMEDOUT;
-        } else
-                ret = 0;
-        priv->ucode_write_complete = 0;
-        return ret;
+        return iwl5000_load_section(priv, "DATA", data_image,
+                                    IWL50_RTC_DATA_LOWER_BOUND);
 }
 int iwl5000_load_ucode(struct iwl_priv *priv)
@@ -781,7 +772,7 @@ void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
        scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
-        if (txq->q.write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
                scd_bc_tbl[txq_id].
                        tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
 }
@@ -800,12 +791,12 @@ void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
        if (txq_id != IWL_CMD_QUEUE_NUM)
                sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
-        bc_ent =  cpu_to_le16(1 | (sta_id << 12));
+        bc_ent = cpu_to_le16(1 | (sta_id << 12));
        scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
-        if (txq->q.write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
                scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] =  bc_ent;
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
 }
 static int iwl5000_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
@@ -1466,6 +1457,8 @@ struct iwl_lib_ops iwl5000_lib = {
        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
        .load_ucode = iwl5000_load_ucode,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
@@ -1501,6 +1494,7 @@ struct iwl_lib_ops iwl5000_lib = {
                .temperature = iwl5000_temperature,
                .set_ct_kill = iwl5000_set_ct_threshold,
         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
 static struct iwl_lib_ops iwl5150_lib = {
@@ -1518,6 +1512,7 @@ static struct iwl_lib_ops iwl5150_lib = {
        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
        .load_ucode = iwl5000_load_ucode,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
@@ -1553,9 +1548,10 @@ static struct iwl_lib_ops iwl5150_lib = {
                .temperature = iwl5150_temperature,
                .set_ct_kill = iwl5150_set_ct_threshold,
         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
-static struct iwl_ops iwl5000_ops = {
+static const struct iwl_ops iwl5000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl5000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -1563,7 +1559,7 @@ static struct iwl_ops iwl5000_ops = {
        .led = &iwlagn_led_ops,
 };
-static struct iwl_ops iwl5150_ops = {
+static const struct iwl_ops iwl5150_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl5150_lib,
        .hcmd = &iwl5000_hcmd,
@@ -1600,7 +1596,8 @@ struct iwl_cfg iwl5300_agn_cfg = {
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5100_bgn_cfg = {
@@ -1625,6 +1622,8 @@ struct iwl_cfg iwl5100_bgn_cfg = {
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5100_abg_cfg = {
@@ -1647,6 +1646,8 @@ struct iwl_cfg iwl5100_abg_cfg = {
        .use_bsm = false,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5100_agn_cfg = {
@@ -1671,7 +1672,8 @@ struct iwl_cfg iwl5100_agn_cfg = {
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -1696,7 +1698,8 @@ struct iwl_cfg iwl5350_agn_cfg = {
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -1721,7 +1724,8 @@ struct iwl_cfg iwl5150_agn_cfg = {
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl5150_abg_cfg = {
@@ -1744,6 +1748,8 @@ struct iwl_cfg iwl5150_abg_cfg = {
        .use_bsm = false,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
index 90185777d98..ddba3999999 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-6000-hw.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 74e57104927..782e23a2698 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2008-2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -108,7 +108,7 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
        .auto_corr_max_ofdm = 145,
        .auto_corr_max_ofdm_mrc = 232,
-        .auto_corr_max_ofdm_x1 = 145,
+        .auto_corr_max_ofdm_x1 = 110,
        .auto_corr_max_ofdm_mrc_x1 = 232,
        .auto_corr_min_cck = 125,
@@ -158,11 +158,25 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
        /* Set initial sensitivity parameters */
        /* Set initial calibration set */
        priv->hw_params.sens = &iwl6000_sensitivity;
-        priv->hw_params.calib_init_cfg =
+        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        case CSR_HW_REV_TYPE_6x50:
+                priv->hw_params.calib_init_cfg =
                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_DC)               |
                        BIT(IWL_CALIB_LO)               |
                        BIT(IWL_CALIB_TX_IQ)            |
                        BIT(IWL_CALIB_BASE_BAND);
+                break;
+        default:
+                priv->hw_params.calib_init_cfg =
+                        BIT(IWL_CALIB_XTAL)             |
+                        BIT(IWL_CALIB_LO)               |
+                        BIT(IWL_CALIB_TX_IQ)            |
+                        BIT(IWL_CALIB_BASE_BAND);
+                break;
+        }
        return 0;
 }
@@ -215,6 +229,8 @@ static struct iwl_lib_ops iwl6000_lib = {
        .load_ucode = iwl5000_load_ucode,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_csr = iwl_dump_csr,
+        .dump_fh = iwl_dump_fh,
        .init_alive_start = iwl5000_init_alive_start,
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
@@ -250,9 +266,10 @@ static struct iwl_lib_ops iwl6000_lib = {
                .temperature = iwl5000_temperature,
                .set_ct_kill = iwl6000_set_ct_threshold,
         },
+        .add_bcast_station = iwl_add_bcast_station,
 };
-static struct iwl_ops iwl6000_ops = {
+static const struct iwl_ops iwl6000_ops = {
        .ucode = &iwl5000_ucode,
        .lib = &iwl6000_lib,
        .hcmd = &iwl5000_hcmd,
@@ -260,21 +277,6 @@ static struct iwl_ops iwl6000_ops = {
        .led = &iwlagn_led_ops,
 };
-static struct iwl_hcmd_utils_ops iwl6050_hcmd_utils = {
-        .get_hcmd_size = iwl5000_get_hcmd_size,
-        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
-        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
-        .calc_rssi = iwl5000_calc_rssi,
-};
-static struct iwl_ops iwl6050_ops = {
-        .ucode = &iwl5000_ucode,
-        .lib = &iwl6000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl6050_hcmd_utils,
-        .led = &iwlagn_led_ops,
-};
 /*
 * "i": Internal configuration, use internal Power Amplifier
 */
@@ -306,7 +308,8 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -336,6 +339,8 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -365,6 +370,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -373,7 +380,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .ucode_api_max = IWL6050_UCODE_API_MAX,
        .ucode_api_min = IWL6050_UCODE_API_MIN,
        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6050_ops,
+        .ops = &iwl6000_ops,
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
@@ -395,7 +402,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DYNAMIC,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -404,7 +412,7 @@ struct iwl_cfg iwl6050_2abg_cfg = {
        .ucode_api_max = IWL6050_UCODE_API_MAX,
        .ucode_api_min = IWL6050_UCODE_API_MIN,
        .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6050_ops,
+        .ops = &iwl6000_ops,
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
@@ -425,6 +433,8 @@ struct iwl_cfg iwl6050_2abg_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -455,7 +465,8 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .supports_idle = true,
        .adv_thermal_throttle = true,
        .support_ct_kill_exit = true,
-        .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-led.c b/drivers/net/wireless/iwlwifi/iwl-agn-led.c
index 3bccba20f6d..1a24946bc20 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-led.h b/drivers/net/wireless/iwlwifi/iwl-agn-led.h
index ab55f92a161..a594e4fdc6b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index b93e4915819..6aebcedaca8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index affc0c5a2f2..e71923961e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -191,7 +191,7 @@ enum {
        IWL_RATE_2M_MASK)
 #define IWL_CCK_RATES_MASK          \
-       (IWL_BASIC_RATES_MASK      | \
+       (IWL_CCK_BASIC_RATES_MASK  | \
        IWL_RATE_5M_MASK          | \
        IWL_RATE_11M_MASK)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1c9866daf81..1854c720b5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -73,13 +73,7 @@
 #define VD
 #endif
-#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
+#define DRV_VERSION     IWLWIFI_VERSION VD
-#define VS "s"
-#else
-#define VS
-#endif
-#define DRV_VERSION     IWLWIFI_VERSION VD VS
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
@@ -203,7 +197,8 @@ int iwl_commit_rxon(struct iwl_priv *priv)
        priv->start_calib = 0;
        /* Add the broadcast address so we can send broadcast frames */
-        iwl_add_bcast_station(priv);
+        priv->cfg->ops->lib->add_bcast_station(priv);
        /* If we have set the ASSOC_MSK and we are in BSS mode then
         * add the IWL_AP_ID to the station rate table */
@@ -657,6 +652,131 @@ static void iwl_bg_statistics_periodic(unsigned long data)
        iwl_send_statistics_request(priv, CMD_ASYNC, false);
 }
+static void iwl_print_cont_event_trace(struct iwl_priv *priv, u32 base,
+                                        u32 start_idx, u32 num_events,
+                                        u32 mode)
+{
+        u32 i;
+        u32 ptr;        /* SRAM byte address of log data */
+        u32 ev, time, data; /* event log data */
+        unsigned long reg_flags;
+        if (mode == 0)
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 2 * sizeof(u32));
+        else
+                ptr = base + (4 * sizeof(u32)) + (start_idx * 3 * sizeof(u32));
+        /* Make sure device is powered up for SRAM reads */
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (iwl_grab_nic_access(priv)) {
+                spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+                return;
+        }
+        /* Set starting address; reads will auto-increment */
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, ptr);
+        rmb();
+        /*
+         * "time" is actually "data" for mode 0 (no timestamp).
+         * place event id # at far right for easier visual parsing.
+         */
+        for (i = 0; i < num_events; i++) {
+                ev = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                if (mode == 0) {
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                        0, time, ev);
+                } else {
+                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+                        trace_iwlwifi_dev_ucode_cont_event(priv,
+                                                time, data, ev);
+                }
+        }
+        /* Allow device to power down */
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+}
+static void iwl_continuous_event_trace(struct iwl_priv *priv)
+{
+        u32 capacity;   /* event log capacity in # entries */
+        u32 base;       /* SRAM byte address of event log header */
+        u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
+        u32 num_wraps;  /* # times uCode wrapped to top of log */
+        u32 next_entry; /* index of next entry to be written by uCode */
+        if (priv->ucode_type == UCODE_INIT)
+                base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
+        else
+                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
+        if (priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
+                capacity = iwl_read_targ_mem(priv, base);
+                num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
+                mode = iwl_read_targ_mem(priv, base + (1 * sizeof(u32)));
+                next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
+        } else
+                return;
+        if (num_wraps == priv->event_log.num_wraps) {
+                iwl_print_cont_event_trace(priv,
+                                       base, priv->event_log.next_entry,
+                                       next_entry - priv->event_log.next_entry,
+                                       mode);
+                priv->event_log.non_wraps_count++;
+        } else {
+                if ((num_wraps - priv->event_log.num_wraps) > 1)
+                        priv->event_log.wraps_more_count++;
+                else
+                        priv->event_log.wraps_once_count++;
+                trace_iwlwifi_dev_ucode_wrap_event(priv,
+                                num_wraps - priv->event_log.num_wraps,
+                                next_entry, priv->event_log.next_entry);
+                if (next_entry < priv->event_log.next_entry) {
+                        iwl_print_cont_event_trace(priv, base,
+                               priv->event_log.next_entry,
+                               capacity - priv->event_log.next_entry,
+                               mode);
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                } else {
+                        iwl_print_cont_event_trace(priv, base,
+                               next_entry, capacity - next_entry,
+                               mode);
+                        iwl_print_cont_event_trace(priv, base, 0,
+                                next_entry, mode);
+                }
+        }
+        priv->event_log.num_wraps = num_wraps;
+        priv->event_log.next_entry = next_entry;
+}
+/**
+ * iwl_bg_ucode_trace - Timer callback to log ucode event
+ *
+ * The timer is continually set to execute every
+ * UCODE_TRACE_PERIOD milliseconds after the last timer expired
+ * this function is to perform continuous uCode event logging operation
+ * if enabled
+ */
+static void iwl_bg_ucode_trace(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+        if (priv->event_log.ucode_trace) {
+                iwl_continuous_event_trace(priv);
+                /* Reschedule the timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                         jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        }
+}
 static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
@@ -689,12 +809,14 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
        u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
        unsigned long status = priv->status;
-        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s\n",
+        IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s CT:%s\n",
                          (flags & HW_CARD_DISABLED) ? "Kill" : "On",
-                          (flags & SW_CARD_DISABLED) ? "Kill" : "On");
+                          (flags & SW_CARD_DISABLED) ? "Kill" : "On",
+                          (flags & CT_CARD_DISABLED) ?
+                          "Reached" : "Not reached");
        if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED |
-                     RF_CARD_DISABLED)) {
+                     CT_CARD_DISABLED)) {
                iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                            CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
@@ -708,10 +830,10 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                        iwl_write_direct32(priv, HBUS_TARG_MBX_C,
                                        HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
                }
-                if (flags & RF_CARD_DISABLED)
+                if (flags & CT_CARD_DISABLED)
                        iwl_tt_enter_ct_kill(priv);
        }
-        if (!(flags & RF_CARD_DISABLED))
+        if (!(flags & CT_CARD_DISABLED))
                iwl_tt_exit_ct_kill(priv);
        if (flags & HW_CARD_DISABLED)
@@ -761,6 +883,8 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
        priv->rx_handlers[REPLY_ALIVE] = iwl_rx_reply_alive;
        priv->rx_handlers[REPLY_ERROR] = iwl_rx_reply_error;
        priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl_rx_csa;
+        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
+                        iwl_rx_spectrum_measure_notif;
        priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl_rx_pm_sleep_notif;
        priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
            iwl_rx_pm_debug_statistics_notif;
@@ -774,7 +898,6 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl_reply_statistics;
        priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl_rx_statistics;
-        iwl_setup_spectrum_handlers(priv);
        iwl_setup_rx_scan_handlers(priv);
        /* status change handler */
@@ -1634,7 +1757,7 @@ static const char *desc_lookup_text[] = {
        "DEBUG_1",
        "DEBUG_2",
        "DEBUG_3",
-        "UNKNOWN"
+        "ADVANCED SYSASSERT"
 };
 static const char *desc_lookup(int i)
@@ -1705,8 +1828,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
 * iwl_print_event_log - Dump error event log to syslog
 *
 */
-static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
+static int iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+                               u32 num_events, u32 mode,
+                               int pos, char **buf, size_t bufsz)
 {
        u32 i;
        u32 base;       /* SRAM byte address of event log header */
@@ -1716,7 +1840,7 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
        unsigned long reg_flags;
        if (num_events == 0)
-                return;
+                return pos;
        if (priv->ucode_type == UCODE_INIT)
                base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
        else
@@ -1744,27 +1868,44 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        /* data, ev */
-                        trace_iwlwifi_dev_ucode_event(priv, 0, time, ev);
+                        if (bufsz) {
-                        IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n", time, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOG:0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                        time, ev);
+                                IWL_ERR(priv, "EVT_LOG:0x%08x:%04u\n",
+                                        time, ev);
+                        }
                } else {
                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                        IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
+                        if (bufsz) {
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "EVT_LOGT:%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "EVT_LOGT:%010u:0x%08x:%04u\n",
                                        time, data, ev);
-                        trace_iwlwifi_dev_ucode_event(priv, time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                        data, ev);
+                        }
                }
        }
        /* Allow device to power down */
        iwl_release_nic_access(priv);
        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
 }
 /**
 * iwl_print_last_event_logs - Dump the newest # of event log to syslog
 */
-static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+static int iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
-                                      u32 num_wraps, u32 next_entry,
+                                    u32 num_wraps, u32 next_entry,
-                                      u32 size, u32 mode)
+                                    u32 size, u32 mode,
+                                    int pos, char **buf, size_t bufsz)
 {
        /*
         * display the newest DEFAULT_LOG_ENTRIES entries
@@ -1772,21 +1913,26 @@ static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         */
        if (num_wraps) {
                if (next_entry < size) {
-                        iwl_print_event_log(priv,
+                        pos = iwl_print_event_log(priv,
-                                        capacity - (size - next_entry),
+                                                capacity - (size - next_entry),
-                                        size - next_entry, mode);
+                                                size - next_entry, mode,
-                        iwl_print_event_log(priv, 0,
+                                                pos, buf, bufsz);
-                                    next_entry, mode);
+                        pos = iwl_print_event_log(priv, 0,
+                                                  next_entry, mode,
+                                                  pos, buf, bufsz);
                } else
-                        iwl_print_event_log(priv, next_entry - size,
+                        pos = iwl_print_event_log(priv, next_entry - size,
-                                    size, mode);
+                                                  size, mode, pos, buf, bufsz);
        } else {
-                if (next_entry < size)
+                if (next_entry < size) {
-                        iwl_print_event_log(priv, 0, next_entry, mode);
+                        pos = iwl_print_event_log(priv, 0, next_entry,
-                else
+                                                  mode, pos, buf, bufsz);
-                        iwl_print_event_log(priv, next_entry - size,
+                } else {
-                                            size, mode);
+                        pos = iwl_print_event_log(priv, next_entry - size,
+                                                  size, mode, pos, buf, bufsz);
+                }
        }
+        return pos;
 }
 /* For sanity check only.  Actual size is determined by uCode, typ. 512 */
@@ -1794,7 +1940,8 @@ static void iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
 #define DEFAULT_DUMP_EVENT_LOG_ENTRIES (20)
-void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
+int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
        u32 base;       /* SRAM byte address of event log header */
        u32 capacity;   /* event log capacity in # entries */
@@ -1802,6 +1949,8 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        u32 num_wraps;  /* # times uCode wrapped to top of log */
        u32 next_entry; /* index of next entry to be written by uCode */
        u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
        if (priv->ucode_type == UCODE_INIT)
                base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
@@ -1812,7 +1961,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                IWL_ERR(priv,
                        "Invalid event log pointer 0x%08X for %s uCode\n",
                        base, (priv->ucode_type == UCODE_INIT) ? "Init" : "RT");
-                return;
+                return -EINVAL;
        }
        /* event log header */
@@ -1838,7 +1987,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        /* bail out if nothing in log */
        if (size == 0) {
                IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
        }
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1853,6 +2002,15 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                size);
 #ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+        }
        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
                /*
                 * if uCode has wrapped back to top of log,
@@ -1860,17 +2018,22 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                 * i.e the next one that uCode would fill.
                 */
                if (num_wraps)
-                        iwl_print_event_log(priv, next_entry,
+                        pos = iwl_print_event_log(priv, next_entry,
-                                            capacity - next_entry, mode);
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
                /* (then/else) start at top of log */
-                iwl_print_event_log(priv, 0, next_entry, mode);
+                pos = iwl_print_event_log(priv, 0,
+                                          next_entry, mode, pos, buf, bufsz);
        } else
-                iwl_print_last_event_logs(priv, capacity, num_wraps,
+                pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
-                                        next_entry, size, mode);
+                                                next_entry, size, mode,
+                                                pos, buf, bufsz);
 #else
-        iwl_print_last_event_logs(priv, capacity, num_wraps,
+        pos = iwl_print_last_event_logs(priv, capacity, num_wraps,
-                                next_entry, size, mode);
+                                        next_entry, size, mode,
+                                        pos, buf, bufsz);
 #endif
+        return pos;
 }
 /**
@@ -2276,18 +2439,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
        return;
 }
-static void iwl_bg_up(struct work_struct *data)
-{
-        struct iwl_priv *priv = container_of(data, struct iwl_priv, up);
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-        mutex_lock(&priv->mutex);
-        __iwl_up(priv);
-        mutex_unlock(&priv->mutex);
-}
 static void iwl_bg_restart(struct work_struct *data)
 {
        struct iwl_priv *priv = container_of(data, struct iwl_priv, restart);
@@ -2304,7 +2455,13 @@ static void iwl_bg_restart(struct work_struct *data)
                ieee80211_restart_hw(priv->hw);
        } else {
                iwl_down(priv);
-                queue_work(priv->workqueue, &priv->up);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return;
+                mutex_lock(&priv->mutex);
+                __iwl_up(priv);
+                mutex_unlock(&priv->mutex);
        }
 }
@@ -2440,7 +2597,7 @@ void iwl_post_associate(struct iwl_priv *priv)
 * Not a mac80211 entry point function, but it fits in with all the
 * other mac80211 functions grouped here.
 */
-static int iwl_setup_mac(struct iwl_priv *priv)
+static int iwl_mac_setup_register(struct iwl_priv *priv)
 {
        int ret;
        struct ieee80211_hw *hw = priv->hw;
@@ -2456,6 +2613,10 @@ static int iwl_setup_mac(struct iwl_priv *priv)
                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+        if (priv->cfg->sku & IWL_SKU_N)
+                hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                             IEEE80211_HW_SUPPORTS_STATIC_SMPS;
        hw->sta_data_size = sizeof(struct iwl_station_priv);
        hw->wiphy->interface_modes =
                BIT(NL80211_IFTYPE_STATION) |
@@ -2470,7 +2631,7 @@ static int iwl_setup_mac(struct iwl_priv *priv)
         */
        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX + 1;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -2668,14 +2829,18 @@ void iwl_config_ap(struct iwl_priv *priv)
 }
 static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
-                        struct ieee80211_key_conf *keyconf, const u8 *addr,
+                                    struct ieee80211_vif *vif,
-                        u32 iv32, u16 *phase1key)
+                                    struct ieee80211_key_conf *keyconf,
+                                    struct ieee80211_sta *sta,
+                                    u32 iv32, u16 *phase1key)
 {
        struct iwl_priv *priv = hw->priv;
        IWL_DEBUG_MAC80211(priv, "enter\n");
-        iwl_update_tkip_key(priv, keyconf, addr, iv32, phase1key);
+        iwl_update_tkip_key(priv, keyconf,
+                            sta ? sta->addr : iwl_bcast_addr,
+                            iv32, phase1key);
        IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -2784,6 +2949,9 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                        return 0;
                else
                        return ret;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                /* do nothing */
+                return -EOPNOTSUPP;
        default:
                IWL_DEBUG_HT(priv, "unknown\n");
                return -EINVAL;
@@ -2833,6 +3001,8 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
                break;
        case STA_NOTIFY_AWAKE:
                WARN_ON(!sta_priv->client);
+                if (!sta_priv->asleep)
+                        break;
                sta_priv->asleep = false;
                sta_id = iwl_find_station(priv, sta->addr);
                if (sta_id != IWL_INVALID_STATION)
@@ -3109,7 +3279,6 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
        init_waitqueue_head(&priv->wait_command_queue);
-        INIT_WORK(&priv->up, iwl_bg_up);
        INIT_WORK(&priv->restart, iwl_bg_restart);
        INIT_WORK(&priv->rx_replenish, iwl_bg_rx_replenish);
        INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update);
@@ -3126,6 +3295,10 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
        priv->statistics_periodic.data = (unsigned long)priv;
        priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+        init_timer(&priv->ucode_trace);
+        priv->ucode_trace.data = (unsigned long)priv;
+        priv->ucode_trace.function = iwl_bg_ucode_trace;
        if (!priv->cfg->use_isr_legacy)
                tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                        iwl_irq_tasklet, (unsigned long)priv);
@@ -3144,6 +3317,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
        cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->beacon_update);
        del_timer_sync(&priv->statistics_periodic);
+        del_timer_sync(&priv->ucode_trace);
 }
 static void iwl_init_hw_rates(struct iwl_priv *priv,
@@ -3188,6 +3362,8 @@ static int iwl_init_drv(struct iwl_priv *priv)
        priv->band = IEEE80211_BAND_2GHZ;
        priv->iw_mode = NL80211_IFTYPE_STATION;
+        priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
+        priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
        /* Choose which receivers/antennas to use */
        if (priv->cfg->ops->hcmd->set_rxon_chain)
@@ -3264,7 +3440,6 @@ static struct ieee80211_ops iwl_hw_ops = {
        .set_key = iwl_mac_set_key,
        .update_tkip_key = iwl_mac_update_tkip_key,
        .get_stats = iwl_mac_get_stats,
-        .get_tx_stats = iwl_mac_get_tx_stats,
        .conf_tx = iwl_mac_conf_tx,
        .reset_tsf = iwl_mac_reset_tsf,
        .bss_info_changed = iwl_bss_info_changed,
@@ -3439,9 +3614,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        iwl_setup_deferred_work(priv);
        iwl_setup_rx_handlers(priv);
-        /**********************************
+        /*********************************************
-         * 8. Setup and register mac80211
+         * 8. Enable interrupts and read RFKILL state
-         **********************************/
+         *********************************************/
        /* enable interrupts if needed: hw bug w/a */
        pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
@@ -3452,14 +3627,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        iwl_enable_interrupts(priv);
-        err = iwl_setup_mac(priv);
-        if (err)
-                goto out_remove_sysfs;
-        err = iwl_dbgfs_register(priv, DRV_NAME);
-        if (err)
-                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
        /* If platform's RF_KILL switch is NOT set to KILL */
        if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
                clear_bit(STATUS_RF_KILL_HW, &priv->status);
@@ -3471,6 +3638,18 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        iwl_power_initialize(priv);
        iwl_tt_initialize(priv);
+        /**************************************************
+         * 9. Setup and register with mac80211 and debugfs
+         **************************************************/
+        err = iwl_mac_setup_register(priv);
+        if (err)
+                goto out_remove_sysfs;
+        err = iwl_dbgfs_register(priv, DRV_NAME);
+        if (err)
+                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
        return 0;
 out_remove_sysfs:
@@ -3589,7 +3768,7 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 *****************************************************************************/
 /* Hardware specific file defines the PCI IDs table for that hardware module */
-static struct pci_device_id iwl_hw_card_ids[] = {
+static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 #ifdef CONFIG_IWL4965
        {IWL_PCI_DEVICE(0x4229, PCI_ANY_ID, iwl4965_agn_cfg)},
        {IWL_PCI_DEVICE(0x4230, PCI_ANY_ID, iwl4965_agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 95a57b36a7e..845831ac053 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -414,7 +414,6 @@ static int iwl_sens_auto_corr_ofdm(struct iwl_priv *priv,
 /* Prepare a SENSITIVITY_CMD, send to uCode if values have changed */
 static int iwl_sensitivity_write(struct iwl_priv *priv)
 {
-        int ret = 0;
        struct iwl_sensitivity_cmd cmd ;
        struct iwl_sensitivity_data *data = NULL;
        struct iwl_host_cmd cmd_out = {
@@ -477,11 +476,7 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
        memcpy(&(priv->sensitivity_tbl[0]), &(cmd.table[0]),
               sizeof(u16)*HD_TABLE_SIZE);
-        ret = iwl_send_cmd(priv, &cmd_out);
+        return iwl_send_cmd(priv, &cmd_out);
-        if (ret)
-                IWL_ERR(priv, "SENSITIVITY_CMD failed\n");
-        return ret;
 }
 void iwl_init_sensitivity(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.h b/drivers/net/wireless/iwlwifi/iwl-calib.h
index b6cef989a79..2b7b1df83ba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.h
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index e9150753192..c2f31eb26be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -120,7 +120,6 @@ enum {
        CALIBRATION_COMPLETE_NOTIFICATION = 0x67,
        /* 802.11h related */
-        RADAR_NOTIFICATION = 0x70,      /* not used */
        REPLY_QUIET_CMD = 0x71,         /* not used */
        REPLY_CHANNEL_SWITCH = 0x72,
        CHANNEL_SWITCH_NOTIFICATION = 0x73,
@@ -2248,10 +2247,22 @@ struct iwl_link_quality_cmd {
        __le32 reserved2;
 } __attribute__ ((packed));
+/*
+ * BT configuration enable flags:
+ *   bit 0 - 1: BT channel announcement enabled
+ *           0: disable
+ *   bit 1 - 1: priority of BT device enabled
+ *           0: disable
+ *   bit 2 - 1: BT 2 wire support enabled
+ *           0: disable
+ */
+#define BT_COEX_DISABLE (0x0)
+#define BT_ENABLE_CHANNEL_ANNOUNCE BIT(0)
+#define BT_ENABLE_PRIORITY         BIT(1)
+#define BT_ENABLE_2_WIRE           BIT(2)
 #define BT_COEX_DISABLE (0x0)
-#define BT_COEX_MODE_2W (0x1)
+#define BT_COEX_ENABLE  (BT_ENABLE_CHANNEL_ANNOUNCE | BT_ENABLE_PRIORITY)
-#define BT_COEX_MODE_3W (0x2)
-#define BT_COEX_MODE_4W (0x3)
 #define BT_LEAD_TIME_MIN (0x0)
 #define BT_LEAD_TIME_DEF (0x1E)
@@ -2510,7 +2521,7 @@ struct iwl_card_state_notif {
 #define HW_CARD_DISABLED   0x01
 #define SW_CARD_DISABLED   0x02
-#define RF_CARD_DISABLED   0x04
+#define CT_CARD_DISABLED   0x04
 #define RXON_CARD_DISABLED 0x10
 struct iwl_ct_kill_config {
@@ -2984,7 +2995,7 @@ struct statistics_rx_ht_phy {
        __le32 agg_crc32_good;
        __le32 agg_mpdu_cnt;
        __le32 agg_cnt;
-        __le32 reserved2;
+        __le32 unsupport_mcs;
 } __attribute__ ((packed));
 #define INTERFERENCE_DATA_AVAILABLE      cpu_to_le32(1)
@@ -3087,8 +3098,8 @@ struct statistics_div {
 } __attribute__ ((packed));
 struct statistics_general {
-        __le32 temperature;
+        __le32 temperature;   /* radio temperature */
-        __le32 temperature_m;
+        __le32 temperature_m; /* for 5000 and up, this is radio voltage */
        struct statistics_dbg dbg;
        __le32 sleep_time;
        __le32 slots_out;
@@ -3096,7 +3107,12 @@ struct statistics_general {
        __le32 ttl_timestamp;
        struct statistics_div div;
        __le32 rx_enable_counter;
-        __le32 reserved1;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
        __le32 reserved2;
        __le32 reserved3;
 } __attribute__ ((packed));
@@ -3161,13 +3177,30 @@ struct iwl_notif_statistics {
 /*
 * MISSED_BEACONS_NOTIFICATION = 0xa2 (notification only, not a command)
+ *
+ * uCode send MISSED_BEACONS_NOTIFICATION to driver when detect beacon missed
+ * in regardless of how many missed beacons, which mean when driver receive the
+ * notification, inside the command, it can find all the beacons information
+ * which include number of total missed beacons, number of consecutive missed
+ * beacons, number of beacons received and number of beacons expected to
+ * receive.
+ *
+ * If uCode detected consecutive_missed_beacons > 5, it will reset the radio
+ * in order to bring the radio/PHY back to working state; which has no relation
+ * to when driver will perform sensitivity calibration.
+ *
+ * Driver should set it own missed_beacon_threshold to decide when to perform
+ * sensitivity calibration based on number of consecutive missed beacons in
+ * order to improve overall performance, especially in noisy environment.
+ *
 */
-/* if ucode missed CONSECUTIVE_MISSED_BCONS_TH beacons in a row,
- * then this notification will be sent. */
+#define IWL_MISSED_BEACON_THRESHOLD_MIN (1)
-#define CONSECUTIVE_MISSED_BCONS_TH 20
+#define IWL_MISSED_BEACON_THRESHOLD_DEF (5)
+#define IWL_MISSED_BEACON_THRESHOLD_MAX IWL_MISSED_BEACON_THRESHOLD_DEF
 struct iwl_missed_beacon_notif {
-        __le32 consequtive_missed_beacons;
+        __le32 consecutive_missed_beacons;
        __le32 total_missed_becons;
        __le32 num_expected_beacons;
        __le32 num_recvd_beacons;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index d10bea64fce..d390eef2efe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2,7 +2,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -47,6 +47,26 @@ MODULE_VERSION(IWLWIFI_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
+/*
+ * set bt_coex_active to true, uCode will do kill/defer
+ * every time the priority line is asserted (BT is sending signals on the
+ * priority line in the PCIx).
+ * set bt_coex_active to false, uCode will ignore the BT activity and
+ * perform the normal operation
+ *
+ * User might experience transmit issue on some platform due to WiFi/BT
+ * co-exist problem. The possible behaviors are:
+ *   Able to scan and finding all the available AP
+ *   Not able to associate with any AP
+ * On those platforms, WiFi communication can be restored by set
+ * "bt_coex_active" module parameter to "false"
+ *
+ * default: bt_coex_active = true (BT_COEX_ENABLE)
+ */
+static bool bt_coex_active = true;
+module_param(bt_coex_active, bool, S_IRUGO);
+MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist\n");
 static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
        {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
         0, COEX_UNASSOC_IDLE_FLAGS},
@@ -257,8 +277,8 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
        spin_lock_irqsave(&priv->lock, flags);
        priv->cfg->ops->lib->apm_ops.init(priv);
-        /* Set interrupt coalescing timer to 512 usecs */
+        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, 512 / 32);
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -450,8 +470,6 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
        if (priv->cfg->ht_greenfield_support)
                ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
        ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
-        ht_info->cap |= (IEEE80211_HT_CAP_SM_PS &
-                             (priv->cfg->sm_ps_mode << 2));
        max_bit_rate = MAX_BIT_RATE_20_MHZ;
        if (priv->hw_params.ht40_channel & BIT(band)) {
                ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -636,7 +654,7 @@ EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
 static bool is_single_rx_stream(struct iwl_priv *priv)
 {
-        return !priv->current_ht_config.is_ht ||
+        return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
               priv->current_ht_config.single_chain_sufficient;
 }
@@ -1003,28 +1021,18 @@ static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 */
 static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
 {
-        int idle_cnt = active_cnt;
+        /* # Rx chains when idling, depending on SMPS mode */
-        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        switch (priv->current_ht_config.smps) {
+        case IEEE80211_SMPS_STATIC:
-        /* # Rx chains when idling and maybe trying to save power */
+        case IEEE80211_SMPS_DYNAMIC:
-        switch (priv->cfg->sm_ps_mode) {
+                return IWL_NUM_IDLE_CHAINS_SINGLE;
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        case IEEE80211_SMPS_OFF:
-                idle_cnt = (is_cam) ? active_cnt : IWL_NUM_IDLE_CHAINS_SINGLE;
+                return active_cnt;
-                break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
-                idle_cnt = (is_cam) ? IWL_NUM_IDLE_CHAINS_DUAL :
-                        IWL_NUM_IDLE_CHAINS_SINGLE;
-                break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
-                break;
-        case WLAN_HT_CAP_SM_PS_INVALID:
        default:
-                IWL_ERR(priv, "invalid sm_ps mode %u\n",
+                WARN(1, "invalid SMPS mode %d",
-                        priv->cfg->sm_ps_mode);
+                     priv->current_ht_config.smps);
-                WARN_ON(1);
+                return active_cnt;
-                break;
        }
-        return idle_cnt;
 }
 /* up to 4 chains */
@@ -1363,7 +1371,11 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
        priv->cfg->ops->lib->dump_nic_error_log(priv);
-        priv->cfg->ops->lib->dump_nic_event_log(priv, false);
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+        if (priv->cfg->ops->lib->dump_fh)
+                priv->cfg->ops->lib->dump_fh(priv, NULL, false);
+        priv->cfg->ops->lib->dump_nic_event_log(priv, false, NULL, false);
 #ifdef CONFIG_IWLWIFI_DEBUG
        if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS)
                iwl_print_rx_config_cmd(priv);
@@ -1813,6 +1825,16 @@ irqreturn_t iwl_isr_ict(int irq, void *data)
        if (val == 0xffffffff)
                val = 0;
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
        inta = (0xff & val) | ((0xff00 & val) << 16);
        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
                        inta, inta_mask, val);
@@ -1975,13 +1997,20 @@ EXPORT_SYMBOL(iwl_isr_legacy);
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
        struct iwl_bt_cmd bt_cmd = {
-                .flags = BT_COEX_MODE_4W,
                .lead_time = BT_LEAD_TIME_DEF,
                .max_kill = BT_MAX_KILL_DEF,
                .kill_ack_mask = 0,
                .kill_cts_mask = 0,
        };
+        if (!bt_coex_active)
+                bt_cmd.flags = BT_COEX_DISABLE;
+        else
+                bt_cmd.flags = BT_COEX_ENABLE;
+        IWL_DEBUG_INFO(priv, "BT coex %s\n",
+                (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
        return iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
                                sizeof(struct iwl_bt_cmd), &bt_cmd);
 }
@@ -2599,44 +2628,43 @@ int iwl_set_mode(struct iwl_priv *priv, int mode)
 EXPORT_SYMBOL(iwl_set_mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf)
+                                 struct ieee80211_vif *vif)
 {
        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
+        int err = 0;
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
+        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", vif->type);
+        mutex_lock(&priv->mutex);
        if (priv->vif) {
                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
+                goto out;
        }
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->vif = vif;
-        priv->vif = conf->vif;
+        priv->iw_mode = vif->type;
-        priv->iw_mode = conf->type;
-        spin_unlock_irqrestore(&priv->lock, flags);
-        mutex_lock(&priv->mutex);
+        if (vif->addr) {
+                IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
-        if (conf->mac_addr) {
+                memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", conf->mac_addr);
-                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
        }
-        if (iwl_set_mode(priv, conf->type) == -EAGAIN)
+        if (iwl_set_mode(priv, vif->type) == -EAGAIN)
                /* we are not ready, will run again when ready */
                set_bit(STATUS_MODE_PENDING, &priv->status);
+ out:
        mutex_unlock(&priv->mutex);
        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL(iwl_mac_add_interface);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_if_init_conf *conf)
+                                     struct ieee80211_vif *vif)
 {
        struct iwl_priv *priv = hw->priv;
@@ -2649,7 +2677,7 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
                iwlcore_commit_rxon(priv);
        }
-        if (priv->vif == conf->vif) {
+        if (priv->vif == vif) {
                priv->vif = NULL;
                memset(priv->bssid, 0, ETH_ALEN);
        }
@@ -2689,6 +2717,21 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
        }
+        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
+                       IEEE80211_CONF_CHANGE_CHANNEL)) {
+                /* mac80211 uses static for non-HT which is what we want */
+                priv->current_ht_config.smps = conf->smps_mode;
+                /*
+                 * Recalculate chain counts.
+                 *
+                 * If monitor mode is enabled then mac80211 will
+                 * set up the SM PS mode to OFF if an HT channel is
+                 * configured.
+                 */
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+        }
        /* during scanning mac80211 will delay channel setting until
         * scan finish with changed = 0
@@ -2786,10 +2829,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                iwl_set_tx_power(priv, conf->power_level, false);
        }
-        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv);
        if (!iwl_is_ready(priv)) {
                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                goto out;
@@ -2812,42 +2851,6 @@ out:
 }
 EXPORT_SYMBOL(iwl_mac_config);
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-        int i, avail;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        unsigned long flags;
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-        spin_lock_irqsave(&priv->lock, flags);
-        for (i = 0; i < AC_NUM; i++) {
-                txq = &priv->txq[i];
-                q = &txq->q;
-                avail = iwl_queue_space(q);
-                stats[i].len = q->n_window - avail;
-                stats[i].limit = q->n_window - q->high_mark;
-                stats[i].count = q->n_window;
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
-}
-EXPORT_SYMBOL(iwl_mac_get_tx_stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 {
        struct iwl_priv *priv = hw->priv;
@@ -3197,6 +3200,164 @@ void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
 EXPORT_SYMBOL(iwl_update_stats);
 #endif
+const static char *get_csr_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(CSR_HW_IF_CONFIG_REG);
+                IWL_CMD(CSR_INT_COALESCING);
+                IWL_CMD(CSR_INT);
+                IWL_CMD(CSR_INT_MASK);
+                IWL_CMD(CSR_FH_INT_STATUS);
+                IWL_CMD(CSR_GPIO_IN);
+                IWL_CMD(CSR_RESET);
+                IWL_CMD(CSR_GP_CNTRL);
+                IWL_CMD(CSR_HW_REV);
+                IWL_CMD(CSR_EEPROM_REG);
+                IWL_CMD(CSR_EEPROM_GP);
+                IWL_CMD(CSR_OTP_GP_REG);
+                IWL_CMD(CSR_GIO_REG);
+                IWL_CMD(CSR_GP_UCODE_REG);
+                IWL_CMD(CSR_GP_DRIVER_REG);
+                IWL_CMD(CSR_UCODE_DRV_GP1);
+                IWL_CMD(CSR_UCODE_DRV_GP2);
+                IWL_CMD(CSR_LED_REG);
+                IWL_CMD(CSR_DRAM_INT_TBL_REG);
+                IWL_CMD(CSR_GIO_CHICKEN_BITS);
+                IWL_CMD(CSR_ANA_PLL_CFG);
+                IWL_CMD(CSR_HW_REV_WA_REG);
+                IWL_CMD(CSR_DBG_HPET_MEM_REG);
+        default:
+                return "UNKNOWN";
+        }
+}
+void iwl_dump_csr(struct iwl_priv *priv)
+{
+        int i;
+        u32 csr_tbl[] = {
+                CSR_HW_IF_CONFIG_REG,
+                CSR_INT_COALESCING,
+                CSR_INT,
+                CSR_INT_MASK,
+                CSR_FH_INT_STATUS,
+                CSR_GPIO_IN,
+                CSR_RESET,
+                CSR_GP_CNTRL,
+                CSR_HW_REV,
+                CSR_EEPROM_REG,
+                CSR_EEPROM_GP,
+                CSR_OTP_GP_REG,
+                CSR_GIO_REG,
+                CSR_GP_UCODE_REG,
+                CSR_GP_DRIVER_REG,
+                CSR_UCODE_DRV_GP1,
+                CSR_UCODE_DRV_GP2,
+                CSR_LED_REG,
+                CSR_DRAM_INT_TBL_REG,
+                CSR_GIO_CHICKEN_BITS,
+                CSR_ANA_PLL_CFG,
+                CSR_HW_REV_WA_REG,
+                CSR_DBG_HPET_MEM_REG
+        };
+        IWL_ERR(priv, "CSR values:\n");
+        IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
+                "CSR_INT_PERIODIC_REG)\n");
+        for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
+                IWL_ERR(priv, "  %25s: 0X%08x\n",
+                        get_csr_string(csr_tbl[i]),
+                        iwl_read32(priv, csr_tbl[i]));
+        }
+}
+EXPORT_SYMBOL(iwl_dump_csr);
+const static char *get_fh_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
+                IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
+                IWL_CMD(FH_RSCSR_CHNL0_WPTR);
+                IWL_CMD(FH_MEM_RCSR_CHNL0_CONFIG_REG);
+                IWL_CMD(FH_MEM_RSSR_SHARED_CTRL_REG);
+                IWL_CMD(FH_MEM_RSSR_RX_STATUS_REG);
+                IWL_CMD(FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
+                IWL_CMD(FH_TSSR_TX_STATUS_REG);
+                IWL_CMD(FH_TSSR_TX_ERROR_REG);
+        default:
+                return "UNKNOWN";
+        }
+}
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
+{
+        int i;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        int pos = 0;
+        size_t bufsz = 0;
+#endif
+        u32 fh_tbl[] = {
+                FH_RSCSR_CHNL0_STTS_WPTR_REG,
+                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+                FH_RSCSR_CHNL0_WPTR,
+                FH_MEM_RCSR_CHNL0_CONFIG_REG,
+                FH_MEM_RSSR_SHARED_CTRL_REG,
+                FH_MEM_RSSR_RX_STATUS_REG,
+                FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
+                FH_TSSR_TX_STATUS_REG,
+                FH_TSSR_TX_ERROR_REG
+        };
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+                pos += scnprintf(*buf + pos, bufsz - pos,
+                                "FH register values:\n");
+                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+                        pos += scnprintf(*buf + pos, bufsz - pos,
+                                "  %34s: 0X%08x\n",
+                                get_fh_string(fh_tbl[i]),
+                                iwl_read_direct32(priv, fh_tbl[i]));
+                }
+                return pos;
+        }
+#endif
+        IWL_ERR(priv, "FH register values:\n");
+        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+                IWL_ERR(priv, "  %34s: 0X%08x\n",
+                        get_fh_string(fh_tbl[i]),
+                        iwl_read_direct32(priv, fh_tbl[i]));
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwl_dump_fh);
+void iwl_force_rf_reset(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+        if (!iwl_is_associated(priv)) {
+                IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");
+                return;
+        }
+        /*
+         * There is no easy and better way to force reset the radio,
+         * the only known method is switching channel which will force to
+         * reset and tune the radio.
+         * Use internal short scan (single channel) operation to should
+         * achieve this objective.
+         * Driver should reset the radio when number of consecutive missed
+         * beacon, or any other uCode error condition detected.
+         */
+        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
+        iwl_internal_short_hw_scan(priv);
+        return;
+}
+EXPORT_SYMBOL(iwl_force_rf_reset);
 #ifdef CONFIG_PM
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 27ca859e745..8f0c564e68b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -63,8 +63,6 @@
 #ifndef __iwl_core_h__
 #define __iwl_core_h__
-#include <generated/utsrelease.h>
 /************************
 * forward declarations *
 ************************/
@@ -72,8 +70,8 @@ struct iwl_host_cmd;
 struct iwl_cmd;
-#define IWLWIFI_VERSION UTS_RELEASE "-k"
+#define IWLWIFI_VERSION "in-tree:"
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2009 Intel Corporation"
+#define DRV_COPYRIGHT   "Copyright(c) 2003-2010 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 #define IWL_PCI_DEVICE(dev, subdev, cfg) \
@@ -169,8 +167,11 @@ struct iwl_lib_ops {
        int (*is_valid_rtc_data_addr)(u32 addr);
        /* 1st ucode load */
        int (*load_ucode)(struct iwl_priv *priv);
-        void (*dump_nic_event_log)(struct iwl_priv *priv, bool full_log);
+        int (*dump_nic_event_log)(struct iwl_priv *priv,
+                                  bool full_log, char **buf, bool display);
        void (*dump_nic_error_log)(struct iwl_priv *priv);
+        void (*dump_csr)(struct iwl_priv *priv);
+        int (*dump_fh)(struct iwl_priv *priv, char **buf, bool display);
        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
        /* power management */
        struct iwl_apm_ops apm_ops;
@@ -187,6 +188,8 @@ struct iwl_lib_ops {
        /* temperature */
        struct iwl_temp_ops temp_ops;
+        /* station management */
+        void (*add_bcast_station)(struct iwl_priv *priv);
 };
 struct iwl_led_ops {
@@ -230,8 +233,9 @@ struct iwl_mod_params {
 * @chain_noise_num_beacons: number of beacons used to compute chain noise
 * @adv_thermal_throttle: support advance thermal throttle
 * @support_ct_kill_exit: support ct kill exit condition
- * @sm_ps_mode: spatial multiplexing power save mode
 * @support_wimax_coexist: support wimax/wifi co-exist
+ * @plcp_delta_threshold: plcp error rate threshold used to trigger
+ *      radio tuning when there is a high receiving plcp error rate
 *
 * We enable the driver to be backward compatible wrt API version. The
 * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -287,8 +291,9 @@ struct iwl_cfg {
        const bool supports_idle;
        bool adv_thermal_throttle;
        bool support_ct_kill_exit;
-        u8 sm_ps_mode;
        const bool support_wimax_coexist;
+        u8 plcp_delta_threshold;
+        s32 chain_noise_scale;
 };
 /***************************
@@ -332,13 +337,11 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
 int iwl_commit_rxon(struct iwl_priv *priv);
 int iwl_set_mode(struct iwl_priv *priv, int mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                          struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                              struct ieee80211_vif *vif);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
 void iwl_config_ap(struct iwl_priv *priv);
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
 int iwl_alloc_txq_mem(struct iwl_priv *priv);
 void iwl_free_txq_mem(struct iwl_priv *priv);
@@ -425,6 +428,8 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
 /* Handlers */
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb);
+void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
+                                          struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_statistics(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb);
 void iwl_reply_statistics(struct iwl_priv *priv,
@@ -495,6 +500,8 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
+int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_force_rf_reset(struct iwl_priv *priv);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                       const u8 *ie, int ie_len, int left);
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
@@ -525,14 +532,6 @@ int iwl_send_calib_results(struct iwl_priv *priv);
 int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len);
 void iwl_calib_free_results(struct iwl_priv *priv);
-/*******************************************************************************
- * Spectrum Measureemtns in  iwl-spectrum.c
- ******************************************************************************/
-#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
-void iwl_setup_spectrum_handlers(struct iwl_priv *priv);
-#else
-static inline void iwl_setup_spectrum_handlers(struct iwl_priv *priv) {}
-#endif
 /*****************************************************
 *   S e n d i n g     H o s t     C o m m a n d s   *
 *****************************************************/
@@ -581,7 +580,10 @@ int iwl_pci_resume(struct pci_dev *pdev);
 *  Error Handling Debugging
 ******************************************************/
 void iwl_dump_nic_error_log(struct iwl_priv *priv);
-void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log);
+int iwl_dump_nic_event_log(struct iwl_priv *priv,
+                           bool full_log, char **buf, bool display);
+void iwl_dump_csr(struct iwl_priv *priv);
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display);
 #ifdef CONFIG_IWLWIFI_DEBUG
 void iwl_print_rx_config_cmd(struct iwl_priv *priv);
 #else
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 1ec8cb4d5ea..1e00720bf8b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index d61293ab67c..1c7b53d511c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project.
 *
@@ -67,57 +67,6 @@ do {                                            			\
                               DUMP_PREFIX_OFFSET, 16, 1, p, len, 1);   \
 } while (0)
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-struct iwl_debugfs {
-        const char *name;
-        struct dentry *dir_drv;
-        struct dentry *dir_data;
-        struct dentry *dir_debug;
-        struct dentry *dir_rf;
-        struct dir_data_files {
-                struct dentry *file_sram;
-                struct dentry *file_nvm;
-                struct dentry *file_stations;
-                struct dentry *file_log_event;
-                struct dentry *file_channels;
-                struct dentry *file_status;
-                struct dentry *file_interrupt;
-                struct dentry *file_qos;
-                struct dentry *file_thermal_throttling;
-                struct dentry *file_led;
-                struct dentry *file_disable_ht40;
-                struct dentry *file_sleep_level_override;
-                struct dentry *file_current_sleep_command;
-        } dbgfs_data_files;
-        struct dir_rf_files {
-                struct dentry *file_disable_sensitivity;
-                struct dentry *file_disable_chain_noise;
-                struct dentry *file_disable_tx_power;
-        } dbgfs_rf_files;
-        struct dir_debug_files {
-                struct dentry *file_rx_statistics;
-                struct dentry *file_tx_statistics;
-                struct dentry *file_traffic_log;
-                struct dentry *file_rx_queue;
-                struct dentry *file_tx_queue;
-                struct dentry *file_ucode_rx_stats;
-                struct dentry *file_ucode_tx_stats;
-                struct dentry *file_ucode_general_stats;
-                struct dentry *file_sensitivity;
-                struct dentry *file_chain_noise;
-                struct dentry *file_tx_power;
-                struct dentry *file_power_save_status;
-                struct dentry *file_clear_ucode_statistics;
-                struct dentry *file_clear_traffic_statistics;
-        } dbgfs_debug_files;
-        u32 sram_offset;
-        u32 sram_len;
-};
-int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
-void iwl_dbgfs_unregister(struct iwl_priv *priv);
-#endif
 #else
 #define IWL_DEBUG(__priv, level, fmt, args...)
 #define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
@@ -126,9 +75,10 @@ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
 {}
 #endif                          /* CONFIG_IWLWIFI_DEBUG */
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
-#ifndef CONFIG_IWLWIFI_DEBUGFS
+void iwl_dbgfs_unregister(struct iwl_priv *priv);
+#else
 static inline int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
        return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 21e0f6699da..d134301b553 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -2,7 +2,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -41,43 +41,28 @@
 #include "iwl-calib.h"
 /* create and remove of files */
-#define DEBUGFS_ADD_DIR(name, parent) do {                              \
+#define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
-        dbgfs->dir_##name = debugfs_create_dir(#name, parent);          \
+        if (!debugfs_create_file(#name, mode, parent, priv,             \
-        if (!(dbgfs->dir_##name))                                       \
+                                 &iwl_dbgfs_##name##_ops))              \
-                goto err;                                               \
+                goto err;                                               \
 } while (0)
-#define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
+#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
+        struct dentry *__tmp;                                           \
-        debugfs_create_file(#name, mode,                                \
+        __tmp = debugfs_create_bool(#name, S_IWUSR | S_IRUSR,           \
-                                dbgfs->dir_##parent, priv,              \
+                                    parent, ptr);                       \
-                                &iwl_dbgfs_##name##_ops);               \
+        if (IS_ERR(__tmp) || !__tmp)                                    \
-        if (!(dbgfs->dbgfs_##parent##_files.file_##name))               \
+                goto err;                                               \
-                goto err;                                               \
 } while (0)
-#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
+#define DEBUGFS_ADD_X32(name, parent, ptr) do {                         \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
+        struct dentry *__tmp;                                           \
-        debugfs_create_bool(#name, S_IWUSR | S_IRUSR,                   \
+        __tmp = debugfs_create_x32(#name, S_IWUSR | S_IRUSR,            \
-                            dbgfs->dir_##parent, ptr);                  \
+                                   parent, ptr);                        \
-        if (IS_ERR(dbgfs->dbgfs_##parent##_files.file_##name)           \
+        if (IS_ERR(__tmp) || !__tmp)                                    \
-                        || !dbgfs->dbgfs_##parent##_files.file_##name)  \
+                goto err;                                               \
-                goto err;                                               \
 } while (0)
-#define DEBUGFS_ADD_X32(name, parent, ptr) do {                        \
-        dbgfs->dbgfs_##parent##_files.file_##name =                     \
-        debugfs_create_x32(#name, S_IRUSR, dbgfs->dir_##parent, ptr);   \
-        if (IS_ERR(dbgfs->dbgfs_##parent##_files.file_##name)           \
-                        || !dbgfs->dbgfs_##parent##_files.file_##name)  \
-                goto err;                                               \
-} while (0)
-#define DEBUGFS_REMOVE(name)  do {              \
-        debugfs_remove(name);                   \
-        name = NULL;                            \
-} while (0);
 /* file operation */
 #define DEBUGFS_READ_FUNC(name)                                         \
 static ssize_t iwl_dbgfs_##name##_read(struct file *file,               \
@@ -125,7 +110,7 @@ static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char *buf;
        int pos = 0;
@@ -184,7 +169,7 @@ static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char *buf;
        int pos = 0;
        int cnt;
@@ -232,28 +217,28 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
        ssize_t ret;
        int i;
        int pos = 0;
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        size_t bufsz;
        /* default is to dump the entire data segment */
-        if (!priv->dbgfs->sram_offset && !priv->dbgfs->sram_len) {
+        if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
-                priv->dbgfs->sram_offset = 0x800000;
+                priv->dbgfs_sram_offset = 0x800000;
                if (priv->ucode_type == UCODE_INIT)
-                        priv->dbgfs->sram_len = priv->ucode_init_data.len;
+                        priv->dbgfs_sram_len = priv->ucode_init_data.len;
                else
-                        priv->dbgfs->sram_len = priv->ucode_data.len;
+                        priv->dbgfs_sram_len = priv->ucode_data.len;
        }
-        bufsz =  30 + priv->dbgfs->sram_len * sizeof(char) * 10;
+        bufsz =  30 + priv->dbgfs_sram_len * sizeof(char) * 10;
        buf = kmalloc(bufsz, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;
        pos += scnprintf(buf + pos, bufsz - pos, "sram_len: 0x%x\n",
-                        priv->dbgfs->sram_len);
+                        priv->dbgfs_sram_len);
        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n",
-                        priv->dbgfs->sram_offset);
+                        priv->dbgfs_sram_offset);
-        for (i = priv->dbgfs->sram_len; i > 0; i -= 4) {
+        for (i = priv->dbgfs_sram_len; i > 0; i -= 4) {
-                val = iwl_read_targ_mem(priv, priv->dbgfs->sram_offset + \
+                val = iwl_read_targ_mem(priv, priv->dbgfs_sram_offset + \
-                                        priv->dbgfs->sram_len - i);
+                                        priv->dbgfs_sram_len - i);
                if (i < 4) {
                        switch (i) {
                        case 1:
@@ -293,11 +278,11 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
                return -EFAULT;
        if (sscanf(buf, "%x,%x", &offset, &len) == 2) {
-                priv->dbgfs->sram_offset = offset;
+                priv->dbgfs_sram_offset = offset;
-                priv->dbgfs->sram_len = len;
+                priv->dbgfs_sram_len = len;
        } else {
-                priv->dbgfs->sram_offset = 0;
+                priv->dbgfs_sram_offset = 0;
-                priv->dbgfs->sram_len = 0;
+                priv->dbgfs_sram_len = 0;
        }
        return count;
@@ -306,7 +291,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
 static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        struct iwl_station_entry *station;
        int max_sta = priv->hw_params.max_stations;
        char *buf;
@@ -376,7 +361,7 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                                       loff_t *ppos)
 {
        ssize_t ret;
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0, ofs = 0, buf_size = 0;
        const u8 *ptr;
        char *buf;
@@ -420,6 +405,24 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
        return ret;
 }
+static ssize_t iwl_dbgfs_log_event_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char *buf;
+        int pos = 0;
+        ssize_t ret = -ENOMEM;
+        ret = pos = priv->cfg->ops->lib->dump_nic_event_log(
+                                        priv, true, &buf, true);
+        if (buf) {
+                ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+                kfree(buf);
+        }
+        return ret;
+}
 static ssize_t iwl_dbgfs_log_event_write(struct file *file,
                                        const char __user *user_buf,
                                        size_t count, loff_t *ppos)
@@ -436,7 +439,8 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
        if (sscanf(buf, "%d", &event_log_flag) != 1)
                return -EFAULT;
        if (event_log_flag == 1)
-                priv->cfg->ops->lib->dump_nic_event_log(priv, true);
+                priv->cfg->ops->lib->dump_nic_event_log(priv, true,
+                                                        NULL, false);
        return count;
 }
@@ -446,7 +450,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
 static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                                       size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        struct ieee80211_channel *channels = NULL;
        const struct ieee80211_supported_band *supp_band = NULL;
        int pos = 0, i, bufsz = PAGE_SIZE;
@@ -519,7 +523,7 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[512];
        int pos = 0;
        const size_t bufsz = sizeof(buf);
@@ -567,7 +571,7 @@ static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        int cnt = 0;
        char *buf;
@@ -654,7 +658,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
 static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
                                       size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0, i;
        char buf[256];
        const size_t bufsz = sizeof(buf);
@@ -677,7 +681,7 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
 static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        char buf[256];
        const size_t bufsz = sizeof(buf);
@@ -703,7 +707,7 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
                                char __user *user_buf,
                                size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
        struct iwl_tt_restriction *restriction;
        char buf[100];
@@ -763,7 +767,7 @@ static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[100];
        int pos = 0;
        const size_t bufsz = sizeof(buf);
@@ -811,7 +815,9 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
        priv->power_data.debug_sleep_level_override = value;
+        mutex_lock(&priv->mutex);
        iwl_power_update_mode(priv, true);
+        mutex_unlock(&priv->mutex);
        return count;
 }
@@ -820,7 +826,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_read(struct file *file,
                                                   char __user *user_buf,
                                                   size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[10];
        int pos, value;
        const size_t bufsz = sizeof(buf);
@@ -838,7 +844,7 @@ static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
                                                    char __user *user_buf,
                                                    size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[200];
        int pos = 0, i;
        const size_t bufsz = sizeof(buf);
@@ -859,7 +865,7 @@ static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
 }
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
-DEBUGFS_WRITE_FILE_OPS(log_event);
+DEBUGFS_READ_WRITE_FILE_OPS(log_event);
 DEBUGFS_READ_FILE_OPS(nvm);
 DEBUGFS_READ_FILE_OPS(stations);
 DEBUGFS_READ_FILE_OPS(channels);
@@ -976,7 +982,7 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        struct iwl_tx_queue *txq;
        struct iwl_queue *q;
        char *buf;
@@ -1022,7 +1028,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        struct iwl_rx_queue *rxq = &priv->rxq;
        char buf[256];
        int pos = 0;
@@ -1063,36 +1069,33 @@ static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
        return p;
 }
+static const char ucode_stats_header[] =
+        "%-32s     current  acumulative       delta         max\n";
+static const char ucode_stats_short_format[] =
+        "  %-30s %10u\n";
+static const char ucode_stats_format[] =
+        "  %-30s %10u  %10u  %10u  %10u\n";
 static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        char *buf;
-        int bufsz = sizeof(struct statistics_rx_phy) * 20 +
+        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
-                sizeof(struct statistics_rx_non_phy) * 20 +
+                sizeof(struct statistics_rx_non_phy) * 40 +
-                sizeof(struct statistics_rx_ht_phy) * 20 + 400;
+                sizeof(struct statistics_rx_ht_phy) * 40 + 400;
        ssize_t ret;
-        struct statistics_rx_phy *ofdm, *accum_ofdm;
+        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
-        struct statistics_rx_phy *cck, *accum_cck;
+        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
        struct statistics_rx_non_phy *general, *accum_general;
-        struct statistics_rx_ht_phy *ht, *accum_ht;
+        struct statistics_rx_non_phy *delta_general, *max_general;
+        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
        buf = kzalloc(bufsz, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1111,264 +1114,401 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
        accum_cck = &priv->accum_statistics.rx.cck;
        accum_general = &priv->accum_statistics.rx.general;
        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
+        delta_ofdm = &priv->delta_statistics.rx.ofdm;
+        delta_cck = &priv->delta_statistics.rx.cck;
+        delta_general = &priv->delta_statistics.rx.general;
+        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
+        max_ofdm = &priv->max_delta.rx.ofdm;
+        max_cck = &priv->max_delta.rx.cck;
+        max_general = &priv->max_delta.rx.general;
+        max_ht = &priv->max_delta.rx.ofdm_ht;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         "Statistics_Rx - OFDM:");
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
-                         le32_to_cpu(ofdm->ina_cnt), accum_ofdm->ina_cnt);
+                         accum_ofdm->ina_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
-                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+                         "fina_cnt:",
-                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err);
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
-                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         "plcp_err:",
-                         "overrun_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "overrun_err:",
                         le32_to_cpu(ofdm->overrun_err),
-                         accum_ofdm->overrun_err);
+                         accum_ofdm->overrun_err,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->overrun_err, max_ofdm->overrun_err);
-                         "early_overrun_err:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
                         le32_to_cpu(ofdm->early_overrun_err),
-                         accum_ofdm->early_overrun_err);
+                         accum_ofdm->early_overrun_err,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_good:",
                         le32_to_cpu(ofdm->crc32_good),
-                         accum_ofdm->crc32_good);
+                         accum_ofdm->crc32_good,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->crc32_good, max_ofdm->crc32_good);
-                         "false_alarm_cnt:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "false_alarm_cnt:",
                         le32_to_cpu(ofdm->false_alarm_cnt),
-                         accum_ofdm->false_alarm_cnt);
+                         accum_ofdm->false_alarm_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->false_alarm_cnt,
-                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_sync_err_cnt:",
                         le32_to_cpu(ofdm->fina_sync_err_cnt),
-                         accum_ofdm->fina_sync_err_cnt);
+                         accum_ofdm->fina_sync_err_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->fina_sync_err_cnt,
-                         "sfd_timeout:\t\t%u\t\t\t%u\n",
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sfd_timeout:",
                         le32_to_cpu(ofdm->sfd_timeout),
-                         accum_ofdm->sfd_timeout);
+                         accum_ofdm->sfd_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->sfd_timeout,
-                         "fina_timeout:\t\t%u\t\t\t%u\n",
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_timeout:",
                         le32_to_cpu(ofdm->fina_timeout),
-                         accum_ofdm->fina_timeout);
+                         accum_ofdm->fina_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->fina_timeout,
-                         "unresponded_rts:\t%u\t\t\t%u\n",
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unresponded_rts:",
                         le32_to_cpu(ofdm->unresponded_rts),
-                         accum_ofdm->unresponded_rts);
+                         accum_ofdm->unresponded_rts,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->unresponded_rts,
-                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "rxe_frame_lmt_ovrun:",
                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
-                         accum_ofdm->rxe_frame_limit_overrun);
+                         accum_ofdm->rxe_frame_limit_overrun,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->rxe_frame_limit_overrun,
-                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ack_cnt:",
                         le32_to_cpu(ofdm->sent_ack_cnt),
-                         accum_ofdm->sent_ack_cnt);
+                         accum_ofdm->sent_ack_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->sent_ack_cnt,
-                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_cts_cnt:",
                         le32_to_cpu(ofdm->sent_cts_cnt),
-                         accum_ofdm->sent_cts_cnt);
+                         accum_ofdm->sent_cts_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
-                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ba_rsp_cnt:",
                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
-                         accum_ofdm->sent_ba_rsp_cnt);
+                         accum_ofdm->sent_ba_rsp_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->sent_ba_rsp_cnt,
-                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         max_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_self_kill:",
                         le32_to_cpu(ofdm->dsp_self_kill),
-                         accum_ofdm->dsp_self_kill);
+                         accum_ofdm->dsp_self_kill,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->dsp_self_kill,
-                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         max_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
                         le32_to_cpu(ofdm->mh_format_err),
-                         accum_ofdm->mh_format_err);
+                         accum_ofdm->mh_format_err,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ofdm->mh_format_err,
-                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+                         max_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "re_acq_main_rssi_sum:",
                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
-                         accum_ofdm->re_acq_main_rssi_sum);
+                         accum_ofdm->re_acq_main_rssi_sum,
+                         delta_ofdm->re_acq_main_rssi_sum,
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - CCK:\n");
+                        max_ofdm->re_acq_main_rssi_sum);
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
+                         "Statistics_Rx - CCK:");
-                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
+                         "ina_cnt:",
-                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt);
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
-                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+                         "fina_cnt:",
-                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err);
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
-                         "overrun_err:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "overrun_err:",
                         le32_to_cpu(cck->overrun_err),
-                         accum_cck->overrun_err);
+                         accum_cck->overrun_err,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->overrun_err, max_cck->overrun_err);
-                         "early_overrun_err:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
                         le32_to_cpu(cck->early_overrun_err),
-                         accum_cck->early_overrun_err);
+                         accum_cck->early_overrun_err,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         delta_cck->early_overrun_err,
-                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good);
+                         max_cck->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "false_alarm_cnt:\t%u\t\t\t%u\n",
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good,
+                         max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "false_alarm_cnt:",
                         le32_to_cpu(cck->false_alarm_cnt),
-                         accum_cck->false_alarm_cnt);
+                         accum_cck->false_alarm_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
-                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_sync_err_cnt:",
                         le32_to_cpu(cck->fina_sync_err_cnt),
-                         accum_cck->fina_sync_err_cnt);
+                         accum_cck->fina_sync_err_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->fina_sync_err_cnt,
-                         "sfd_timeout:\t\t%u\t\t\t%u\n",
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sfd_timeout:",
                         le32_to_cpu(cck->sfd_timeout),
-                         accum_cck->sfd_timeout);
+                         accum_cck->sfd_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
-                         "fina_timeout:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "fina_timeout:",
                         le32_to_cpu(cck->fina_timeout),
-                         accum_cck->fina_timeout);
+                         accum_cck->fina_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->fina_timeout, max_cck->fina_timeout);
-                         "unresponded_rts:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unresponded_rts:",
                         le32_to_cpu(cck->unresponded_rts),
-                         accum_cck->unresponded_rts);
+                         accum_cck->unresponded_rts,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->unresponded_rts,
-                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "rxe_frame_lmt_ovrun:",
                         le32_to_cpu(cck->rxe_frame_limit_overrun),
-                         accum_cck->rxe_frame_limit_overrun);
+                         accum_cck->rxe_frame_limit_overrun,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->rxe_frame_limit_overrun,
-                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ack_cnt:",
                         le32_to_cpu(cck->sent_ack_cnt),
-                         accum_cck->sent_ack_cnt);
+                         accum_cck->sent_ack_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->sent_ack_cnt,
-                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_cts_cnt:",
                         le32_to_cpu(cck->sent_cts_cnt),
-                         accum_cck->sent_cts_cnt);
+                         accum_cck->sent_cts_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->sent_cts_cnt,
-                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+                         max_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sent_ba_rsp_cnt:",
                         le32_to_cpu(cck->sent_ba_rsp_cnt),
-                         accum_cck->sent_ba_rsp_cnt);
+                         accum_cck->sent_ba_rsp_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->sent_ba_rsp_cnt,
-                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         max_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_self_kill:",
                         le32_to_cpu(cck->dsp_self_kill),
-                         accum_cck->dsp_self_kill);
+                         accum_cck->dsp_self_kill,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->dsp_self_kill,
-                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         max_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
                         le32_to_cpu(cck->mh_format_err),
-                         accum_cck->mh_format_err);
+                         accum_cck->mh_format_err,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_cck->mh_format_err, max_cck->mh_format_err);
-                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "re_acq_main_rssi_sum:",
                         le32_to_cpu(cck->re_acq_main_rssi_sum),
-                         accum_cck->re_acq_main_rssi_sum);
+                         accum_cck->re_acq_main_rssi_sum,
+                         delta_cck->re_acq_main_rssi_sum,
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - GENERAL:\n");
+                         max_cck->re_acq_main_rssi_sum);
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts:\t\t%u\t\t\t%u\n",
+                        "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bogus_cts:",
                         le32_to_cpu(general->bogus_cts),
-                         accum_general->bogus_cts);
+                         accum_general->bogus_cts,
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack:\t\t%u\t\t\t%u\n",
+                         delta_general->bogus_cts, max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bogus_ack:",
                         le32_to_cpu(general->bogus_ack),
-                         accum_general->bogus_ack);
+                         accum_general->bogus_ack,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->bogus_ack, max_general->bogus_ack);
-                         "non_bssid_frames:\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "non_bssid_frames:",
                         le32_to_cpu(general->non_bssid_frames),
-                         accum_general->non_bssid_frames);
+                         accum_general->non_bssid_frames,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->non_bssid_frames,
-                         "filtered_frames:\t%u\t\t\t%u\n",
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "filtered_frames:",
                         le32_to_cpu(general->filtered_frames),
-                         accum_general->filtered_frames);
+                         accum_general->filtered_frames,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->filtered_frames,
-                         "non_channel_beacons:\t%u\t\t\t%u\n",
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "non_channel_beacons:",
                         le32_to_cpu(general->non_channel_beacons),
-                         accum_general->non_channel_beacons);
+                         accum_general->non_channel_beacons,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->non_channel_beacons,
-                         "channel_beacons:\t%u\t\t\t%u\n",
+                         max_general->non_channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "channel_beacons:",
                         le32_to_cpu(general->channel_beacons),
-                         accum_general->channel_beacons);
+                         accum_general->channel_beacons,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->channel_beacons,
-                         "num_missed_bcon:\t%u\t\t\t%u\n",
+                         max_general->channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "num_missed_bcon:",
                         le32_to_cpu(general->num_missed_bcon),
-                         accum_general->num_missed_bcon);
+                         accum_general->num_missed_bcon,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->num_missed_bcon,
-                        "adc_rx_saturation_time:\t%u\t\t\t%u\n",
+                         max_general->num_missed_bcon);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "adc_rx_saturation_time:",
                         le32_to_cpu(general->adc_rx_saturation_time),
-                         accum_general->adc_rx_saturation_time);
+                         accum_general->adc_rx_saturation_time,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->adc_rx_saturation_time,
-                        "ina_detect_search_tm:\t%u\t\t\t%u\n",
+                         max_general->adc_rx_saturation_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "ina_detect_search_tm:",
                         le32_to_cpu(general->ina_detection_search_time),
-                         accum_general->ina_detection_search_time);
+                         accum_general->ina_detection_search_time,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->ina_detection_search_time,
-                         "beacon_silence_rssi_a:\t%u\t\t\t%u\n",
+                         max_general->ina_detection_search_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_a:",
                         le32_to_cpu(general->beacon_silence_rssi_a),
-                         accum_general->beacon_silence_rssi_a);
+                         accum_general->beacon_silence_rssi_a,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_silence_rssi_a,
-                         "beacon_silence_rssi_b:\t%u\t\t\t%u\n",
+                         max_general->beacon_silence_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_b:",
                         le32_to_cpu(general->beacon_silence_rssi_b),
-                         accum_general->beacon_silence_rssi_b);
+                         accum_general->beacon_silence_rssi_b,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_silence_rssi_b,
-                         "beacon_silence_rssi_c:\t%u\t\t\t%u\n",
+                         max_general->beacon_silence_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_silence_rssi_c:",
                         le32_to_cpu(general->beacon_silence_rssi_c),
-                         accum_general->beacon_silence_rssi_c);
+                         accum_general->beacon_silence_rssi_c,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_silence_rssi_c,
-                        "interference_data_flag:\t%u\t\t\t%u\n",
+                         max_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "interference_data_flag:",
                         le32_to_cpu(general->interference_data_flag),
-                         accum_general->interference_data_flag);
+                         accum_general->interference_data_flag,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->interference_data_flag,
-                         "channel_load:\t\t%u\t\t\t%u\n",
+                         max_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "channel_load:",
                         le32_to_cpu(general->channel_load),
-                         accum_general->channel_load);
+                         accum_general->channel_load,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->channel_load,
-                         "dsp_false_alarms:\t%u\t\t\t%u\n",
+                         max_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dsp_false_alarms:",
                         le32_to_cpu(general->dsp_false_alarms),
-                         accum_general->dsp_false_alarms);
+                         accum_general->dsp_false_alarms,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->dsp_false_alarms,
-                         "beacon_rssi_a:\t\t%u\t\t\t%u\n",
+                         max_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_a:",
                         le32_to_cpu(general->beacon_rssi_a),
-                         accum_general->beacon_rssi_a);
+                         accum_general->beacon_rssi_a,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_rssi_a,
-                         "beacon_rssi_b:\t\t%u\t\t\t%u\n",
+                         max_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_b:",
                         le32_to_cpu(general->beacon_rssi_b),
-                         accum_general->beacon_rssi_b);
+                         accum_general->beacon_rssi_b,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_rssi_b,
-                         "beacon_rssi_c:\t\t%u\t\t\t%u\n",
+                         max_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_rssi_c:",
                         le32_to_cpu(general->beacon_rssi_c),
-                         accum_general->beacon_rssi_c);
+                         accum_general->beacon_rssi_c,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_rssi_c,
-                         "beacon_energy_a:\t%u\t\t\t%u\n",
+                         max_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_a:",
                         le32_to_cpu(general->beacon_energy_a),
-                         accum_general->beacon_energy_a);
+                         accum_general->beacon_energy_a,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_energy_a,
-                         "beacon_energy_b:\t%u\t\t\t%u\n",
+                         max_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_b:",
                         le32_to_cpu(general->beacon_energy_b),
-                         accum_general->beacon_energy_b);
+                         accum_general->beacon_energy_b,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->beacon_energy_b,
-                         "beacon_energy_c:\t%u\t\t\t%u\n",
+                         max_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "beacon_energy_c:",
                         le32_to_cpu(general->beacon_energy_c),
-                         accum_general->beacon_energy_c);
+                         accum_general->beacon_energy_c,
+                         delta_general->beacon_energy_c,
+                         max_general->beacon_energy_c);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+                        "Statistics_Rx - OFDM_HT:");
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err);
+                         "plcp_err:",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
-                         "overrun_err:\t\t%u\t\t\t%u\n",
+                         delta_ht->plcp_err, max_ht->plcp_err);
-                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         "overrun_err:",
-                         "early_overrun_err:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
+                         delta_ht->overrun_err, max_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "early_overrun_err:",
                         le32_to_cpu(ht->early_overrun_err),
-                         accum_ht->early_overrun_err);
+                         accum_ht->early_overrun_err,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         delta_ht->early_overrun_err,
-                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good);
+                         max_ht->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err);
+                         "crc32_good:",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
-                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         delta_ht->crc32_good, max_ht->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "crc32_err:",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
+                         delta_ht->crc32_err, max_ht->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "mh_format_err:",
                         le32_to_cpu(ht->mh_format_err),
-                         accum_ht->mh_format_err);
+                         accum_ht->mh_format_err,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ht->mh_format_err, max_ht->mh_format_err);
-                         "agg_crc32_good:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_crc32_good:",
                         le32_to_cpu(ht->agg_crc32_good),
-                         accum_ht->agg_crc32_good);
+                         accum_ht->agg_crc32_good,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
-                         "agg_mpdu_cnt:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_mpdu_cnt:",
                         le32_to_cpu(ht->agg_mpdu_cnt),
-                         accum_ht->agg_mpdu_cnt);
+                         accum_ht->agg_mpdu_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt:\t\t%u\t\t\t%u\n",
+                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
-                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg_cnt:",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
+                         delta_ht->agg_cnt, max_ht->agg_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "unsupport_mcs:",
+                         le32_to_cpu(ht->unsupport_mcs),
+                         accum_ht->unsupport_mcs,
+                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
@@ -1379,26 +1519,16 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        char *buf;
-        int bufsz = (sizeof(struct statistics_tx) * 24) + 250;
+        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
        ssize_t ret;
-        struct statistics_tx *tx, *accum_tx;
+        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
        buf = kzalloc(bufsz, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1411,106 +1541,148 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
         */
        tx = &priv->statistics.tx;
        accum_tx = &priv->accum_statistics.tx;
+        delta_tx = &priv->delta_statistics.tx;
+        max_tx = &priv->max_delta.tx;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Tx:\n");
+        pos += scnprintf(buf + pos, bufsz - pos,  ucode_stats_header,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                        "Statistics_Tx:");
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "preamble:\t\t\t%u\t\t\t%u\n",
+                         "preamble:",
                         le32_to_cpu(tx->preamble_cnt),
-                         accum_tx->preamble_cnt);
+                         accum_tx->preamble_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
-                         "rx_detected_cnt:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "rx_detected_cnt:",
                         le32_to_cpu(tx->rx_detected_cnt),
-                         accum_tx->rx_detected_cnt);
+                         accum_tx->rx_detected_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
-                         "bt_prio_defer_cnt:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bt_prio_defer_cnt:",
                         le32_to_cpu(tx->bt_prio_defer_cnt),
-                         accum_tx->bt_prio_defer_cnt);
+                         accum_tx->bt_prio_defer_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->bt_prio_defer_cnt,
-                         "bt_prio_kill_cnt:\t\t%u\t\t\t%u\n",
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "bt_prio_kill_cnt:",
                         le32_to_cpu(tx->bt_prio_kill_cnt),
-                         accum_tx->bt_prio_kill_cnt);
+                         accum_tx->bt_prio_kill_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->bt_prio_kill_cnt,
-                         "few_bytes_cnt:\t\t\t%u\t\t\t%u\n",
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "few_bytes_cnt:",
                         le32_to_cpu(tx->few_bytes_cnt),
-                         accum_tx->few_bytes_cnt);
+                         accum_tx->few_bytes_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
-                         "cts_timeout:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout);
+                         "cts_timeout:",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
-                         "ack_timeout:\t\t\t%u\t\t\t%u\n",
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "ack_timeout:",
                         le32_to_cpu(tx->ack_timeout),
-                         accum_tx->ack_timeout);
+                         accum_tx->ack_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
-                         "expected_ack_cnt:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "expected_ack_cnt:",
                         le32_to_cpu(tx->expected_ack_cnt),
-                         accum_tx->expected_ack_cnt);
+                         accum_tx->expected_ack_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->expected_ack_cnt,
-                         "actual_ack_cnt:\t\t\t%u\t\t\t%u\n",
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "actual_ack_cnt:",
                         le32_to_cpu(tx->actual_ack_cnt),
-                         accum_tx->actual_ack_cnt);
+                         accum_tx->actual_ack_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->actual_ack_cnt,
-                         "dump_msdu_cnt:\t\t\t%u\t\t\t%u\n",
+                         max_tx->actual_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "dump_msdu_cnt:",
                         le32_to_cpu(tx->dump_msdu_cnt),
-                         accum_tx->dump_msdu_cnt);
+                         accum_tx->dump_msdu_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->dump_msdu_cnt,
-                         "abort_nxt_frame_mismatch:"
+                         max_tx->dump_msdu_cnt);
-                         "\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "abort_nxt_frame_mismatch:",
                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
-                         accum_tx->burst_abort_next_frame_mismatch_cnt);
+                         accum_tx->burst_abort_next_frame_mismatch_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->burst_abort_next_frame_mismatch_cnt,
-                         "abort_missing_nxt_frame:"
+                         max_tx->burst_abort_next_frame_mismatch_cnt);
-                         "\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "abort_missing_nxt_frame:",
                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
-                         accum_tx->burst_abort_missing_next_frame_cnt);
+                         accum_tx->burst_abort_missing_next_frame_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->burst_abort_missing_next_frame_cnt,
-                         "cts_timeout_collision:\t\t%u\t\t\t%u\n",
+                         max_tx->burst_abort_missing_next_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "cts_timeout_collision:",
                         le32_to_cpu(tx->cts_timeout_collision),
-                         accum_tx->cts_timeout_collision);
+                         accum_tx->cts_timeout_collision,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->cts_timeout_collision,
-                        "ack_ba_timeout_collision:\t%u\t\t\t%u\n",
+                         max_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "ack_ba_timeout_collision:",
                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
-                         accum_tx->ack_or_ba_timeout_collision);
+                         accum_tx->ack_or_ba_timeout_collision,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->ack_or_ba_timeout_collision,
-                         "agg ba_timeout:\t\t\t%u\t\t\t%u\n",
+                         max_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg ba_timeout:",
                         le32_to_cpu(tx->agg.ba_timeout),
-                         accum_tx->agg.ba_timeout);
+                         accum_tx->agg.ba_timeout,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.ba_timeout,
-                        "agg ba_resched_frames:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg ba_resched_frames:",
                         le32_to_cpu(tx->agg.ba_reschedule_frames),
-                         accum_tx->agg.ba_reschedule_frames);
+                         accum_tx->agg.ba_reschedule_frames,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.ba_reschedule_frames,
-                        "agg scd_query_agg_frame:\t%u\t\t\t%u\n",
+                         max_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg scd_query_agg_frame:",
                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
-                         accum_tx->agg.scd_query_agg_frame_cnt);
+                         accum_tx->agg.scd_query_agg_frame_cnt,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.scd_query_agg_frame_cnt,
-                         "agg scd_query_no_agg:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg scd_query_no_agg:",
                         le32_to_cpu(tx->agg.scd_query_no_agg),
-                         accum_tx->agg.scd_query_no_agg);
+                         accum_tx->agg.scd_query_no_agg,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.scd_query_no_agg,
-                         "agg scd_query_agg:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg scd_query_agg:",
                         le32_to_cpu(tx->agg.scd_query_agg),
-                         accum_tx->agg.scd_query_agg);
+                         accum_tx->agg.scd_query_agg,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.scd_query_agg,
-                        "agg scd_query_mismatch:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                        "agg scd_query_mismatch:",
                         le32_to_cpu(tx->agg.scd_query_mismatch),
-                         accum_tx->agg.scd_query_mismatch);
+                         accum_tx->agg.scd_query_mismatch,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.scd_query_mismatch,
-                         "agg frame_not_ready:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg frame_not_ready:",
                         le32_to_cpu(tx->agg.frame_not_ready),
-                         accum_tx->agg.frame_not_ready);
+                         accum_tx->agg.frame_not_ready,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.frame_not_ready,
-                         "agg underrun:\t\t\t%u\t\t\t%u\n",
+                         max_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg underrun:",
                         le32_to_cpu(tx->agg.underrun),
-                         accum_tx->agg.underrun);
+                         accum_tx->agg.underrun,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.underrun, max_tx->agg.underrun);
-                         "agg bt_prio_kill:\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg bt_prio_kill:",
                         le32_to_cpu(tx->agg.bt_prio_kill),
-                         accum_tx->agg.bt_prio_kill);
+                         accum_tx->agg.bt_prio_kill,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_tx->agg.bt_prio_kill,
-                         "agg rx_ba_rsp_cnt:\t\t%u\t\t\t%u\n",
+                         max_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "agg rx_ba_rsp_cnt:",
                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
-                         accum_tx->agg.rx_ba_rsp_cnt);
+                         accum_tx->agg.rx_ba_rsp_cnt,
+                         delta_tx->agg.rx_ba_rsp_cnt,
+                         max_tx->agg.rx_ba_rsp_cnt);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
@@ -1521,28 +1693,19 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        char *buf;
-        int bufsz = sizeof(struct statistics_general) * 4 + 250;
+        int bufsz = sizeof(struct statistics_general) * 10 + 300;
        ssize_t ret;
        struct statistics_general *general, *accum_general;
-        struct statistics_dbg *dbg, *accum_dbg;
+        struct statistics_general *delta_general, *max_general;
-        struct statistics_div *div, *accum_div;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct statistics_div *div, *accum_div, *delta_div, *max_div;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
-        /* make request to uCode to retrieve statistics information */
-        mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-        if (ret) {
-                IWL_ERR(priv,
-                        "Error sending statistics request: %zd\n", ret);
-                return -EAGAIN;
-        }
        buf = kzalloc(bufsz, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
@@ -1557,52 +1720,78 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
        dbg = &priv->statistics.general.dbg;
        div = &priv->statistics.general.div;
        accum_general = &priv->accum_statistics.general;
+        delta_general = &priv->delta_statistics.general;
+        max_general = &priv->max_delta.general;
        accum_dbg = &priv->accum_statistics.general.dbg;
+        delta_dbg = &priv->delta_statistics.general.dbg;
+        max_dbg = &priv->max_delta.general.dbg;
        accum_div = &priv->accum_statistics.general.div;
+        delta_div = &priv->delta_statistics.general.div;
+        max_div = &priv->max_delta.general.div;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_General:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                        "Statistics_General:");
-                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature:\t\t\t%u\n",
+                         "temperature:",
                         le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m:\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
+                         "temperature_m:",
                         le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "burst_check:\t\t\t%u\t\t\t%u\n",
+                         "burst_check:",
                         le32_to_cpu(dbg->burst_check),
-                         accum_dbg->burst_check);
+                         accum_dbg->burst_check,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_dbg->burst_check, max_dbg->burst_check);
-                         "burst_count:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "burst_count:",
                         le32_to_cpu(dbg->burst_count),
-                         accum_dbg->burst_count);
+                         accum_dbg->burst_count,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_dbg->burst_count, max_dbg->burst_count);
-                         "sleep_time:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "sleep_time:",
                         le32_to_cpu(general->sleep_time),
-                         accum_general->sleep_time);
+                         accum_general->sleep_time,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->sleep_time, max_general->sleep_time);
-                         "slots_out:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "slots_out:",
                         le32_to_cpu(general->slots_out),
-                         accum_general->slots_out);
+                         accum_general->slots_out,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_general->slots_out, max_general->slots_out);
-                         "slots_idle:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "slots_idle:",
                         le32_to_cpu(general->slots_idle),
-                         accum_general->slots_idle);
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
                         le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a);
+                         "tx_on_a:",
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
-                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b);
+                         delta_div->tx_on_a, max_div->tx_on_a);
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "exec_time:\t\t\t%u\t\t\t%u\n",
+                         "tx_on_b:",
-                         le32_to_cpu(div->exec_time), accum_div->exec_time);
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         delta_div->tx_on_b, max_div->tx_on_b);
-                         "probe_time:\t\t\t%u\t\t\t%u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         le32_to_cpu(div->probe_time), accum_div->probe_time);
+                         "exec_time:",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
-                         "rx_enable_counter:\t\t%u\t\t\t%u\n",
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "rx_enable_counter:",
                         le32_to_cpu(general->rx_enable_counter),
-                         accum_general->rx_enable_counter);
+                         accum_general->rx_enable_counter,
+                         delta_general->rx_enable_counter,
+                         max_general->rx_enable_counter);
+        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
+                         "num_of_sos_states:",
+                         le32_to_cpu(general->num_of_sos_states),
+                         accum_general->num_of_sos_states,
+                         delta_general->num_of_sos_states,
+                         max_general->num_of_sos_states);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
        return ret;
@@ -1612,7 +1801,7 @@ static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        int cnt = 0;
        char *buf;
@@ -1693,7 +1882,7 @@ static ssize_t iwl_dbgfs_chain_noise_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        int pos = 0;
        int cnt = 0;
        char *buf;
@@ -1751,26 +1940,15 @@ static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count, loff_t *ppos) {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[128];
        int pos = 0;
-        ssize_t ret;
        const size_t bufsz = sizeof(buf);
        struct statistics_tx *tx;
        if (!iwl_is_alive(priv))
                pos += scnprintf(buf + pos, bufsz - pos, "N/A\n");
        else {
-                /* make request to uCode to retrieve statistics information */
-                mutex_lock(&priv->mutex);
-                ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
-                mutex_unlock(&priv->mutex);
-                if (ret) {
-                        IWL_ERR(priv, "Error sending statistics request: %zd\n",
-                                ret);
-                        return -EAGAIN;
-                }
                tx = &priv->statistics.tx;
                if (tx->tx_power.ant_a ||
                    tx->tx_power.ant_b ||
@@ -1802,7 +1980,7 @@ static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,
                                                    char __user *user_buf,
                                                    size_t count, loff_t *ppos)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_priv *priv = file->private_data;
        char buf[60];
        int pos = 0;
        const size_t bufsz = sizeof(buf);
@@ -1845,6 +2023,206 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
        return count;
 }
+static ssize_t iwl_dbgfs_csr_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int csr;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &csr) != 1)
+                return -EFAULT;
+        if (priv->cfg->ops->lib->dump_csr)
+                priv->cfg->ops->lib->dump_csr(priv);
+        return count;
+}
+static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[128];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+        pos += scnprintf(buf + pos, bufsz - pos, "ucode trace timer is %s\n",
+                        priv->event_log.ucode_trace ? "On" : "Off");
+        pos += scnprintf(buf + pos, bufsz - pos, "non_wraps_count:\t\t %u\n",
+                        priv->event_log.non_wraps_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_once_count:\t\t %u\n",
+                        priv->event_log.wraps_once_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "wraps_more_count:\t\t %u\n",
+                        priv->event_log.wraps_more_count);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int trace;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &trace) != 1)
+                return -EFAULT;
+        if (trace) {
+                priv->event_log.ucode_trace = true;
+                /* schedule the ucode timer to occur in UCODE_TRACE_PERIOD */
+                mod_timer(&priv->ucode_trace,
+                        jiffies + msecs_to_jiffies(UCODE_TRACE_PERIOD));
+        } else {
+                priv->event_log.ucode_trace = false;
+                del_timer_sync(&priv->ucode_trace);
+        }
+        return count;
+}
+static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char *buf;
+        int pos = 0;
+        ssize_t ret = -EFAULT;
+        if (priv->cfg->ops->lib->dump_fh) {
+                ret = pos = priv->cfg->ops->lib->dump_fh(priv, &buf, true);
+                if (buf) {
+                        ret = simple_read_from_buffer(user_buf,
+                                                      count, ppos, buf, pos);
+                        kfree(buf);
+                }
+        }
+        return ret;
+}
+static ssize_t iwl_dbgfs_missed_beacon_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char buf[12];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+        pos += scnprintf(buf + pos, bufsz - pos, "%d\n",
+                        priv->missed_beacon_threshold);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int missed;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &missed) != 1)
+                return -EINVAL;
+        if (missed < IWL_MISSED_BEACON_THRESHOLD_MIN ||
+            missed > IWL_MISSED_BEACON_THRESHOLD_MAX)
+                priv->missed_beacon_threshold =
+                        IWL_MISSED_BEACON_THRESHOLD_DEF;
+        else
+                priv->missed_beacon_threshold = missed;
+        return count;
+}
+static ssize_t iwl_dbgfs_internal_scan_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int scan;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &scan) != 1)
+                return -EINVAL;
+        iwl_internal_short_hw_scan(priv);
+        return count;
+}
+static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char buf[12];
+        const size_t bufsz = sizeof(buf);
+        ssize_t ret;
+        pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
+                        priv->cfg->plcp_delta_threshold);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        return ret;
+}
+static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int plcp;
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &plcp) != 1)
+                return -EINVAL;
+        if ((plcp <= IWL_MAX_PLCP_ERR_THRESHOLD_MIN) ||
+                (plcp > IWL_MAX_PLCP_ERR_THRESHOLD_MAX))
+                priv->cfg->plcp_delta_threshold =
+                        IWL_MAX_PLCP_ERR_THRESHOLD_DEF;
+        else
+                priv->cfg->plcp_delta_threshold = plcp;
+        return count;
+}
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1859,6 +2237,12 @@ DEBUGFS_READ_FILE_OPS(tx_power);
 DEBUGFS_READ_FILE_OPS(power_save_status);
 DEBUGFS_WRITE_FILE_OPS(clear_ucode_statistics);
 DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
+DEBUGFS_WRITE_FILE_OPS(csr);
+DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
+DEBUGFS_READ_FILE_OPS(fh_reg);
+DEBUGFS_READ_WRITE_FILE_OPS(missed_beacon);
+DEBUGFS_WRITE_FILE_OPS(internal_scan);
+DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
 /*
 * Create the debugfs files and directories
@@ -1866,69 +2250,73 @@ DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
 */
 int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
-        struct iwl_debugfs *dbgfs;
        struct dentry *phyd = priv->hw->wiphy->debugfsdir;
-        int ret = 0;
+        struct dentry *dir_drv, *dir_data, *dir_rf, *dir_debug;
-        dbgfs = kzalloc(sizeof(struct iwl_debugfs), GFP_KERNEL);
+        dir_drv = debugfs_create_dir(name, phyd);
-        if (!dbgfs) {
+        if (!dir_drv)
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto err;
-        }
+        priv->debugfs_dir = dir_drv;
-        priv->dbgfs = dbgfs;
+        dir_data = debugfs_create_dir("data", dir_drv);
-        dbgfs->name = name;
+        if (!dir_data)
-        dbgfs->dir_drv = debugfs_create_dir(name, phyd);
+                goto err;
-        if (!dbgfs->dir_drv || IS_ERR(dbgfs->dir_drv)) {
+        dir_rf = debugfs_create_dir("rf", dir_drv);
-                ret = -ENOENT;
+        if (!dir_rf)
+                goto err;
+        dir_debug = debugfs_create_dir("debug", dir_drv);
+        if (!dir_debug)
                goto err;
-        }
-        DEBUGFS_ADD_DIR(data, dbgfs->dir_drv);
+        DEBUGFS_ADD_FILE(nvm, dir_data, S_IRUSR);
-        DEBUGFS_ADD_DIR(rf, dbgfs->dir_drv);
+        DEBUGFS_ADD_FILE(sram, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_DIR(debug, dbgfs->dir_drv);
+        DEBUGFS_ADD_FILE(log_event, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(nvm, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(stations, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(sram, data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(channels, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(log_event, data, S_IWUSR);
+        DEBUGFS_ADD_FILE(status, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(stations, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(interrupt, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(channels, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(qos, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(status, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(led, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(interrupt, data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(sleep_level_override, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(qos, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(current_sleep_command, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(led, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(thermal_throttling, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(sleep_level_override, data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(disable_ht40, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(current_sleep_command, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(rx_statistics, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(thermal_throttling, data, S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_statistics, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(disable_ht40, data, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(traffic_log, dir_debug, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(rx_statistics, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(rx_queue, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(tx_statistics, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_queue, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(traffic_log, debug, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(tx_power, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(rx_queue, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(power_save_status, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(tx_queue, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(clear_ucode_statistics, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(tx_power, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(clear_traffic_statistics, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(power_save_status, debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(csr, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(clear_ucode_statistics, debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(fh_reg, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(clear_traffic_statistics, debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(internal_scan, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_ADD_FILE(ucode_rx_stats, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_tx_stats, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_general_stats, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(sensitivity, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(chain_noise, debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
+                DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
        }
-        DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
+        DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf, &priv->disable_sens_cal);
-        DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
+        DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
                         &priv->disable_chain_noise_cal);
        if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_3945))
-                DEBUGFS_ADD_BOOL(disable_tx_power, rf,
+                DEBUGFS_ADD_BOOL(disable_tx_power, dir_rf,
                                &priv->disable_tx_power_cal);
        return 0;
 err:
-        IWL_ERR(priv, "Can't open the debugfs directory\n");
+        IWL_ERR(priv, "Can't create the debugfs directory\n");
        iwl_dbgfs_unregister(priv);
-        return ret;
+        return -ENOMEM;
 }
 EXPORT_SYMBOL(iwl_dbgfs_register);
@@ -1938,56 +2326,11 @@ EXPORT_SYMBOL(iwl_dbgfs_register);
 */
 void iwl_dbgfs_unregister(struct iwl_priv *priv)
 {
-        if (!priv->dbgfs)
+        if (!priv->debugfs_dir)
                return;
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sleep_level_override);
+        debugfs_remove_recursive(priv->debugfs_dir);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_current_sleep_command);
+        priv->debugfs_dir = NULL;
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_nvm);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sram);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_log_event);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_stations);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_channels);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_status);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_interrupt);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_qos);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_led);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_thermal_throttling);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_disable_ht40);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_data);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_traffic_log);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_power_save_status);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_clear_ucode_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_clear_traffic_statistics);
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_rx_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_tx_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_ucode_general_stats);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_sensitivity);
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
-                        file_chain_noise);
-        }
-        DEBUGFS_REMOVE(priv->dbgfs->dir_debug);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_chain_noise);
-        if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
-            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_3945))
-                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_tx_power);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_rf);
-        DEBUGFS_REMOVE(priv->dbgfs->dir_drv);
-        kfree(priv->dbgfs);
-        priv->dbgfs = NULL;
 }
 EXPORT_SYMBOL(iwl_dbgfs_unregister);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 3822cf53e36..55dc5a86654 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -512,6 +512,7 @@ struct iwl_ht_config {
        bool is_ht;
        bool is_40mhz;
        bool single_chain_sufficient;
+        enum ieee80211_smps_mode smps; /* current smps mode */
        /* BSS related data */
        u8 extension_chan_offset;
        u8 ht_protection;
@@ -984,6 +985,56 @@ struct iwl_switch_rxon {
        __le16 channel;
 };
+/*
+ * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+ * to perform continuous uCode event logging operation if enabled
+ */
+#define UCODE_TRACE_PERIOD (100)
+/*
+ * iwl_event_log: current uCode event log position
+ *
+ * @ucode_trace: enable/disable ucode continuous trace timer
+ * @num_wraps: how many times the event buffer wraps
+ * @next_entry:  the entry just before the next one that uCode would fill
+ * @non_wraps_count: counter for no wrap detected when dump ucode events
+ * @wraps_once_count: counter for wrap once detected when dump ucode events
+ * @wraps_more_count: counter for wrap more than once detected
+ *                    when dump ucode events
+ */
+struct iwl_event_log {
+        bool ucode_trace;
+        u32 num_wraps;
+        u32 next_entry;
+        int non_wraps_count;
+        int wraps_once_count;
+        int wraps_more_count;
+};
+/*
+ * host interrupt timeout value
+ * used with setting interrupt coalescing timer
+ * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
+ *
+ * default interrupt coalescing timer is 64 x 32 = 2048 usecs
+ * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
+ */
+#define IWL_HOST_INT_TIMEOUT_MAX        (0xFF)
+#define IWL_HOST_INT_TIMEOUT_DEF        (0x40)
+#define IWL_HOST_INT_TIMEOUT_MIN        (0x0)
+#define IWL_HOST_INT_CALIB_TIMEOUT_MAX  (0xFF)
+#define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
+#define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
+/*
+ * This is the threshold value of plcp error rate per 100mSecs.  It is
+ * used to set and check for the validity of plcp_delta.
+ */
+#define IWL_MAX_PLCP_ERR_THRESHOLD_MIN  (0)
+#define IWL_MAX_PLCP_ERR_THRESHOLD_DEF  (50)
+#define IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF     (100)
+#define IWL_MAX_PLCP_ERR_THRESHOLD_MAX  (255)
 struct iwl_priv {
        /* ieee device used by generic ieee processing code */
@@ -1004,13 +1055,16 @@ struct iwl_priv {
        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
-#if defined(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) || defined(CONFIG_IWL3945_SPECTRUM_MEASUREMENT)
        /* spectrum measurement report caching */
        struct iwl_spectrum_notification measure_report;
        u8 measurement_status;
-#endif
        /* ucode beacon time */
        u32 ucode_beacon_time;
+        int missed_beacon_threshold;
+        /* storing the jiffies when the plcp error rate is received */
+        unsigned long plcp_jiffies;
        /* we allocate array of iwl4965_channel_info for NIC's valid channels.
         *    Access via channel # using indirect index array */
@@ -1029,14 +1083,15 @@ struct iwl_priv {
        struct iwl_calib_result calib_results[IWL_CALIB_MAX];
        /* Scan related variables */
-        unsigned long last_scan_jiffies;
        unsigned long next_scan_jiffies;
        unsigned long scan_start;
        unsigned long scan_pass_start;
        unsigned long scan_start_tsf;
+        unsigned long last_internal_scan_jiffies;
        void *scan;
        int scan_bands;
        struct cfg80211_scan_request *scan_request;
+        bool is_internal_short_scan;
        u8 scan_tx_ant[IEEE80211_NUM_BANDS];
        u8 mgmt_tx_ant;
@@ -1135,6 +1190,8 @@ struct iwl_priv {
        struct iwl_notif_statistics statistics;
 #ifdef CONFIG_IWLWIFI_DEBUG
        struct iwl_notif_statistics accum_statistics;
+        struct iwl_notif_statistics delta_statistics;
+        struct iwl_notif_statistics max_delta;
 #endif
        /* context information */
@@ -1207,15 +1264,10 @@ struct iwl_priv {
        struct workqueue_struct *workqueue;
-        struct work_struct up;
        struct work_struct restart;
-        struct work_struct calibrated_work;
        struct work_struct scan_completed;
        struct work_struct rx_replenish;
        struct work_struct abort_scan;
-        struct work_struct update_link_led;
-        struct work_struct auth_work;
-        struct work_struct report_work;
        struct work_struct request_scan;
        struct work_struct beacon_update;
        struct work_struct tt_work;
@@ -1251,7 +1303,8 @@ struct iwl_priv {
        u16 rx_traffic_idx;
        u8 *tx_traffic;
        u8 *rx_traffic;
-        struct iwl_debugfs *dbgfs;
+        struct dentry *debugfs_dir;
+        u32 dbgfs_sram_offset, dbgfs_sram_len;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 #endif /* CONFIG_IWLWIFI_DEBUG */
@@ -1261,6 +1314,7 @@ struct iwl_priv {
        u32 disable_tx_power_cal;
        struct work_struct run_time_calib_work;
        struct timer_list statistics_periodic;
+        struct timer_list ucode_trace;
        bool hw_ready;
        /*For 3945*/
 #define IWL_DEFAULT_TX_POWER 0x0F
@@ -1268,6 +1322,8 @@ struct iwl_priv {
        struct iwl3945_notif_statistics statistics_39;
        u32 sta_supp_rates;
+        struct iwl_event_log event_log;
 }; /*iwl_priv */
 static inline void iwl_txq_ctx_activate(struct iwl_priv *priv, int txq_id)
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 83cc4e500a9..36580d8d8b8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -37,4 +37,6 @@ EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_rx);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_wrap_event);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index d9c7363b1bb..ff4d012ce26 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -91,6 +91,50 @@ TRACE_EVENT(iwlwifi_dev_iowrite32,
 );
 #undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwlwifi_ucode
+TRACE_EVENT(iwlwifi_dev_ucode_cont_event,
+        TP_PROTO(struct iwl_priv *priv, u32 time, u32 data, u32 ev),
+        TP_ARGS(priv, time, data, ev),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, time)
+                __field(u32, data)
+                __field(u32, ev)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->time = time;
+                __entry->data = data;
+                __entry->ev = ev;
+        ),
+        TP_printk("[%p] EVT_LOGT:%010u:0x%08x:%04u",
+                  __entry->priv, __entry->time, __entry->data, __entry->ev)
+);
+TRACE_EVENT(iwlwifi_dev_ucode_wrap_event,
+        TP_PROTO(struct iwl_priv *priv, u32 wraps, u32 n_entry, u32 p_entry),
+        TP_ARGS(priv, wraps, n_entry, p_entry),
+        TP_STRUCT__entry(
+                PRIV_ENTRY
+                __field(u32, wraps)
+                __field(u32, n_entry)
+                __field(u32, p_entry)
+        ),
+        TP_fast_assign(
+                PRIV_ASSIGN;
+                __entry->wraps = wraps;
+                __entry->n_entry = n_entry;
+                __entry->p_entry = p_entry;
+        ),
+        TP_printk("[%p] wraps=#%02d n=0x%X p=0x%X",
+                  __entry->priv, __entry->wraps, __entry->n_entry,
+                  __entry->p_entry)
+);
+#undef TRACE_SYSTEM
 #define TRACE_SYSTEM iwlwifi
 TRACE_EVENT(iwlwifi_dev_hcmd,
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 4a30969689f..fd37152abae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 0cd9c02ee04..4e1ba824dc5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 65fa8a69fd5..113c3669b9c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -379,6 +379,25 @@
 #define FH_TSSR_TX_STATUS_REG           (FH_TSSR_LOWER_BOUND + 0x010)
+/**
+ * Bit fields for TSSR(Tx Shared Status & Control) error status register:
+ * 31:  Indicates an address error when accessed to internal memory
+ *      uCode/driver must write "1" in order to clear this flag
+ * 30:  Indicates that Host did not send the expected number of dwords to FH
+ *      uCode/driver must write "1" in order to clear this flag
+ * 16-9:Each status bit is for one channel. Indicates that an (Error) ActDMA
+ *      command was received from the scheduler while the TRB was already full
+ *      with previous command
+ *      uCode/driver must write "1" in order to clear this flag
+ * 7-0: Each status bit indicates a channel's TxCredit error. When an error
+ *      bit is set, it indicates that the FH has received a full indication
+ *      from the RTC TxFIFO and the current value of the TxCredit counter was
+ *      not equal to zero. This mean that the credit mechanism was not
+ *      synchronized to the TxFIFO status
+ *      uCode/driver must write "1" in order to clear this flag
+ */
+#define FH_TSSR_TX_ERROR_REG            (FH_TSSR_LOWER_BOUND + 0x018)
 #define FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_chnl) ((1 << (_chnl)) << 24)
 #define FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_chnl) ((1 << (_chnl)) << 16)
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 30e9ea6d54e..86783c27d97 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -2,7 +2,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -58,7 +58,6 @@ const char *get_cmd_string(u8 cmd)
                IWL_CMD(COEX_PRIORITY_TABLE_CMD);
                IWL_CMD(COEX_MEDIUM_NOTIFICATION);
                IWL_CMD(COEX_EVENT_CMD);
-                IWL_CMD(RADAR_NOTIFICATION);
                IWL_CMD(REPLY_QUIET_CMD);
                IWL_CMD(REPLY_CHANNEL_SWITCH);
                IWL_CMD(CHANNEL_SWITCH_NOTIFICATION);
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index bd0b12efb5c..45af5bbc1c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index e552d4c4bdb..c719baf2585 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project.
 *
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index 46c7a95b88f..a6f9c918aab 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.h b/drivers/net/wireless/iwlwifi/iwl-led.h
index f47f053f02e..49a70baa3fb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 8ccc0bb1d9e..1a1a9f081cc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -303,13 +303,12 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
                                sizeof(struct iwl_powertable_cmd), cmd);
 }
+/* priv->mutex must be held */
 int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 {
        int ret = 0;
        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
-        bool enabled = (priv->iw_mode == NL80211_IFTYPE_STATION) &&
+        bool enabled = priv->hw->conf.flags & IEEE80211_CONF_PS;
-                        (priv->hw->conf.flags & IEEE80211_CONF_PS);
        bool update_chains;
        struct iwl_powertable_cmd cmd;
        int dtimper;
@@ -319,7 +318,7 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
                        priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
        if (priv->vif)
-                dtimper = priv->vif->bss_conf.dtim_period;
+                dtimper = priv->hw->conf.ps_dtim_period;
        else
                dtimper = 1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index 310c32e8f69..5db91c10dcc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 6d95832db06..d2d2a917490 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 2dbce85404a..0f718f6df5f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -473,8 +473,8 @@ int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                           (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
                           (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
-        /* Set interrupt coalescing timer to 64 x 32 = 2048 usecs */
+        /* Set interrupt coalescing timer to default (2048 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, 0x40);
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
        return 0;
 }
@@ -499,9 +499,10 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
        struct iwl_missed_beacon_notif *missed_beacon;
        missed_beacon = &pkt->u.missed_beacon;
-        if (le32_to_cpu(missed_beacon->consequtive_missed_beacons) > 5) {
+        if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
+            priv->missed_beacon_threshold) {
                IWL_DEBUG_CALIB(priv, "missed bcn cnsq %d totl %d rcd %d expctd %d\n",
-                    le32_to_cpu(missed_beacon->consequtive_missed_beacons),
+                    le32_to_cpu(missed_beacon->consecutive_missed_beacons),
                    le32_to_cpu(missed_beacon->total_missed_becons),
                    le32_to_cpu(missed_beacon->num_recvd_beacons),
                    le32_to_cpu(missed_beacon->num_expected_beacons));
@@ -511,6 +512,24 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_rx_missed_beacon_notif);
+void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
+                                          struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
+        if (!report->state) {
+                IWL_DEBUG_11H(priv,
+                        "Spectrum Measure Notification: Start\n");
+                return;
+        }
+        memcpy(&priv->measure_report, report, sizeof(*report));
+        priv->measurement_status |= MEASUREMENT_READY;
+}
+EXPORT_SYMBOL(iwl_rx_spectrum_measure_notif);
 /* Calculate noise level, based on measurements during network silence just
 *   before arriving beacon.  This measurement can be done only if we know
@@ -564,15 +583,24 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
        int i;
        __le32 *prev_stats;
        u32 *accum_stats;
+        u32 *delta, *max_delta;
        prev_stats = (__le32 *)&priv->statistics;
        accum_stats = (u32 *)&priv->accum_statistics;
+        delta = (u32 *)&priv->delta_statistics;
+        max_delta = (u32 *)&priv->max_delta;
        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
-             i += sizeof(__le32), stats++, prev_stats++, accum_stats++)
+             i += sizeof(__le32), stats++, prev_stats++, delta++,
-                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats))
+             max_delta++, accum_stats++) {
-                        *accum_stats += (le32_to_cpu(*stats) -
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
+                        *delta = (le32_to_cpu(*stats) -
                                le32_to_cpu(*prev_stats));
+                        *accum_stats += *delta;
+                        if (*delta > *max_delta)
+                                *max_delta = *delta;
+                }
+        }
        /* reset accumulative statistics for "no-counter" type statistics */
        priv->accum_statistics.general.temperature =
@@ -592,11 +620,15 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
 #define REG_RECALIB_PERIOD (60)
+#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
 void iwl_rx_statistics(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb)
 {
        int change;
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        int combined_plcp_delta;
+        unsigned int plcp_msec;
+        unsigned long plcp_received_jiffies;
        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                     (int)sizeof(priv->statistics),
@@ -611,6 +643,56 @@ void iwl_rx_statistics(struct iwl_priv *priv,
 #ifdef CONFIG_IWLWIFI_DEBUG
        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
 #endif
+        /*
+         * check for plcp_err and trigger radio reset if it exceeds
+         * the plcp error threshold plcp_delta.
+         */
+        plcp_received_jiffies = jiffies;
+        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
+                                        (long) priv->plcp_jiffies);
+        priv->plcp_jiffies = plcp_received_jiffies;
+        /*
+         * check to make sure plcp_msec is not 0 to prevent division
+         * by zero.
+         */
+        if (plcp_msec) {
+                combined_plcp_delta =
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err) -
+                        le32_to_cpu(priv->statistics.rx.ofdm.plcp_err)) +
+                        (le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err) -
+                        le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
+                if ((combined_plcp_delta > 0) &&
+                        ((combined_plcp_delta * 100) / plcp_msec) >
+                        priv->cfg->plcp_delta_threshold) {
+                        /*
+                         * if plcp_err exceed the threshold, the following
+                         * data is printed in csv format:
+                         *    Text: plcp_err exceeded %d,
+                         *    Received ofdm.plcp_err,
+                         *    Current ofdm.plcp_err,
+                         *    Received ofdm_ht.plcp_err,
+                         *    Current ofdm_ht.plcp_err,
+                         *    combined_plcp_delta,
+                         *    plcp_msec
+                         */
+                        IWL_DEBUG_RADIO(priv, PLCP_MSG,
+                                priv->cfg->plcp_delta_threshold,
+                                le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
+                                le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
+                                le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
+                                le32_to_cpu(
+                                        priv->statistics.rx.ofdm_ht.plcp_err),
+                                combined_plcp_delta, plcp_msec);
+                        /*
+                         * Reset the RF radio due to the high plcp
+                         * error rate
+                         */
+                        iwl_force_rf_reset(priv);
+                }
+        }
        memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
        set_bit(STATUS_STATISTICS, &priv->status);
@@ -638,11 +720,13 @@ void iwl_reply_statistics(struct iwl_priv *priv,
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATISTICS_CLEAR_MSK) {
-                memset(&priv->statistics, 0,
-                        sizeof(struct iwl_notif_statistics));
 #ifdef CONFIG_IWLWIFI_DEBUG
                memset(&priv->accum_statistics, 0,
                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->delta_statistics, 0,
+                        sizeof(struct iwl_notif_statistics));
+                memset(&priv->max_delta, 0,
+                        sizeof(struct iwl_notif_statistics));
 #endif
                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index fa1c89ba645..f786a407638 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -2,7 +2,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2008 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -192,19 +192,17 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
        IWL_DEBUG_SCAN(priv, "Scan ch.res: "
                       "%d [802.11%s] "
                       "(TSF: 0x%08X:%08X) - %d "
-                       "elapsed=%lu usec (%dms since last)\n",
+                       "elapsed=%lu usec\n",
                       notif->channel,
                       notif->band ? "bg" : "a",
                       le32_to_cpu(notif->tsf_high),
                       le32_to_cpu(notif->tsf_low),
                       le32_to_cpu(notif->statistics[0]),
-                       le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
+                       le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf);
-                       jiffies_to_msecs(elapsed_jiffies
-                                        (priv->last_scan_jiffies, jiffies)));
 #endif
-        priv->last_scan_jiffies = jiffies;
+        if (!priv->is_internal_short_scan)
-        priv->next_scan_jiffies = 0;
+                priv->next_scan_jiffies = 0;
 }
 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
@@ -250,8 +248,11 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                        goto reschedule;
        }
-        priv->last_scan_jiffies = jiffies;
+        if (!priv->is_internal_short_scan)
-        priv->next_scan_jiffies = 0;
+                priv->next_scan_jiffies = 0;
+        else
+                priv->last_internal_scan_jiffies = jiffies;
        IWL_DEBUG_INFO(priv, "Setting scan to off\n");
        clear_bit(STATUS_SCANNING, &priv->status);
@@ -314,6 +315,72 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_get_passive_dwell_time);
+static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     struct iwl_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int i, added = 0;
+        u16 channel = 0;
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band);
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+        if (channel) {
+                scan_ch->channel = cpu_to_le16(channel);
+                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
 static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                                     enum ieee80211_band band,
                                     u8 is_active, u8 n_probes,
@@ -421,6 +488,7 @@ static int iwl_scan_initiate(struct iwl_priv *priv)
        IWL_DEBUG_INFO(priv, "Starting scan...\n");
        set_bit(STATUS_SCANNING, &priv->status);
+        priv->is_internal_short_scan = false;
        priv->scan_start = jiffies;
        priv->scan_pass_start = priv->scan_start;
@@ -461,15 +529,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                goto out_unlock;
        }
-        /* if we just finished scan ask for delay */
-        if (iwl_is_associated(priv) && priv->last_scan_jiffies &&
-            time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within previous scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
        priv->scan_bands = 0;
        for (i = 0; i < req->n_channels; i++)
                priv->scan_bands |= BIT(req->channels[i]->band);
@@ -488,6 +547,54 @@ out_unlock:
 }
 EXPORT_SYMBOL(iwl_mac_hw_scan);
+/*
+ * internal short scan, this function should only been called while associated.
+ * It will reset and tune the radio to prevent possible RF related problem
+ */
+#define IWL_DELAY_NEXT_INTERNAL_SCAN (HZ*1)
+int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+{
+        int ret = 0;
+        if (!iwl_is_ready_rf(priv)) {
+                ret = -EIO;
+                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
+                goto out;
+        }
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
+                ret = -EAGAIN;
+                goto out;
+        }
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
+                ret = -EAGAIN;
+                goto out;
+        }
+        if (priv->last_internal_scan_jiffies &&
+            time_after(priv->last_internal_scan_jiffies +
+                       IWL_DELAY_NEXT_INTERNAL_SCAN, jiffies)) {
+                IWL_DEBUG_SCAN(priv, "internal scan rejected\n");
+                goto out;
+        }
+        priv->scan_bands = 0;
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
+        else
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
+        set_bit(STATUS_SCANNING, &priv->status);
+        priv->is_internal_short_scan = true;
+        queue_work(priv->workqueue, &priv->request_scan);
+out:
+        return ret;
+}
+EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 void iwl_bg_scan_check(struct work_struct *data)
@@ -544,14 +651,26 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
        if (left < 0)
                return 0;
        *pos++ = WLAN_EID_SSID;
-        *pos++ = 0;
+        if (!priv->is_internal_short_scan &&
+            priv->scan_request->n_ssids) {
-        len += 2;
+                struct cfg80211_ssid *ssid =
+                        priv->scan_request->ssids;
+                /* Broadcast if ssid_len is 0 */
+                *pos++ = ssid->ssid_len;
+                memcpy(pos, ssid->ssid, ssid->ssid_len);
+                pos += ssid->ssid_len;
+                len += 2 + ssid->ssid_len;
+        } else {
+                *pos++ = 0;
+                len += 2;
+        }
        if (WARN_ON(left < ie_len))
                return len;
-        memcpy(pos, ies, ie_len);
+        if (ies)
+                memcpy(pos, ies, ie_len);
        len += ie_len;
        left -= ie_len;
@@ -654,7 +773,6 @@ static void iwl_bg_request_scan(struct work_struct *data)
                unsigned long flags;
                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
                spin_lock_irqsave(&priv->lock, flags);
                interval = priv->beacon_int;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -672,21 +790,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                               scan_suspend_time, interval);
        }
-        if (priv->scan_request->n_ssids) {
+        if (priv->is_internal_short_scan) {
-                int i, p = 0;
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-                for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                /*
-                        /* always does wildcard anyway */
+                 * The first SSID to scan is stuffed into the probe request
-                        if (!priv->scan_request->ssids[i].ssid_len)
+                 * template and the remaining ones are handled through the
-                                continue;
+                 * direct_scan array.
-                        scan->direct_scan[p].id = WLAN_EID_SSID;
+                 */
-                        scan->direct_scan[p].len =
+                if (priv->scan_request->n_ssids > 1) {
-                                priv->scan_request->ssids[i].ssid_len;
+                        int i, p = 0;
-                        memcpy(scan->direct_scan[p].ssid,
+                        for (i = 1; i < priv->scan_request->n_ssids; i++) {
-                               priv->scan_request->ssids[i].ssid,
+                                if (!priv->scan_request->ssids[i].ssid_len)
-                               priv->scan_request->ssids[i].ssid_len);
+                                        continue;
-                        n_probes++;
+                                scan->direct_scan[p].id = WLAN_EID_SSID;
-                        p++;
+                                scan->direct_scan[p].len =
+                                        priv->scan_request->ssids[i].ssid_len;
+                                memcpy(scan->direct_scan[p].ssid,
+                                       priv->scan_request->ssids[i].ssid,
+                                       priv->scan_request->ssids[i].ssid_len);
+                                n_probes++;
+                                p++;
+                        }
                }
                is_active = true;
        } else
@@ -753,24 +879,38 @@ static void iwl_bg_request_scan(struct work_struct *data)
        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
        scan->rx_chain = cpu_to_le16(rx_chain);
-        cmd_len = iwl_fill_probe_req(priv,
+        if (!priv->is_internal_short_scan) {
-                                (struct ieee80211_mgmt *)scan->data,
+                cmd_len = iwl_fill_probe_req(priv,
-                                priv->scan_request->ie,
+                                        (struct ieee80211_mgmt *)scan->data,
-                                priv->scan_request->ie_len,
+                                        priv->scan_request->ie,
-                                IWL_MAX_SCAN_SIZE - sizeof(*scan));
+                                        priv->scan_request->ie_len,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        } else {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        NULL, 0,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        }
        scan->tx_cmd.len = cpu_to_le16(cmd_len);
        if (iwl_is_monitor_mode(priv))
                scan->filter_flags = RXON_FILTER_PROMISC_MSK;
        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
                               RXON_FILTER_BCON_AWARE_MSK);
-        scan->channel_count =
+        if (priv->is_internal_short_scan) {
-                iwl_get_channels_for_scan(priv, band, is_active, n_probes,
+                scan->channel_count =
-                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
+                        iwl_get_single_channel_for_scan(priv, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl_get_channels_for_scan(priv, band,
+                                is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        }
        if (scan->channel_count == 0) {
                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
                goto done;
@@ -831,7 +971,12 @@ void iwl_bg_scan_completed(struct work_struct *work)
        cancel_delayed_work(&priv->scan_check);
-        ieee80211_scan_completed(priv->hw, false);
+        if (!priv->is_internal_short_scan)
+                ieee80211_scan_completed(priv->hw, false);
+        else {
+                priv->is_internal_short_scan = false;
+                IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
+        }
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return;
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.c b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
deleted file mode 100644
index 1ea5cd345fe..00000000000
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.c
+++ /dev/null
@@ -1,198 +0,0 @@
-/******************************************************************************
- *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
- *
- * Portions of this file are derived from the ipw3945 project, as well
- * as portions of the ieee80211 subsystem header files.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- *****************************************************************************/
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/wireless.h>
-#include <net/mac80211.h>
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-#include "iwl-io.h"
-#include "iwl-spectrum.h"
-#define BEACON_TIME_MASK_LOW    0x00FFFFFF
-#define BEACON_TIME_MASK_HIGH   0xFF000000
-#define TIME_UNIT               1024
-/*
- * extended beacon time format
- * time in usec will be changed into a 32-bit value in 8:24 format
- * the high 1 byte is the beacon counts
- * the lower 3 bytes is the time in usec within one beacon interval
- */
-/* TOOD: was used in sysfs debug interface need to add to mac */
-#if 0
-static u32 iwl_usecs_to_beacons(u32 usec, u32 beacon_interval)
-{
-        u32 quot;
-        u32 rem;
-        u32 interval = beacon_interval * 1024;
-        if (!interval || !usec)
-                return 0;
-        quot = (usec / interval) & (BEACON_TIME_MASK_HIGH >> 24);
-        rem = (usec % interval) & BEACON_TIME_MASK_LOW;
-        return (quot << 24) + rem;
-}
-/* base is usually what we get from ucode with each received frame,
- * the same as HW timer counter counting down
- */
-static __le32 iwl_add_beacon_time(u32 base, u32 addon, u32 beacon_interval)
-{
-        u32 base_low = base & BEACON_TIME_MASK_LOW;
-        u32 addon_low = addon & BEACON_TIME_MASK_LOW;
-        u32 interval = beacon_interval * TIME_UNIT;
-        u32 res = (base & BEACON_TIME_MASK_HIGH) +
-            (addon & BEACON_TIME_MASK_HIGH);
-        if (base_low > addon_low)
-                res += base_low - addon_low;
-        else if (base_low < addon_low) {
-                res += interval + base_low - addon_low;
-                res += (1 << 24);
-        } else
-                res += (1 << 24);
-        return cpu_to_le32(res);
-}
-static int iwl_get_measurement(struct iwl_priv *priv,
-                               struct ieee80211_measurement_params *params,
-                               u8 type)
-{
-        struct iwl4965_spectrum_cmd spectrum;
-        struct iwl_rx_packet *res;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
-                .data = (void *)&spectrum,
-                .meta.flags = CMD_WANT_SKB,
-        };
-        u32 add_time = le64_to_cpu(params->start_time);
-        int rc;
-        int spectrum_resp_status;
-        int duration = le16_to_cpu(params->duration);
-        if (iwl_is_associated(priv))
-                add_time =
-                    iwl_usecs_to_beacons(
-                        le64_to_cpu(params->start_time) - priv->last_tsf,
-                        le16_to_cpu(priv->rxon_timing.beacon_interval));
-        memset(&spectrum, 0, sizeof(spectrum));
-        spectrum.channel_count = cpu_to_le16(1);
-        spectrum.flags =
-            RXON_FLG_TSF2HOST_MSK | RXON_FLG_ANT_A_MSK | RXON_FLG_DIS_DIV_MSK;
-        spectrum.filter_flags = MEASUREMENT_FILTER_FLAG;
-        cmd.len = sizeof(spectrum);
-        spectrum.len = cpu_to_le16(cmd.len - sizeof(spectrum.len));
-        if (iwl_is_associated(priv))
-                spectrum.start_time =
-                    iwl_add_beacon_time(priv->last_beacon_time,
-                                add_time,
-                                le16_to_cpu(priv->rxon_timing.beacon_interval));
-        else
-                spectrum.start_time = 0;
-        spectrum.channels[0].duration = cpu_to_le32(duration * TIME_UNIT);
-        spectrum.channels[0].channel = params->channel;
-        spectrum.channels[0].type = type;
-        if (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK)
-                spectrum.flags |= RXON_FLG_BAND_24G_MSK |
-                    RXON_FLG_AUTO_DETECT_MSK | RXON_FLG_TGG_PROTECT_MSK;
-        rc = iwl_send_cmd_sync(priv, &cmd);
-        if (rc)
-                return rc;
-        res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_RX_ON_ASSOC command\n");
-                rc = -EIO;
-        }
-        spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
-        switch (spectrum_resp_status) {
-        case 0:         /* Command will be handled */
-                if (res->u.spectrum.id != 0xff) {
-                        IWL_DEBUG_INFO(priv,
-                                "Replaced existing measurement: %d\n",
-                                res->u.spectrum.id);
-                        priv->measurement_status &= ~MEASUREMENT_READY;
-                }
-                priv->measurement_status |= MEASUREMENT_ACTIVE;
-                rc = 0;
-                break;
-        case 1:         /* Command will not be handled */
-                rc = -EAGAIN;
-                break;
-        }
-        dev_kfree_skb_any(cmd.meta.u.skb);
-        return rc;
-}
-#endif
-static void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
-                                          struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
-        if (!report->state) {
-                IWL_DEBUG_11H(priv,
-                        "Spectrum Measure Notification: Start\n");
-                return;
-        }
-        memcpy(&priv->measure_report, report, sizeof(*report));
-        priv->measurement_status |= MEASUREMENT_READY;
-}
-void iwl_setup_spectrum_handlers(struct iwl_priv *priv)
-{
-        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
-                        iwl_rx_spectrum_measure_notif;
-}
-EXPORT_SYMBOL(iwl_setup_spectrum_handlers);
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.h b/drivers/net/wireless/iwlwifi/iwl-spectrum.h
index a77c1e61906..af6babee289 100644
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.h
+++ b/drivers/net/wireless/iwlwifi/iwl-spectrum.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ieee80211 subsystem header files.
 *
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 90fbdb25399..4a6686fa6b3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -80,46 +80,103 @@ int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
 }
 EXPORT_SYMBOL(iwl_get_ra_sta_id);
+/* priv->sta_lock must be held */
 static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&priv->sta_lock, flags);
        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
-                IWL_ERR(priv, "ACTIVATE a non DRIVER active station %d\n",
+                IWL_ERR(priv, "ACTIVATE a non DRIVER active station id %u addr %pM\n",
-                        sta_id);
+                        sta_id, priv->stations[sta_id].sta.sta.addr);
-        priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
-        IWL_DEBUG_ASSOC(priv, "Added STA to Ucode: %pM\n",
-                        priv->stations[sta_id].sta.sta.addr);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) {
+                IWL_DEBUG_ASSOC(priv,
+                                "STA id %u addr %pM already present in uCode (according to driver)\n",
+                                sta_id, priv->stations[sta_id].sta.sta.addr);
+        } else {
+                priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
+                IWL_DEBUG_ASSOC(priv, "Added STA id %u addr %pM to uCode\n",
+                                sta_id, priv->stations[sta_id].sta.sta.addr);
+        }
 }
-static void iwl_add_sta_callback(struct iwl_priv *priv,
+static void iwl_process_add_sta_resp(struct iwl_priv *priv,
-                                 struct iwl_device_cmd *cmd,
+                                     struct iwl_addsta_cmd *addsta,
-                                 struct iwl_rx_packet *pkt)
+                                     struct iwl_rx_packet *pkt,
+                                     bool sync)
 {
-        struct iwl_addsta_cmd *addsta =
-                (struct iwl_addsta_cmd *)cmd->cmd.payload;
        u8 sta_id = addsta->sta.sta_id;
+        unsigned long flags;
        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          pkt->hdr.flags);
+                        pkt->hdr.flags);
                return;
        }
+        IWL_DEBUG_INFO(priv, "Processing response for adding station %u\n",
+                       sta_id);
+        spin_lock_irqsave(&priv->sta_lock, flags);
        switch (pkt->u.add_sta.status) {
        case ADD_STA_SUCCESS_MSK:
+                IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
                iwl_sta_ucode_activate(priv, sta_id);
-                 /* fall through */
+                break;
+        case ADD_STA_NO_ROOM_IN_TABLE:
+                IWL_ERR(priv, "Adding station %d failed, no room in table.\n",
+                        sta_id);
+                break;
+        case ADD_STA_NO_BLOCK_ACK_RESOURCE:
+                IWL_ERR(priv, "Adding station %d failed, no block ack resource.\n",
+                        sta_id);
+                break;
+        case ADD_STA_MODIFY_NON_EXIST_STA:
+                IWL_ERR(priv, "Attempting to modify non-existing station %d \n",
+                        sta_id);
+                break;
        default:
-                IWL_DEBUG_HC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
+                IWL_DEBUG_ASSOC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
-                             pkt->u.add_sta.status);
+                                pkt->u.add_sta.status);
                break;
        }
+        IWL_DEBUG_INFO(priv, "%s station id %u addr %pM\n",
+                       priv->stations[sta_id].sta.mode ==
+                       STA_CONTROL_MODIFY_MSK ?  "Modified" : "Added",
+                       sta_id, priv->stations[sta_id].sta.sta.addr);
+        /*
+         * XXX: The MAC address in the command buffer is often changed from
+         * the original sent to the device. That is, the MAC address
+         * written to the command buffer often is not the same MAC adress
+         * read from the command buffer when the command returns. This
+         * issue has not yet been resolved and this debugging is left to
+         * observe the problem.
+         */
+        IWL_DEBUG_INFO(priv, "%s station according to cmd buffer %pM\n",
+                       priv->stations[sta_id].sta.mode ==
+                       STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
+                       addsta->sta.addr);
+        /*
+         * Determine if we wanted to modify or add a station,
+         * if adding a station succeeded we have some more initialization
+         * to do when using station notification. TODO
+         */
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+}
+static void iwl_add_sta_callback(struct iwl_priv *priv,
+                                 struct iwl_device_cmd *cmd,
+                                 struct iwl_rx_packet *pkt)
+{
+        struct iwl_addsta_cmd *addsta =
+                (struct iwl_addsta_cmd *)cmd->cmd.payload;
+        iwl_process_add_sta_resp(priv, addsta, pkt, false);
 }
 int iwl_send_add_sta(struct iwl_priv *priv,
@@ -145,24 +202,9 @@ int iwl_send_add_sta(struct iwl_priv *priv,
        if (ret || (flags & CMD_ASYNC))
                return ret;
-        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          pkt->hdr.flags);
-                ret = -EIO;
-        }
        if (ret == 0) {
-                switch (pkt->u.add_sta.status) {
+                pkt = (struct iwl_rx_packet *)cmd.reply_page;
-                case ADD_STA_SUCCESS_MSK:
+                iwl_process_add_sta_resp(priv, sta, pkt, true);
-                        iwl_sta_ucode_activate(priv, sta->sta.sta_id);
-                        IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
-                        break;
-                default:
-                        ret = -EIO;
-                        IWL_WARN(priv, "REPLY_ADD_STA failed\n");
-                        break;
-                }
        }
        iwl_free_pages(priv, cmd.reply_page);
@@ -1003,24 +1045,19 @@ int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
        struct ieee80211_sta_ht_cap *cur_ht_config = NULL;
        u8 sta_id;
-        /* Add station to device's station table */
        /*
-         * XXX: This check is definitely not correct, if we're an AP
+         * Set HT capabilities. It is ok to set this struct even if not using
-         *      it'll always be false which is not what we want, but
+         * HT config: the priv->current_ht_config.is_ht flag will just be false
-         *      it doesn't look like iwlagn is prepared to be an HT
-         *      AP anyway.
         */
-        if (priv->current_ht_config.is_ht) {
+        rcu_read_lock();
-                rcu_read_lock();
+        sta = ieee80211_find_sta(priv->vif, addr);
-                sta = ieee80211_find_sta(priv->vif, addr);
+        if (sta) {
-                if (sta) {
+                memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
-                        memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
+                cur_ht_config = &ht_config;
-                        cur_ht_config = &ht_config;
-                }
-                rcu_read_unlock();
        }
+        rcu_read_unlock();
+        /* Add station to device's station table */
        sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
        /* Set up default rate scaling table in device's station table */
@@ -1085,6 +1122,7 @@ static void iwl_sta_init_bcast_lq(struct iwl_priv *priv)
 */
 void iwl_add_bcast_station(struct iwl_priv *priv)
 {
+        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
        /* Set up default rate scaling table in device's station table */
@@ -1093,6 +1131,16 @@ void iwl_add_bcast_station(struct iwl_priv *priv)
 EXPORT_SYMBOL(iwl_add_bcast_station);
 /**
+ * iwl3945_add_bcast_station - add broadcast station into station table.
+ */
+void iwl3945_add_bcast_station(struct iwl_priv *priv)
+{
+        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
+        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+}
+EXPORT_SYMBOL(iwl3945_add_bcast_station);
+/**
 * iwl_get_sta_id - Find station's index within station table
 *
 * If new IBSS station, create new entry in station table
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 8d052de2d40..2dc35fe28f5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -53,6 +53,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_add_bcast_station(struct iwl_priv *priv);
+void iwl3945_add_bcast_station(struct iwl_priv *priv);
 int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_clear_stations_table(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 87ce2bd292c..d365d13e329 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index f8e4e4b18d0..eac2b9a9571 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -56,6 +56,7 @@
 #include "iwl-helpers.h"
 #include "iwl-core.h"
 #include "iwl-dev.h"
+#include "iwl-spectrum.h"
 /*
 * module name, copyright, version, etc.
@@ -70,14 +71,13 @@
 #define VD
 #endif
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
+/*
-#define VS "s"
+ * add "s" to indicate spectrum measurement included.
-#else
+ * we add it here to be consistent with previous releases in which
-#define VS
+ * this was configurable.
-#endif
+ */
+#define DRV_VERSION  IWLWIFI_VERSION VD "s"
-#define DRV_VERSION  IWLWIFI_VERSION VD VS
+#define DRV_COPYRIGHT   "Copyright(c) 2003-2010 Intel Corporation"
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2009 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
@@ -689,10 +689,6 @@ drop:
        return -1;
 }
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
-#include "iwl-spectrum.h"
 #define BEACON_TIME_MASK_LOW    0x00FFFFFF
 #define BEACON_TIME_MASK_HIGH   0xFF000000
 #define TIME_UNIT               1024
@@ -819,7 +815,6 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
        return rc;
 }
-#endif
 static void iwl3945_rx_reply_alive(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
@@ -962,6 +957,8 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
        priv->rx_handlers[REPLY_ADD_STA] = iwl3945_rx_reply_add_sta;
        priv->rx_handlers[REPLY_ERROR] = iwl_rx_reply_error;
        priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl_rx_csa;
+        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
+                        iwl_rx_spectrum_measure_notif;
        priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl_rx_pm_sleep_notif;
        priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
            iwl_rx_pm_debug_statistics_notif;
@@ -975,7 +972,6 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
        priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
-        iwl_setup_spectrum_handlers(priv);
        iwl_setup_rx_scan_handlers(priv);
        priv->rx_handlers[CARD_STATE_NOTIFICATION] = iwl3945_rx_card_state_notif;
@@ -1518,8 +1514,9 @@ void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
 * iwl3945_print_event_log - Dump error event log to syslog
 *
 */
-static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
+static int iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
-                                u32 num_events, u32 mode)
+                                  u32 num_events, u32 mode,
+                                  int pos, char **buf, size_t bufsz)
 {
        u32 i;
        u32 base;       /* SRAM byte address of event log header */
@@ -1529,7 +1526,7 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
        unsigned long reg_flags;
        if (num_events == 0)
-                return;
+                return pos;
        base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
@@ -1555,26 +1552,43 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
                time = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
                if (mode == 0) {
                        /* data, ev */
-                        IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                        if (bufsz) {
-                        trace_iwlwifi_dev_ucode_event(priv, 0, time, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "0x%08x:%04u\n",
+                                                time, ev);
+                        } else {
+                                IWL_ERR(priv, "0x%08x\t%04u\n", time, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, 0,
+                                                              time, ev);
+                        }
                } else {
                        data = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
-                        IWL_ERR(priv, "%010u\t0x%08x\t%04u\n", time, data, ev);
+                        if (bufsz) {
-                        trace_iwlwifi_dev_ucode_event(priv, time, data, ev);
+                                pos += scnprintf(*buf + pos, bufsz - pos,
+                                                "%010u:0x%08x:%04u\n",
+                                                 time, data, ev);
+                        } else {
+                                IWL_ERR(priv, "%010u\t0x%08x\t%04u\n",
+                                        time, data, ev);
+                                trace_iwlwifi_dev_ucode_event(priv, time,
+                                                              data, ev);
+                        }
                }
        }
        /* Allow device to power down */
        iwl_release_nic_access(priv);
        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return pos;
 }
 /**
 * iwl3945_print_last_event_logs - Dump the newest # of event log to syslog
 */
-static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
+static int iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
                                      u32 num_wraps, u32 next_entry,
-                                      u32 size, u32 mode)
+                                      u32 size, u32 mode,
+                                      int pos, char **buf, size_t bufsz)
 {
        /*
         * display the newest DEFAULT_LOG_ENTRIES entries
@@ -1582,21 +1596,28 @@ static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         */
        if (num_wraps) {
                if (next_entry < size) {
-                        iwl3945_print_event_log(priv,
+                        pos = iwl3945_print_event_log(priv,
-                                        capacity - (size - next_entry),
+                                             capacity - (size - next_entry),
-                                        size - next_entry, mode);
+                                             size - next_entry, mode,
-                        iwl3945_print_event_log(priv, 0,
+                                             pos, buf, bufsz);
-                                    next_entry, mode);
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
                } else
-                        iwl3945_print_event_log(priv, next_entry - size,
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
-                                    size, mode);
+                                                      size, mode,
+                                                      pos, buf, bufsz);
        } else {
                if (next_entry < size)
-                        iwl3945_print_event_log(priv, 0, next_entry, mode);
+                        pos = iwl3945_print_event_log(priv, 0,
+                                                      next_entry, mode,
+                                                      pos, buf, bufsz);
                else
-                        iwl3945_print_event_log(priv, next_entry - size,
+                        pos = iwl3945_print_event_log(priv, next_entry - size,
-                                            size, mode);
+                                                      size, mode,
+                                                      pos, buf, bufsz);
        }
+        return pos;
 }
 /* For sanity check only.  Actual size is determined by uCode, typ. 512 */
@@ -1604,7 +1625,8 @@ static void iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
 #define DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES (20)
-void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
+int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
+                            char **buf, bool display)
 {
        u32 base;       /* SRAM byte address of event log header */
        u32 capacity;   /* event log capacity in # entries */
@@ -1612,11 +1634,13 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        u32 num_wraps;  /* # times uCode wrapped to top of log */
        u32 next_entry; /* index of next entry to be written by uCode */
        u32 size;       /* # entries that we'll print */
+        int pos = 0;
+        size_t bufsz = 0;
        base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
        if (!iwl3945_hw_valid_rtc_data_addr(base)) {
                IWL_ERR(priv, "Invalid event log pointer 0x%08X\n", base);
-                return;
+                return  -EINVAL;
        }
        /* event log header */
@@ -1642,7 +1666,7 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
        /* bail out if nothing in log */
        if (size == 0) {
                IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                return;
+                return pos;
        }
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1658,25 +1682,38 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
                  size);
 #ifdef CONFIG_IWLWIFI_DEBUG
+        if (display) {
+                if (full_log)
+                        bufsz = capacity * 48;
+                else
+                        bufsz = size * 48;
+                *buf = kmalloc(bufsz, GFP_KERNEL);
+                if (!*buf)
+                        return -ENOMEM;
+        }
        if ((iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) || full_log) {
                /* if uCode has wrapped back to top of log,
                 * start at the oldest entry,
                 * i.e the next one that uCode would fill.
                 */
                if (num_wraps)
-                        iwl3945_print_event_log(priv, next_entry,
+                        pos = iwl3945_print_event_log(priv, next_entry,
-                                    capacity - next_entry, mode);
+                                                capacity - next_entry, mode,
+                                                pos, buf, bufsz);
                /* (then/else) start at top of log */
-                iwl3945_print_event_log(priv, 0, next_entry, mode);
+                pos = iwl3945_print_event_log(priv, 0, next_entry, mode,
+                                              pos, buf, bufsz);
        } else
-                iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+                pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
-                                        next_entry, size, mode);
+                                                    next_entry, size, mode,
+                                                    pos, buf, bufsz);
 #else
-        iwl3945_print_last_event_logs(priv, capacity, num_wraps,
+        pos = iwl3945_print_last_event_logs(priv, capacity, num_wraps,
-                                next_entry, size, mode);
+                                            next_entry, size, mode,
+                                            pos, buf, bufsz);
 #endif
+        return pos;
 }
 static void iwl3945_irq_tasklet(struct iwl_priv *priv)
@@ -2996,18 +3033,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
        mutex_unlock(&priv->mutex);
 }
-static void iwl3945_bg_up(struct work_struct *data)
-{
-        struct iwl_priv *priv = container_of(data, struct iwl_priv, up);
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-        mutex_lock(&priv->mutex);
-        __iwl3945_up(priv);
-        mutex_unlock(&priv->mutex);
-}
 static void iwl3945_bg_restart(struct work_struct *data)
 {
        struct iwl_priv *priv = container_of(data, struct iwl_priv, restart);
@@ -3024,7 +3049,13 @@ static void iwl3945_bg_restart(struct work_struct *data)
                ieee80211_restart_hw(priv->hw);
        } else {
                iwl3945_down(priv);
-                queue_work(priv->workqueue, &priv->up);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                        return;
+                mutex_lock(&priv->mutex);
+                __iwl3945_up(priv);
+                mutex_unlock(&priv->mutex);
        }
 }
@@ -3528,8 +3559,6 @@ static ssize_t store_filter_flags(struct device *d,
 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
                   store_filter_flags);
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
 static ssize_t show_measurement(struct device *d,
                                struct device_attribute *attr, char *buf)
 {
@@ -3599,7 +3628,6 @@ static ssize_t store_measurement(struct device *d,
 static DEVICE_ATTR(measurement, S_IRUSR | S_IWUSR,
                   show_measurement, store_measurement);
-#endif /* CONFIG_IWL3945_SPECTRUM_MEASUREMENT */
 static ssize_t store_retry_rate(struct device *d,
                                struct device_attribute *attr,
@@ -3748,7 +3776,6 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
        init_waitqueue_head(&priv->wait_command_queue);
-        INIT_WORK(&priv->up, iwl3945_bg_up);
        INIT_WORK(&priv->restart, iwl3945_bg_restart);
        INIT_WORK(&priv->rx_replenish, iwl3945_bg_rx_replenish);
        INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
@@ -3782,9 +3809,7 @@ static struct attribute *iwl3945_sysfs_entries[] = {
        &dev_attr_dump_errors.attr,
        &dev_attr_flags.attr,
        &dev_attr_filter_flags.attr,
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
        &dev_attr_measurement.attr,
-#endif
        &dev_attr_retry_rate.attr,
        &dev_attr_statistics.attr,
        &dev_attr_status.attr,
@@ -3810,7 +3835,6 @@ static struct ieee80211_ops iwl3945_hw_ops = {
        .config = iwl_mac_config,
        .configure_filter = iwl_configure_filter,
        .set_key = iwl3945_mac_set_key,
-        .get_tx_stats = iwl_mac_get_tx_stats,
        .conf_tx = iwl_mac_conf_tx,
        .reset_tsf = iwl_mac_reset_tsf,
        .bss_info_changed = iwl_bss_info_changed,
@@ -3840,6 +3864,7 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
        priv->band = IEEE80211_BAND_2GHZ;
        priv->iw_mode = NL80211_IFTYPE_STATION;
+        priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
        iwl_reset_qos(priv);