20 files changed, 373 insertions, 383 deletions

diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index ad3bdba6bee..1d7572f9887 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -111,20 +111,3 @@ config IWLWIFI_DEVICE_SVTOOL
           NL80211_TESTMODE. svtool is a software validation tool that runs in
           the user space and interacts with the device in the kernel space
           through the generic netlink message via NL80211_TESTMODE channel.
-
-config IWL_P2P
-        bool "iwlwifi experimental P2P support"
-        depends on IWLAGN
-        help
-          This option enables experimental P2P support for some devices
-          based on microcode support. Since P2P support is still under
-          development, this option may even enable it for some devices
-          now that turn out to not support it in the future due to
-          microcode restrictions.
-
-          To determine if your microcode supports the experimental P2P
-          offered by this option, check if the driver advertises AP
-          support when it is loaded.
-
-          Say Y only if you want to experiment with P2P.
-
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 01b49eb8c8e..ccdbed56717 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -30,7 +30,6 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
@@ -46,8 +45,12 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL1000_UCODE_API_MAX 5
-#define IWL100_UCODE_API_MAX 5
+#define IWL1000_UCODE_API_MAX 6
+#define IWL100_UCODE_API_MAX 6
+
+/* Oldest version we won't warn about */
+#define IWL1000_UCODE_API_OK 5
+#define IWL100_UCODE_API_OK 5
 
 /* Lowest firmware API version supported */
 #define IWL1000_UCODE_API_MIN 1
@@ -135,8 +138,7 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
 
         priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
         if (priv->cfg->rx_with_siso_diversity)
@@ -201,12 +203,13 @@ static struct iwl_base_params iwl1000_base_params = {
 static struct iwl_ht_params iwl1000_ht_params = {
         .ht_greenfield_support = true,
         .use_rts_for_aggregation = true, /* use rts/cts protection */
-        .smps_mode = IEEE80211_SMPS_STATIC,
+        .smps_mode = IEEE80211_SMPS_DYNAMIC,
 };
 
 #define IWL_DEVICE_1000                                         \
         .fw_name_pre = IWL1000_FW_PRE,                          \
         .ucode_api_max = IWL1000_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL1000_UCODE_API_OK,                   \
         .ucode_api_min = IWL1000_UCODE_API_MIN,                 \
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
@@ -228,6 +231,7 @@ struct iwl_cfg iwl1000_bg_cfg = {
 #define IWL_DEVICE_100                                          \
         .fw_name_pre = IWL100_FW_PRE,                           \
         .ucode_api_max = IWL100_UCODE_API_MAX,                  \
+        .ucode_api_ok = IWL100_UCODE_API_OK,                    \
         .ucode_api_min = IWL100_UCODE_API_MIN,                  \
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 0e13f0bb2e1..54d931d614f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -30,7 +30,6 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
@@ -47,10 +46,16 @@
 #include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL2030_UCODE_API_MAX 5
-#define IWL2000_UCODE_API_MAX 5
-#define IWL105_UCODE_API_MAX 5
-#define IWL135_UCODE_API_MAX 5
+#define IWL2030_UCODE_API_MAX 6
+#define IWL2000_UCODE_API_MAX 6
+#define IWL105_UCODE_API_MAX 6
+#define IWL135_UCODE_API_MAX 6
+
+/* Oldest version we won't warn about */
+#define IWL2030_UCODE_API_OK 5
+#define IWL2000_UCODE_API_OK 5
+#define IWL105_UCODE_API_OK 5
+#define IWL135_UCODE_API_OK 5
 
 /* Lowest firmware API version supported */
 #define IWL2030_UCODE_API_MIN 5
@@ -130,8 +135,7 @@ static int iwl2000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
 
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
 
         priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
         if (priv->cfg->rx_with_siso_diversity)
@@ -217,6 +221,7 @@ static struct iwl_base_params iwl2000_base_params = {
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = true,
+        .hd_v2 = true,
 };
 
 
@@ -236,6 +241,7 @@ static struct iwl_base_params iwl2030_base_params = {
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = true,
+        .hd_v2 = true,
 };
 
 static struct iwl_ht_params iwl2000_ht_params = {
@@ -256,6 +262,7 @@ static struct iwl_bt_params iwl2030_bt_params = {
 #define IWL_DEVICE_2000                                         \
         .fw_name_pre = IWL2000_FW_PRE,                          \
         .ucode_api_max = IWL2000_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL2000_UCODE_API_OK,                   \
         .ucode_api_min = IWL2000_UCODE_API_MIN,                 \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
@@ -280,6 +287,7 @@ struct iwl_cfg iwl2000_2bg_cfg = {
 #define IWL_DEVICE_2030                                         \
         .fw_name_pre = IWL2030_FW_PRE,                          \
         .ucode_api_max = IWL2030_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL2030_UCODE_API_OK,                   \
         .ucode_api_min = IWL2030_UCODE_API_MIN,                 \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
@@ -306,6 +314,7 @@ struct iwl_cfg iwl2030_2bg_cfg = {
 #define IWL_DEVICE_105                                          \
         .fw_name_pre = IWL105_FW_PRE,                           \
         .ucode_api_max = IWL105_UCODE_API_MAX,                  \
+        .ucode_api_ok = IWL105_UCODE_API_OK,                    \
         .ucode_api_min = IWL105_UCODE_API_MIN,                  \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
@@ -332,6 +341,7 @@ struct iwl_cfg iwl105_bgn_cfg = {
 #define IWL_DEVICE_135                                          \
         .fw_name_pre = IWL135_FW_PRE,                           \
         .ucode_api_max = IWL135_UCODE_API_MAX,                  \
+        .ucode_api_ok = IWL135_UCODE_API_OK,                    \
         .ucode_api_min = IWL135_UCODE_API_MIN,                  \
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index c95cefd529d..a9adee5634d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -31,7 +31,6 @@
 #include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
@@ -84,12 +83,12 @@ static void iwl5000_nic_config(struct iwl_priv *priv)
 }
 
 static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
-        .min_nrg_cck = 95,
+        .min_nrg_cck = 100,
         .max_nrg_cck = 0, /* not used, set to 0 */
         .auto_corr_min_ofdm = 90,
         .auto_corr_min_ofdm_mrc = 170,
-        .auto_corr_min_ofdm_x1 = 120,
-        .auto_corr_min_ofdm_mrc_x1 = 240,
+        .auto_corr_min_ofdm_x1 = 105,
+        .auto_corr_min_ofdm_mrc_x1 = 220,
 
         .auto_corr_max_ofdm = 120,
         .auto_corr_max_ofdm_mrc = 210,
@@ -98,10 +97,10 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
 
         .auto_corr_min_cck = 125,
         .auto_corr_max_cck = 200,
-        .auto_corr_min_cck_mrc = 170,
+        .auto_corr_min_cck_mrc = 200,
         .auto_corr_max_cck_mrc = 400,
-        .nrg_th_cck = 95,
-        .nrg_th_ofdm = 95,
+        .nrg_th_cck = 100,
+        .nrg_th_ofdm = 100,
 
         .barker_corr_th_min = 190,
         .barker_corr_th_min_mrc = 390,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 973d1972e8c..339de88d9ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -30,7 +30,6 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
@@ -50,7 +49,10 @@
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 5
-#define IWL6000G2_UCODE_API_MAX 5
+#define IWL6000G2_UCODE_API_MAX 6
+
+/* Oldest version we won't warn about */
+#define IWL6000G2_UCODE_API_OK 5
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
@@ -111,7 +113,7 @@ static void iwl6000_nic_config(struct iwl_priv *priv)
 }
 
 static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
-        .min_nrg_cck = 97,
+        .min_nrg_cck = 110,
         .max_nrg_cck = 0, /* not used, set to 0 */
         .auto_corr_min_ofdm = 80,
         .auto_corr_min_ofdm_mrc = 128,
@@ -127,11 +129,11 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
         .auto_corr_max_cck = 175,
         .auto_corr_min_cck_mrc = 160,
         .auto_corr_max_cck_mrc = 310,
-        .nrg_th_cck = 97,
-        .nrg_th_ofdm = 100,
+        .nrg_th_cck = 110,
+        .nrg_th_ofdm = 110,
 
         .barker_corr_th_min = 190,
-        .barker_corr_th_min_mrc = 390,
+        .barker_corr_th_min_mrc = 336,
         .nrg_th_cca = 62,
 };
 
@@ -365,8 +367,9 @@ static struct iwl_bt_params iwl6000_bt_params = {
 };
 
 #define IWL_DEVICE_6005                                         \
-        .fw_name_pre = IWL6005_FW_PRE,                  \
+        .fw_name_pre = IWL6005_FW_PRE,                          \
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
+        .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
         .eeprom_ver = EEPROM_6005_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6005_TX_POWER_VERSION,       \
@@ -393,8 +396,9 @@ struct iwl_cfg iwl6005_2bg_cfg = {
 };
 
 #define IWL_DEVICE_6030                                         \
-        .fw_name_pre = IWL6030_FW_PRE,                  \
+        .fw_name_pre = IWL6030_FW_PRE,                          \
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
+        .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
         .eeprom_ver = EEPROM_6030_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index 72d6297602b..1789e3af810 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -505,28 +505,53 @@ static int iwl_enhance_sensitivity_write(struct iwl_priv *priv)
 
         iwl_prepare_legacy_sensitivity_tbl(priv, data, &cmd.enhance_table[0]);
 
-        cmd.enhance_table[HD_INA_NON_SQUARE_DET_OFDM_INDEX] =
-                HD_INA_NON_SQUARE_DET_OFDM_DATA;
-        cmd.enhance_table[HD_INA_NON_SQUARE_DET_CCK_INDEX] =
-                HD_INA_NON_SQUARE_DET_CCK_DATA;
-        cmd.enhance_table[HD_CORR_11_INSTEAD_OF_CORR_9_EN_INDEX] =
-                HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA;
-        cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
-                HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA;
-        cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
-                HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA;
-        cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_INDEX] =
-                HD_OFDM_NON_SQUARE_DET_SLOPE_DATA;
-        cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_INDEX] =
-                HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA;
-        cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
-                HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA;
-        cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
-                HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA;
-        cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_INDEX] =
-                HD_CCK_NON_SQUARE_DET_SLOPE_DATA;
-        cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_INDEX] =
-                HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA;
+        if (priv->cfg->base_params->hd_v2) {
+                cmd.enhance_table[HD_INA_NON_SQUARE_DET_OFDM_INDEX] =
+                        HD_INA_NON_SQUARE_DET_OFDM_DATA_V2;
+                cmd.enhance_table[HD_INA_NON_SQUARE_DET_CCK_INDEX] =
+                        HD_INA_NON_SQUARE_DET_CCK_DATA_V2;
+                cmd.enhance_table[HD_CORR_11_INSTEAD_OF_CORR_9_EN_INDEX] =
+                        HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA_V2;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA_V2;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V2;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_SLOPE_DATA_V2;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA_V2;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA_V2;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V2;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_SLOPE_DATA_V2;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA_V2;
+        } else {
+                cmd.enhance_table[HD_INA_NON_SQUARE_DET_OFDM_INDEX] =
+                        HD_INA_NON_SQUARE_DET_OFDM_DATA_V1;
+                cmd.enhance_table[HD_INA_NON_SQUARE_DET_CCK_INDEX] =
+                        HD_INA_NON_SQUARE_DET_CCK_DATA_V1;
+                cmd.enhance_table[HD_CORR_11_INSTEAD_OF_CORR_9_EN_INDEX] =
+                        HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA_V1;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA_V1;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V1;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_SLOPE_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_SLOPE_DATA_V1;
+                cmd.enhance_table[HD_OFDM_NON_SQUARE_DET_INTERCEPT_INDEX] =
+                        HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA_V1;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_MRC_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA_V1;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V1;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_SLOPE_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_SLOPE_DATA_V1;
+                cmd.enhance_table[HD_CCK_NON_SQUARE_DET_INTERCEPT_INDEX] =
+                        HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA_V1;
+        }
 
         /* Update uCode's "work" table, and copy it to DSP */
         cmd.control = SENSITIVITY_CMD_CONTROL_WORK_TABLE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 0e5b842529c..47c43042ba4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -92,8 +92,8 @@
 
 #define IWLAGN_CMD_FIFO_NUM             7
 #define IWLAGN_NUM_QUEUES               20
-#define IWLAGN_NUM_AMPDU_QUEUES         10
-#define IWLAGN_FIRST_AMPDU_QUEUE        10
+#define IWLAGN_NUM_AMPDU_QUEUES         9
+#define IWLAGN_FIRST_AMPDU_QUEUE        11
 
 /* Fixed (non-configurable) rx data from phy */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 3bee0f119bc..4edb6cfc548 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -753,18 +753,6 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
         return added;
 }
 
-static int iwl_fill_offch_tx(struct iwl_priv *priv, void *data, size_t maxlen)
-{
-        struct sk_buff *skb = priv->offchan_tx_skb;
-
-        if (skb->len < maxlen)
-                maxlen = skb->len;
-
-        memcpy(data, skb->data, maxlen);
-
-        return maxlen;
-}
-
 int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct iwl_host_cmd cmd = {
@@ -807,7 +795,7 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 
-        if (priv->scan_type != IWL_SCAN_OFFCH_TX &&
+        if (priv->scan_type != IWL_SCAN_ROC &&
             iwl_is_any_associated(priv)) {
                 u16 interval = 0;
                 u32 extra;
@@ -816,7 +804,7 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
                 switch (priv->scan_type) {
-                case IWL_SCAN_OFFCH_TX:
+                case IWL_SCAN_ROC:
                         WARN_ON(1);
                         break;
                 case IWL_SCAN_RADIO_RESET:
@@ -838,10 +826,11 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 scan->suspend_time = cpu_to_le32(scan_suspend_time);
                 IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
                                scan_suspend_time, interval);
-        } else if (priv->scan_type == IWL_SCAN_OFFCH_TX) {
+        } else if (priv->scan_type == IWL_SCAN_ROC) {
                 scan->suspend_time = 0;
-                scan->max_out_time =
-                        cpu_to_le32(1024 * priv->offchan_tx_timeout);
+                scan->max_out_time = 0;
+                scan->quiet_time = 0;
+                scan->quiet_plcp_th = 0;
         }
 
         switch (priv->scan_type) {
@@ -869,8 +858,8 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 } else
                         IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
                 break;
-        case IWL_SCAN_OFFCH_TX:
-                IWL_DEBUG_SCAN(priv, "Start offchannel TX scan.\n");
+        case IWL_SCAN_ROC:
+                IWL_DEBUG_SCAN(priv, "Start ROC scan.\n");
                 break;
         }
 
@@ -988,19 +977,13 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                                         IWL_MAX_SCAN_SIZE - sizeof(*scan));
                 break;
         case IWL_SCAN_RADIO_RESET:
+        case IWL_SCAN_ROC:
                 /* use bcast addr, will not be transmitted but must be valid */
                 cmd_len = iwl_fill_probe_req(priv,
                                         (struct ieee80211_mgmt *)scan->data,
                                         iwl_bcast_addr, NULL, 0,
                                         IWL_MAX_SCAN_SIZE - sizeof(*scan));
                 break;
-        case IWL_SCAN_OFFCH_TX:
-                cmd_len = iwl_fill_offch_tx(priv, scan->data,
-                                            IWL_MAX_SCAN_SIZE
-                                             - sizeof(*scan)
-                                             - sizeof(struct iwl_scan_channel));
-                scan->scan_flags |= IWL_SCAN_FLAGS_ACTION_FRAME_TX;
-                break;
         default:
                 BUG();
         }
@@ -1021,18 +1004,18 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                                 is_active, n_probes,
                                 (void *)&scan->data[cmd_len]);
                 break;
-        case IWL_SCAN_OFFCH_TX: {
+        case IWL_SCAN_ROC: {
                 struct iwl_scan_channel *scan_ch;
 
                 scan->channel_count = 1;
 
                 scan_ch = (void *)&scan->data[cmd_len];
-                scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
+                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
                 scan_ch->channel =
-                        cpu_to_le16(priv->offchan_tx_chan->hw_value);
+                        cpu_to_le16(priv->hw_roc_channel->hw_value);
                 scan_ch->active_dwell =
-                        cpu_to_le16(priv->offchan_tx_timeout);
-                scan_ch->passive_dwell = 0;
+                scan_ch->passive_dwell =
+                        cpu_to_le16(priv->hw_roc_duration);
 
                 /* Set txpower levels to defaults */
                 scan_ch->dsp_atten = 110;
@@ -1041,7 +1024,7 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                  * power level:
                  * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
                  */
-                if (priv->offchan_tx_chan->band == IEEE80211_BAND_5GHZ)
+                if (priv->hw_roc_channel->band == IEEE80211_BAND_5GHZ)
                         scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
                 else
                         scan_ch->tx_gain = ((1 << 5) | (5 << 3));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 3789ff4bf53..1fa438e20f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -27,7 +27,6 @@
 #include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index d42ef1763a7..d562e9359d9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -337,10 +337,10 @@ int iwlagn_set_pan_params(struct iwl_priv *priv)
         cmd.slots[0].type = 0; /* BSS */
         cmd.slots[1].type = 1; /* PAN */
 
-        if (priv->hw_roc_channel) {
+        if (priv->hw_roc_setup) {
                 /* both contexts must be used for this to happen */
-                slot1 = priv->hw_roc_duration;
-                slot0 = IWL_MIN_SLOT_TIME;
+                slot1 = IWL_MIN_SLOT_TIME;
+                slot0 = 3000;
         } else if (ctx_bss->vif && ctx_pan->vif) {
                 int bcnint = ctx_pan->beacon_int;
                 int dtim = ctx_pan->vif->bss_conf.dtim_period ?: 1;
@@ -437,23 +437,6 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         /* always get timestamp with Rx frame */
         ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
 
-        if (ctx->ctxid == IWL_RXON_CTX_PAN && priv->hw_roc_channel) {
-                struct ieee80211_channel *chan = priv->hw_roc_channel;
-
-                iwl_set_rxon_channel(priv, chan, ctx);
-                iwl_set_flags_for_band(priv, ctx, chan->band, NULL);
-                ctx->staging.filter_flags |=
-                        RXON_FILTER_ASSOC_MSK |
-                        RXON_FILTER_PROMISC_MSK |
-                        RXON_FILTER_CTL2HOST_MSK;
-                ctx->staging.dev_type = RXON_DEV_TYPE_P2P;
-                new_assoc = true;
-
-                if (memcmp(&ctx->staging, &ctx->active,
-                           sizeof(ctx->staging)) == 0)
-                        return 0;
-        }
-
         /*
          * force CTS-to-self frames protection if RTS-CTS is not preferred
          * one aggregation protection method
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 53bb59ee719..9bc26da6276 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -128,11 +128,10 @@ static void iwlagn_tx_cmd_protection(struct iwl_priv *priv,
  * handle build REPLY_TX command notification.
  */
 static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
-                                        struct sk_buff *skb,
-                                        struct iwl_tx_cmd *tx_cmd,
-                                        struct ieee80211_tx_info *info,
-                                        struct ieee80211_hdr *hdr,
-                                        u8 std_id)
+                                      struct sk_buff *skb,
+                                      struct iwl_tx_cmd *tx_cmd,
+                                      struct ieee80211_tx_info *info,
+                                      struct ieee80211_hdr *hdr, u8 sta_id)
 {
         __le16 fc = hdr->frame_control;
         __le32 tx_flags = tx_cmd->tx_flags;
@@ -157,7 +156,7 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
                 tx_flags |= TX_CMD_FLG_IGNORE_BT;
 
 
-        tx_cmd->sta_id = std_id;
+        tx_cmd->sta_id = sta_id;
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
 
@@ -189,9 +188,9 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
 #define RTS_DFAULT_RETRY_LIMIT          60
 
 static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
-                              struct iwl_tx_cmd *tx_cmd,
-                              struct ieee80211_tx_info *info,
-                              __le16 fc)
+                                     struct iwl_tx_cmd *tx_cmd,
+                                     struct ieee80211_tx_info *info,
+                                     __le16 fc)
 {
         u32 rate_flags;
         int rate_idx;
@@ -334,14 +333,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         unsigned long flags;
         bool is_agg = false;
 
-        /*
-         * If the frame needs to go out off-channel, then
-         * we'll have put the PAN context to that channel,
-         * so make the frame go out there.
-         */
-        if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
-                ctx = &priv->contexts[IWL_RXON_CTX_PAN];
-        else if (info->control.vif)
+        if (info->control.vif)
                 ctx = iwl_rxon_ctx_from_vif(info->control.vif);
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -407,7 +399,9 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                  */
                 hdr->frame_control |=
                         cpu_to_le16(IEEE80211_FCTL_MOREDATA);
-        } else
+        } else if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+                txq_id = IWL_AUX_QUEUE;
+        else
                 txq_id = ctx->ac_to_queue[skb_get_queue_mapping(skb)];
 
         /* irqs already disabled/saved above when locking priv->lock */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f08..33894dde1ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -35,7 +35,6 @@
 #include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
@@ -614,6 +613,87 @@ static int iwl_alloc_fw_desc(struct iwl_priv *priv, struct fw_desc *desc,
         return 0;
 }
 
+static void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
+{
+        static const u8 iwlagn_bss_ac_to_fifo[] = {
+                IWL_TX_FIFO_VO,
+                IWL_TX_FIFO_VI,
+                IWL_TX_FIFO_BE,
+                IWL_TX_FIFO_BK,
+        };
+        static const u8 iwlagn_bss_ac_to_queue[] = {
+                0, 1, 2, 3,
+        };
+        static const u8 iwlagn_pan_ac_to_fifo[] = {
+                IWL_TX_FIFO_VO_IPAN,
+                IWL_TX_FIFO_VI_IPAN,
+                IWL_TX_FIFO_BE_IPAN,
+                IWL_TX_FIFO_BK_IPAN,
+        };
+        static const u8 iwlagn_pan_ac_to_queue[] = {
+                7, 6, 5, 4,
+        };
+        int i;
+
+        /*
+         * The default context is always valid,
+         * the PAN context depends on uCode.
+         */
+        priv->valid_contexts = BIT(IWL_RXON_CTX_BSS);
+        if (ucode_flags & IWL_UCODE_TLV_FLAGS_PAN)
+                priv->valid_contexts |= BIT(IWL_RXON_CTX_PAN);
+
+        for (i = 0; i < NUM_IWL_RXON_CTX; i++)
+                priv->contexts[i].ctxid = i;
+
+        priv->contexts[IWL_RXON_CTX_BSS].always_active = true;
+        priv->contexts[IWL_RXON_CTX_BSS].is_active = true;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_cmd = REPLY_RXON;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_timing_cmd = REPLY_RXON_TIMING;
+        priv->contexts[IWL_RXON_CTX_BSS].rxon_assoc_cmd = REPLY_RXON_ASSOC;
+        priv->contexts[IWL_RXON_CTX_BSS].qos_cmd = REPLY_QOS_PARAM;
+        priv->contexts[IWL_RXON_CTX_BSS].ap_sta_id = IWL_AP_ID;
+        priv->contexts[IWL_RXON_CTX_BSS].wep_key_cmd = REPLY_WEPKEY;
+        priv->contexts[IWL_RXON_CTX_BSS].ac_to_fifo = iwlagn_bss_ac_to_fifo;
+        priv->contexts[IWL_RXON_CTX_BSS].ac_to_queue = iwlagn_bss_ac_to_queue;
+        priv->contexts[IWL_RXON_CTX_BSS].exclusive_interface_modes =
+                BIT(NL80211_IFTYPE_ADHOC);
+        priv->contexts[IWL_RXON_CTX_BSS].interface_modes =
+                BIT(NL80211_IFTYPE_STATION);
+        priv->contexts[IWL_RXON_CTX_BSS].ap_devtype = RXON_DEV_TYPE_AP;
+        priv->contexts[IWL_RXON_CTX_BSS].ibss_devtype = RXON_DEV_TYPE_IBSS;
+        priv->contexts[IWL_RXON_CTX_BSS].station_devtype = RXON_DEV_TYPE_ESS;
+        priv->contexts[IWL_RXON_CTX_BSS].unused_devtype = RXON_DEV_TYPE_ESS;
+
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_cmd = REPLY_WIPAN_RXON;
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_timing_cmd =
+                REPLY_WIPAN_RXON_TIMING;
+        priv->contexts[IWL_RXON_CTX_PAN].rxon_assoc_cmd =
+                REPLY_WIPAN_RXON_ASSOC;
+        priv->contexts[IWL_RXON_CTX_PAN].qos_cmd = REPLY_WIPAN_QOS_PARAM;
+        priv->contexts[IWL_RXON_CTX_PAN].ap_sta_id = IWL_AP_ID_PAN;
+        priv->contexts[IWL_RXON_CTX_PAN].wep_key_cmd = REPLY_WIPAN_WEPKEY;
+        priv->contexts[IWL_RXON_CTX_PAN].bcast_sta_id = IWLAGN_PAN_BCAST_ID;
+        priv->contexts[IWL_RXON_CTX_PAN].station_flags = STA_FLG_PAN_STATION;
+        priv->contexts[IWL_RXON_CTX_PAN].ac_to_fifo = iwlagn_pan_ac_to_fifo;
+        priv->contexts[IWL_RXON_CTX_PAN].ac_to_queue = iwlagn_pan_ac_to_queue;
+        priv->contexts[IWL_RXON_CTX_PAN].mcast_queue = IWL_IPAN_MCAST_QUEUE;
+        priv->contexts[IWL_RXON_CTX_PAN].interface_modes =
+                BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_AP);
+
+        if (ucode_flags & IWL_UCODE_TLV_FLAGS_P2P)
+                priv->contexts[IWL_RXON_CTX_PAN].interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO);
+
+        priv->contexts[IWL_RXON_CTX_PAN].ap_devtype = RXON_DEV_TYPE_CP;
+        priv->contexts[IWL_RXON_CTX_PAN].station_devtype = RXON_DEV_TYPE_2STA;
+        priv->contexts[IWL_RXON_CTX_PAN].unused_devtype = RXON_DEV_TYPE_P2P;
+
+        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
+}
+
+
 struct iwlagn_ucode_capabilities {
         u32 max_probe_length;
         u32 standard_phy_calibration_size;
@@ -952,6 +1032,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         int err;
         struct iwlagn_firmware_pieces pieces;
         const unsigned int api_max = priv->cfg->ucode_api_max;
+        unsigned int api_ok = priv->cfg->ucode_api_ok;
         const unsigned int api_min = priv->cfg->ucode_api_min;
         u32 api_ver;
         char buildstr[25];
@@ -962,10 +1043,13 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                         IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE,
         };
 
+        if (!api_ok)
+                api_ok = api_max;
+
         memset(&pieces, 0, sizeof(pieces));
 
         if (!ucode_raw) {
-                if (priv->fw_index <= priv->cfg->ucode_api_max)
+                if (priv->fw_index <= api_ok)
                         IWL_ERR(priv,
                                 "request for firmware file '%s' failed.\n",
                                 priv->firmware_name);
@@ -1011,12 +1095,18 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                         goto try_again;
                 }
 
-                if (api_ver != api_max)
-                        IWL_ERR(priv,
-                                "Firmware has old API version. Expected v%u, "
-                                "got v%u. New firmware can be obtained "
-                                "from http://www.intellinuxwireless.org.\n",
-                                api_max, api_ver);
+                if (api_ver < api_ok) {
+                        if (api_ok != api_max)
+                                IWL_ERR(priv, "Firmware has old API version, "
+                                        "expected v%u through v%u, got v%u.\n",
+                                        api_ok, api_max, api_ver);
+                        else
+                                IWL_ERR(priv, "Firmware has old API version, "
+                                        "expected v%u, got v%u.\n",
+                                        api_max, api_ver);
+                        IWL_ERR(priv, "New firmware can be obtained from "
+                                      "http://www.intellinuxwireless.org/.\n");
+                }
         }
 
         if (build)
@@ -1143,17 +1233,23 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         priv->new_scan_threshold_behaviour =
                 !!(ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWSCAN);
 
-        if ((priv->cfg->sku & EEPROM_SKU_CAP_IPAN_ENABLE) &&
-            (ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PAN)) {
-                priv->valid_contexts |= BIT(IWL_RXON_CTX_PAN);
-                priv->sta_key_max_num = STA_KEY_MAX_NUM_PAN;
-        } else
-                priv->sta_key_max_num = STA_KEY_MAX_NUM;
+        if (!(priv->cfg->sku & EEPROM_SKU_CAP_IPAN_ENABLE))
+                ucode_capa.flags &= ~IWL_UCODE_TLV_FLAGS_PAN;
 
-        if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
+        /*
+         * if not PAN, then don't support P2P -- might be a uCode
+         * packaging bug or due to the eeprom check above
+         */
+        if (!(ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PAN))
+                ucode_capa.flags &= ~IWL_UCODE_TLV_FLAGS_P2P;
+
+        if (ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PAN) {
+                priv->sta_key_max_num = STA_KEY_MAX_NUM_PAN;
                 priv->cmd_queue = IWL_IPAN_CMD_QUEUE_NUM;
-        else
+        } else {
+                priv->sta_key_max_num = STA_KEY_MAX_NUM;
                 priv->cmd_queue = IWL_DEFAULT_CMD_QUEUE_NUM;
+        }
 
         /*
          * figure out the offset of chain noise reset and gain commands
@@ -1169,6 +1265,9 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         priv->phy_calib_chain_noise_gain_cmd =
                 ucode_capa.standard_phy_calibration_size + 1;
 
+        /* initialize all valid contexts */
+        iwl_init_context(priv, ucode_capa.flags);
+
         /**************************************************
          * This is still part of probe() in a sense...
          *
@@ -1765,6 +1864,13 @@ static void __iwl_down(struct iwl_priv *priv)
 
         iwl_scan_cancel_timeout(priv, 200);
 
+        /*
+         * If active, scanning won't cancel it, so say it expired.
+         * No race since we hold the mutex here and a new one
+         * can't come in at this time.
+         */
+        ieee80211_remain_on_channel_expired(priv->hw);
+
         exit_pending = test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
@@ -1955,94 +2061,6 @@ static void iwl_bg_restart(struct work_struct *data)
         }
 }
 
-static int iwl_mac_offchannel_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type,
-                                 unsigned int wait)
-{
-        struct iwl_priv *priv = hw->priv;
-        int ret;
-
-        /* Not supported if we don't have PAN */
-        if (!(priv->valid_contexts & BIT(IWL_RXON_CTX_PAN))) {
-                ret = -EOPNOTSUPP;
-                goto free;
-        }
-
-        /* Not supported on pre-P2P firmware */
-        if (!(priv->contexts[IWL_RXON_CTX_PAN].interface_modes &
-                                        BIT(NL80211_IFTYPE_P2P_CLIENT))) {
-                ret = -EOPNOTSUPP;
-                goto free;
-        }
-
-        mutex_lock(&priv->mutex);
-
-        if (!priv->contexts[IWL_RXON_CTX_PAN].is_active) {
-                /*
-                 * If the PAN context is free, use the normal
-                 * way of doing remain-on-channel offload + TX.
-                 */
-                ret = 1;
-                goto out;
-        }
-
-        /* TODO: queue up if scanning? */
-        if (test_bit(STATUS_SCANNING, &priv->status) ||
-            priv->offchan_tx_skb) {
-                ret = -EBUSY;
-                goto out;
-        }
-
-        /*
-         * max_scan_ie_len doesn't include the blank SSID or the header,
-         * so need to add that again here.
-         */
-        if (skb->len > hw->wiphy->max_scan_ie_len + 24 + 2) {
-                ret = -ENOBUFS;
-                goto out;
-        }
-
-        priv->offchan_tx_skb = skb;
-        priv->offchan_tx_timeout = wait;
-        priv->offchan_tx_chan = chan;
-
-        ret = iwl_scan_initiate(priv, priv->contexts[IWL_RXON_CTX_PAN].vif,
-                                IWL_SCAN_OFFCH_TX, chan->band);
-        if (ret)
-                priv->offchan_tx_skb = NULL;
- out:
-        mutex_unlock(&priv->mutex);
- free:
-        if (ret < 0)
-                kfree_skb(skb);
-
-        return ret;
-}
-
-static int iwl_mac_offchannel_tx_cancel_wait(struct ieee80211_hw *hw)
-{
-        struct iwl_priv *priv = hw->priv;
-        int ret;
-
-        mutex_lock(&priv->mutex);
-
-        if (!priv->offchan_tx_skb) {
-                ret = -EINVAL;
-                goto unlock;
-        }
-
-        priv->offchan_tx_skb = NULL;
-
-        ret = iwl_scan_cancel_timeout(priv, 200);
-        if (ret)
-                ret = -EIO;
-unlock:
-        mutex_unlock(&priv->mutex);
-
-        return ret;
-}
-
 /*****************************************************************************
  *
  * mac80211 entry point functions
@@ -3198,35 +3216,34 @@ done:
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static void iwlagn_disable_roc(struct iwl_priv *priv)
+void iwlagn_disable_roc(struct iwl_priv *priv)
 {
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_PAN];
-        struct ieee80211_channel *chan = ACCESS_ONCE(priv->hw->conf.channel);
 
         lockdep_assert_held(&priv->mutex);
 
-        if (!ctx->is_active)
+        if (!priv->hw_roc_setup)
                 return;
 
-        ctx->staging.dev_type = RXON_DEV_TYPE_2STA;
+        ctx->staging.dev_type = RXON_DEV_TYPE_P2P;
         ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwl_set_rxon_channel(priv, chan, ctx);
-        iwl_set_flags_for_band(priv, ctx, chan->band, NULL);
 
         priv->hw_roc_channel = NULL;
 
+        memset(ctx->staging.node_addr, 0, ETH_ALEN);
+
         iwlagn_commit_rxon(priv, ctx);
 
         ctx->is_active = false;
+        priv->hw_roc_setup = false;
 }
 
-static void iwlagn_bg_roc_done(struct work_struct *work)
+static void iwlagn_disable_roc_work(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
-                                             hw_roc_work.work);
+                                             hw_roc_disable_work.work);
 
         mutex_lock(&priv->mutex);
-        ieee80211_remain_on_channel_expired(priv->hw);
         iwlagn_disable_roc(priv);
         mutex_unlock(&priv->mutex);
 }
@@ -3237,33 +3254,63 @@ static int iwl_mac_remain_on_channel(struct ieee80211_hw *hw,
                                      int duration)
 {
         struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_PAN];
         int err = 0;
 
         if (!(priv->valid_contexts & BIT(IWL_RXON_CTX_PAN)))
                 return -EOPNOTSUPP;
 
-        if (!(priv->contexts[IWL_RXON_CTX_PAN].interface_modes &
-                                        BIT(NL80211_IFTYPE_P2P_CLIENT)))
+        if (!(ctx->interface_modes & BIT(NL80211_IFTYPE_P2P_CLIENT)))
                 return -EOPNOTSUPP;
 
         mutex_lock(&priv->mutex);
 
-        if (priv->contexts[IWL_RXON_CTX_PAN].is_active ||
-            test_bit(STATUS_SCAN_HW, &priv->status)) {
+        /*
+         * TODO: Remove this hack! Firmware needs to be updated
+         * to allow longer off-channel periods in scanning for
+         * this use case, based on a flag (and we'll need an API
+         * flag in the firmware when it has that).
+         */
+        if (iwl_is_associated(priv, IWL_RXON_CTX_BSS) && duration > 80)
+                duration = 80;
+
+        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
                 err = -EBUSY;
                 goto out;
         }
 
-        priv->contexts[IWL_RXON_CTX_PAN].is_active = true;
         priv->hw_roc_channel = channel;
         priv->hw_roc_chantype = channel_type;
-        priv->hw_roc_duration = DIV_ROUND_UP(duration * 1000, 1024);
-        iwlagn_commit_rxon(priv, &priv->contexts[IWL_RXON_CTX_PAN]);
-        queue_delayed_work(priv->workqueue, &priv->hw_roc_work,
-                           msecs_to_jiffies(duration + 20));
+        priv->hw_roc_duration = duration;
+        cancel_delayed_work(&priv->hw_roc_disable_work);
+
+        if (!ctx->is_active) {
+                ctx->is_active = true;
+                ctx->staging.dev_type = RXON_DEV_TYPE_P2P;
+                memcpy(ctx->staging.node_addr,
+                       priv->contexts[IWL_RXON_CTX_BSS].staging.node_addr,
+                       ETH_ALEN);
+                memcpy(ctx->staging.bssid_addr,
+                       priv->contexts[IWL_RXON_CTX_BSS].staging.node_addr,
+                       ETH_ALEN);
+                err = iwlagn_commit_rxon(priv, ctx);
+                if (err)
+                        goto out;
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK |
+                                             RXON_FILTER_PROMISC_MSK |
+                                             RXON_FILTER_CTL2HOST_MSK;
+
+                err = iwlagn_commit_rxon(priv, ctx);
+                if (err) {
+                        iwlagn_disable_roc(priv);
+                        goto out;
+                }
+                priv->hw_roc_setup = true;
+        }
 
-        msleep(IWL_MIN_SLOT_TIME); /* TU is almost ms */
-        ieee80211_ready_on_channel(priv->hw);
+        err = iwl_scan_initiate(priv, ctx->vif, IWL_SCAN_ROC, channel->band);
+        if (err)
+                iwlagn_disable_roc(priv);
 
  out:
         mutex_unlock(&priv->mutex);
@@ -3278,9 +3325,8 @@ static int iwl_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
         if (!(priv->valid_contexts & BIT(IWL_RXON_CTX_PAN)))
                 return -EOPNOTSUPP;
 
-        cancel_delayed_work_sync(&priv->hw_roc_work);
-
         mutex_lock(&priv->mutex);
+        iwl_scan_cancel_timeout(priv, priv->hw_roc_duration);
         iwlagn_disable_roc(priv);
         mutex_unlock(&priv->mutex);
 
@@ -3305,7 +3351,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->tx_flush, iwl_bg_tx_flush);
         INIT_WORK(&priv->bt_full_concurrency, iwl_bg_bt_full_concurrency);
         INIT_WORK(&priv->bt_runtime_config, iwl_bg_bt_runtime_config);
-        INIT_DELAYED_WORK(&priv->hw_roc_work, iwlagn_bg_roc_done);
+        INIT_DELAYED_WORK(&priv->hw_roc_disable_work,
+                          iwlagn_disable_roc_work);
 
         iwl_setup_scan_deferred_work(priv);
 
@@ -3337,6 +3384,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_work_sync(&priv->bt_full_concurrency);
         cancel_work_sync(&priv->bt_runtime_config);
+        cancel_delayed_work_sync(&priv->hw_roc_disable_work);
 
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
@@ -3489,8 +3537,6 @@ struct ieee80211_ops iwlagn_hw_ops = {
         .tx_last_beacon = iwl_mac_tx_last_beacon,
         .remain_on_channel = iwl_mac_remain_on_channel,
         .cancel_remain_on_channel = iwl_mac_cancel_remain_on_channel,
-        .offchannel_tx = iwl_mac_offchannel_tx,
-        .offchannel_tx_cancel_wait = iwl_mac_offchannel_tx_cancel_wait,
         .rssi_callback = iwl_mac_rssi_callback,
         CFG80211_TESTMODE_CMD(iwl_testmode_cmd)
         CFG80211_TESTMODE_DUMP(iwl_testmode_dump)
@@ -3519,28 +3565,6 @@ static int iwl_set_hw_params(struct iwl_priv *priv)
         return priv->cfg->lib->set_hw_params(priv);
 }
 
-static const u8 iwlagn_bss_ac_to_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-};
-
-static const u8 iwlagn_bss_ac_to_queue[] = {
-        0, 1, 2, 3,
-};
-
-static const u8 iwlagn_pan_ac_to_fifo[] = {
-        IWL_TX_FIFO_VO_IPAN,
-        IWL_TX_FIFO_VI_IPAN,
-        IWL_TX_FIFO_BE_IPAN,
-        IWL_TX_FIFO_BK_IPAN,
-};
-
-static const u8 iwlagn_pan_ac_to_queue[] = {
-        7, 6, 5, 4,
-};
-
 /* This function both allocates and initializes hw and priv. */
 static struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg)
 {
@@ -3563,65 +3587,6 @@ out:
         return hw;
 }
 
-static void iwl_init_context(struct iwl_priv *priv)
-{
-        int i;
-
-        /*
-         * The default context is always valid,
-         * more may be discovered when firmware
-         * is loaded.
-         */
-        priv->valid_contexts = BIT(IWL_RXON_CTX_BSS);
-
-        for (i = 0; i < NUM_IWL_RXON_CTX; i++)
-                priv->contexts[i].ctxid = i;
-
-        priv->contexts[IWL_RXON_CTX_BSS].always_active = true;
-        priv->contexts[IWL_RXON_CTX_BSS].is_active = true;
-        priv->contexts[IWL_RXON_CTX_BSS].rxon_cmd = REPLY_RXON;
-        priv->contexts[IWL_RXON_CTX_BSS].rxon_timing_cmd = REPLY_RXON_TIMING;
-        priv->contexts[IWL_RXON_CTX_BSS].rxon_assoc_cmd = REPLY_RXON_ASSOC;
-        priv->contexts[IWL_RXON_CTX_BSS].qos_cmd = REPLY_QOS_PARAM;
-        priv->contexts[IWL_RXON_CTX_BSS].ap_sta_id = IWL_AP_ID;
-        priv->contexts[IWL_RXON_CTX_BSS].wep_key_cmd = REPLY_WEPKEY;
-        priv->contexts[IWL_RXON_CTX_BSS].ac_to_fifo = iwlagn_bss_ac_to_fifo;
-        priv->contexts[IWL_RXON_CTX_BSS].ac_to_queue = iwlagn_bss_ac_to_queue;
-        priv->contexts[IWL_RXON_CTX_BSS].exclusive_interface_modes =
-                BIT(NL80211_IFTYPE_ADHOC);
-        priv->contexts[IWL_RXON_CTX_BSS].interface_modes =
-                BIT(NL80211_IFTYPE_STATION);
-        priv->contexts[IWL_RXON_CTX_BSS].ap_devtype = RXON_DEV_TYPE_AP;
-        priv->contexts[IWL_RXON_CTX_BSS].ibss_devtype = RXON_DEV_TYPE_IBSS;
-        priv->contexts[IWL_RXON_CTX_BSS].station_devtype = RXON_DEV_TYPE_ESS;
-        priv->contexts[IWL_RXON_CTX_BSS].unused_devtype = RXON_DEV_TYPE_ESS;
-
-        priv->contexts[IWL_RXON_CTX_PAN].rxon_cmd = REPLY_WIPAN_RXON;
-        priv->contexts[IWL_RXON_CTX_PAN].rxon_timing_cmd =
-                REPLY_WIPAN_RXON_TIMING;
-        priv->contexts[IWL_RXON_CTX_PAN].rxon_assoc_cmd =
-                REPLY_WIPAN_RXON_ASSOC;
-        priv->contexts[IWL_RXON_CTX_PAN].qos_cmd = REPLY_WIPAN_QOS_PARAM;
-        priv->contexts[IWL_RXON_CTX_PAN].ap_sta_id = IWL_AP_ID_PAN;
-        priv->contexts[IWL_RXON_CTX_PAN].wep_key_cmd = REPLY_WIPAN_WEPKEY;
-        priv->contexts[IWL_RXON_CTX_PAN].bcast_sta_id = IWLAGN_PAN_BCAST_ID;
-        priv->contexts[IWL_RXON_CTX_PAN].station_flags = STA_FLG_PAN_STATION;
-        priv->contexts[IWL_RXON_CTX_PAN].ac_to_fifo = iwlagn_pan_ac_to_fifo;
-        priv->contexts[IWL_RXON_CTX_PAN].ac_to_queue = iwlagn_pan_ac_to_queue;
-        priv->contexts[IWL_RXON_CTX_PAN].mcast_queue = IWL_IPAN_MCAST_QUEUE;
-        priv->contexts[IWL_RXON_CTX_PAN].interface_modes =
-                BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_AP);
-#ifdef CONFIG_IWL_P2P
-        priv->contexts[IWL_RXON_CTX_PAN].interface_modes |=
-                BIT(NL80211_IFTYPE_P2P_CLIENT) | BIT(NL80211_IFTYPE_P2P_GO);
-#endif
-        priv->contexts[IWL_RXON_CTX_PAN].ap_devtype = RXON_DEV_TYPE_CP;
-        priv->contexts[IWL_RXON_CTX_PAN].station_devtype = RXON_DEV_TYPE_2STA;
-        priv->contexts[IWL_RXON_CTX_PAN].unused_devtype = RXON_DEV_TYPE_P2P;
-
-        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
-}
-
 int iwl_probe(struct iwl_bus *bus, struct iwl_cfg *cfg)
 {
         int err = 0;
@@ -3724,9 +3689,6 @@ int iwl_probe(struct iwl_bus *bus, struct iwl_cfg *cfg)
                 priv->hw->wiphy->n_addresses++;
         }
 
-        /* initialize all valid contexts */
-        iwl_init_context(priv);
-
         /************************
          * 5. Setup HW constants
          ************************/
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index d941c4c98e4..df2960ae92a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -209,6 +209,7 @@ u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx, u8 valid);
 /* scan */
 int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
 void iwlagn_post_scan(struct iwl_priv *priv);
+void iwlagn_disable_roc(struct iwl_priv *priv);
 
 /* station mgmt */
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index e9e9d1d1778..0016c61b300 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -3067,17 +3067,29 @@ struct iwl_missed_beacon_notif {
 /* number of additional entries for enhanced tbl */
 #define ENHANCE_HD_TABLE_ENTRIES  (ENHANCE_HD_TABLE_SIZE - HD_TABLE_SIZE)
 
-#define HD_INA_NON_SQUARE_DET_OFDM_DATA                 cpu_to_le16(0)
-#define HD_INA_NON_SQUARE_DET_CCK_DATA                  cpu_to_le16(0)
-#define HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA            cpu_to_le16(0)
-#define HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA           cpu_to_le16(668)
-#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA       cpu_to_le16(4)
-#define HD_OFDM_NON_SQUARE_DET_SLOPE_DATA               cpu_to_le16(486)
-#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA           cpu_to_le16(37)
-#define HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA            cpu_to_le16(853)
-#define HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA        cpu_to_le16(4)
-#define HD_CCK_NON_SQUARE_DET_SLOPE_DATA                cpu_to_le16(476)
-#define HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA            cpu_to_le16(99)
+#define HD_INA_NON_SQUARE_DET_OFDM_DATA_V1              cpu_to_le16(0)
+#define HD_INA_NON_SQUARE_DET_CCK_DATA_V1               cpu_to_le16(0)
+#define HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA_V1         cpu_to_le16(0)
+#define HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA_V1        cpu_to_le16(668)
+#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V1    cpu_to_le16(4)
+#define HD_OFDM_NON_SQUARE_DET_SLOPE_DATA_V1            cpu_to_le16(486)
+#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA_V1        cpu_to_le16(37)
+#define HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA_V1         cpu_to_le16(853)
+#define HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V1     cpu_to_le16(4)
+#define HD_CCK_NON_SQUARE_DET_SLOPE_DATA_V1             cpu_to_le16(476)
+#define HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA_V1         cpu_to_le16(99)
+
+#define HD_INA_NON_SQUARE_DET_OFDM_DATA_V2              cpu_to_le16(1)
+#define HD_INA_NON_SQUARE_DET_CCK_DATA_V2               cpu_to_le16(1)
+#define HD_CORR_11_INSTEAD_OF_CORR_9_EN_DATA_V2         cpu_to_le16(1)
+#define HD_OFDM_NON_SQUARE_DET_SLOPE_MRC_DATA_V2        cpu_to_le16(600)
+#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V2    cpu_to_le16(40)
+#define HD_OFDM_NON_SQUARE_DET_SLOPE_DATA_V2            cpu_to_le16(486)
+#define HD_OFDM_NON_SQUARE_DET_INTERCEPT_DATA_V2        cpu_to_le16(45)
+#define HD_CCK_NON_SQUARE_DET_SLOPE_MRC_DATA_V2         cpu_to_le16(853)
+#define HD_CCK_NON_SQUARE_DET_INTERCEPT_MRC_DATA_V2     cpu_to_le16(60)
+#define HD_CCK_NON_SQUARE_DET_SLOPE_DATA_V2             cpu_to_le16(476)
+#define HD_CCK_NON_SQUARE_DET_INTERCEPT_DATA_V2         cpu_to_le16(99)
 
 
 /* Control field in struct iwl_sensitivity_cmd */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index cf376f62b2f..e269987cd64 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -40,6 +40,7 @@
 #include "iwl-io.h"
 #include "iwl-power.h"
 #include "iwl-sta.h"
+#include "iwl-agn.h"
 #include "iwl-helpers.h"
 #include "iwl-agn.h"
 #include "iwl-trans.h"
@@ -1273,8 +1274,12 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
                            viftype, vif->addr);
 
+        cancel_delayed_work_sync(&priv->hw_roc_disable_work);
+
         mutex_lock(&priv->mutex);
 
+        iwlagn_disable_roc(priv);
+
         if (!iwl_is_ready_rf(priv)) {
                 IWL_WARN(priv, "Try to add interface when device not ready\n");
                 err = -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 02817a43855..42bcb469d32 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -136,6 +136,7 @@ struct iwl_mod_params {
  * @max_event_log_size: size of event log buffer size for ucode event logging
  * @shadow_reg_enable: HW shadhow register bit
  * @no_idle_support: do not support idle mode
+ * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
  */
 struct iwl_base_params {
         int eeprom_size;
@@ -158,6 +159,7 @@ struct iwl_base_params {
         u32 max_event_log_size;
         const bool shadow_reg_enable;
         const bool no_idle_support;
+        const bool hd_v2;
 };
 /*
  * @advanced_bt_coexist: support advanced bt coexist
@@ -194,6 +196,8 @@ struct iwl_ht_params {
  *      (.ucode) will be added to filename before loading from disk. The
  *      filename is constructed as fw_name_pre<api>.ucode.
  * @ucode_api_max: Highest version of uCode API supported by driver.
+ * @ucode_api_ok: oldest version of the uCode API that is OK to load
+ *      without a warning, for use in transitions
  * @ucode_api_min: Lowest version of uCode API supported by driver.
  * @valid_tx_ant: valid transmit antenna
  * @valid_rx_ant: valid receive antenna
@@ -237,6 +241,7 @@ struct iwl_cfg {
         const char *name;
         const char *fw_name_pre;
         const unsigned int ucode_api_max;
+        const unsigned int ucode_api_ok;
         const unsigned int ucode_api_min;
         u8   valid_tx_ant;
         u8   valid_rx_ant;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6c9790cac8d..dd34c7c502f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -230,12 +230,23 @@ struct iwl_channel_info {
 #define IWL_TX_FIFO_BE_IPAN     4
 #define IWL_TX_FIFO_VI_IPAN     IWL_TX_FIFO_VI
 #define IWL_TX_FIFO_VO_IPAN     5
+/* re-uses the VO FIFO, uCode will properly flush/schedule */
+#define IWL_TX_FIFO_AUX         5
 #define IWL_TX_FIFO_UNUSED      -1
 
-/* Minimum number of queues. MAX_NUM is defined in hw specific files.
- * Set the minimum to accommodate the 4 standard TX queues, 1 command
- * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
-#define IWL_MIN_NUM_QUEUES      10
+/* AUX (TX during scan dwell) queue */
+#define IWL_AUX_QUEUE           10
+
+/*
+ * Minimum number of queues. MAX_NUM is defined in hw specific files.
+ * Set the minimum to accommodate
+ *  - 4 standard TX queues
+ *  - the command queue
+ *  - 4 PAN TX queues
+ *  - the PAN multicast queue, and
+ *  - the AUX (TX during scan dwell) queue.
+ */
+#define IWL_MIN_NUM_QUEUES      11
 
 /*
  * Command queue depends on iPAN support.
@@ -564,11 +575,13 @@ enum iwl_ucode_tlv_type {
  * @IWL_UCODE_TLV_FLAGS_NEWSCAN: new uCode scan behaviour on hidden SSID,
  *      treats good CRC threshold as a boolean
  * @IWL_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
+ * @IWL_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
  */
 enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_PAN         = BIT(0),
         IWL_UCODE_TLV_FLAGS_NEWSCAN     = BIT(1),
         IWL_UCODE_TLV_FLAGS_MFP         = BIT(2),
+        IWL_UCODE_TLV_FLAGS_P2P         = BIT(3),
 };
 
 struct iwl_ucode_tlv {
@@ -1168,7 +1181,7 @@ struct iwl_rxon_context {
 enum iwl_scan_type {
         IWL_SCAN_NORMAL,
         IWL_SCAN_RADIO_RESET,
-        IWL_SCAN_OFFCH_TX,
+        IWL_SCAN_ROC,
 };
 
 enum iwlagn_ucode_type {
@@ -1438,15 +1451,11 @@ struct iwl_priv {
 
         /* remain-on-channel offload support */
         struct ieee80211_channel *hw_roc_channel;
-        struct delayed_work hw_roc_work;
+        struct delayed_work hw_roc_disable_work;
         enum nl80211_channel_type hw_roc_chantype;
         int hw_roc_duration;
         bool hw_roc_setup;
 
-        struct sk_buff *offchan_tx_skb;
-        int offchan_tx_timeout;
-        struct ieee80211_channel *offchan_tx_chan;
-
         /* bt coex */
         u8 bt_enable_flag;
         u8 bt_status;
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index a67ae56d546..1a5252d8ca7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -31,7 +31,6 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#include <linux/wireless.h>
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd6937e9705..28e59319f58 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -103,6 +103,12 @@ static void iwl_complete_scan(struct iwl_priv *priv, bool aborted)
                 ieee80211_scan_completed(priv->hw, aborted);
         }
 
+        if (priv->scan_type == IWL_SCAN_ROC) {
+                ieee80211_remain_on_channel_expired(priv->hw);
+                priv->hw_roc_channel = NULL;
+                schedule_delayed_work(&priv->hw_roc_disable_work, 10 * HZ);
+        }
+
         priv->scan_type = IWL_SCAN_NORMAL;
         priv->scan_vif = NULL;
         priv->scan_request = NULL;
@@ -211,6 +217,9 @@ static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
                        le32_to_cpu(notif->tsf_high),
                        le32_to_cpu(notif->tsf_low),
                        notif->status, notif->beacon_timer);
+
+        if (priv->scan_type == IWL_SCAN_ROC)
+                ieee80211_ready_on_channel(priv->hw);
 }
 
 /* Service SCAN_RESULTS_NOTIFICATION (0x83) */
@@ -370,7 +379,7 @@ int __must_check iwl_scan_initiate(struct iwl_priv *priv,
 
         IWL_DEBUG_SCAN(priv, "Starting %sscan...\n",
                         scan_type == IWL_SCAN_NORMAL ? "" :
-                        scan_type == IWL_SCAN_OFFCH_TX ? "offchan TX " :
+                        scan_type == IWL_SCAN_ROC ? "remain-on-channel " :
                         "internal short ");
 
         set_bit(STATUS_SCANNING, &priv->status);
@@ -565,10 +574,10 @@ static void iwl_bg_scan_completed(struct work_struct *work)
                 goto out_settings;
         }
 
-        if (priv->scan_type == IWL_SCAN_OFFCH_TX && priv->offchan_tx_skb) {
-                ieee80211_tx_status_irqsafe(priv->hw,
-                                            priv->offchan_tx_skb);
-                priv->offchan_tx_skb = NULL;
+        if (priv->scan_type == IWL_SCAN_ROC) {
+                ieee80211_remain_on_channel_expired(priv->hw);
+                priv->hw_roc_channel = NULL;
+                schedule_delayed_work(&priv->hw_roc_disable_work, 10 * HZ);
         }
 
         if (priv->scan_type != IWL_SCAN_NORMAL && !aborted) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.c b/drivers/net/wireless/iwlwifi/iwl-trans.c
index 41f0de91400..3001bfb46e2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.c
@@ -750,6 +750,7 @@ static const struct queue_to_fifo_ac iwlagn_default_queue_to_tx_fifo[] = {
         { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
         { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
         { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
 };
 
 static const struct queue_to_fifo_ac iwlagn_ipan_queue_to_tx_fifo[] = {
@@ -763,6 +764,7 @@ static const struct queue_to_fifo_ac iwlagn_ipan_queue_to_tx_fifo[] = {
         { IWL_TX_FIFO_VO_IPAN, IEEE80211_AC_VO, },
         { IWL_TX_FIFO_BE_IPAN, 2, },
         { IWLAGN_CMD_FIFO_NUM, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_AUX, IWL_AC_UNSET, },
 };
 static void iwl_trans_tx_start(struct iwl_priv *priv)
 {
@@ -848,10 +850,12 @@ static void iwl_trans_tx_start(struct iwl_priv *priv)
         /* reset to 0 to enable all the queue first */
         priv->txq_ctx_active_msk = 0;
 
-        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo) != 10);
-        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo) != 10);
+        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo) !=
+                                                IWLAGN_FIRST_AMPDU_QUEUE);
+        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo) !=
+                                                IWLAGN_FIRST_AMPDU_QUEUE);
 
-        for (i = 0; i < 10; i++) {
+        for (i = 0; i < IWLAGN_FIRST_AMPDU_QUEUE; i++) {
                 int fifo = queue_to_fifo[i].fifo;
                 int ac = queue_to_fifo[i].ac;