48 files changed, 8858 insertions, 7210 deletions

diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 4e378faee650..7c7235385513 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -9,7 +9,10 @@ CFLAGS_iwl-devtrace.o := -I$(src)
 
 # AGN
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
-iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o
+iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
+iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
+iwlagn-objs             += iwl-agn-lib.o
+iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
 iwlagn-$(CONFIG_IWL5000) += iwl-5000.o
@@ -19,5 +22,6 @@ iwlagn-$(CONFIG_IWL5000) += iwl-1000.o
 # 3945
 obj-$(CONFIG_IWL3945)   += iwl3945.o
 iwl3945-objs            := iwl3945-base.o iwl-3945.o iwl-3945-rs.o iwl-3945-led.o
+iwl3945-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-3945-debugfs.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 3bf2e6e9b2d9..6be2992f8f21 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -42,9 +42,11 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 #include "iwl-sta.h"
+#include "iwl-agn.h"
 #include "iwl-helpers.h"
-#include "iwl-5000-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 3
@@ -117,7 +119,7 @@ static struct iwl_sensitivity_ranges iwl1000_sensitivity = {
 static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -125,13 +127,13 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
-        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
         priv->hw_params.max_bsm_size = 0;
         priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
@@ -161,25 +163,25 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 
 static struct iwl_lib_ops iwl1000_lib = {
         .set_hw_params = iwl1000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
                 .init = iwl_apm_init,
@@ -189,40 +191,47 @@ static struct iwl_lib_ops iwl1000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl1000_set_ct_threshold,
          },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl1000_ops = {
-        .ucode = &iwl5000_ucode,
         .lib = &iwl1000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 struct iwl_cfg iwl1000_bgn_cfg = {
-        .name = "1000 Series BGN",
+        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
@@ -230,10 +239,10 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .ops = &iwl1000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -248,10 +257,15 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 128,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl1000_bg_cfg = {
-        .name = "1000 Series BG",
+        .name = "Intel(R) Centrino(R) Wireless-N 1000 BG",
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
@@ -259,10 +273,10 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .ops = &iwl1000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -270,12 +284,16 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 128,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
new file mode 100644
index 000000000000..6a9c64a50e36
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
@@ -0,0 +1,500 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-3945-debugfs.h"
+
+ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
+                                    char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl39_statistics_rx_phy) * 40 +
+                    sizeof(struct iwl39_statistics_rx_non_phy) * 40 + 400;
+        ssize_t ret;
+        struct iwl39_statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
+        struct iwl39_statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
+        struct iwl39_statistics_rx_non_phy *general, *accum_general;
+        struct iwl39_statistics_rx_non_phy *delta_general, *max_general;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        ofdm = &priv->_3945.statistics.rx.ofdm;
+        cck = &priv->_3945.statistics.rx.cck;
+        general = &priv->_3945.statistics.rx.general;
+        accum_ofdm = &priv->_3945.accum_statistics.rx.ofdm;
+        accum_cck = &priv->_3945.accum_statistics.rx.cck;
+        accum_general = &priv->_3945.accum_statistics.rx.general;
+        delta_ofdm = &priv->_3945.delta_statistics.rx.ofdm;
+        delta_cck = &priv->_3945.delta_statistics.rx.cck;
+        delta_general = &priv->_3945.delta_statistics.rx.general;
+        max_ofdm = &priv->_3945.max_delta.rx.ofdm;
+        max_cck = &priv->_3945.max_delta.rx.cck;
+        max_general = &priv->_3945.max_delta.rx.general;
+
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         accum_ofdm->ina_cnt,
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "plcp_err:",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",  "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err, delta_ofdm->overrun_err,
+                         max_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err,
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good, delta_ofdm->crc32_good,
+                         max_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt,
+                         delta_ofdm->false_alarm_cnt,
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt,
+                         delta_ofdm->fina_sync_err_cnt,
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout,
+                         delta_ofdm->sfd_timeout,
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_timeout:",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout,
+                         delta_ofdm->fina_timeout,
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts,
+                         delta_ofdm->unresponded_rts,
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun,
+                         delta_ofdm->rxe_frame_limit_overrun,
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ack_cnt:",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt,
+                         delta_ofdm->sent_ack_cnt,
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_cts_cnt:",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt,
+                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err,
+                         delta_cck->overrun_err, max_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err,
+                         delta_cck->early_overrun_err,
+                         max_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good,
+                         max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "false_alarm_cnt:",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt,
+                         delta_cck->fina_sync_err_cnt,
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout,
+                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_timeout:",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout,
+                         delta_cck->fina_timeout, max_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts,
+                         delta_cck->unresponded_rts,
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun,
+                         delta_cck->rxe_frame_limit_overrun,
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ack_cnt:",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt,
+                         delta_cck->sent_ack_cnt,
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_cts_cnt:",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt,
+                         delta_cck->sent_cts_cnt,
+                         max_cck->sent_cts_cnt);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bogus_cts:",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts,
+                         delta_general->bogus_cts, max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bogus_ack:",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack,
+                         delta_general->bogus_ack, max_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_bssid_frames:",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames,
+                         delta_general->non_bssid_frames,
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "filtered_frames:",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames,
+                         delta_general->filtered_frames,
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_channel_beacons:",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons,
+                         delta_general->non_channel_beacons,
+                         max_general->non_channel_beacons);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl3945_ucode_tx_stats_read(struct file *file,
+                                    char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct iwl39_statistics_tx) * 48) + 250;
+        ssize_t ret;
+        struct iwl39_statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        tx = &priv->_3945.statistics.tx;
+        accum_tx = &priv->_3945.accum_statistics.tx;
+        delta_tx = &priv->_3945.delta_statistics.tx;
+        max_tx = &priv->_3945.max_delta.tx;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "preamble:",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_detected_cnt:",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_defer_cnt:",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt,
+                         delta_tx->bt_prio_defer_cnt,
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_kill_cnt:",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt,
+                         delta_tx->bt_prio_kill_cnt,
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "few_bytes_cnt:",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout:",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_timeout:",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "expected_ack_cnt:",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt,
+                         delta_tx->expected_ack_cnt,
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "actual_ack_cnt:",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt,
+                         delta_tx->actual_ack_cnt,
+                         max_tx->actual_ack_cnt);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl39_statistics_general) * 10 + 300;
+        ssize_t ret;
+        struct iwl39_statistics_general *general, *accum_general;
+        struct iwl39_statistics_general *delta_general, *max_general;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct iwl39_statistics_div *div, *accum_div, *delta_div, *max_div;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        general = &priv->_3945.statistics.general;
+        dbg = &priv->_3945.statistics.general.dbg;
+        div = &priv->_3945.statistics.general.div;
+        accum_general = &priv->_3945.accum_statistics.general;
+        delta_general = &priv->_3945.delta_statistics.general;
+        max_general = &priv->_3945.max_delta.general;
+        accum_dbg = &priv->_3945.accum_statistics.general.dbg;
+        delta_dbg = &priv->_3945.delta_statistics.general.dbg;
+        max_dbg = &priv->_3945.max_delta.general.dbg;
+        accum_div = &priv->_3945.accum_statistics.general.div;
+        delta_div = &priv->_3945.delta_statistics.general.div;
+        max_div = &priv->_3945.max_delta.general.div;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_check:",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check,
+                         delta_dbg->burst_check, max_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_count:",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count,
+                         delta_dbg->burst_count, max_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sleep_time:",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time,
+                         delta_general->sleep_time, max_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_out:",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out,
+                         delta_general->slots_out, max_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_idle:",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_a:",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
+                         delta_div->tx_on_a, max_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_b:",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
+                         delta_div->tx_on_b, max_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "exec_time:",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h
new file mode 100644
index 000000000000..70809c53c215
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-debug.h"
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+ssize_t iwl3945_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos);
+ssize_t iwl3945_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos);
+ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                         char __user *user_buf, size_t count,
+                                         loff_t *ppos);
+#else
+static ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
+                                           char __user *user_buf, size_t count,
+                                           loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl3945_ucode_tx_stats_read(struct file *file,
+                                           char __user *user_buf, size_t count,
+                                           loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 3a876a8ece38..91bcb4e3cdfb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -71,13 +71,11 @@
 
 #include "iwl-eeprom.h"
 
-/* Time constants */
-#define SHORT_SLOT_TIME 9
-#define LONG_SLOT_TIME 20
-
 /* RSSI to dBm */
 #define IWL39_RSSI_OFFSET       95
 
+#define IWL_DEFAULT_TX_POWER    0x0F
+
 /*
  * EEPROM related constants, enums, and structures.
  */
@@ -228,7 +226,6 @@ struct iwl3945_eeprom {
 
 /* 4 DATA + 1 CMD. There are 2 HCCA queues that are not used. */
 #define IWL39_NUM_QUEUES        5
-#define IWL_NUM_SCAN_RATES         (2)
 
 #define IWL_DEFAULT_TX_RETRY  15
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 902c4d4293e9..8e84a08ff951 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -330,16 +330,25 @@ static void iwl3945_collect_tx_data(struct iwl3945_rs_sta *rs_sta,
 
 }
 
-static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
-                         struct ieee80211_sta *sta, void *priv_sta)
+/*
+ * Called after adding a new station to initialize rate scaling
+ */
+void iwl3945_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_id)
 {
-        struct iwl3945_rs_sta *rs_sta = priv_sta;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
+        struct ieee80211_hw *hw = priv->hw;
+        struct ieee80211_conf *conf = &priv->hw->conf;
+        struct iwl3945_sta_priv *psta;
+        struct iwl3945_rs_sta *rs_sta;
+        struct ieee80211_supported_band *sband;
         int i;
 
-        IWL_DEBUG_RATE(priv, "enter\n");
+        IWL_DEBUG_INFO(priv, "enter\n");
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                goto out;
 
-        spin_lock_init(&rs_sta->lock);
+        psta = (struct iwl3945_sta_priv *) sta->drv_priv;
+        rs_sta = &psta->rs_sta;
+        sband = hw->wiphy->bands[conf->channel->band];
 
         rs_sta->priv = priv;
 
@@ -352,9 +361,7 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
         rs_sta->last_flush = jiffies;
         rs_sta->flush_time = IWL_RATE_FLUSH;
         rs_sta->last_tx_packets = 0;
-        rs_sta->ibss_sta_added = 0;
 
-        init_timer(&rs_sta->rate_scale_flush);
         rs_sta->rate_scale_flush.data = (unsigned long)rs_sta;
         rs_sta->rate_scale_flush.function = iwl3945_bg_rate_scale_flush;
 
@@ -373,16 +380,18 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
                 }
         }
 
-        priv->sta_supp_rates = sta->supp_rates[sband->band];
+        priv->_3945.sta_supp_rates = sta->supp_rates[sband->band];
         /* For 5 GHz band it start at IWL_FIRST_OFDM_RATE */
         if (sband->band == IEEE80211_BAND_5GHZ) {
                 rs_sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
-                priv->sta_supp_rates = priv->sta_supp_rates <<
+                priv->_3945.sta_supp_rates = priv->_3945.sta_supp_rates <<
                                                 IWL_FIRST_OFDM_RATE;
         }
 
+out:
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
 
-        IWL_DEBUG_RATE(priv, "leave\n");
+        IWL_DEBUG_INFO(priv, "leave\n");
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
@@ -406,6 +415,9 @@ static void *rs_alloc_sta(void *iwl_priv, struct ieee80211_sta *sta, gfp_t gfp)
 
         rs_sta = &psta->rs_sta;
 
+        spin_lock_init(&rs_sta->lock);
+        init_timer(&rs_sta->rate_scale_flush);
+
         IWL_DEBUG_RATE(priv, "leave\n");
 
         return rs_sta;
@@ -414,13 +426,14 @@ static void *rs_alloc_sta(void *iwl_priv, struct ieee80211_sta *sta, gfp_t gfp)
 static void rs_free_sta(void *iwl_priv, struct ieee80211_sta *sta,
                         void *priv_sta)
 {
-        struct iwl3945_sta_priv *psta = (void *) sta->drv_priv;
-        struct iwl3945_rs_sta *rs_sta = &psta->rs_sta;
-        struct iwl_priv *priv __maybe_unused = rs_sta->priv;
+        struct iwl3945_rs_sta *rs_sta = priv_sta;
 
-        IWL_DEBUG_RATE(priv, "enter\n");
+        /*
+         * Be careful not to use any members of iwl3945_rs_sta (like trying
+         * to use iwl_priv to print out debugging) since it may not be fully
+         * initialized at this point.
+         */
         del_timer_sync(&rs_sta->rate_scale_flush);
-        IWL_DEBUG_RATE(priv, "leave\n");
 }
 
 
@@ -459,6 +472,13 @@ static void rs_tx_status(void *priv_rate, struct ieee80211_supported_band *sband
                 return;
         }
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (!rs_sta->priv) {
+                IWL_DEBUG_RATE(priv, "leave: STA priv data uninitialized!\n");
+                return;
+        }
+
+
         rs_sta->tx_packets++;
 
         scale_rate_index = first_index;
@@ -525,8 +545,6 @@ static void rs_tx_status(void *priv_rate, struct ieee80211_supported_band *sband
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
         IWL_DEBUG_RATE(priv, "leave\n");
-
-        return;
 }
 
 static u16 iwl3945_get_adjacent_rate(struct iwl3945_rs_sta *rs_sta,
@@ -626,14 +644,19 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         u32 fail_count;
         s8 scale_action = 0;
         unsigned long flags;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         u16 rate_mask = sta ? sta->supp_rates[sband->band] : 0;
         s8 max_rate_idx = -1;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
+        struct iwl_priv *priv __maybe_unused = (struct iwl_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         IWL_DEBUG_RATE(priv, "enter\n");
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (rs_sta && !rs_sta->priv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling information not initialized yet.\n");
+                priv_sta = NULL;
+        }
+
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
 
@@ -651,20 +674,6 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         if (sband->band == IEEE80211_BAND_5GHZ)
                 rate_mask = rate_mask << IWL_FIRST_OFDM_RATE;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !rs_sta->ibss_sta_added) {
-                u8 sta_id = iwl_find_station(priv, hdr->addr1);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
-                                       hdr->addr1);
-                        sta_id = iwl_add_station(priv, hdr->addr1, false,
-                                CMD_ASYNC, NULL);
-                }
-                if (sta_id != IWL_INVALID_STATION)
-                        rs_sta->ibss_sta_added = 1;
-        }
-
         spin_lock_irqsave(&rs_sta->lock, flags);
 
         /* for recent assoc, choose best rate regarding
@@ -884,12 +893,22 @@ static void iwl3945_remove_debugfs(void *priv, void *priv_sta)
 }
 #endif
 
+/*
+ * Initialization of rate scaling information is done by driver after
+ * the station is added. Since mac80211 calls this function before a
+ * station is added we ignore it.
+ */
+static void rs_rate_init_stub(void *priv_r, struct ieee80211_supported_band *sband,
+                              struct ieee80211_sta *sta, void *priv_sta)
+{
+}
+
 static struct rate_control_ops rs_ops = {
         .module = NULL,
         .name = RS_NAME,
         .tx_status = rs_tx_status,
         .get_rate = rs_get_rate,
-        .rate_init = rs_rate_init,
+        .rate_init = rs_rate_init_stub,
         .alloc = rs_alloc,
         .free = rs_free,
         .alloc_sta = rs_alloc_sta,
@@ -900,7 +919,6 @@ static struct rate_control_ops rs_ops = {
 #endif
 
 };
-
 void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 {
         struct iwl_priv *priv = hw->priv;
@@ -917,6 +935,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
         sta = ieee80211_find_sta(priv->vif,
                                  priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
+                IWL_DEBUG_RATE(priv, "Unable to find station to initialize rate scaling.\n");
                 rcu_read_unlock();
                 return;
         }
@@ -947,7 +966,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
-        rssi = priv->last_rx_rssi;
+        rssi = priv->_3945.last_rx_rssi;
         if (rssi == 0)
                 rssi = IWL_MIN_RSSI_VAL;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 0728054a22d4..068f7f8435c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -50,6 +50,7 @@
 #include "iwl-helpers.h"
 #include "iwl-led.h"
 #include "iwl-3945-led.h"
+#include "iwl-3945-debugfs.h"
 
 #define IWL_DECLARE_RATE_INFO(r, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,   \
@@ -192,12 +193,12 @@ static int iwl3945_hwrate_to_plcp_idx(u8 plcp)
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-#define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
+#define TX_STATUS_ENTRY(x) case TX_3945_STATUS_FAIL_ ## x: return #x
 
 static const char *iwl3945_get_tx_fail_reason(u32 status)
 {
         switch (status & TX_STATUS_MSK) {
-        case TX_STATUS_SUCCESS:
+        case TX_3945_STATUS_SUCCESS:
                 return "SUCCESS";
                 TX_STATUS_ENTRY(SHORT_LIMIT);
                 TX_STATUS_ENTRY(LONG_LIMIT);
@@ -243,7 +244,7 @@ int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate)
                         next_rate = IWL_RATE_6M_INDEX;
                 break;
         case IEEE80211_BAND_2GHZ:
-                if (!(priv->sta_supp_rates & IWL_OFDM_RATES_MASK) &&
+                if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
                     iwl_is_associated(priv)) {
                         if (rate == IWL_RATE_11M_INDEX)
                                 next_rate = IWL_RATE_5M_INDEX;
@@ -293,7 +294,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
  * iwl3945_rx_reply_tx - Handle Tx response
  */
 static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
-                            struct iwl_rx_mem_buffer *rxb)
+                                struct iwl_rx_mem_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
@@ -351,18 +352,143 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
  *  RX handler implementations
  *
  *****************************************************************************/
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl3945_accumulative_statistics(struct iwl_priv *priv,
+                                            __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+        u32 *delta, *max_delta;
+
+        prev_stats = (__le32 *)&priv->_3945.statistics;
+        accum_stats = (u32 *)&priv->_3945.accum_statistics;
+        delta = (u32 *)&priv->_3945.delta_statistics;
+        max_delta = (u32 *)&priv->_3945.max_delta;
+
+        for (i = sizeof(__le32); i < sizeof(struct iwl3945_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, delta++,
+             max_delta++, accum_stats++) {
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
+                        *delta = (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+                        *accum_stats += *delta;
+                        if (*delta > *max_delta)
+                                *max_delta = *delta;
+                }
+        }
+
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->_3945.accum_statistics.general.temperature =
+                priv->_3945.statistics.general.temperature;
+        priv->_3945.accum_statistics.general.ttl_timestamp =
+                priv->_3945.statistics.general.ttl_timestamp;
+}
+#endif
+
+/**
+ * iwl3945_good_plcp_health - checks for plcp error.
+ *
+ * When the plcp error is exceeding the thresholds, reset the radio
+ * to improve the throughput.
+ */
+static bool iwl3945_good_plcp_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        bool rc = true;
+        struct iwl3945_notif_statistics current_stat;
+        int combined_plcp_delta;
+        unsigned int plcp_msec;
+        unsigned long plcp_received_jiffies;
+
+        memcpy(&current_stat, pkt->u.raw, sizeof(struct
+                        iwl3945_notif_statistics));
+        /*
+         * check for plcp_err and trigger radio reset if it exceeds
+         * the plcp error threshold plcp_delta.
+         */
+        plcp_received_jiffies = jiffies;
+        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
+                                        (long) priv->plcp_jiffies);
+        priv->plcp_jiffies = plcp_received_jiffies;
+        /*
+         * check to make sure plcp_msec is not 0 to prevent division
+         * by zero.
+         */
+        if (plcp_msec) {
+                combined_plcp_delta =
+                        (le32_to_cpu(current_stat.rx.ofdm.plcp_err) -
+                        le32_to_cpu(priv->_3945.statistics.rx.ofdm.plcp_err));
+
+                if ((combined_plcp_delta > 0) &&
+                        ((combined_plcp_delta * 100) / plcp_msec) >
+                        priv->cfg->plcp_delta_threshold) {
+                        /*
+                         * if plcp_err exceed the threshold, the following
+                         * data is printed in csv format:
+                         *    Text: plcp_err exceeded %d,
+                         *    Received ofdm.plcp_err,
+                         *    Current ofdm.plcp_err,
+                         *    combined_plcp_delta,
+                         *    plcp_msec
+                         */
+                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
+                                "%u, %d, %u mSecs\n",
+                                priv->cfg->plcp_delta_threshold,
+                                le32_to_cpu(current_stat.rx.ofdm.plcp_err),
+                                combined_plcp_delta, plcp_msec);
+                        /*
+                         * Reset the RF radio due to the high plcp
+                         * error rate
+                         */
+                        rc = false;
+                }
+        }
+        return rc;
+}
 
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                 struct iwl_rx_mem_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl3945_accumulative_statistics(priv, (__le32 *)&pkt->u.raw);
+#endif
+        iwl_recover_from_statistics(priv, pkt);
+
+        memcpy(&priv->_3945.statistics, pkt->u.raw, sizeof(priv->_3945.statistics));
+}
+
+void iwl3945_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        __le32 *flag = (__le32 *)&pkt->u.raw;
 
-        memcpy(&priv->statistics_39, pkt->u.raw, sizeof(priv->statistics_39));
+        if (le32_to_cpu(*flag) & UCODE_STATISTICS_CLEAR_MSK) {
+#ifdef CONFIG_IWLWIFI_DEBUG
+                memset(&priv->_3945.accum_statistics, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+                memset(&priv->_3945.delta_statistics, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+                memset(&priv->_3945.max_delta, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+#endif
+                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
+        }
+        iwl3945_hw_rx_statistics(priv, rxb);
 }
 
+
 /******************************************************************************
  *
  * Misc. internal state and helper functions
@@ -487,7 +613,7 @@ static void _iwl3945_dbg_report_frame(struct iwl_priv *priv,
                  *    but you can hack it to show more, if you'd like to. */
                 if (dataframe)
                         IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%d, \n",
+                                     "len=%u, rssi=%d, chnl=%d, rate=%d,\n",
                                      title, le16_to_cpu(fc), header->addr1[5],
                                      length, rssi, channel, rate);
                 else {
@@ -549,7 +675,6 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
         u16 len = le16_to_cpu(rx_hdr->len);
         struct sk_buff *skb;
-        int ret;
         __le16 fc = hdr->frame_control;
 
         /* We received data from the HW, so stop the watchdog */
@@ -566,9 +691,9 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                 return;
         }
 
-        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
+        skb = dev_alloc_skb(128);
         if (!skb) {
-                IWL_ERR(priv, "alloc_skb failed\n");
+                IWL_ERR(priv, "dev_alloc_skb failed\n");
                 return;
         }
 
@@ -577,37 +702,13 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                        (struct ieee80211_hdr *)rxb_addr(rxb),
                                        le32_to_cpu(rx_end->status), stats);
 
-        skb_reserve(skb, IWL_LINK_HDR_MAX);
         skb_add_rx_frag(skb, 0, rxb->page,
                         (void *)rx_hdr->payload - (void *)pkt, len);
 
-        /* mac80211 currently doesn't support paged SKB. Convert it to
-         * linear SKB for management frame and data frame requires
-         * software decryption or software defragementation. */
-        if (ieee80211_is_mgmt(fc) ||
-            ieee80211_has_protected(fc) ||
-            ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
-                ret = skb_linearize(skb);
-        else
-                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
-                        0 : -ENOMEM;
-
-        if (ret) {
-                kfree_skb(skb);
-                goto out;
-        }
-
-        /*
-         * XXX: We cannot touch the page and its virtual memory (pkt) after
-         * here. It might have already been freed by the above skb change.
-         */
-
         iwl_update_stats(priv, false, fc, len);
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
         ieee80211_rx(priv->hw, skb);
- out:
         priv->alloc_rxb_page--;
         rxb->page = NULL;
 }
@@ -623,9 +724,8 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
         struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        int snr;
-        u16 rx_stats_sig_avg = le16_to_cpu(rx_stats->sig_avg);
-        u16 rx_stats_noise_diff = le16_to_cpu(rx_stats->noise_diff);
+        u16 rx_stats_sig_avg __maybe_unused = le16_to_cpu(rx_stats->sig_avg);
+        u16 rx_stats_noise_diff __maybe_unused = le16_to_cpu(rx_stats->noise_diff);
         u8 network_packet;
 
         rx_status.flag = 0;
@@ -663,53 +763,29 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
         /* Convert 3945's rssi indicator to dBm */
         rx_status.signal = rx_stats->rssi - IWL39_RSSI_OFFSET;
 
-        /* Set default noise value to -127 */
-        if (priv->last_rx_noise == 0)
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-
-        /* 3945 provides noise info for OFDM frames only.
-         * sig_avg and noise_diff are measured by the 3945's digital signal
-         *   processor (DSP), and indicate linear levels of signal level and
-         *   distortion/noise within the packet preamble after
-         *   automatic gain control (AGC).  sig_avg should stay fairly
-         *   constant if the radio's AGC is working well.
-         * Since these values are linear (not dB or dBm), linear
-         *   signal-to-noise ratio (SNR) is (sig_avg / noise_diff).
-         * Convert linear SNR to dB SNR, then subtract that from rssi dBm
-         *   to obtain noise level in dBm.
-         * Calculate rx_status.signal (quality indicator in %) based on SNR. */
-        if (rx_stats_noise_diff) {
-                snr = rx_stats_sig_avg / rx_stats_noise_diff;
-                rx_status.noise = rx_status.signal -
-                                        iwl3945_calc_db_from_ratio(snr);
-        } else {
-                rx_status.noise = priv->last_rx_noise;
-        }
-
-
-        IWL_DEBUG_STATS(priv, "Rssi %d noise %d sig_avg %d noise_diff %d\n",
-                        rx_status.signal, rx_status.noise,
-                        rx_stats_sig_avg, rx_stats_noise_diff);
+        IWL_DEBUG_STATS(priv, "Rssi %d sig_avg %d noise_diff %d\n",
+                        rx_status.signal, rx_stats_sig_avg,
+                        rx_stats_noise_diff);
 
         header = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
 
         network_packet = iwl3945_is_network_packet(priv, header);
 
-        IWL_DEBUG_STATS_LIMIT(priv, "[%c] %d RSSI:%d Signal:%u, Noise:%u, Rate:%u\n",
+        IWL_DEBUG_STATS_LIMIT(priv, "[%c] %d RSSI:%d Signal:%u, Rate:%u\n",
                               network_packet ? '*' : ' ',
                               le16_to_cpu(rx_hdr->channel),
                               rx_status.signal, rx_status.signal,
-                              rx_status.noise, rx_status.rate_idx);
+                              rx_status.rate_idx);
 
         /* Set "1" to report good data frames in groups of 100 */
         iwl3945_dbg_report_frame(priv, pkt, header, 1);
         iwl_dbg_log_rx_data_frame(priv, le16_to_cpu(rx_hdr->len), header);
 
         if (network_packet) {
-                priv->last_beacon_time = le32_to_cpu(rx_end->beacon_timestamp);
-                priv->last_tsf = le64_to_cpu(rx_end->timestamp);
-                priv->last_rx_rssi = rx_status.signal;
-                priv->last_rx_noise = rx_status.noise;
+                priv->_3945.last_beacon_time =
+                        le32_to_cpu(rx_end->beacon_timestamp);
+                priv->_3945.last_tsf = le64_to_cpu(rx_end->timestamp);
+                priv->_3945.last_rx_rssi = rx_status.signal;
         }
 
         iwl3945_pass_packet_to_mac80211(priv, rxb, &rx_status);
@@ -871,7 +947,8 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                        tx_cmd->supp_rates[1], tx_cmd->supp_rates[0]);
 }
 
-u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
+static u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id,
+                           u16 tx_rate, u8 flags)
 {
         unsigned long flags_spin;
         struct iwl_station_entry *station;
@@ -957,7 +1034,7 @@ static int iwl3945_tx_reset(struct iwl_priv *priv)
         iwl_write_prph(priv, ALM_SCD_TXF5MF_REG, 0x000005);
 
         iwl_write_direct32(priv, FH39_TSSR_CBB_BASE,
-                             priv->shared_phys);
+                             priv->_3945.shared_phys);
 
         iwl_write_direct32(priv, FH39_TSSR_MSG_CONFIG,
                 FH39_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TXPD_ON |
@@ -1049,7 +1126,7 @@ static void iwl3945_nic_config(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
 
         if (rev_id & PCI_CFG_REV_ID_BIT_RTP)
-                IWL_DEBUG_INFO(priv, "RTP type \n");
+                IWL_DEBUG_INFO(priv, "RTP type\n");
         else if (rev_id & PCI_CFG_REV_ID_BIT_BASIC_SKU) {
                 IWL_DEBUG_INFO(priv, "3945 RADIO-MB type\n");
                 iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
@@ -1607,7 +1684,7 @@ static int iwl3945_hw_reg_set_new_power(struct iwl_priv *priv,
         int power;
 
         /* Get this chnlgrp's rate-to-max/clip-powers table */
-        clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+        clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
         /* Get this channel's rate-to-current-power settings table */
         power_info = ch_info->power_info;
@@ -1701,6 +1778,11 @@ static int iwl3945_hw_reg_comp_txpower_temp(struct iwl_priv *priv)
         int ref_temp;
         int temperature = priv->temperature;
 
+        if (priv->disable_tx_power_cal ||
+            test_bit(STATUS_SCANNING, &priv->status)) {
+                /* do not perform tx power calibration */
+                return 0;
+        }
         /* set up new Tx power info for each and every channel, 2.4 and 5.x */
         for (i = 0; i < priv->channel_count; i++) {
                 ch_info = &priv->channel_info[i];
@@ -1733,7 +1815,7 @@ static int iwl3945_hw_reg_comp_txpower_temp(struct iwl_priv *priv)
                 }
 
                 /* Get this chnlgrp's rate-to-max/clip-powers table */
-                clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+                clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
                 /* set scan tx power, 1Mbit for CCK, 6Mbit for OFDM */
                 for (scan_tbl_index = 0;
@@ -1911,6 +1993,8 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                                   "configuration (%d).\n", rc);
                         return rc;
                 }
+                iwl_clear_ucode_stations(priv);
+                iwl_restore_stations(priv);
         }
 
         IWL_DEBUG_INFO(priv, "Sending RXON\n"
@@ -1941,7 +2025,10 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
 
         memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
 
-        iwl_clear_stations_table(priv);
+        if (!new_assoc) {
+                iwl_clear_ucode_stations(priv);
+                iwl_restore_stations(priv);
+        }
 
         /* If we issue a new RXON command which required a tune then we must
          * send a new TXPOWER command or we won't be able to Tx any frames */
@@ -1951,19 +2038,6 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                 return rc;
         }
 
-        /* Add the broadcast address so we can send broadcast frames */
-        priv->cfg->ops->lib->add_bcast_station(priv);
-
-        /* If we have set the ASSOC_MSK and we are in BSS mode then
-         * add the IWL_AP_ID to the station rate table */
-        if (iwl_is_associated(priv) &&
-            (priv->iw_mode == NL80211_IFTYPE_STATION))
-                if (iwl_add_station(priv, priv->active_rxon.bssid_addr,
-                                true, CMD_SYNC, NULL) == IWL_INVALID_STATION) {
-                        IWL_ERR(priv, "Error adding AP address for transmit\n");
-                        return -EIO;
-                }
-
         /* Init the hardware's rate fallback order based on the band */
         rc = iwl3945_init_hw_rate_table(priv);
         if (rc) {
@@ -1998,13 +2072,13 @@ void iwl3945_reg_txpower_periodic(struct iwl_priv *priv)
 
  reschedule:
         queue_delayed_work(priv->workqueue,
-                           &priv->thermal_periodic, REG_RECALIB_PERIOD * HZ);
+                           &priv->_3945.thermal_periodic, REG_RECALIB_PERIOD * HZ);
 }
 
 static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
-                                             thermal_periodic.work);
+                                             _3945.thermal_periodic.work);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -2140,7 +2214,7 @@ static void iwl3945_hw_reg_init_channel_groups(struct iwl_priv *priv)
                  *   power peaks, without too much distortion (clipping).
                  */
                 /* we'll fill in this array with h/w max power levels */
-                clip_pwrs = (s8 *) priv->clip39_groups[i].clip_powers;
+                clip_pwrs = (s8 *) priv->_3945.clip_groups[i].clip_powers;
 
                 /* divide factory saturation power by 2 to find -3dB level */
                 satur_pwr = (s8) (group->saturation_power >> 1);
@@ -2224,7 +2298,7 @@ int iwl3945_txpower_set_from_eeprom(struct iwl_priv *priv)
                         iwl3945_hw_reg_get_ch_grp_index(priv, ch_info);
 
                 /* Get this chnlgrp's rate->max/clip-powers table */
-                clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+                clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
                 /* calculate power index *adjustment* value according to
                  *  diff between current temperature and factory temperature */
@@ -2332,7 +2406,7 @@ int iwl3945_hw_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 {
         int txq_id = txq->q.id;
 
-        struct iwl3945_shared *shared_data = priv->shared_virt;
+        struct iwl3945_shared *shared_data = priv->_3945.shared_virt;
 
         shared_data->tx_base_ptr[txq_id] = cpu_to_le32((u32)txq->q.dma_addr);
 
@@ -2385,6 +2459,30 @@ static u16 iwl3945_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
         return (u16)sizeof(struct iwl3945_addsta_cmd);
 }
 
+static int iwl3945_manage_ibss_station(struct iwl_priv *priv,
+                                       struct ieee80211_vif *vif, bool add)
+{
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+        int ret;
+
+        if (add) {
+                ret = iwl_add_bssid_station(priv, vif->bss_conf.bssid, false,
+                                            &vif_priv->ibss_bssid_sta_id);
+                if (ret)
+                        return ret;
+
+                iwl3945_sync_sta(priv, vif_priv->ibss_bssid_sta_id,
+                                 (priv->band == IEEE80211_BAND_5GHZ) ?
+                                 IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
+                                 CMD_ASYNC);
+                iwl3945_rate_scale_init(priv->hw, vif_priv->ibss_bssid_sta_id);
+
+                return 0;
+        }
+
+        return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
+                                  vif->bss_conf.bssid);
+}
 
 /**
  * iwl3945_init_hw_rate_table - Initialize the hardware rate fallback table
@@ -2432,7 +2530,7 @@ int iwl3945_init_hw_rate_table(struct iwl_priv *priv)
                 /* If an OFDM rate is used, have it fall back to the
                  * 1M CCK rates */
 
-                if (!(priv->sta_supp_rates & IWL_OFDM_RATES_MASK) &&
+                if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
                     iwl_is_associated(priv)) {
 
                         index = IWL_FIRST_CCK_RATE;
@@ -2471,12 +2569,12 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         memset((void *)&priv->hw_params, 0,
                sizeof(struct iwl_hw_params));
 
-        priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
-                                               sizeof(struct iwl3945_shared),
-                                               &priv->shared_phys, GFP_KERNEL);
-        if (!priv->shared_virt) {
+        priv->_3945.shared_virt =
+                dma_alloc_coherent(&priv->pci_dev->dev,
+                                   sizeof(struct iwl3945_shared),
+                                   &priv->_3945.shared_phys, GFP_KERNEL);
+        if (!priv->_3945.shared_virt) {
                 IWL_ERR(priv, "failed to allocate pci memory\n");
-                mutex_unlock(&priv->mutex);
                 return -ENOMEM;
         }
 
@@ -2537,13 +2635,13 @@ void iwl3945_hw_rx_handler_setup(struct iwl_priv *priv)
 
 void iwl3945_hw_setup_deferred_work(struct iwl_priv *priv)
 {
-        INIT_DELAYED_WORK(&priv->thermal_periodic,
+        INIT_DELAYED_WORK(&priv->_3945.thermal_periodic,
                           iwl3945_bg_reg_txpower_periodic);
 }
 
 void iwl3945_hw_cancel_deferred_work(struct iwl_priv *priv)
 {
-        cancel_delayed_work(&priv->thermal_periodic);
+        cancel_delayed_work(&priv->_3945.thermal_periodic);
 }
 
 /* check contents of special bootstrap uCode SRAM */
@@ -2714,48 +2812,10 @@ static int iwl3945_load_bsm(struct iwl_priv *priv)
         return 0;
 }
 
-#define IWL3945_UCODE_GET(item)                                         \
-static u32 iwl3945_ucode_get_##item(const struct iwl_ucode_header *ucode,\
-                                    u32 api_ver)                        \
-{                                                                       \
-        return le32_to_cpu(ucode->u.v1.item);                           \
-}
-
-static u32 iwl3945_ucode_get_header_size(u32 api_ver)
-{
-        return UCODE_HEADER_SIZE(1);
-}
-static u32 iwl3945_ucode_get_build(const struct iwl_ucode_header *ucode,
-                                   u32 api_ver)
-{
-        return 0;
-}
-static u8 *iwl3945_ucode_get_data(const struct iwl_ucode_header *ucode,
-                                  u32 api_ver)
-{
-        return (u8 *) ucode->u.v1.data;
-}
-
-IWL3945_UCODE_GET(inst_size);
-IWL3945_UCODE_GET(data_size);
-IWL3945_UCODE_GET(init_size);
-IWL3945_UCODE_GET(init_data_size);
-IWL3945_UCODE_GET(boot_size);
-
 static struct iwl_hcmd_ops iwl3945_hcmd = {
         .rxon_assoc = iwl3945_send_rxon_assoc,
         .commit_rxon = iwl3945_commit_rxon,
-};
-
-static struct iwl_ucode_ops iwl3945_ucode = {
-        .get_header_size = iwl3945_ucode_get_header_size,
-        .get_build = iwl3945_ucode_get_build,
-        .get_inst_size = iwl3945_ucode_get_inst_size,
-        .get_data_size = iwl3945_ucode_get_data_size,
-        .get_init_size = iwl3945_ucode_get_init_size,
-        .get_init_data_size = iwl3945_ucode_get_init_data_size,
-        .get_boot_size = iwl3945_ucode_get_boot_size,
-        .get_data = iwl3945_ucode_get_data,
+        .send_bt_config = iwl_send_bt_config,
 };
 
 static struct iwl_lib_ops iwl3945_lib = {
@@ -2791,17 +2851,24 @@ static struct iwl_lib_ops iwl3945_lib = {
         .post_associate = iwl3945_post_associate,
         .isr = iwl_isr_legacy,
         .config_ap = iwl3945_config_ap,
-        .add_bcast_station = iwl3945_add_bcast_station,
+        .manage_ibss_station = iwl3945_manage_ibss_station,
+        .check_plcp_health = iwl3945_good_plcp_health,
+
+        .debugfs_ops = {
+                .rx_stats_read = iwl3945_ucode_rx_stats_read,
+                .tx_stats_read = iwl3945_ucode_tx_stats_read,
+                .general_stats_read = iwl3945_ucode_general_stats_read,
+        },
 };
 
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
         .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
+        .request_scan = iwl3945_request_scan,
 };
 
 static const struct iwl_ops iwl3945_ops = {
-        .ucode = &iwl3945_ucode,
         .lib = &iwl3945_lib,
         .hcmd = &iwl3945_hcmd,
         .utils = &iwl3945_hcmd_utils,
@@ -2826,7 +2893,10 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .ht_greenfield_support = false,
         .led_compensation = 64,
         .broken_powersave = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .tx_power_by_driver = true,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2844,7 +2914,10 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .ht_greenfield_support = false,
         .led_compensation = 64,
         .broken_powersave = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .tx_power_by_driver = true,
 };
 
 DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 452dfd5456c6..bb2aeebf3652 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -95,7 +95,6 @@ struct iwl3945_rs_sta {
         u8 tgg;
         u8 flush_pending;
         u8 start_rate;
-        u8 ibss_sta_added;
         struct timer_list rate_scale_flush;
         struct iwl3945_rate_scale_data win[IWL_RATE_COUNT_3945];
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -107,7 +106,12 @@ struct iwl3945_rs_sta {
 };
 
 
+/*
+ * The common struct MUST be first because it is shared between
+ * 3945 and agn!
+ */
 struct iwl3945_sta_priv {
+        struct iwl_station_priv_common common;
         struct iwl3945_rs_sta rs_sta;
 };
 
@@ -212,13 +216,6 @@ extern int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                                        char **buf, bool display);
 extern void iwl3945_dump_nic_error_log(struct iwl_priv *priv);
 
-/*
- * Currently used by iwl-3945-rs... look at restructuring so that it doesn't
- * call this... todo... fix that.
-*/
-extern u8 iwl3945_sync_station(struct iwl_priv *priv, int sta_id,
-                           u16 tx_rate, u8 flags);
-
 /******************************************************************************
  *
  * Functions implemented in iwl-[34]*.c which are forward declared here
@@ -265,10 +262,14 @@ extern int iwl3945_hw_reg_send_txpower(struct iwl_priv *priv);
 extern int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power);
 extern void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                                  struct iwl_rx_mem_buffer *rxb);
+void iwl3945_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb);
 extern void iwl3945_disable_events(struct iwl_priv *priv);
 extern int iwl4965_get_temperature(const struct iwl_priv *priv);
-extern void iwl3945_post_associate(struct iwl_priv *priv);
-extern void iwl3945_config_ap(struct iwl_priv *priv);
+extern void iwl3945_post_associate(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif);
+extern void iwl3945_config_ap(struct iwl_priv *priv,
+                              struct ieee80211_vif *vif);
 
 /**
  * iwl3945_hw_find_station - Find station id for a given BSSID
@@ -287,14 +288,15 @@ extern __le32 iwl3945_get_antenna_flags(const struct iwl_priv *priv);
 extern int iwl3945_init_hw_rate_table(struct iwl_priv *priv);
 extern void iwl3945_reg_txpower_periodic(struct iwl_priv *priv);
 extern int iwl3945_txpower_set_from_eeprom(struct iwl_priv *priv);
-extern u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id,
-                 u16 tx_rate, u8 flags);
 
 extern const struct iwl_channel_info *iwl3945_get_channel_info(
         const struct iwl_priv *priv, enum ieee80211_band band, u16 channel);
 
 extern int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate);
 
+/* scanning */
+void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+
 /* Requires full declaration of iwl_priv before including */
 #include "iwl-io.h"
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index 67ef562e8db1..cd4b61ae25b7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -81,26 +81,6 @@
  */
 #define IWL49_FIRST_AMPDU_QUEUE 7
 
-/* Time constants */
-#define SHORT_SLOT_TIME 9
-#define LONG_SLOT_TIME 20
-
-/* RSSI to dBm */
-#define IWL49_RSSI_OFFSET       44
-
-
-/* PCI registers */
-#define PCI_CFG_RETRY_TIMEOUT   0x041
-
-/* PCI register values */
-#define PCI_CFG_LINK_CTRL_VAL_L0S_EN    0x01
-#define PCI_CFG_LINK_CTRL_VAL_L1_EN     0x02
-
-#define IWL_NUM_SCAN_RATES         (2)
-
-#define IWL_DEFAULT_TX_RETRY  15
-
-
 /* Sizes and addresses for instruction and data memory (SRAM) in
  * 4965's embedded processor.  Driver access is via HBUS_TARG_MEM_* regs. */
 #define IWL49_RTC_INST_LOWER_BOUND              (0x000000)
@@ -393,10 +373,6 @@ static inline int iwl4965_hw_valid_rtc_data_addr(u32 addr)
  *     location(s) in command (struct iwl4965_txpowertable_cmd).
  */
 
-/* Limit range of txpower output target to be between these values */
-#define IWL_TX_POWER_TARGET_POWER_MIN       (0) /* 0 dBm = 1 milliwatt */
-#define IWL_TX_POWER_TARGET_POWER_MAX      (16) /* 16 dBm */
-
 /**
  * When MIMO is used (2 transmitters operating simultaneously), driver should
  * limit each transmitter to deliver a max of 3 dB below the regulatory limit
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 8972166386cb..d3afddae8d9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -46,6 +46,8 @@
 #include "iwl-calib.h"
 #include "iwl-sta.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn.h"
+#include "iwl-agn-debugfs.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
 static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
@@ -60,14 +62,6 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 #define _IWL4965_MODULE_FIRMWARE(api) IWL4965_FW_PRE #api ".ucode"
 #define IWL4965_MODULE_FIRMWARE(api) _IWL4965_MODULE_FIRMWARE(api)
 
-
-/* module parameters */
-static struct iwl_mod_params iwl4965_mod_params = {
-        .amsdu_size_8K = 1,
-        .restart_fw = 1,
-        /* the rest are 0 by default */
-};
-
 /* check contents of special bootstrap uCode SRAM */
 static int iwl4965_verify_bsm(struct iwl_priv *priv)
 {
@@ -417,7 +411,7 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
                                       sizeof(cmd), &cmd);
                 if (ret)
                         IWL_DEBUG_CALIB(priv, "fail sending cmd "
-                                     "REPLY_PHY_CALIBRATION_CMD \n");
+                                     "REPLY_PHY_CALIBRATION_CMD\n");
 
                 /* TODO we might want recalculate
                  * rx_chain in rxon cmd */
@@ -502,14 +496,14 @@ static void iwl4965_tx_queue_set_status(struct iwl_priv *priv,
                        scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
 }
 
-static const u16 default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
+static const s8 default_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
         IWL49_CMD_FIFO_NUM,
-        IWL_TX_FIFO_HCCA_1,
-        IWL_TX_FIFO_HCCA_2
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
 };
 
 static int iwl4965_alive_notify(struct iwl_priv *priv)
@@ -589,9 +583,15 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
         /* reset to 0 to enable all the queue first */
         priv->txq_ctx_active_msk = 0;
         /* Map each Tx/cmd queue to its corresponding fifo */
+        BUILD_BUG_ON(ARRAY_SIZE(default_queue_to_tx_fifo) != 7);
         for (i = 0; i < ARRAY_SIZE(default_queue_to_tx_fifo); i++) {
                 int ac = default_queue_to_tx_fifo[i];
+
                 iwl_txq_ctx_activate(priv, i);
+
+                if (ac == IWL_TX_FIFO_UNUSED)
+                        continue;
+
                 iwl4965_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
         }
 
@@ -1613,19 +1613,19 @@ static int iwl4965_is_temp_calib_needed(struct iwl_priv *priv)
 
         /* get absolute value */
         if (temp_diff < 0) {
-                IWL_DEBUG_POWER(priv, "Getting cooler, delta %d, \n", temp_diff);
+                IWL_DEBUG_POWER(priv, "Getting cooler, delta %d\n", temp_diff);
                 temp_diff = -temp_diff;
         } else if (temp_diff == 0)
-                IWL_DEBUG_POWER(priv, "Same temp, \n");
+                IWL_DEBUG_POWER(priv, "Temperature unchanged\n");
         else
-                IWL_DEBUG_POWER(priv, "Getting warmer, delta %d, \n", temp_diff);
+                IWL_DEBUG_POWER(priv, "Getting warmer, delta %d\n", temp_diff);
 
         if (temp_diff < IWL_TEMPERATURE_THRESHOLD) {
-                IWL_DEBUG_POWER(priv, "Thermal txpower calib not needed\n");
+                IWL_DEBUG_POWER(priv, " => thermal txpower calib not needed\n");
                 return 0;
         }
 
-        IWL_DEBUG_POWER(priv, "Thermal txpower calib needed\n");
+        IWL_DEBUG_POWER(priv, " => thermal txpower calib needed\n");
 
         return 1;
 }
@@ -1874,7 +1874,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                 info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
+                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
                 /* FIXME: code repetition end */
 
                 IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
@@ -1953,6 +1953,60 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
         return 0;
 }
 
+static u8 iwl_find_station(struct iwl_priv *priv, const u8 *addr)
+{
+        int i;
+        int start = 0;
+        int ret = IWL_INVALID_STATION;
+        unsigned long flags;
+
+        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) ||
+            (priv->iw_mode == NL80211_IFTYPE_AP))
+                start = IWL_STA_ID;
+
+        if (is_broadcast_ether_addr(addr))
+                return priv->hw_params.bcast_sta_id;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        for (i = start; i < priv->hw_params.max_stations; i++)
+                if (priv->stations[i].used &&
+                    (!compare_ether_addr(priv->stations[i].sta.sta.addr,
+                                         addr))) {
+                        ret = i;
+                        goto out;
+                }
+
+        IWL_DEBUG_ASSOC_LIMIT(priv, "can not find STA %pM total %d\n",
+                              addr, priv->num_stations);
+
+ out:
+        /*
+         * It may be possible that more commands interacting with stations
+         * arrive before we completed processing the adding of
+         * station
+         */
+        if (ret != IWL_INVALID_STATION &&
+            (!(priv->stations[ret].used & IWL_STA_UCODE_ACTIVE) ||
+             ((priv->stations[ret].used & IWL_STA_UCODE_ACTIVE) &&
+              (priv->stations[ret].used & IWL_STA_UCODE_INPROGRESS)))) {
+                IWL_ERR(priv, "Requested station info for sta %d before ready.\n",
+                        ret);
+                ret = IWL_INVALID_STATION;
+        }
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        return ret;
+}
+
+static int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
+{
+        if (priv->iw_mode == NL80211_IFTYPE_STATION) {
+                return IWL_AP_ID;
+        } else {
+                u8 *da = ieee80211_get_DA(hdr);
+                return iwl_find_station(priv, da);
+        }
+}
+
 /**
  * iwl4965_rx_reply_tx - Handle standard (non-aggregation) Tx response
  */
@@ -2014,7 +2068,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
-                        freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+                        freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                         if (qc)
                                 iwl_free_tfds_in_queue(priv, sta_id,
                                                        tid, freed);
@@ -2031,7 +2085,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         } else {
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv,
+                iwlagn_hwrate_to_tx_control(priv,
                                         le32_to_cpu(tx_resp->rate_n_flags),
                                         info);
 
@@ -2042,7 +2096,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                    le32_to_cpu(tx_resp->rate_n_flags),
                                    tx_resp->failure_frame);
 
-                freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+                freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                 if (qc && likely(sta_id != IWL_INVALID_STATION))
                         iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
                 else if (sta_id == IWL_INVALID_STATION)
@@ -2053,10 +2107,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         iwl_wake_queue(priv, txq_id);
         }
         if (qc && likely(sta_id != IWL_INVALID_STATION))
-                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+                iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
 
-        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
-                IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
+        iwl_check_abort_status(priv, tx_resp->frame_count, status);
 }
 
 static int iwl4965_calc_rssi(struct iwl_priv *priv,
@@ -2090,7 +2143,7 @@ static int iwl4965_calc_rssi(struct iwl_priv *priv,
 
         /* dBm = max_rssi dB - agc dB - constant.
          * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc - IWL49_RSSI_OFFSET;
+        return max_rssi - agc - IWLAGN_RSSI_OFFSET;
 }
 
 
@@ -2098,7 +2151,7 @@ static int iwl4965_calc_rssi(struct iwl_priv *priv,
 static void iwl4965_rx_handler_setup(struct iwl_priv *priv)
 {
         /* Legacy Rx frames */
-        priv->rx_handlers[REPLY_RX] = iwl_rx_reply_rx;
+        priv->rx_handlers[REPLY_RX] = iwlagn_rx_reply_rx;
         /* Tx response */
         priv->rx_handlers[REPLY_TX] = iwl4965_rx_reply_tx;
 }
@@ -2113,50 +2166,13 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv)
         cancel_work_sync(&priv->txpower_work);
 }
 
-#define IWL4965_UCODE_GET(item)                                         \
-static u32 iwl4965_ucode_get_##item(const struct iwl_ucode_header *ucode,\
-                                    u32 api_ver)                        \
-{                                                                       \
-        return le32_to_cpu(ucode->u.v1.item);                           \
-}
-
-static u32 iwl4965_ucode_get_header_size(u32 api_ver)
-{
-        return UCODE_HEADER_SIZE(1);
-}
-static u32 iwl4965_ucode_get_build(const struct iwl_ucode_header *ucode,
-                                   u32 api_ver)
-{
-        return 0;
-}
-static u8 *iwl4965_ucode_get_data(const struct iwl_ucode_header *ucode,
-                                  u32 api_ver)
-{
-        return (u8 *) ucode->u.v1.data;
-}
-
-IWL4965_UCODE_GET(inst_size);
-IWL4965_UCODE_GET(data_size);
-IWL4965_UCODE_GET(init_size);
-IWL4965_UCODE_GET(init_data_size);
-IWL4965_UCODE_GET(boot_size);
-
 static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
         .set_rxon_chain = iwl_set_rxon_chain,
+        .send_bt_config = iwl_send_bt_config,
 };
 
-static struct iwl_ucode_ops iwl4965_ucode = {
-        .get_header_size = iwl4965_ucode_get_header_size,
-        .get_build = iwl4965_ucode_get_build,
-        .get_inst_size = iwl4965_ucode_get_inst_size,
-        .get_data_size = iwl4965_ucode_get_data_size,
-        .get_init_size = iwl4965_ucode_get_init_size,
-        .get_init_data_size = iwl4965_ucode_get_init_data_size,
-        .get_boot_size = iwl4965_ucode_get_boot_size,
-        .get_data = iwl4965_ucode_get_data,
-};
 static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .get_hcmd_size = iwl4965_get_hcmd_size,
         .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
@@ -2164,6 +2180,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .gain_computation = iwl4965_gain_computation,
         .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
         .calc_rssi = iwl4965_calc_rssi,
+        .request_scan = iwlagn_request_scan,
 };
 
 static struct iwl_lib_ops iwl4965_lib = {
@@ -2184,6 +2201,7 @@ static struct iwl_lib_ops iwl4965_lib = {
         .load_ucode = iwl4965_load_bsm,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_fh = iwl_dump_fh,
         .set_channel_switch = iwl4965_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
@@ -2216,11 +2234,16 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .temperature = iwl4965_temperature_calib,
                 .set_ct_kill = iwl4965_set_ct_threshold,
         },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .check_plcp_health = iwl_good_plcp_health,
 };
 
 static const struct iwl_ops iwl4965_ops = {
-        .ucode = &iwl4965_ucode,
         .lib = &iwl4965_lib,
         .hcmd = &iwl4965_hcmd,
         .utils = &iwl4965_hcmd_utils,
@@ -2228,7 +2251,7 @@ static const struct iwl_ops iwl4965_ops = {
 };
 
 struct iwl_cfg iwl4965_agn_cfg = {
-        .name = "4965AGN",
+        .name = "Intel(R) Wireless WiFi Link 4965AGN",
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
@@ -2239,7 +2262,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .ops = &iwl4965_ops,
         .num_of_queues = IWL49_NUM_QUEUES,
         .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl4965_mod_params,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = 0,
@@ -2251,27 +2274,20 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .led_compensation = 61,
         .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .temperature_kelvin = true,
+        .max_event_log_size = 512,
+        .tx_power_by_driver = true,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
+        /*
+         * Force use of chains B and C for scan RX on 5 GHz band
+         * because the device has off-channel reception on chain A.
+         */
+        .scan_antennas[IEEE80211_BAND_5GHZ] = ANT_BC,
 };
 
 /* Module firmware */
 MODULE_FIRMWARE(IWL4965_MODULE_FIRMWARE(IWL4965_UCODE_API_MAX));
 
-module_param_named(antenna, iwl4965_mod_params.antenna, int, S_IRUGO);
-MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(swcrypto, iwl4965_mod_params.sw_crypto, int, S_IRUGO);
-MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
-module_param_named(
-        disable_hw_scan, iwl4965_mod_params.disable_hw_scan, int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
-
-module_param_named(queues_num, iwl4965_mod_params.num_of_queues, int, S_IRUGO);
-MODULE_PARM_DESC(queues_num, "number of hw queues.");
-/* 11n */
-module_param_named(11n_disable, iwl4965_mod_params.disable_11n, int, S_IRUGO);
-MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
-module_param_named(amsdu_size_8K, iwl4965_mod_params.amsdu_size_8K,
-                   int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
-
-module_param_named(fw_restart4965, iwl4965_mod_params.restart_fw, int, S_IRUGO);
-MODULE_PARM_DESC(fw_restart4965, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 714e032f6217..146e6431ae95 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -68,25 +68,6 @@
 #ifndef __iwl_5000_hw_h__
 #define __iwl_5000_hw_h__
 
-#define IWL50_RTC_INST_LOWER_BOUND              (0x000000)
-#define IWL50_RTC_INST_UPPER_BOUND              (0x020000)
-
-#define IWL50_RTC_DATA_LOWER_BOUND              (0x800000)
-#define IWL50_RTC_DATA_UPPER_BOUND              (0x80C000)
-
-#define IWL50_RTC_INST_SIZE (IWL50_RTC_INST_UPPER_BOUND - \
-                                IWL50_RTC_INST_LOWER_BOUND)
-#define IWL50_RTC_DATA_SIZE (IWL50_RTC_DATA_UPPER_BOUND - \
-                                IWL50_RTC_DATA_LOWER_BOUND)
-
-/* EEPROM */
-#define IWL_5000_EEPROM_IMG_SIZE                        2048
-
-#define IWL50_CMD_FIFO_NUM                 7
-#define IWL50_NUM_QUEUES                  20
-#define IWL50_NUM_AMPDU_QUEUES            10
-#define IWL50_FIRST_AMPDU_QUEUE           10
-
 /* 5150 only */
 #define IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF   (-5)
 
@@ -103,19 +84,5 @@ static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
         return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
 }
 
-/* Fixed (non-configurable) rx data from phy */
-
-/**
- * struct iwl5000_schedq_bc_tbl scheduler byte count table
- *      base physical address of iwl5000_shared
- *      is provided to SCD_DRAM_BASE_ADDR
- * @tfd_offset  0-12 - tx command byte count
- *             12-16 - station index
- */
-struct iwl5000_scd_bc_tbl {
-        __le16 tfd_offset[TFD_QUEUE_BC_SIZE];
-} __attribute__ ((packed));
-
-
 #endif /* __iwl_5000_hw_h__ */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e476acb53aa7..a28af7eb67eb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -19,6 +19,7 @@
  * file called LICENSE.
  *
  * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  *
  *****************************************************************************/
@@ -43,9 +44,11 @@
 #include "iwl-io.h"
 #include "iwl-sta.h"
 #include "iwl-helpers.h"
+#include "iwl-agn.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-hw.h"
 #include "iwl-5000-hw.h"
-#include "iwl-6000-hw.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 2
@@ -63,18 +66,8 @@
 #define _IWL5150_MODULE_FIRMWARE(api) IWL5150_FW_PRE #api ".ucode"
 #define IWL5150_MODULE_FIRMWARE(api) _IWL5150_MODULE_FIRMWARE(api)
 
-static const u16 iwl5000_default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
-        IWL50_CMD_FIFO_NUM,
-        IWL_TX_FIFO_HCCA_1,
-        IWL_TX_FIFO_HCCA_2
-};
-
 /* NIC configuration for 5000 series */
-void iwl5000_nic_config(struct iwl_priv *priv)
+static void iwl5000_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
@@ -107,162 +100,6 @@ void iwl5000_nic_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-
-/*
- * EEPROM
- */
-static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
-{
-        u16 offset = 0;
-
-        if ((address & INDIRECT_ADDRESS) == 0)
-                return address;
-
-        switch (address & INDIRECT_TYPE_MSK) {
-        case INDIRECT_HOST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_HOST);
-                break;
-        case INDIRECT_GENERAL:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_GENERAL);
-                break;
-        case INDIRECT_REGULATORY:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_REGULATORY);
-                break;
-        case INDIRECT_CALIBRATION:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_CALIBRATION);
-                break;
-        case INDIRECT_PROCESS_ADJST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_PROCESS_ADJST);
-                break;
-        case INDIRECT_OTHERS:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_OTHERS);
-                break;
-        default:
-                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
-                address & INDIRECT_TYPE_MSK);
-                break;
-        }
-
-        /* translate the offset from words to byte */
-        return (address & ADDRESS_MSK) + (offset << 1);
-}
-
-u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv)
-{
-        struct iwl_eeprom_calib_hdr {
-                u8 version;
-                u8 pa_type;
-                u16 voltage;
-        } *hdr;
-
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
-                                                        EEPROM_5000_CALIB_ALL);
-        return hdr->version;
-
-}
-
-static void iwl5000_gain_computation(struct iwl_priv *priv,
-                u32 average_noise[NUM_RX_CHAINS],
-                u16 min_average_noise_antenna_i,
-                u32 min_average_noise,
-                u8 default_chain)
-{
-        int i;
-        s32 delta_g;
-        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
-
-        /*
-         * Find Gain Code for the chains based on "default chain"
-         */
-        for (i = default_chain + 1; i < NUM_RX_CHAINS; i++) {
-                if ((data->disconn_array[i])) {
-                        data->delta_gain_code[i] = 0;
-                        continue;
-                }
-
-                delta_g = (priv->cfg->chain_noise_scale *
-                        ((s32)average_noise[default_chain] -
-                        (s32)average_noise[i])) / 1500;
-
-                /* bound gain by 2 bits value max, 3rd bit is sign */
-                data->delta_gain_code[i] =
-                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
-
-                if (delta_g < 0)
-                        /*
-                         * set negative sign ...
-                         * note to Intel developers:  This is uCode API format,
-                         *   not the format of any internal device registers.
-                         *   Do not change this format for e.g. 6050 or similar
-                         *   devices.  Change format only if more resolution
-                         *   (i.e. more than 2 bits magnitude) is needed.
-                         */
-                        data->delta_gain_code[i] |= (1 << 2);
-        }
-
-        IWL_DEBUG_CALIB(priv, "Delta gains: ANT_B = %d  ANT_C = %d\n",
-                        data->delta_gain_code[1], data->delta_gain_code[2]);
-
-        if (!data->radio_write) {
-                struct iwl_calib_chain_noise_gain_cmd cmd;
-
-                memset(&cmd, 0, sizeof(cmd));
-
-                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_GAIN_CMD;
-                cmd.hdr.first_group = 0;
-                cmd.hdr.groups_num = 1;
-                cmd.hdr.data_valid = 1;
-                cmd.delta_gain_1 = data->delta_gain_code[1];
-                cmd.delta_gain_2 = data->delta_gain_code[2];
-                iwl_send_cmd_pdu_async(priv, REPLY_PHY_CALIBRATION_CMD,
-                        sizeof(cmd), &cmd, NULL);
-
-                data->radio_write = 1;
-                data->state = IWL_CHAIN_NOISE_CALIBRATED;
-        }
-
-        data->chain_noise_a = 0;
-        data->chain_noise_b = 0;
-        data->chain_noise_c = 0;
-        data->chain_signal_a = 0;
-        data->chain_signal_b = 0;
-        data->chain_signal_c = 0;
-        data->beacon_count = 0;
-}
-
-static void iwl5000_chain_noise_reset(struct iwl_priv *priv)
-{
-        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
-        int ret;
-
-        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
-                struct iwl_calib_chain_noise_reset_cmd cmd;
-                memset(&cmd, 0, sizeof(cmd));
-
-                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD;
-                cmd.hdr.first_group = 0;
-                cmd.hdr.groups_num = 1;
-                cmd.hdr.data_valid = 1;
-                ret = iwl_send_cmd_pdu(priv, REPLY_PHY_CALIBRATION_CMD,
-                                        sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(priv,
-                                "Could not send REPLY_PHY_CALIBRATION_CMD\n");
-                data->state = IWL_CHAIN_NOISE_ACCUMULATE;
-                IWL_DEBUG_CALIB(priv, "Run chain_noise_calibrate\n");
-        }
-}
-
-void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                        __le32 *tx_flags)
-{
-        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-        else
-                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
-}
-
 static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
         .min_nrg_cck = 95,
         .max_nrg_cck = 0, /* not used, set to 0 */
@@ -314,14 +151,6 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
         .nrg_th_cca = 62,
 };
 
-const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
-                                           size_t offset)
-{
-        u32 address = eeprom_indirect_address(priv, offset);
-        BUG_ON(address >= priv->cfg->eeprom_size);
-        return &priv->eeprom[address];
-}
-
 static void iwl5150_set_ct_threshold(struct iwl_priv *priv)
 {
         const s32 volt2temp_coef = IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF;
@@ -337,356 +166,10 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
         priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
 }
 
-/*
- *  Calibration
- */
-static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
-{
-        struct iwl_calib_xtal_freq_cmd cmd;
-        __le16 *xtal_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
-
-        cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
-        cmd.hdr.first_group = 0;
-        cmd.hdr.groups_num = 1;
-        cmd.hdr.data_valid = 1;
-        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
-        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
-        return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
-                             (u8 *)&cmd, sizeof(cmd));
-}
-
-static int iwl5000_send_calib_cfg(struct iwl_priv *priv)
-{
-        struct iwl_calib_cfg_cmd calib_cfg_cmd;
-        struct iwl_host_cmd cmd = {
-                .id = CALIBRATION_CFG_CMD,
-                .len = sizeof(struct iwl_calib_cfg_cmd),
-                .data = &calib_cfg_cmd,
-        };
-
-        memset(&calib_cfg_cmd, 0, sizeof(calib_cfg_cmd));
-        calib_cfg_cmd.ucd_calib_cfg.once.is_enable = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.once.start = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.once.send_res = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.flags = IWL_CALIB_INIT_CFG_ALL;
-
-        return iwl_send_cmd(priv, &cmd);
-}
-
-static void iwl5000_rx_calib_result(struct iwl_priv *priv,
-                             struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
-        int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        int index;
-
-        /* reduce the size of the length field itself */
-        len -= 4;
-
-        /* Define the order in which the results will be sent to the runtime
-         * uCode. iwl_send_calib_results sends them in a row according to their
-         * index. We sort them here */
-        switch (hdr->op_code) {
-        case IWL_PHY_CALIBRATE_DC_CMD:
-                index = IWL_CALIB_DC;
-                break;
-        case IWL_PHY_CALIBRATE_LO_CMD:
-                index = IWL_CALIB_LO;
-                break;
-        case IWL_PHY_CALIBRATE_TX_IQ_CMD:
-                index = IWL_CALIB_TX_IQ;
-                break;
-        case IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD:
-                index = IWL_CALIB_TX_IQ_PERD;
-                break;
-        case IWL_PHY_CALIBRATE_BASE_BAND_CMD:
-                index = IWL_CALIB_BASE_BAND;
-                break;
-        default:
-                IWL_ERR(priv, "Unknown calibration notification %d\n",
-                          hdr->op_code);
-                return;
-        }
-        iwl_calib_set(&priv->calib_results[index], pkt->u.raw, len);
-}
-
-static void iwl5000_rx_calib_complete(struct iwl_priv *priv,
-                               struct iwl_rx_mem_buffer *rxb)
-{
-        IWL_DEBUG_INFO(priv, "Init. calibration is completed, restarting fw.\n");
-        queue_work(priv->workqueue, &priv->restart);
-}
-
-/*
- * ucode
- */
-static int iwl5000_load_section(struct iwl_priv *priv, const char *name,
-                                struct fw_desc *image, u32 dst_addr)
-{
-        dma_addr_t phy_addr = image->p_addr;
-        u32 byte_cnt = image->len;
-        int ret;
-
-        priv->ucode_write_complete = 0;
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
-
-        iwl_write_direct32(priv,
-                FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL), dst_addr);
-
-        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
-                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
-
-        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
-                (iwl_get_dma_hi_addr(phy_addr)
-                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
-                FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE       |
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
-                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
-
-        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
-                                        priv->ucode_write_complete, 5 * HZ);
-        if (ret == -ERESTARTSYS) {
-                IWL_ERR(priv, "Could not load the %s uCode section due "
-                        "to interrupt\n", name);
-                return ret;
-        }
-        if (!ret) {
-                IWL_ERR(priv, "Could not load the %s uCode section\n",
-                        name);
-                return -ETIMEDOUT;
-        }
-
-        return 0;
-}
-
-static int iwl5000_load_given_ucode(struct iwl_priv *priv,
-                struct fw_desc *inst_image,
-                struct fw_desc *data_image)
-{
-        int ret = 0;
-
-        ret = iwl5000_load_section(priv, "INST", inst_image,
-                                   IWL50_RTC_INST_LOWER_BOUND);
-        if (ret)
-                return ret;
-
-        return iwl5000_load_section(priv, "DATA", data_image,
-                                    IWL50_RTC_DATA_LOWER_BOUND);
-}
-
-int iwl5000_load_ucode(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        /* check whether init ucode should be loaded, or rather runtime ucode */
-        if (priv->ucode_init.len && (priv->ucode_type == UCODE_NONE)) {
-                IWL_DEBUG_INFO(priv, "Init ucode found. Loading init ucode...\n");
-                ret = iwl5000_load_given_ucode(priv,
-                        &priv->ucode_init, &priv->ucode_init_data);
-                if (!ret) {
-                        IWL_DEBUG_INFO(priv, "Init ucode load complete.\n");
-                        priv->ucode_type = UCODE_INIT;
-                }
-        } else {
-                IWL_DEBUG_INFO(priv, "Init ucode not found, or already loaded. "
-                        "Loading runtime ucode...\n");
-                ret = iwl5000_load_given_ucode(priv,
-                        &priv->ucode_code, &priv->ucode_data);
-                if (!ret) {
-                        IWL_DEBUG_INFO(priv, "Runtime ucode load complete.\n");
-                        priv->ucode_type = UCODE_RT;
-                }
-        }
-
-        return ret;
-}
-
-void iwl5000_init_alive_start(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        /* Check alive response for "valid" sign from uCode */
-        if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
-                /* We had an error bringing up the hardware, so take it
-                 * all the way back down so we can try again */
-                IWL_DEBUG_INFO(priv, "Initialize Alive failed.\n");
-                goto restart;
-        }
-
-        /* initialize uCode was loaded... verify inst image.
-         * This is a paranoid check, because we would not have gotten the
-         * "initialize" alive if code weren't properly loaded.  */
-        if (iwl_verify_ucode(priv)) {
-                /* Runtime instruction load was bad;
-                 * take it all the way back down so we can try again */
-                IWL_DEBUG_INFO(priv, "Bad \"initialize\" uCode load.\n");
-                goto restart;
-        }
-
-        iwl_clear_stations_table(priv);
-        ret = priv->cfg->ops->lib->alive_notify(priv);
-        if (ret) {
-                IWL_WARN(priv,
-                        "Could not complete ALIVE transition: %d\n", ret);
-                goto restart;
-        }
-
-        iwl5000_send_calib_cfg(priv);
-        return;
-
-restart:
-        /* real restart (first load init_ucode) */
-        queue_work(priv->workqueue, &priv->restart);
-}
-
-static void iwl5000_set_wr_ptrs(struct iwl_priv *priv,
-                                int txq_id, u32 index)
-{
-        iwl_write_direct32(priv, HBUS_TARG_WRPTR,
-                        (index & 0xff) | (txq_id << 8));
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(txq_id), index);
-}
-
-static void iwl5000_tx_queue_set_status(struct iwl_priv *priv,
-                                        struct iwl_tx_queue *txq,
-                                        int tx_fifo_id, int scd_retry)
-{
-        int txq_id = txq->q.id;
-        int active = test_bit(txq_id, &priv->txq_ctx_active_msk) ? 1 : 0;
-
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                        (active << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
-                        (tx_fifo_id << IWL50_SCD_QUEUE_STTS_REG_POS_TXF) |
-                        (1 << IWL50_SCD_QUEUE_STTS_REG_POS_WSL) |
-                        IWL50_SCD_QUEUE_STTS_REG_MSK);
-
-        txq->sched_retry = scd_retry;
-
-        IWL_DEBUG_INFO(priv, "%s %s Queue %d on AC %d\n",
-                       active ? "Activate" : "Deactivate",
-                       scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
-}
-
-int iwl5000_alive_notify(struct iwl_priv *priv)
-{
-        u32 a;
-        unsigned long flags;
-        int i, chan;
-        u32 reg_val;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->scd_base_addr = iwl_read_prph(priv, IWL50_SCD_SRAM_BASE_ADDR);
-        a = priv->scd_base_addr + IWL50_SCD_CONTEXT_DATA_OFFSET;
-        for (; a < priv->scd_base_addr + IWL50_SCD_TX_STTS_BITMAP_OFFSET;
-                a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-        for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
-                a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-        for (; a < priv->scd_base_addr +
-               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-
-        iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,
-                       priv->scd_bc_tbls.dma >> 10);
-
-        /* Enable DMA channel */
-        for (chan = 0; chan < FH50_TCSR_CHNL_NUM ; chan++)
-                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
-
-        /* Update FH chicken bits */
-        reg_val = iwl_read_direct32(priv, FH_TX_CHICKEN_BITS_REG);
-        iwl_write_direct32(priv, FH_TX_CHICKEN_BITS_REG,
-                           reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
-
-        iwl_write_prph(priv, IWL50_SCD_QUEUECHAIN_SEL,
-                IWL50_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
-        iwl_write_prph(priv, IWL50_SCD_AGGR_SEL, 0);
-
-        /* initiate the queues */
-        for (i = 0; i < priv->hw_params.max_txq_num; i++) {
-                iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(i), 0);
-                iwl_write_direct32(priv, HBUS_TARG_WRPTR, 0 | (i << 8));
-                iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
-                iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i) +
-                                sizeof(u32),
-                                ((SCD_WIN_SIZE <<
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
-                                ((SCD_FRAME_LIMIT <<
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
-        }
-
-        iwl_write_prph(priv, IWL50_SCD_INTERRUPT_MASK,
-                        IWL_MASK(0, priv->hw_params.max_txq_num));
-
-        /* Activate all Tx DMA/FIFO channels */
-        priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 7));
-
-        iwl5000_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
-
-        /* make sure all queue are not stopped */
-        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
-        for (i = 0; i < 4; i++)
-                atomic_set(&priv->queue_stop_count[i], 0);
-
-        /* reset to 0 to enable all the queue first */
-        priv->txq_ctx_active_msk = 0;
-        /* map qos queues to fifos one-to-one */
-        for (i = 0; i < ARRAY_SIZE(iwl5000_default_queue_to_tx_fifo); i++) {
-                int ac = iwl5000_default_queue_to_tx_fifo[i];
-                iwl_txq_ctx_activate(priv, i);
-                iwl5000_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
-        }
-
-        /*
-         * TODO - need to initialize these queues and map them to FIFOs
-         * in the loop above, not only mark them as active. We do this
-         * because we want the first aggregation queue to be queue #10,
-         * but do not use 8 or 9 otherwise yet.
-         */
-        iwl_txq_ctx_activate(priv, 7);
-        iwl_txq_ctx_activate(priv, 8);
-        iwl_txq_ctx_activate(priv, 9);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-
-        iwl_send_wimax_coex(priv);
-
-        iwl5000_set_Xtal_calib(priv);
-        iwl_send_calib_results(priv);
-
-        return 0;
-}
-
-int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
+static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -694,13 +177,13 @@ int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
-        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
         priv->hw_params.max_bsm_size = 0;
         priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
@@ -717,571 +200,61 @@ int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_5150:
-                priv->hw_params.sens = &iwl5150_sensitivity;
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_DC)               |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-
-                break;
-        default:
-                priv->hw_params.sens = &iwl5000_sensitivity;
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_TX_IQ_PERD)       |
-                        BIT(IWL_CALIB_BASE_BAND);
-                break;
-        }
-
-        return 0;
-}
-
-/**
- * iwl5000_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
- */
-void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
-                                            struct iwl_tx_queue *txq,
-                                            u16 byte_cnt)
-{
-        struct iwl5000_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
-        int write_ptr = txq->q.write_ptr;
-        int txq_id = txq->q.id;
-        u8 sec_ctl = 0;
-        u8 sta_id = 0;
-        u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
-        __le16 bc_ent;
-
-        WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX);
-
-        if (txq_id != IWL_CMD_QUEUE_NUM) {
-                sta_id = txq->cmd[txq->q.write_ptr]->cmd.tx.sta_id;
-                sec_ctl = txq->cmd[txq->q.write_ptr]->cmd.tx.sec_ctl;
-
-                switch (sec_ctl & TX_CMD_SEC_MSK) {
-                case TX_CMD_SEC_CCM:
-                        len += CCMP_MIC_LEN;
-                        break;
-                case TX_CMD_SEC_TKIP:
-                        len += TKIP_ICV_LEN;
-                        break;
-                case TX_CMD_SEC_WEP:
-                        len += WEP_IV_LEN + WEP_ICV_LEN;
-                        break;
-                }
-        }
-
-        bc_ent = cpu_to_le16((len & 0xFFF) | (sta_id << 12));
-
-        scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
-
-        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
-                scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
-}
-
-void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
-                                           struct iwl_tx_queue *txq)
-{
-        struct iwl5000_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
-        int txq_id = txq->q.id;
-        int read_ptr = txq->q.read_ptr;
-        u8 sta_id = 0;
-        __le16 bc_ent;
-
-        WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
-
-        if (txq_id != IWL_CMD_QUEUE_NUM)
-                sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
-
-        bc_ent = cpu_to_le16(1 | (sta_id << 12));
-        scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
-
-        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
-                scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
-}
-
-static int iwl5000_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
-                                        u16 txq_id)
-{
-        u32 tbl_dw_addr;
-        u32 tbl_dw;
-        u16 scd_q2ratid;
-
-        scd_q2ratid = ra_tid & IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
-
-        tbl_dw_addr = priv->scd_base_addr +
-                        IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
-
-        tbl_dw = iwl_read_targ_mem(priv, tbl_dw_addr);
-
-        if (txq_id & 0x1)
-                tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
-        else
-                tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
-
-        iwl_write_targ_mem(priv, tbl_dw_addr, tbl_dw);
-
-        return 0;
-}
-static void iwl5000_tx_queue_stop_scheduler(struct iwl_priv *priv, u16 txq_id)
-{
-        /* Simply stop the queue, but don't change any configuration;
-         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
-        iwl_write_prph(priv,
-                IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                (0 << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                (1 << IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
-}
-
-int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
-                                  int tx_fifo, int sta_id, int tid, u16 ssn_idx)
-{
-        unsigned long flags;
-        u16 ra_tid;
-
-        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
-                IWL_WARN(priv,
-                        "queue number out of range: %d, must be %d to %d\n",
-                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
-                return -EINVAL;
-        }
-
-        ra_tid = BUILD_RAxTID(sta_id, tid);
-
-        /* Modify device's station table to Tx this TID */
-        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Stop this Tx queue before configuring it */
-        iwl5000_tx_queue_stop_scheduler(priv, txq_id);
-
-        /* Map receiver-address / traffic-ID to this queue */
-        iwl5000_tx_queue_set_q2ratid(priv, ra_tid, txq_id);
-
-        /* Set this queue as a chain-building queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_QUEUECHAIN_SEL, (1<<txq_id));
-
-        /* enable aggregations for the queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1<<txq_id));
-
-        /* Place first TFD at index corresponding to start sequence number.
-         * Assumes that ssn_idx is valid (!= 0xFFF) */
-        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
-        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
-        iwl5000_set_wr_ptrs(priv, txq_id, ssn_idx);
-
-        /* Set up Tx window size and frame limit for this queue */
-        iwl_write_targ_mem(priv, priv->scd_base_addr +
-                        IWL50_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
-                        sizeof(u32),
-                        ((SCD_WIN_SIZE <<
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
-                        ((SCD_FRAME_LIMIT <<
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
-
-        iwl_set_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
-
-        /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
-        iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw_params.sens = &iwl5000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_TX_IQ_PERD)       |
+                BIT(IWL_CALIB_BASE_BAND);
 
         return 0;
 }
 
-int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
-                                   u16 ssn_idx, u8 tx_fifo)
+static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
-                IWL_ERR(priv,
-                        "queue number out of range: %d, must be %d to %d\n",
-                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
-                return -EINVAL;
-        }
-
-        iwl5000_tx_queue_stop_scheduler(priv, txq_id);
-
-        iwl_clear_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1 << txq_id));
-
-        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
-        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
-        /* supposes that ssn_idx is valid (!= 0xFFF) */
-        iwl5000_set_wr_ptrs(priv, txq_id, ssn_idx);
-
-        iwl_clear_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
-        iwl_txq_ctx_deactivate(priv, txq_id);
-        iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
-
-        return 0;
-}
-
-u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
-{
-        u16 size = (u16)sizeof(struct iwl_addsta_cmd);
-        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
-        memcpy(addsta, cmd, size);
-        /* resrved in 5000 */
-        addsta->rate_n_flags = cpu_to_le16(0);
-        return size;
-}
-
-
-/*
- * Activate/Deactivate Tx DMA/FIFO channels according tx fifos mask
- * must be called under priv->lock and mac access
- */
-void iwl5000_txq_set_sched(struct iwl_priv *priv, u32 mask)
-{
-        iwl_write_prph(priv, IWL50_SCD_TXFACT, mask);
-}
-
-
-static inline u32 iwl5000_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
-{
-        return le32_to_cpup((__le32 *)&tx_resp->status +
-                            tx_resp->frame_count) & MAX_SN;
-}
-
-static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
-                                      struct iwl_ht_agg *agg,
-                                      struct iwl5000_tx_resp *tx_resp,
-                                      int txq_id, u16 start_idx)
-{
-        u16 status;
-        struct agg_tx_status *frame_status = &tx_resp->status;
-        struct ieee80211_tx_info *info = NULL;
-        struct ieee80211_hdr *hdr = NULL;
-        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
-        int i, sh, idx;
-        u16 seq;
-
-        if (agg->wait_for_ba)
-                IWL_DEBUG_TX_REPLY(priv, "got tx response w/o block-ack\n");
-
-        agg->frame_count = tx_resp->frame_count;
-        agg->start_idx = start_idx;
-        agg->rate_n_flags = rate_n_flags;
-        agg->bitmap = 0;
-
-        /* # frames attempted by Tx command */
-        if (agg->frame_count == 1) {
-                /* Only one frame was attempted; no block-ack will arrive */
-                status = le16_to_cpu(frame_status[0].status);
-                idx = start_idx;
-
-                /* FIXME: code repetition */
-                IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
-                                   agg->frame_count, agg->start_idx, idx);
-
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
-
-                /* FIXME: code repetition end */
-
-                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
-                                    status & 0xff, tx_resp->failure_frame);
-                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
-
-                agg->wait_for_ba = 0;
-        } else {
-                /* Two or more frames were attempted; expect block-ack */
-                u64 bitmap = 0;
-                int start = agg->start_idx;
-
-                /* Construct bit-map of pending frames within Tx window */
-                for (i = 0; i < agg->frame_count; i++) {
-                        u16 sc;
-                        status = le16_to_cpu(frame_status[i].status);
-                        seq  = le16_to_cpu(frame_status[i].sequence);
-                        idx = SEQ_TO_INDEX(seq);
-                        txq_id = SEQ_TO_QUEUE(seq);
-
-                        if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
-                                      AGG_TX_STATE_ABORT_MSK))
-                                continue;
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-                        IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
-                                           agg->frame_count, txq_id, idx);
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwlagn_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-                        hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
-                        if (!hdr) {
-                                IWL_ERR(priv,
-                                        "BUG_ON idx doesn't point to valid skb"
-                                        " idx=%d, txq_id=%d\n", idx, txq_id);
-                                return -1;
-                        }
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
-                        sc = le16_to_cpu(hdr->seq_ctrl);
-                        if (idx != (SEQ_TO_SN(sc) & 0xff)) {
-                                IWL_ERR(priv,
-                                        "BUG_ON idx doesn't match seq control"
-                                        " idx=%d, seq_idx=%d, seq=%d\n",
-                                          idx, SEQ_TO_SN(sc),
-                                          hdr->seq_ctrl);
-                                return -1;
-                        }
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
 
-                        IWL_DEBUG_TX_REPLY(priv, "AGG Frame i=%d idx %d seq=%d\n",
-                                           i, idx, SEQ_TO_SN(sc));
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-                        sh = idx - start;
-                        if (sh > 64) {
-                                sh = (start - idx) + 0xff;
-                                bitmap = bitmap << sh;
-                                sh = 0;
-                                start = idx;
-                        } else if (sh < -64)
-                                sh  = 0xff - (start - idx);
-                        else if (sh < 0) {
-                                sh = start - idx;
-                                start = idx;
-                                bitmap = bitmap << sh;
-                                sh = 0;
-                        }
-                        bitmap |= 1ULL << sh;
-                        IWL_DEBUG_TX_REPLY(priv, "start=%d bitmap=0x%llx\n",
-                                           start, (unsigned long long)bitmap);
-                }
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
-                agg->bitmap = bitmap;
-                agg->start_idx = start;
-                IWL_DEBUG_TX_REPLY(priv, "Frames %d start_idx=%d bitmap=0x%llx\n",
-                                   agg->frame_count, agg->start_idx,
-                                   (unsigned long long)agg->bitmap);
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl5150_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_DC)               |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
 
-                if (bitmap)
-                        agg->wait_for_ba = 1;
-        }
         return 0;
 }
 
-static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
-                                struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
-        int txq_id = SEQ_TO_QUEUE(sequence);
-        int index = SEQ_TO_INDEX(sequence);
-        struct iwl_tx_queue *txq = &priv->txq[txq_id];
-        struct ieee80211_tx_info *info;
-        struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
-        u32  status = le16_to_cpu(tx_resp->status.status);
-        int tid;
-        int sta_id;
-        int freed;
-
-        if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
-                IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
-                          "is out of range [0-%d] %d %d\n", txq_id,
-                          index, txq->q.n_bd, txq->q.write_ptr,
-                          txq->q.read_ptr);
-                return;
-        }
-
-        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
-        memset(&info->status, 0, sizeof(info->status));
-
-        tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
-        sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
-
-        if (txq->sched_retry) {
-                const u32 scd_ssn = iwl5000_get_scd_ssn(tx_resp);
-                struct iwl_ht_agg *agg = NULL;
-
-                agg = &priv->stations[sta_id].tid[tid].agg;
-
-                iwl5000_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
-
-                /* check if BAR is needed */
-                if ((tx_resp->frame_count == 1) && !iwl_is_tx_success(status))
-                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
-
-                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
-                        index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
-                        IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim "
-                                        "scd_ssn=%d idx=%d txq=%d swq=%d\n",
-                                        scd_ssn , index, txq_id, txq->swq_id);
-
-                        freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                        if (priv->mac80211_registered &&
-                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
-                                if (agg->state == IWL_AGG_OFF)
-                                        iwl_wake_queue(priv, txq_id);
-                                else
-                                        iwl_wake_queue(priv, txq->swq_id);
-                        }
-                }
-        } else {
-                BUG_ON(txq_id != txq->swq_id);
-
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv,
-                                        le32_to_cpu(tx_resp->rate_n_flags),
-                                        info);
-
-                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
-                                   "0x%x retries %d\n",
-                                   txq_id,
-                                   iwl_get_tx_fail_reason(status), status,
-                                   le32_to_cpu(tx_resp->rate_n_flags),
-                                   tx_resp->failure_frame);
-
-                freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                if (priv->mac80211_registered &&
-                    (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        iwl_wake_queue(priv, txq_id);
-        }
-
-        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
-
-        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
-                IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
-}
-
-/* Currently 5000 is the superset of everything */
-u16 iwl5000_get_hcmd_size(u8 cmd_id, u16 len)
-{
-        return len;
-}
-
-void iwl5000_setup_deferred_work(struct iwl_priv *priv)
-{
-        /* in 5000 the tx power calibration is done in uCode */
-        priv->disable_tx_power_cal = 1;
-}
-
-void iwl5000_rx_handler_setup(struct iwl_priv *priv)
-{
-        /* init calibration handlers */
-        priv->rx_handlers[CALIBRATION_RES_NOTIFICATION] =
-                                        iwl5000_rx_calib_result;
-        priv->rx_handlers[CALIBRATION_COMPLETE_NOTIFICATION] =
-                                        iwl5000_rx_calib_complete;
-        priv->rx_handlers[REPLY_TX] = iwl5000_rx_reply_tx;
-}
-
-
-int iwl5000_hw_valid_rtc_data_addr(u32 addr)
-{
-        return (addr >= IWL50_RTC_DATA_LOWER_BOUND) &&
-                (addr < IWL50_RTC_DATA_UPPER_BOUND);
-}
-
-static int iwl5000_send_rxon_assoc(struct iwl_priv *priv)
-{
-        int ret = 0;
-        struct iwl5000_rxon_assoc_cmd rxon_assoc;
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
-
-        if ((rxon1->flags == rxon2->flags) &&
-            (rxon1->filter_flags == rxon2->filter_flags) &&
-            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
-            (rxon1->ofdm_ht_single_stream_basic_rates ==
-             rxon2->ofdm_ht_single_stream_basic_rates) &&
-            (rxon1->ofdm_ht_dual_stream_basic_rates ==
-             rxon2->ofdm_ht_dual_stream_basic_rates) &&
-            (rxon1->ofdm_ht_triple_stream_basic_rates ==
-             rxon2->ofdm_ht_triple_stream_basic_rates) &&
-            (rxon1->acquisition_data == rxon2->acquisition_data) &&
-            (rxon1->rx_chain == rxon2->rx_chain) &&
-            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
-                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
-                return 0;
-        }
-
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
-        rxon_assoc.reserved1 = 0;
-        rxon_assoc.reserved2 = 0;
-        rxon_assoc.reserved3 = 0;
-        rxon_assoc.ofdm_ht_single_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
-        rxon_assoc.ofdm_ht_dual_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
-        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
-        rxon_assoc.ofdm_ht_triple_stream_basic_rates =
-                 priv->staging_rxon.ofdm_ht_triple_stream_basic_rates;
-        rxon_assoc.acquisition_data = priv->staging_rxon.acquisition_data;
-
-        ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
-                                     sizeof(rxon_assoc), &rxon_assoc, NULL);
-        if (ret)
-                return ret;
-
-        return ret;
-}
-int  iwl5000_send_tx_power(struct iwl_priv *priv)
-{
-        struct iwl5000_tx_power_dbm_cmd tx_power_cmd;
-        u8 tx_ant_cfg_cmd;
-
-        /* half dBm need to multiply */
-        tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
-
-        if (priv->tx_power_lmt_in_half_dbm &&
-            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
-                /*
-                 * For the newer devices which using enhanced/extend tx power
-                 * table in EEPROM, the format is in half dBm. driver need to
-                 * convert to dBm format before report to mac80211.
-                 * By doing so, there is a possibility of 1/2 dBm resolution
-                 * lost. driver will perform "round-up" operation before
-                 * reporting, but it will cause 1/2 dBm tx power over the
-                 * regulatory limit. Perform the checking here, if the
-                 * "tx_power_user_lmt" is higher than EEPROM value (in
-                 * half-dBm format), lower the tx power based on EEPROM
-                 */
-                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
-        }
-        tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
-        tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
-
-        if (IWL_UCODE_API(priv->ucode_ver) == 1)
-                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD_V1;
-        else
-                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
-
-        return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
-                                       sizeof(tx_power_cmd), &tx_power_cmd,
-                                       NULL);
-}
-
-void iwl5000_temperature(struct iwl_priv *priv)
-{
-        /* store temperature from statistics (in Celsius) */
-        priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
-        iwl_tt_handler(priv);
-}
-
 static void iwl5150_temperature(struct iwl_priv *priv)
 {
         u32 vt = 0;
@@ -1294,100 +267,6 @@ static void iwl5150_temperature(struct iwl_priv *priv)
         iwl_tt_handler(priv);
 }
 
-/* Calc max signal level (dBm) among 3 possible receivers */
-int iwl5000_calc_rssi(struct iwl_priv *priv,
-                             struct iwl_rx_phy_res *rx_resp)
-{
-        /* data from PHY/DSP regarding signal strength, etc.,
-         *   contents are always there, not configurable by host
-         */
-        struct iwl5000_non_cfg_phy *ncphy =
-                (struct iwl5000_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
-        u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
-        u8 agc;
-
-        val  = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_AGC_IDX]);
-        agc = (val & IWL50_OFDM_AGC_MSK) >> IWL50_OFDM_AGC_BIT_POS;
-
-        /* Find max rssi among 3 possible receivers.
-         * These values are measured by the digital signal processor (DSP).
-         * They should stay fairly constant even as the signal strength varies,
-         *   if the radio's automatic gain control (AGC) is working right.
-         * AGC value (see below) will provide the "interesting" info.
-         */
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_AB_IDX]);
-        rssi_a = (val & IWL50_OFDM_RSSI_A_MSK) >> IWL50_OFDM_RSSI_A_BIT_POS;
-        rssi_b = (val & IWL50_OFDM_RSSI_B_MSK) >> IWL50_OFDM_RSSI_B_BIT_POS;
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_C_IDX]);
-        rssi_c = (val & IWL50_OFDM_RSSI_C_MSK) >> IWL50_OFDM_RSSI_C_BIT_POS;
-
-        max_rssi = max_t(u32, rssi_a, rssi_b);
-        max_rssi = max_t(u32, max_rssi, rssi_c);
-
-        IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
-                rssi_a, rssi_b, rssi_c, max_rssi, agc);
-
-        /* dBm = max_rssi dB - agc dB - constant.
-         * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc - IWL49_RSSI_OFFSET;
-}
-
-static int iwl5000_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
-{
-        struct iwl_tx_ant_config_cmd tx_ant_cmd = {
-          .valid = cpu_to_le32(valid_tx_ant),
-        };
-
-        if (IWL_UCODE_API(priv->ucode_ver) > 1) {
-                IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
-                return iwl_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD,
-                                        sizeof(struct iwl_tx_ant_config_cmd),
-                                        &tx_ant_cmd);
-        } else {
-                IWL_DEBUG_HC(priv, "TX_ANT_CONFIGURATION_CMD not supported\n");
-                return -EOPNOTSUPP;
-        }
-}
-
-
-#define IWL5000_UCODE_GET(item)                                         \
-static u32 iwl5000_ucode_get_##item(const struct iwl_ucode_header *ucode,\
-                                    u32 api_ver)                        \
-{                                                                       \
-        if (api_ver <= 2)                                               \
-                return le32_to_cpu(ucode->u.v1.item);                   \
-        return le32_to_cpu(ucode->u.v2.item);                           \
-}
-
-static u32 iwl5000_ucode_get_header_size(u32 api_ver)
-{
-        if (api_ver <= 2)
-                return UCODE_HEADER_SIZE(1);
-        return UCODE_HEADER_SIZE(2);
-}
-
-static u32 iwl5000_ucode_get_build(const struct iwl_ucode_header *ucode,
-                                   u32 api_ver)
-{
-        if (api_ver <= 2)
-                return 0;
-        return le32_to_cpu(ucode->u.v2.build);
-}
-
-static u8 *iwl5000_ucode_get_data(const struct iwl_ucode_header *ucode,
-                                  u32 api_ver)
-{
-        if (api_ver <= 2)
-                return (u8 *) ucode->u.v1.data;
-        return (u8 *) ucode->u.v2.data;
-}
-
-IWL5000_UCODE_GET(inst_size);
-IWL5000_UCODE_GET(data_size);
-IWL5000_UCODE_GET(init_size);
-IWL5000_UCODE_GET(init_data_size);
-IWL5000_UCODE_GET(boot_size);
-
 static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         struct iwl5000_channel_switch_cmd cmd;
@@ -1420,54 +299,27 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         return iwl_send_cmd_sync(priv, &hcmd);
 }
 
-struct iwl_hcmd_ops iwl5000_hcmd = {
-        .rxon_assoc = iwl5000_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
-        .set_tx_ant = iwl5000_send_tx_ant_config,
-};
-
-struct iwl_hcmd_utils_ops iwl5000_hcmd_utils = {
-        .get_hcmd_size = iwl5000_get_hcmd_size,
-        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
-        .gain_computation = iwl5000_gain_computation,
-        .chain_noise_reset = iwl5000_chain_noise_reset,
-        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
-        .calc_rssi = iwl5000_calc_rssi,
-};
-
-struct iwl_ucode_ops iwl5000_ucode = {
-        .get_header_size = iwl5000_ucode_get_header_size,
-        .get_build = iwl5000_ucode_get_build,
-        .get_inst_size = iwl5000_ucode_get_inst_size,
-        .get_data_size = iwl5000_ucode_get_data_size,
-        .get_init_size = iwl5000_ucode_get_init_size,
-        .get_init_data_size = iwl5000_ucode_get_init_data_size,
-        .get_boot_size = iwl5000_ucode_get_boot_size,
-        .get_data = iwl5000_ucode_get_data,
-};
-
-struct iwl_lib_ops iwl5000_lib = {
+static struct iwl_lib_ops iwl5000_lib = {
         .set_hw_params = iwl5000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .load_ucode = iwl5000_load_ucode,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .load_ucode = iwlagn_load_ucode,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
@@ -1478,50 +330,58 @@ struct iwl_lib_ops iwl5000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl5000_set_ct_threshold,
          },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static struct iwl_lib_ops iwl5150_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .set_hw_params = iwl5150_hw_set_hw_params,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
-        .load_ucode = iwl5000_load_ucode,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .load_ucode = iwlagn_load_ucode,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
@@ -1532,19 +392,19 @@ static struct iwl_lib_ops iwl5150_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
@@ -1553,45 +413,44 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .temperature = iwl5150_temperature,
                 .set_ct_kill = iwl5150_set_ct_threshold,
          },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl5000_ops = {
-        .ucode = &iwl5000_ucode,
         .lib = &iwl5000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 static const struct iwl_ops iwl5150_ops = {
-        .ucode = &iwl5000_ucode,
         .lib = &iwl5150_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_mod_params iwl50_mod_params = {
-        .amsdu_size_8K = 1,
-        .restart_fw = 1,
-        /* the rest are 0 by default */
-};
-
-
 struct iwl_cfg iwl5300_agn_cfg = {
-        .name = "5300AGN",
+        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1603,21 +462,26 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5100_bgn_cfg = {
-        .name = "5100BGN",
+        .name = "Intel(R) WiFi Link 5100 BGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1629,21 +493,26 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
-        .name = "5100ABG",
+        .name = "Intel(R) WiFi Link 5100 ABG",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1653,21 +522,26 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
-        .name = "5100AGN",
+        .name = "Intel(R) WiFi Link 5100 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1679,21 +553,26 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
-        .name = "5350AGN",
+        .name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1705,21 +584,26 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
-        .name = "5150AGN",
+        .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5150_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1731,21 +615,26 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl5150_abg_cfg = {
-        .name = "5150ABG",
+        .name = "Intel(R) WiMAX/WiFi Link 5150 ABG",
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
         .ops = &iwl5150_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1755,20 +644,12 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
-
-module_param_named(swcrypto50, iwl50_mod_params.sw_crypto, bool, S_IRUGO);
-MODULE_PARM_DESC(swcrypto50,
-                  "using software crypto engine (default 0 [hardware])\n");
-module_param_named(queues_num50, iwl50_mod_params.num_of_queues, int, S_IRUGO);
-MODULE_PARM_DESC(queues_num50, "number of hw queues in 50xx series");
-module_param_named(11n_disable50, iwl50_mod_params.disable_11n, int, S_IRUGO);
-MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality");
-module_param_named(amsdu_size_8K50, iwl50_mod_params.amsdu_size_8K,
-                   int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K50, "enable 8K amsdu size in 50XX series");
-module_param_named(fw_restart50, iwl50_mod_params.restart_fw, int, S_IRUGO);
-MODULE_PARM_DESC(fw_restart50, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..9fbf54cd3e1a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -42,18 +42,22 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 #include "iwl-sta.h"
+#include "iwl-agn.h"
 #include "iwl-helpers.h"
-#include "iwl-5000-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-6000-hw.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 4
+#define IWL6000G2_UCODE_API_MAX 4
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
+#define IWL6000G2_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -63,6 +67,11 @@
 #define _IWL6050_MODULE_FIRMWARE(api) IWL6050_FW_PRE #api ".ucode"
 #define IWL6050_MODULE_FIRMWARE(api) _IWL6050_MODULE_FIRMWARE(api)
 
+#define IWL6000G2A_FW_PRE "iwlwifi-6000g2a-"
+#define _IWL6000G2A_MODULE_FIRMWARE(api) IWL6000G2A_FW_PRE #api ".ucode"
+#define IWL6000G2A_MODULE_FIRMWARE(api) _IWL6000G2A_MODULE_FIRMWARE(api)
+
+
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
         /* want Celsius */
@@ -136,7 +145,7 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
 static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -144,7 +153,7 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -168,24 +177,56 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
         priv->hw_params.sens = &iwl6000_sensitivity;
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_6x50:
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_DC)               |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-
-                break;
-        default:
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-                break;
-        }
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
+
+        return 0;
+}
+
+static int iwl6050_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwlagn_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+
+        priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
+
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl6000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_DC)               |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
 
         return 0;
 }
@@ -225,25 +266,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 
 static struct iwl_lib_ops iwl6000_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
@@ -254,60 +295,67 @@ static struct iwl_lib_ops iwl6000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl6000_set_ct_threshold,
          },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl6000_ops = {
-        .ucode = &iwl5000_ucode,
         .lib = &iwl6000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 static struct iwl_lib_ops iwl6050_lib = {
-        .set_hw_params = iwl6000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .set_hw_params = iwl6050_hw_set_hw_params,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
@@ -318,45 +366,90 @@ static struct iwl_lib_ops iwl6050_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl6000_set_ct_threshold,
                 .set_calib_version = iwl6050_set_calib_version,
          },
-        .add_bcast_station = iwl_add_bcast_station,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl6050_ops = {
-        .ucode = &iwl5000_ucode,
         .lib = &iwl6050_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
+
+struct iwl_cfg iwl6000g2a_2agn_cfg = {
+        .name = "6000 Series 2x2 AGN Gen2a",
+        .fw_name_pre = IWL6000G2A_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .ops = &iwl6000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_SYSTEM,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 512,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
+};
+
 /*
  * "i": Internal configuration, use internal Power Amplifier
  */
 struct iwl_cfg iwl6000i_2agn_cfg = {
-        .name = "6000 Series 2x2 AGN",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -364,10 +457,10 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -385,10 +478,15 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
-        .name = "6000 Series 2x2 ABG",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 ABG",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -396,10 +494,10 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -408,7 +506,6 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -416,10 +513,15 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
-        .name = "6000 Series 2x2 BG",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 BG",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -427,10 +529,10 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -439,7 +541,6 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -447,10 +548,15 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
-        .name = "6050 Series 2x2 AGN",
+        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
@@ -458,10 +564,10 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
@@ -479,10 +585,15 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1500,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6050_2abg_cfg = {
-        .name = "6050 Series 2x2 ABG",
+        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 ABG",
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
@@ -490,10 +601,10 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
@@ -502,7 +613,6 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -510,10 +620,15 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1500,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
-        .name = "6000 Series 3x3 AGN",
+        .name = "Intel(R) Centrino(R) Ultimate-N 6300 AGN",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -521,10 +636,10 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = 0,
@@ -542,7 +657,13 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .max_event_log_size = 1024,
+        .ucode_tracing = true,
+        .sensitivity_calib_by_driver = true,
+        .chain_noise_calib_by_driver = true,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL6000G2A_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
new file mode 100644
index 000000000000..48c023b4ca36
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -0,0 +1,850 @@
+/******************************************************************************
+*
+* GPL LICENSE SUMMARY
+*
+* Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of version 2 of the GNU General Public License as
+* published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful, but
+* WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+* General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program; if not, write to the Free Software
+* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+* USA
+*
+* The full GNU General Public License is included in this distribution
+* in the file called LICENSE.GPL.
+*
+* Contact Information:
+*  Intel Linux Wireless <ilw@linux.intel.com>
+* Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+*****************************************************************************/
+
+#include "iwl-agn-debugfs.h"
+
+ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+  {
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
+                    sizeof(struct statistics_rx_non_phy) * 40 +
+                    sizeof(struct statistics_rx_ht_phy) * 40 + 400;
+        ssize_t ret;
+        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
+        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
+        struct statistics_rx_non_phy *general, *accum_general;
+        struct statistics_rx_non_phy *delta_general, *max_general;
+        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * the statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        ofdm = &priv->statistics.rx.ofdm;
+        cck = &priv->statistics.rx.cck;
+        general = &priv->statistics.rx.general;
+        ht = &priv->statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->accum_statistics.rx.ofdm;
+        accum_cck = &priv->accum_statistics.rx.cck;
+        accum_general = &priv->accum_statistics.rx.general;
+        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
+        delta_ofdm = &priv->delta_statistics.rx.ofdm;
+        delta_cck = &priv->delta_statistics.rx.cck;
+        delta_general = &priv->delta_statistics.rx.general;
+        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
+        max_ofdm = &priv->max_delta.rx.ofdm;
+        max_cck = &priv->max_delta.rx.cck;
+        max_general = &priv->max_delta.rx.general;
+        max_ht = &priv->max_delta.rx.ofdm_ht;
+
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         accum_ofdm->ina_cnt,
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err, delta_ofdm->overrun_err,
+                         max_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err,
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good, delta_ofdm->crc32_good,
+                         max_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt,
+                         delta_ofdm->false_alarm_cnt,
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt,
+                         delta_ofdm->fina_sync_err_cnt,
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sfd_timeout:",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout, delta_ofdm->sfd_timeout,
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout, delta_ofdm->fina_timeout,
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts,
+                         delta_ofdm->unresponded_rts,
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun,
+                         delta_ofdm->rxe_frame_limit_overrun,
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt, delta_ofdm->sent_ack_cnt,
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt, delta_ofdm->sent_cts_cnt,
+                         max_ofdm->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ba_rsp_cnt:",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
+                         accum_ofdm->sent_ba_rsp_cnt,
+                         delta_ofdm->sent_ba_rsp_cnt,
+                         max_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         le32_to_cpu(ofdm->dsp_self_kill),
+                         accum_ofdm->dsp_self_kill,
+                         delta_ofdm->dsp_self_kill,
+                         max_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "mh_format_err:",
+                         le32_to_cpu(ofdm->mh_format_err),
+                         accum_ofdm->mh_format_err,
+                         delta_ofdm->mh_format_err,
+                         max_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
+                         accum_ofdm->re_acq_main_rssi_sum,
+                         delta_ofdm->re_acq_main_rssi_sum,
+                         max_ofdm->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err, delta_cck->overrun_err,
+                         max_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err,
+                         delta_cck->early_overrun_err,
+                         max_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good, max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "false_alarm_cnt:",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt,
+                         delta_cck->fina_sync_err_cnt,
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout, delta_cck->sfd_timeout,
+                         max_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout, delta_cck->fina_timeout,
+                         max_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts, delta_cck->unresponded_rts,
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun,
+                         delta_cck->rxe_frame_limit_overrun,
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt, delta_cck->sent_ack_cnt,
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt, delta_cck->sent_cts_cnt,
+                         max_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ba_rsp_cnt:",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt),
+                         accum_cck->sent_ba_rsp_cnt,
+                         delta_cck->sent_ba_rsp_cnt,
+                         max_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         le32_to_cpu(cck->dsp_self_kill),
+                         accum_cck->dsp_self_kill, delta_cck->dsp_self_kill,
+                         max_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "mh_format_err:",
+                         le32_to_cpu(cck->mh_format_err),
+                         accum_cck->mh_format_err, delta_cck->mh_format_err,
+                         max_cck->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum),
+                         accum_cck->re_acq_main_rssi_sum,
+                         delta_cck->re_acq_main_rssi_sum,
+                         max_cck->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_cts:",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts, delta_general->bogus_cts,
+                         max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_ack:",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack, delta_general->bogus_ack,
+                         max_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_bssid_frames:",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames,
+                         delta_general->non_bssid_frames,
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "filtered_frames:",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames,
+                         delta_general->filtered_frames,
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_channel_beacons:",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons,
+                         delta_general->non_channel_beacons,
+                         max_general->non_channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "channel_beacons:",
+                         le32_to_cpu(general->channel_beacons),
+                         accum_general->channel_beacons,
+                         delta_general->channel_beacons,
+                         max_general->channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "num_missed_bcon:",
+                         le32_to_cpu(general->num_missed_bcon),
+                         accum_general->num_missed_bcon,
+                         delta_general->num_missed_bcon,
+                         max_general->num_missed_bcon);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "adc_rx_saturation_time:",
+                         le32_to_cpu(general->adc_rx_saturation_time),
+                         accum_general->adc_rx_saturation_time,
+                         delta_general->adc_rx_saturation_time,
+                         max_general->adc_rx_saturation_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_detect_search_tm:",
+                         le32_to_cpu(general->ina_detection_search_time),
+                         accum_general->ina_detection_search_time,
+                         delta_general->ina_detection_search_time,
+                         max_general->ina_detection_search_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_a:",
+                         le32_to_cpu(general->beacon_silence_rssi_a),
+                         accum_general->beacon_silence_rssi_a,
+                         delta_general->beacon_silence_rssi_a,
+                         max_general->beacon_silence_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_b:",
+                         le32_to_cpu(general->beacon_silence_rssi_b),
+                         accum_general->beacon_silence_rssi_b,
+                         delta_general->beacon_silence_rssi_b,
+                         max_general->beacon_silence_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_c:",
+                         le32_to_cpu(general->beacon_silence_rssi_c),
+                         accum_general->beacon_silence_rssi_c,
+                         delta_general->beacon_silence_rssi_c,
+                         max_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "interference_data_flag:",
+                         le32_to_cpu(general->interference_data_flag),
+                         accum_general->interference_data_flag,
+                         delta_general->interference_data_flag,
+                         max_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "channel_load:",
+                         le32_to_cpu(general->channel_load),
+                         accum_general->channel_load,
+                         delta_general->channel_load,
+                         max_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "dsp_false_alarms:",
+                         le32_to_cpu(general->dsp_false_alarms),
+                         accum_general->dsp_false_alarms,
+                         delta_general->dsp_false_alarms,
+                         max_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_a:",
+                         le32_to_cpu(general->beacon_rssi_a),
+                         accum_general->beacon_rssi_a,
+                         delta_general->beacon_rssi_a,
+                         max_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_b:",
+                         le32_to_cpu(general->beacon_rssi_b),
+                         accum_general->beacon_rssi_b,
+                         delta_general->beacon_rssi_b,
+                         max_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_c:",
+                         le32_to_cpu(general->beacon_rssi_c),
+                         accum_general->beacon_rssi_c,
+                         delta_general->beacon_rssi_c,
+                         max_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_a:",
+                         le32_to_cpu(general->beacon_energy_a),
+                         accum_general->beacon_energy_a,
+                         delta_general->beacon_energy_a,
+                         max_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_b:",
+                         le32_to_cpu(general->beacon_energy_b),
+                         accum_general->beacon_energy_b,
+                         delta_general->beacon_energy_b,
+                         max_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_c:",
+                         le32_to_cpu(general->beacon_energy_c),
+                         accum_general->beacon_energy_c,
+                         delta_general->beacon_energy_c,
+                         max_general->beacon_energy_c);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM_HT:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
+                         delta_ht->plcp_err, max_ht->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
+                         delta_ht->overrun_err, max_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ht->early_overrun_err),
+                         accum_ht->early_overrun_err,
+                         delta_ht->early_overrun_err,
+                         max_ht->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
+                         delta_ht->crc32_good, max_ht->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
+                         delta_ht->crc32_err, max_ht->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "mh_format_err:",
+                         le32_to_cpu(ht->mh_format_err),
+                         accum_ht->mh_format_err,
+                         delta_ht->mh_format_err, max_ht->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_crc32_good:",
+                         le32_to_cpu(ht->agg_crc32_good),
+                         accum_ht->agg_crc32_good,
+                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_mpdu_cnt:",
+                         le32_to_cpu(ht->agg_mpdu_cnt),
+                         accum_ht->agg_mpdu_cnt,
+                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_cnt:",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
+                         delta_ht->agg_cnt, max_ht->agg_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unsupport_mcs:",
+                         le32_to_cpu(ht->unsupport_mcs),
+                         accum_ht->unsupport_mcs,
+                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl_ucode_tx_stats_read(struct file *file,
+                                char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
+        ssize_t ret;
+        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+          * the last statistics notification from uCode
+          * might not reflect the current uCode activity
+          */
+        tx = &priv->statistics.tx;
+        accum_tx = &priv->accum_statistics.tx;
+        delta_tx = &priv->delta_statistics.tx;
+        max_tx = &priv->max_delta.tx;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos,  "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "preamble:",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_detected_cnt:",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_defer_cnt:",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt,
+                         delta_tx->bt_prio_defer_cnt,
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_kill_cnt:",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt,
+                         delta_tx->bt_prio_kill_cnt,
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "few_bytes_cnt:",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout:",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_timeout:",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "expected_ack_cnt:",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt,
+                         delta_tx->expected_ack_cnt,
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "actual_ack_cnt:",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt,
+                         delta_tx->actual_ack_cnt,
+                         max_tx->actual_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "dump_msdu_cnt:",
+                         le32_to_cpu(tx->dump_msdu_cnt),
+                         accum_tx->dump_msdu_cnt,
+                         delta_tx->dump_msdu_cnt,
+                         max_tx->dump_msdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "abort_nxt_frame_mismatch:",
+                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
+                         accum_tx->burst_abort_next_frame_mismatch_cnt,
+                         delta_tx->burst_abort_next_frame_mismatch_cnt,
+                         max_tx->burst_abort_next_frame_mismatch_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "abort_missing_nxt_frame:",
+                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
+                         accum_tx->burst_abort_missing_next_frame_cnt,
+                         delta_tx->burst_abort_missing_next_frame_cnt,
+                         max_tx->burst_abort_missing_next_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout_collision:",
+                         le32_to_cpu(tx->cts_timeout_collision),
+                         accum_tx->cts_timeout_collision,
+                         delta_tx->cts_timeout_collision,
+                         max_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_ba_timeout_collision:",
+                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
+                         accum_tx->ack_or_ba_timeout_collision,
+                         delta_tx->ack_or_ba_timeout_collision,
+                         max_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg ba_timeout:",
+                         le32_to_cpu(tx->agg.ba_timeout),
+                         accum_tx->agg.ba_timeout,
+                         delta_tx->agg.ba_timeout,
+                         max_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg ba_resched_frames:",
+                         le32_to_cpu(tx->agg.ba_reschedule_frames),
+                         accum_tx->agg.ba_reschedule_frames,
+                         delta_tx->agg.ba_reschedule_frames,
+                         max_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_agg_frame:",
+                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
+                         accum_tx->agg.scd_query_agg_frame_cnt,
+                         delta_tx->agg.scd_query_agg_frame_cnt,
+                         max_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_no_agg:",
+                         le32_to_cpu(tx->agg.scd_query_no_agg),
+                         accum_tx->agg.scd_query_no_agg,
+                         delta_tx->agg.scd_query_no_agg,
+                         max_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_agg:",
+                         le32_to_cpu(tx->agg.scd_query_agg),
+                         accum_tx->agg.scd_query_agg,
+                         delta_tx->agg.scd_query_agg,
+                         max_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_mismatch:",
+                         le32_to_cpu(tx->agg.scd_query_mismatch),
+                         accum_tx->agg.scd_query_mismatch,
+                         delta_tx->agg.scd_query_mismatch,
+                         max_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg frame_not_ready:",
+                         le32_to_cpu(tx->agg.frame_not_ready),
+                         accum_tx->agg.frame_not_ready,
+                         delta_tx->agg.frame_not_ready,
+                         max_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg underrun:",
+                         le32_to_cpu(tx->agg.underrun),
+                         accum_tx->agg.underrun,
+                         delta_tx->agg.underrun, max_tx->agg.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg bt_prio_kill:",
+                         le32_to_cpu(tx->agg.bt_prio_kill),
+                         accum_tx->agg.bt_prio_kill,
+                         delta_tx->agg.bt_prio_kill,
+                         max_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg rx_ba_rsp_cnt:",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
+                         accum_tx->agg.rx_ba_rsp_cnt,
+                         delta_tx->agg.rx_ba_rsp_cnt,
+                         max_tx->agg.rx_ba_rsp_cnt);
+
+        if (tx->tx_power.ant_a || tx->tx_power.ant_b || tx->tx_power.ant_c) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                        "tx power: (1/2 dB step)\n");
+                if ((priv->cfg->valid_tx_ant & ANT_A) && tx->tx_power.ant_a)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                        "\tantenna A: 0x%X\n",
+                                        tx->tx_power.ant_a);
+                if ((priv->cfg->valid_tx_ant & ANT_B) && tx->tx_power.ant_b)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                        "\tantenna B: 0x%X\n",
+                                        tx->tx_power.ant_b);
+                if ((priv->cfg->valid_tx_ant & ANT_C) && tx->tx_power.ant_c)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                        "\tantenna C: 0x%X\n",
+                                        tx->tx_power.ant_c);
+        }
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_general) * 10 + 300;
+        ssize_t ret;
+        struct statistics_general *general, *accum_general;
+        struct statistics_general *delta_general, *max_general;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct statistics_div *div, *accum_div, *delta_div, *max_div;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+          * the last statistics notification from uCode
+          * might not reflect the current uCode activity
+          */
+        general = &priv->statistics.general;
+        dbg = &priv->statistics.general.dbg;
+        div = &priv->statistics.general.div;
+        accum_general = &priv->accum_statistics.general;
+        delta_general = &priv->delta_statistics.general;
+        max_general = &priv->max_delta.general;
+        accum_dbg = &priv->accum_statistics.general.dbg;
+        delta_dbg = &priv->delta_statistics.general.dbg;
+        max_dbg = &priv->max_delta.general.dbg;
+        accum_div = &priv->accum_statistics.general.div;
+        delta_div = &priv->delta_statistics.general.div;
+        max_div = &priv->max_delta.general.div;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
+                         "temperature:",
+                         le32_to_cpu(general->temperature));
+        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
+                         "temperature_m:",
+                         le32_to_cpu(general->temperature_m));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_check:",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check,
+                         delta_dbg->burst_check, max_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_count:",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count,
+                         delta_dbg->burst_count, max_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sleep_time:",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time,
+                         delta_general->sleep_time, max_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_out:",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out,
+                         delta_general->slots_out, max_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_idle:",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_a:",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
+                         delta_div->tx_on_a, max_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_b:",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
+                         delta_div->tx_on_b, max_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "exec_time:",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_enable_counter:",
+                         le32_to_cpu(general->rx_enable_counter),
+                         accum_general->rx_enable_counter,
+                         delta_general->rx_enable_counter,
+                         max_general->rx_enable_counter);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "num_of_sos_states:",
+                         le32_to_cpu(general->num_of_sos_states),
+                         accum_general->num_of_sos_states,
+                         delta_general->num_of_sos_states,
+                         max_general->num_of_sos_states);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
new file mode 100644
index 000000000000..59b1f25f0d85
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
@@ -0,0 +1,56 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-debug.h"
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
+ssize_t iwl_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
+ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos);
+#else
+static ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
new file mode 100644
index 000000000000..44ef5d93befc
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -0,0 +1,276 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-agn.h"
+
+static int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
+{
+        int ret = 0;
+        struct iwl5000_rxon_assoc_cmd rxon_assoc;
+        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
+        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+
+        if ((rxon1->flags == rxon2->flags) &&
+            (rxon1->filter_flags == rxon2->filter_flags) &&
+            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
+            (rxon1->ofdm_ht_single_stream_basic_rates ==
+             rxon2->ofdm_ht_single_stream_basic_rates) &&
+            (rxon1->ofdm_ht_dual_stream_basic_rates ==
+             rxon2->ofdm_ht_dual_stream_basic_rates) &&
+            (rxon1->ofdm_ht_triple_stream_basic_rates ==
+             rxon2->ofdm_ht_triple_stream_basic_rates) &&
+            (rxon1->acquisition_data == rxon2->acquisition_data) &&
+            (rxon1->rx_chain == rxon2->rx_chain) &&
+            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
+                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
+                return 0;
+        }
+
+        rxon_assoc.flags = priv->staging_rxon.flags;
+        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
+        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.reserved1 = 0;
+        rxon_assoc.reserved2 = 0;
+        rxon_assoc.reserved3 = 0;
+        rxon_assoc.ofdm_ht_single_stream_basic_rates =
+            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
+        rxon_assoc.ofdm_ht_dual_stream_basic_rates =
+            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
+        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
+        rxon_assoc.ofdm_ht_triple_stream_basic_rates =
+                 priv->staging_rxon.ofdm_ht_triple_stream_basic_rates;
+        rxon_assoc.acquisition_data = priv->staging_rxon.acquisition_data;
+
+        ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
+                                     sizeof(rxon_assoc), &rxon_assoc, NULL);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
+static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
+{
+        struct iwl_tx_ant_config_cmd tx_ant_cmd = {
+          .valid = cpu_to_le32(valid_tx_ant),
+        };
+
+        if (IWL_UCODE_API(priv->ucode_ver) > 1) {
+                IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
+                return iwl_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD,
+                                        sizeof(struct iwl_tx_ant_config_cmd),
+                                        &tx_ant_cmd);
+        } else {
+                IWL_DEBUG_HC(priv, "TX_ANT_CONFIGURATION_CMD not supported\n");
+                return -EOPNOTSUPP;
+        }
+}
+
+/* Currently this is the superset of everything */
+static u16 iwlagn_get_hcmd_size(u8 cmd_id, u16 len)
+{
+        return len;
+}
+
+static u16 iwlagn_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
+{
+        u16 size = (u16)sizeof(struct iwl_addsta_cmd);
+        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
+        memcpy(addsta, cmd, size);
+        /* resrved in 5000 */
+        addsta->rate_n_flags = cpu_to_le16(0);
+        return size;
+}
+
+static void iwlagn_gain_computation(struct iwl_priv *priv,
+                u32 average_noise[NUM_RX_CHAINS],
+                u16 min_average_noise_antenna_i,
+                u32 min_average_noise,
+                u8 default_chain)
+{
+        int i;
+        s32 delta_g;
+        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
+
+        /*
+         * Find Gain Code for the chains based on "default chain"
+         */
+        for (i = default_chain + 1; i < NUM_RX_CHAINS; i++) {
+                if ((data->disconn_array[i])) {
+                        data->delta_gain_code[i] = 0;
+                        continue;
+                }
+
+                delta_g = (priv->cfg->chain_noise_scale *
+                        ((s32)average_noise[default_chain] -
+                        (s32)average_noise[i])) / 1500;
+
+                /* bound gain by 2 bits value max, 3rd bit is sign */
+                data->delta_gain_code[i] =
+                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
+
+                if (delta_g < 0)
+                        /*
+                         * set negative sign ...
+                         * note to Intel developers:  This is uCode API format,
+                         *   not the format of any internal device registers.
+                         *   Do not change this format for e.g. 6050 or similar
+                         *   devices.  Change format only if more resolution
+                         *   (i.e. more than 2 bits magnitude) is needed.
+                         */
+                        data->delta_gain_code[i] |= (1 << 2);
+        }
+
+        IWL_DEBUG_CALIB(priv, "Delta gains: ANT_B = %d  ANT_C = %d\n",
+                        data->delta_gain_code[1], data->delta_gain_code[2]);
+
+        if (!data->radio_write) {
+                struct iwl_calib_chain_noise_gain_cmd cmd;
+
+                memset(&cmd, 0, sizeof(cmd));
+
+                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_GAIN_CMD;
+                cmd.hdr.first_group = 0;
+                cmd.hdr.groups_num = 1;
+                cmd.hdr.data_valid = 1;
+                cmd.delta_gain_1 = data->delta_gain_code[1];
+                cmd.delta_gain_2 = data->delta_gain_code[2];
+                iwl_send_cmd_pdu_async(priv, REPLY_PHY_CALIBRATION_CMD,
+                        sizeof(cmd), &cmd, NULL);
+
+                data->radio_write = 1;
+                data->state = IWL_CHAIN_NOISE_CALIBRATED;
+        }
+
+        data->chain_noise_a = 0;
+        data->chain_noise_b = 0;
+        data->chain_noise_c = 0;
+        data->chain_signal_a = 0;
+        data->chain_signal_b = 0;
+        data->chain_signal_c = 0;
+        data->beacon_count = 0;
+}
+
+static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
+{
+        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
+        int ret;
+
+        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
+                struct iwl_calib_chain_noise_reset_cmd cmd;
+                memset(&cmd, 0, sizeof(cmd));
+
+                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD;
+                cmd.hdr.first_group = 0;
+                cmd.hdr.groups_num = 1;
+                cmd.hdr.data_valid = 1;
+                ret = iwl_send_cmd_pdu(priv, REPLY_PHY_CALIBRATION_CMD,
+                                        sizeof(cmd), &cmd);
+                if (ret)
+                        IWL_ERR(priv,
+                                "Could not send REPLY_PHY_CALIBRATION_CMD\n");
+                data->state = IWL_CHAIN_NOISE_ACCUMULATE;
+                IWL_DEBUG_CALIB(priv, "Run chain_noise_calibrate\n");
+        }
+}
+
+static void iwlagn_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                        __le32 *tx_flags)
+{
+        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
+        else
+                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
+}
+
+/* Calc max signal level (dBm) among 3 possible receivers */
+static int iwlagn_calc_rssi(struct iwl_priv *priv,
+                             struct iwl_rx_phy_res *rx_resp)
+{
+        /* data from PHY/DSP regarding signal strength, etc.,
+         *   contents are always there, not configurable by host
+         */
+        struct iwl5000_non_cfg_phy *ncphy =
+                (struct iwl5000_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
+        u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
+        u8 agc;
+
+        val  = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_AGC_IDX]);
+        agc = (val & IWL50_OFDM_AGC_MSK) >> IWL50_OFDM_AGC_BIT_POS;
+
+        /* Find max rssi among 3 possible receivers.
+         * These values are measured by the digital signal processor (DSP).
+         * They should stay fairly constant even as the signal strength varies,
+         *   if the radio's automatic gain control (AGC) is working right.
+         * AGC value (see below) will provide the "interesting" info.
+         */
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_AB_IDX]);
+        rssi_a = (val & IWL50_OFDM_RSSI_A_MSK) >> IWL50_OFDM_RSSI_A_BIT_POS;
+        rssi_b = (val & IWL50_OFDM_RSSI_B_MSK) >> IWL50_OFDM_RSSI_B_BIT_POS;
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_C_IDX]);
+        rssi_c = (val & IWL50_OFDM_RSSI_C_MSK) >> IWL50_OFDM_RSSI_C_BIT_POS;
+
+        max_rssi = max_t(u32, rssi_a, rssi_b);
+        max_rssi = max_t(u32, max_rssi, rssi_c);
+
+        IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
+                rssi_a, rssi_b, rssi_c, max_rssi, agc);
+
+        /* dBm = max_rssi dB - agc dB - constant.
+         * Higher AGC (higher radio gain) means lower signal. */
+        return max_rssi - agc - IWLAGN_RSSI_OFFSET;
+}
+
+struct iwl_hcmd_ops iwlagn_hcmd = {
+        .rxon_assoc = iwlagn_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
+        .set_tx_ant = iwlagn_send_tx_ant_config,
+        .send_bt_config = iwl_send_bt_config,
+};
+
+struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
+        .get_hcmd_size = iwlagn_get_hcmd_size,
+        .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
+        .gain_computation = iwlagn_gain_computation,
+        .chain_noise_reset = iwlagn_chain_noise_reset,
+        .rts_tx_cmd_flag = iwlagn_rts_tx_cmd_flag,
+        .calc_rssi = iwlagn_calc_rssi,
+        .request_scan = iwlagn_request_scan,
+};
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
new file mode 100644
index 000000000000..f9a3fbb6338f
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -0,0 +1,118 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+/*
+ * Please use this file (iwl-agn-hw.h) only for hardware-related definitions.
+ */
+
+#ifndef __iwl_agn_hw_h__
+#define __iwl_agn_hw_h__
+
+#define IWLAGN_RTC_INST_LOWER_BOUND             (0x000000)
+#define IWLAGN_RTC_INST_UPPER_BOUND             (0x020000)
+
+#define IWLAGN_RTC_DATA_LOWER_BOUND             (0x800000)
+#define IWLAGN_RTC_DATA_UPPER_BOUND             (0x80C000)
+
+#define IWLAGN_RTC_INST_SIZE (IWLAGN_RTC_INST_UPPER_BOUND - \
+                                IWLAGN_RTC_INST_LOWER_BOUND)
+#define IWLAGN_RTC_DATA_SIZE (IWLAGN_RTC_DATA_UPPER_BOUND - \
+                                IWLAGN_RTC_DATA_LOWER_BOUND)
+
+/* RSSI to dBm */
+#define IWLAGN_RSSI_OFFSET      44
+
+/* PCI registers */
+#define PCI_CFG_RETRY_TIMEOUT   0x041
+
+/* PCI register values */
+#define PCI_CFG_LINK_CTRL_VAL_L0S_EN    0x01
+#define PCI_CFG_LINK_CTRL_VAL_L1_EN     0x02
+
+#define IWLAGN_DEFAULT_TX_RETRY  15
+
+/* Limit range of txpower output target to be between these values */
+#define IWLAGN_TX_POWER_TARGET_POWER_MIN        (0)     /* 0 dBm: 1 milliwatt */
+#define IWLAGN_TX_POWER_TARGET_POWER_MAX        (16)    /* 16 dBm */
+
+/* EEPROM */
+#define IWLAGN_EEPROM_IMG_SIZE          2048
+
+#define IWLAGN_CMD_FIFO_NUM             7
+#define IWLAGN_NUM_QUEUES               20
+#define IWLAGN_NUM_AMPDU_QUEUES         10
+#define IWLAGN_FIRST_AMPDU_QUEUE        10
+
+/* Fixed (non-configurable) rx data from phy */
+
+/**
+ * struct iwlagn_schedq_bc_tbl scheduler byte count table
+ *      base physical address provided by SCD_DRAM_BASE_ADDR
+ * @tfd_offset  0-12 - tx command byte count
+ *             12-16 - station index
+ */
+struct iwlagn_scd_bc_tbl {
+        __le16 tfd_offset[TFD_QUEUE_BC_SIZE];
+} __attribute__ ((packed));
+
+
+#endif /* __iwl_agn_hw_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
new file mode 100644
index 000000000000..a273e373b7b0
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
@@ -0,0 +1,307 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/sched.h>
+#include <net/mac80211.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-agn.h"
+#include "iwl-helpers.h"
+
+#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
+
+/* Free dram table */
+void iwl_free_isr_ict(struct iwl_priv *priv)
+{
+        if (priv->_agn.ict_tbl_vir) {
+                dma_free_coherent(&priv->pci_dev->dev,
+                                  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                  priv->_agn.ict_tbl_vir,
+                                  priv->_agn.ict_tbl_dma);
+                priv->_agn.ict_tbl_vir = NULL;
+        }
+}
+
+
+/* allocate dram shared table it is a PAGE_SIZE aligned
+ * also reset all data related to ICT table interrupt.
+ */
+int iwl_alloc_isr_ict(struct iwl_priv *priv)
+{
+
+        if (priv->cfg->use_isr_legacy)
+                return 0;
+        /* allocate shrared data table */
+        priv->_agn.ict_tbl_vir =
+                dma_alloc_coherent(&priv->pci_dev->dev,
+                                   (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                   &priv->_agn.ict_tbl_dma, GFP_KERNEL);
+        if (!priv->_agn.ict_tbl_vir)
+                return -ENOMEM;
+
+        /* align table to PAGE_SIZE boundry */
+        priv->_agn.aligned_ict_tbl_dma = ALIGN(priv->_agn.ict_tbl_dma, PAGE_SIZE);
+
+        IWL_DEBUG_ISR(priv, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+                             (unsigned long long)priv->_agn.ict_tbl_dma,
+                             (unsigned long long)priv->_agn.aligned_ict_tbl_dma,
+                        (int)(priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma));
+
+        priv->_agn.ict_tbl =  priv->_agn.ict_tbl_vir +
+                          (priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma);
+
+        IWL_DEBUG_ISR(priv, "ict vir addr %p vir aligned %p diff %d\n",
+                             priv->_agn.ict_tbl, priv->_agn.ict_tbl_vir,
+                        (int)(priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma));
+
+        /* reset table and index to all 0 */
+        memset(priv->_agn.ict_tbl_vir,0, (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
+        priv->_agn.ict_index = 0;
+
+        /* add periodic RX interrupt */
+        priv->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
+        return 0;
+}
+
+/* Device is going up inform it about using ICT interrupt table,
+ * also we need to tell the driver to start using ICT interrupt.
+ */
+int iwl_reset_ict(struct iwl_priv *priv)
+{
+        u32 val;
+        unsigned long flags;
+
+        if (!priv->_agn.ict_tbl_vir)
+                return 0;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwl_disable_interrupts(priv);
+
+        memset(&priv->_agn.ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
+
+        val = priv->_agn.aligned_ict_tbl_dma >> PAGE_SHIFT;
+
+        val |= CSR_DRAM_INT_TBL_ENABLE;
+        val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+
+        IWL_DEBUG_ISR(priv, "CSR_DRAM_INT_TBL_REG =0x%X "
+                        "aligned dma address %Lx\n",
+                        val, (unsigned long long)priv->_agn.aligned_ict_tbl_dma);
+
+        iwl_write32(priv, CSR_DRAM_INT_TBL_REG, val);
+        priv->_agn.use_ict = true;
+        priv->_agn.ict_index = 0;
+        iwl_write32(priv, CSR_INT, priv->inta_mask);
+        iwl_enable_interrupts(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+
+/* Device is going down disable ict interrupt usage */
+void iwl_disable_ict(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->_agn.use_ict = false;
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static irqreturn_t iwl_isr(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        unsigned long flags;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        u32 inta_fh;
+#endif
+        if (!priv)
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         *    back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here. */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(priv, CSR_INT);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!inta) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /* Hardware disappeared. It might have already raised
+                 * an interrupt */
+                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                goto unplugged;
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
+                inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
+                IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
+                              "fh 0x%08x\n", inta, inta_mask, inta_fh);
+        }
+#endif
+
+        priv->_agn.inta |= inta;
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+ unplugged:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service. */
+        /* only Re-enable if diabled by irq  and no schedules tasklet. */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_NONE;
+}
+
+/* interrupt handler using ict table, with this interrupt driver will
+ * stop using INTA register to get device's interrupt, reading this register
+ * is expensive, device will write interrupts in ICT dram table, increment
+ * index then will fire interrupt to driver, driver will OR all ICT table
+ * entries from current index up to table entry with 0 value. the result is
+ * the interrupt we need to service, driver will set the entries back to 0 and
+ * set index.
+ */
+irqreturn_t iwl_isr_ict(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        u32 val = 0;
+        unsigned long flags;
+
+        if (!priv)
+                return IRQ_NONE;
+
+        /* dram interrupt table not set yet,
+         * use legacy interrupt.
+         */
+        if (!priv->_agn.use_ict)
+                return iwl_isr(irq, data);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         * back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here.
+         */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!priv->_agn.ict_tbl[priv->_agn.ict_index]) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        /* read all entries that not 0 start with ict_index */
+        while (priv->_agn.ict_tbl[priv->_agn.ict_index]) {
+
+                val |= le32_to_cpu(priv->_agn.ict_tbl[priv->_agn.ict_index]);
+                IWL_DEBUG_ISR(priv, "ICT index %d value 0x%08X\n",
+                                priv->_agn.ict_index,
+                                le32_to_cpu(priv->_agn.ict_tbl[priv->_agn.ict_index]));
+                priv->_agn.ict_tbl[priv->_agn.ict_index] = 0;
+                priv->_agn.ict_index = iwl_queue_inc_wrap(priv->_agn.ict_index,
+                                                     ICT_COUNT);
+
+        }
+
+        /* We should not get this value, just ignore it. */
+        if (val == 0xffffffff)
+                val = 0;
+
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
+
+        inta = (0xff & val) | ((0xff00 & val) << 16);
+        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
+                        inta, inta_mask, val);
+
+        inta &= priv->inta_mask;
+        priv->_agn.inta |= inta;
+
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta) {
+                /* Allow interrupt if was disabled by this handler and
+                 * no tasklet was schedules, We should not enable interrupt,
+                 * tasklet will enable it.
+                 */
+                iwl_enable_interrupts(priv);
+        }
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service.
+         * only Re-enable if disabled by irq.
+         */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_NONE;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
new file mode 100644
index 000000000000..1004cfc403b1
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -0,0 +1,1530 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+#include <linux/etherdevice.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+#include "iwl-sta.h"
+
+static inline u32 iwlagn_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
+{
+        return le32_to_cpup((__le32 *)&tx_resp->status +
+                            tx_resp->frame_count) & MAX_SN;
+}
+
+static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
+                                      struct iwl_ht_agg *agg,
+                                      struct iwl5000_tx_resp *tx_resp,
+                                      int txq_id, u16 start_idx)
+{
+        u16 status;
+        struct agg_tx_status *frame_status = &tx_resp->status;
+        struct ieee80211_tx_info *info = NULL;
+        struct ieee80211_hdr *hdr = NULL;
+        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
+        int i, sh, idx;
+        u16 seq;
+
+        if (agg->wait_for_ba)
+                IWL_DEBUG_TX_REPLY(priv, "got tx response w/o block-ack\n");
+
+        agg->frame_count = tx_resp->frame_count;
+        agg->start_idx = start_idx;
+        agg->rate_n_flags = rate_n_flags;
+        agg->bitmap = 0;
+
+        /* # frames attempted by Tx command */
+        if (agg->frame_count == 1) {
+                /* Only one frame was attempted; no block-ack will arrive */
+                status = le16_to_cpu(frame_status[0].status);
+                idx = start_idx;
+
+                /* FIXME: code repetition */
+                IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
+                                   agg->frame_count, agg->start_idx, idx);
+
+                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
+                info->status.rates[0].count = tx_resp->failure_frame + 1;
+                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+                info->flags |= iwl_tx_status_to_mac80211(status);
+                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
+
+                /* FIXME: code repetition end */
+
+                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
+                                    status & 0xff, tx_resp->failure_frame);
+                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
+
+                agg->wait_for_ba = 0;
+        } else {
+                /* Two or more frames were attempted; expect block-ack */
+                u64 bitmap = 0;
+                int start = agg->start_idx;
+
+                /* Construct bit-map of pending frames within Tx window */
+                for (i = 0; i < agg->frame_count; i++) {
+                        u16 sc;
+                        status = le16_to_cpu(frame_status[i].status);
+                        seq  = le16_to_cpu(frame_status[i].sequence);
+                        idx = SEQ_TO_INDEX(seq);
+                        txq_id = SEQ_TO_QUEUE(seq);
+
+                        if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
+                                      AGG_TX_STATE_ABORT_MSK))
+                                continue;
+
+                        IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
+                                           agg->frame_count, txq_id, idx);
+
+                        hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
+                        if (!hdr) {
+                                IWL_ERR(priv,
+                                        "BUG_ON idx doesn't point to valid skb"
+                                        " idx=%d, txq_id=%d\n", idx, txq_id);
+                                return -1;
+                        }
+
+                        sc = le16_to_cpu(hdr->seq_ctrl);
+                        if (idx != (SEQ_TO_SN(sc) & 0xff)) {
+                                IWL_ERR(priv,
+                                        "BUG_ON idx doesn't match seq control"
+                                        " idx=%d, seq_idx=%d, seq=%d\n",
+                                          idx, SEQ_TO_SN(sc),
+                                          hdr->seq_ctrl);
+                                return -1;
+                        }
+
+                        IWL_DEBUG_TX_REPLY(priv, "AGG Frame i=%d idx %d seq=%d\n",
+                                           i, idx, SEQ_TO_SN(sc));
+
+                        sh = idx - start;
+                        if (sh > 64) {
+                                sh = (start - idx) + 0xff;
+                                bitmap = bitmap << sh;
+                                sh = 0;
+                                start = idx;
+                        } else if (sh < -64)
+                                sh  = 0xff - (start - idx);
+                        else if (sh < 0) {
+                                sh = start - idx;
+                                start = idx;
+                                bitmap = bitmap << sh;
+                                sh = 0;
+                        }
+                        bitmap |= 1ULL << sh;
+                        IWL_DEBUG_TX_REPLY(priv, "start=%d bitmap=0x%llx\n",
+                                           start, (unsigned long long)bitmap);
+                }
+
+                agg->bitmap = bitmap;
+                agg->start_idx = start;
+                IWL_DEBUG_TX_REPLY(priv, "Frames %d start_idx=%d bitmap=0x%llx\n",
+                                   agg->frame_count, agg->start_idx,
+                                   (unsigned long long)agg->bitmap);
+
+                if (bitmap)
+                        agg->wait_for_ba = 1;
+        }
+        return 0;
+}
+
+void iwl_check_abort_status(struct iwl_priv *priv,
+                            u8 frame_count, u32 status)
+{
+        if (frame_count == 1 && status == TX_STATUS_FAIL_RFKILL_FLUSH) {
+                IWL_ERR(priv, "TODO: Implement Tx flush command!!!\n");
+        }
+}
+
+static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
+        int txq_id = SEQ_TO_QUEUE(sequence);
+        int index = SEQ_TO_INDEX(sequence);
+        struct iwl_tx_queue *txq = &priv->txq[txq_id];
+        struct ieee80211_tx_info *info;
+        struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+        u32  status = le16_to_cpu(tx_resp->status.status);
+        int tid;
+        int sta_id;
+        int freed;
+
+        if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
+                IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
+                          "is out of range [0-%d] %d %d\n", txq_id,
+                          index, txq->q.n_bd, txq->q.write_ptr,
+                          txq->q.read_ptr);
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
+        memset(&info->status, 0, sizeof(info->status));
+
+        tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
+        sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
+
+        if (txq->sched_retry) {
+                const u32 scd_ssn = iwlagn_get_scd_ssn(tx_resp);
+                struct iwl_ht_agg *agg = NULL;
+
+                agg = &priv->stations[sta_id].tid[tid].agg;
+
+                iwlagn_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
+
+                /* check if BAR is needed */
+                if ((tx_resp->frame_count == 1) && !iwl_is_tx_success(status))
+                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+
+                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
+                        index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
+                        IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim "
+                                        "scd_ssn=%d idx=%d txq=%d swq=%d\n",
+                                        scd_ssn , index, txq_id, txq->swq_id);
+
+                        freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                        if (priv->mac80211_registered &&
+                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
+                                if (agg->state == IWL_AGG_OFF)
+                                        iwl_wake_queue(priv, txq_id);
+                                else
+                                        iwl_wake_queue(priv, txq->swq_id);
+                        }
+                }
+        } else {
+                BUG_ON(txq_id != txq->swq_id);
+
+                info->status.rates[0].count = tx_resp->failure_frame + 1;
+                info->flags |= iwl_tx_status_to_mac80211(status);
+                iwlagn_hwrate_to_tx_control(priv,
+                                        le32_to_cpu(tx_resp->rate_n_flags),
+                                        info);
+
+                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
+                                   "0x%x retries %d\n",
+                                   txq_id,
+                                   iwl_get_tx_fail_reason(status), status,
+                                   le32_to_cpu(tx_resp->rate_n_flags),
+                                   tx_resp->failure_frame);
+
+                freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                if (priv->mac80211_registered &&
+                    (iwl_queue_space(&txq->q) > txq->q.low_mark))
+                        iwl_wake_queue(priv, txq_id);
+        }
+
+        iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
+
+        iwl_check_abort_status(priv, tx_resp->frame_count, status);
+}
+
+void iwlagn_rx_handler_setup(struct iwl_priv *priv)
+{
+        /* init calibration handlers */
+        priv->rx_handlers[CALIBRATION_RES_NOTIFICATION] =
+                                        iwlagn_rx_calib_result;
+        priv->rx_handlers[CALIBRATION_COMPLETE_NOTIFICATION] =
+                                        iwlagn_rx_calib_complete;
+        priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;
+}
+
+void iwlagn_setup_deferred_work(struct iwl_priv *priv)
+{
+        /* in agn, the tx power calibration is done in uCode */
+        priv->disable_tx_power_cal = 1;
+}
+
+int iwlagn_hw_valid_rtc_data_addr(u32 addr)
+{
+        return (addr >= IWLAGN_RTC_DATA_LOWER_BOUND) &&
+                (addr < IWLAGN_RTC_DATA_UPPER_BOUND);
+}
+
+int iwlagn_send_tx_power(struct iwl_priv *priv)
+{
+        struct iwl5000_tx_power_dbm_cmd tx_power_cmd;
+        u8 tx_ant_cfg_cmd;
+
+        /* half dBm need to multiply */
+        tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
+
+        if (priv->tx_power_lmt_in_half_dbm &&
+            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
+                /*
+                 * For the newer devices which using enhanced/extend tx power
+                 * table in EEPROM, the format is in half dBm. driver need to
+                 * convert to dBm format before report to mac80211.
+                 * By doing so, there is a possibility of 1/2 dBm resolution
+                 * lost. driver will perform "round-up" operation before
+                 * reporting, but it will cause 1/2 dBm tx power over the
+                 * regulatory limit. Perform the checking here, if the
+                 * "tx_power_user_lmt" is higher than EEPROM value (in
+                 * half-dBm format), lower the tx power based on EEPROM
+                 */
+                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
+        }
+        tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
+        tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
+
+        if (IWL_UCODE_API(priv->ucode_ver) == 1)
+                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD_V1;
+        else
+                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
+
+        return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
+                                       sizeof(tx_power_cmd), &tx_power_cmd,
+                                       NULL);
+}
+
+void iwlagn_temperature(struct iwl_priv *priv)
+{
+        /* store temperature from statistics (in Celsius) */
+        priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
+        iwl_tt_handler(priv);
+}
+
+u16 iwlagn_eeprom_calib_version(struct iwl_priv *priv)
+{
+        struct iwl_eeprom_calib_hdr {
+                u8 version;
+                u8 pa_type;
+                u16 voltage;
+        } *hdr;
+
+        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
+                                                        EEPROM_CALIB_ALL);
+        return hdr->version;
+
+}
+
+/*
+ * EEPROM
+ */
+static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
+{
+        u16 offset = 0;
+
+        if ((address & INDIRECT_ADDRESS) == 0)
+                return address;
+
+        switch (address & INDIRECT_TYPE_MSK) {
+        case INDIRECT_HOST:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_HOST);
+                break;
+        case INDIRECT_GENERAL:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_GENERAL);
+                break;
+        case INDIRECT_REGULATORY:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_REGULATORY);
+                break;
+        case INDIRECT_CALIBRATION:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_CALIBRATION);
+                break;
+        case INDIRECT_PROCESS_ADJST:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_PROCESS_ADJST);
+                break;
+        case INDIRECT_OTHERS:
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_OTHERS);
+                break;
+        default:
+                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
+                address & INDIRECT_TYPE_MSK);
+                break;
+        }
+
+        /* translate the offset from words to byte */
+        return (address & ADDRESS_MSK) + (offset << 1);
+}
+
+const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
+                                           size_t offset)
+{
+        u32 address = eeprom_indirect_address(priv, offset);
+        BUG_ON(address >= priv->cfg->eeprom_size);
+        return &priv->eeprom[address];
+}
+
+struct iwl_mod_params iwlagn_mod_params = {
+        .amsdu_size_8K = 1,
+        .restart_fw = 1,
+        /* the rest are 0 by default */
+};
+
+void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        unsigned long flags;
+        int i;
+        spin_lock_irqsave(&rxq->lock, flags);
+        INIT_LIST_HEAD(&rxq->rx_free);
+        INIT_LIST_HEAD(&rxq->rx_used);
+        /* Fill the rx_used queue with _all_ of the Rx buffers */
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
+                /* In the reset function, these buffers may have been allocated
+                 * to an SKB, so we need to unmap and free potential storage */
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
+                }
+                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+        }
+
+        for (i = 0; i < RX_QUEUE_SIZE; i++)
+                rxq->queue[i] = NULL;
+
+        /* Set us so that we have processed and used all buffers, but have
+         * not restocked the Rx queue with fresh buffers */
+        rxq->read = rxq->write = 0;
+        rxq->write_actual = 0;
+        rxq->free_count = 0;
+        spin_unlock_irqrestore(&rxq->lock, flags);
+}
+
+int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        u32 rb_size;
+        const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
+        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
+
+        if (!priv->cfg->use_isr_legacy)
+                rb_timeout = RX_RB_TIMEOUT;
+
+        if (priv->cfg->mod_params->amsdu_size_8K)
+                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
+        else
+                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
+
+        /* Stop Rx DMA */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
+
+        /* Reset driver's Rx queue write index */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
+
+        /* Tell device where to find RBD circular buffer in DRAM */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+                           (u32)(rxq->dma_addr >> 8));
+
+        /* Tell device where in DRAM to update its Rx status */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_STTS_WPTR_REG,
+                           rxq->rb_stts_dma >> 4);
+
+        /* Enable Rx DMA
+         * FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY is set because of HW bug in
+         *      the credit mechanism in 5000 HW RX FIFO
+         * Direct rx interrupts to hosts
+         * Rx buffer size 4 or 8k
+         * RB timeout 0x10
+         * 256 RBDs
+         */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG,
+                           FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
+                           FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY |
+                           FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
+                           FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
+                           rb_size|
+                           (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
+                           (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
+
+        /* Set interrupt coalescing timer to default (2048 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+
+        return 0;
+}
+
+int iwlagn_hw_nic_init(struct iwl_priv *priv)
+{
+        unsigned long flags;
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        int ret;
+
+        /* nic_init */
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->cfg->ops->lib->apm_ops.init(priv);
+
+        /* Set interrupt coalescing calibration timer to default (512 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
+
+        priv->cfg->ops->lib->apm_ops.config(priv);
+
+        /* Allocate the RX queue, or reset if it is already allocated */
+        if (!rxq->bd) {
+                ret = iwl_rx_queue_alloc(priv);
+                if (ret) {
+                        IWL_ERR(priv, "Unable to initialize Rx queue\n");
+                        return -ENOMEM;
+                }
+        } else
+                iwlagn_rx_queue_reset(priv, rxq);
+
+        iwlagn_rx_replenish(priv);
+
+        iwlagn_rx_init(priv, rxq);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        rxq->need_update = 1;
+        iwl_rx_queue_update_write_ptr(priv, rxq);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Allocate or reset and init all Tx and Command queues */
+        if (!priv->txq) {
+                ret = iwlagn_txq_ctx_alloc(priv);
+                if (ret)
+                        return ret;
+        } else
+                iwlagn_txq_ctx_reset(priv);
+
+        set_bit(STATUS_INIT, &priv->status);
+
+        return 0;
+}
+
+/**
+ * iwlagn_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
+ */
+static inline __le32 iwlagn_dma_addr2rbd_ptr(struct iwl_priv *priv,
+                                          dma_addr_t dma_addr)
+{
+        return cpu_to_le32((u32)(dma_addr >> 8));
+}
+
+/**
+ * iwlagn_rx_queue_restock - refill RX queue from pre-allocated pool
+ *
+ * If there are slots in the RX queue that need to be restocked,
+ * and we have free pre-allocated buffers, fill the ranks as much
+ * as we can, pulling from rx_free.
+ *
+ * This moves the 'write' index forward to catch up with 'processed', and
+ * also updates the memory address in the firmware to reference the new
+ * target buffer.
+ */
+void iwlagn_rx_queue_restock(struct iwl_priv *priv)
+{
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        struct list_head *element;
+        struct iwl_rx_mem_buffer *rxb;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rxq->lock, flags);
+        while ((iwl_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
+                /* The overwritten rxb must be a used one */
+                rxb = rxq->queue[rxq->write];
+                BUG_ON(rxb && rxb->page);
+
+                /* Get next free Rx buffer, remove from free list */
+                element = rxq->rx_free.next;
+                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+
+                /* Point to Rx buffer via next RBD in circular buffer */
+                rxq->bd[rxq->write] = iwlagn_dma_addr2rbd_ptr(priv,
+                                                              rxb->page_dma);
+                rxq->queue[rxq->write] = rxb;
+                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
+                rxq->free_count--;
+        }
+        spin_unlock_irqrestore(&rxq->lock, flags);
+        /* If the pre-allocated buffer pool is dropping low, schedule to
+         * refill it */
+        if (rxq->free_count <= RX_LOW_WATERMARK)
+                queue_work(priv->workqueue, &priv->rx_replenish);
+
+
+        /* If we've added more space for the firmware to place data, tell it.
+         * Increment device's write pointer in multiples of 8. */
+        if (rxq->write_actual != (rxq->write & ~0x7)) {
+                spin_lock_irqsave(&rxq->lock, flags);
+                rxq->need_update = 1;
+                spin_unlock_irqrestore(&rxq->lock, flags);
+                iwl_rx_queue_update_write_ptr(priv, rxq);
+        }
+}
+
+/**
+ * iwlagn_rx_replenish - Move all used packet from rx_used to rx_free
+ *
+ * When moving to rx_free an SKB is allocated for the slot.
+ *
+ * Also restock the Rx queue via iwl_rx_queue_restock.
+ * This is called as a scheduled work item (except for during initialization)
+ */
+void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority)
+{
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        struct list_head *element;
+        struct iwl_rx_mem_buffer *rxb;
+        struct page *page;
+        unsigned long flags;
+        gfp_t gfp_mask = priority;
+
+        while (1) {
+                spin_lock_irqsave(&rxq->lock, flags);
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        return;
+                }
+                spin_unlock_irqrestore(&rxq->lock, flags);
+
+                if (rxq->free_count > RX_LOW_WATERMARK)
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
+
+                /* Alloc a new receive buffer */
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
+                        if (net_ratelimit())
+                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
+                                               "order: %d\n",
+                                               priv->hw_params.rx_page_order);
+
+                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+                            net_ratelimit())
+                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
+                                         priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+                                         rxq->free_count);
+                        /* We don't reschedule replenish work here -- we will
+                         * call the restock method and if it still needs
+                         * more buffers it will schedule replenish */
+                        return;
+                }
+
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        __free_pages(page, priv->hw_params.rx_page_order);
+                        return;
+                }
+                element = rxq->rx_used.next;
+                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+
+                spin_unlock_irqrestore(&rxq->lock, flags);
+
+                BUG_ON(rxb->page);
+                rxb->page = page;
+                /* Get physical address of the RB */
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                /* dma address must be no more than 36 bits */
+                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
+                /* and also 256 byte aligned! */
+                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
+
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                list_add_tail(&rxb->list, &rxq->rx_free);
+                rxq->free_count++;
+                priv->alloc_rxb_page++;
+
+                spin_unlock_irqrestore(&rxq->lock, flags);
+        }
+}
+
+void iwlagn_rx_replenish(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        iwlagn_rx_allocate(priv, GFP_KERNEL);
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwlagn_rx_queue_restock(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+void iwlagn_rx_replenish_now(struct iwl_priv *priv)
+{
+        iwlagn_rx_allocate(priv, GFP_ATOMIC);
+
+        iwlagn_rx_queue_restock(priv);
+}
+
+/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
+ * If an SKB has been detached, the POOL needs to have its SKB set to NULL
+ * This free routine walks the list of POOL entries and if SKB is set to
+ * non NULL it is unmapped and freed
+ */
+void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        int i;
+        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
+                }
+        }
+
+        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                          rxq->dma_addr);
+        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
+                          rxq->rb_stts, rxq->rb_stts_dma);
+        rxq->bd = NULL;
+        rxq->rb_stts  = NULL;
+}
+
+int iwlagn_rxq_stop(struct iwl_priv *priv)
+{
+
+        /* stop Rx DMA */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
+        iwl_poll_direct_bit(priv, FH_MEM_RSSR_RX_STATUS_REG,
+                            FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
+
+        return 0;
+}
+
+int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band)
+{
+        int idx = 0;
+        int band_offset = 0;
+
+        /* HT rate format: mac80211 wants an MCS number, which is just LSB */
+        if (rate_n_flags & RATE_MCS_HT_MSK) {
+                idx = (rate_n_flags & 0xff);
+                return idx;
+        /* Legacy rate format, search for match in table */
+        } else {
+                if (band == IEEE80211_BAND_5GHZ)
+                        band_offset = IWL_FIRST_OFDM_RATE;
+                for (idx = band_offset; idx < IWL_RATE_COUNT_LEGACY; idx++)
+                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
+                                return idx - band_offset;
+        }
+
+        return -1;
+}
+
+/* Calc max signal level (dBm) among 3 possible receivers */
+static inline int iwlagn_calc_rssi(struct iwl_priv *priv,
+                                struct iwl_rx_phy_res *rx_resp)
+{
+        return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+/**
+ * iwlagn_dbg_report_frame - dump frame to syslog during debug sessions
+ *
+ * You may hack this function to show different aspects of received frames,
+ * including selective frame dumps.
+ * group100 parameter selects whether to show 1 out of 100 good data frames.
+ *    All beacon and probe response frames are printed.
+ */
+static void iwlagn_dbg_report_frame(struct iwl_priv *priv,
+                      struct iwl_rx_phy_res *phy_res, u16 length,
+                      struct ieee80211_hdr *header, int group100)
+{
+        u32 to_us;
+        u32 print_summary = 0;
+        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
+        u32 hundred = 0;
+        u32 dataframe = 0;
+        __le16 fc;
+        u16 seq_ctl;
+        u16 channel;
+        u16 phy_flags;
+        u32 rate_n_flags;
+        u32 tsf_low;
+        int rssi;
+
+        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
+                return;
+
+        /* MAC header */
+        fc = header->frame_control;
+        seq_ctl = le16_to_cpu(header->seq_ctrl);
+
+        /* metadata */
+        channel = le16_to_cpu(phy_res->channel);
+        phy_flags = le16_to_cpu(phy_res->phy_flags);
+        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
+
+        /* signal statistics */
+        rssi = iwlagn_calc_rssi(priv, phy_res);
+        tsf_low = le64_to_cpu(phy_res->timestamp) & 0x0ffffffff;
+
+        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
+
+        /* if data frame is to us and all is good,
+         *   (optionally) print summary for only 1 out of every 100 */
+        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
+            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
+                dataframe = 1;
+                if (!group100)
+                        print_summary = 1;      /* print each frame */
+                else if (priv->framecnt_to_us < 100) {
+                        priv->framecnt_to_us++;
+                        print_summary = 0;
+                } else {
+                        priv->framecnt_to_us = 0;
+                        print_summary = 1;
+                        hundred = 1;
+                }
+        } else {
+                /* print summary for all other frames */
+                print_summary = 1;
+        }
+
+        if (print_summary) {
+                char *title;
+                int rate_idx;
+                u32 bitrate;
+
+                if (hundred)
+                        title = "100Frames";
+                else if (ieee80211_has_retry(fc))
+                        title = "Retry";
+                else if (ieee80211_is_assoc_resp(fc))
+                        title = "AscRsp";
+                else if (ieee80211_is_reassoc_resp(fc))
+                        title = "RasRsp";
+                else if (ieee80211_is_probe_resp(fc)) {
+                        title = "PrbRsp";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_beacon(fc)) {
+                        title = "Beacon";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_atim(fc))
+                        title = "ATIM";
+                else if (ieee80211_is_auth(fc))
+                        title = "Auth";
+                else if (ieee80211_is_deauth(fc))
+                        title = "DeAuth";
+                else if (ieee80211_is_disassoc(fc))
+                        title = "DisAssoc";
+                else
+                        title = "Frame";
+
+                rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
+                if (unlikely((rate_idx < 0) || (rate_idx >= IWL_RATE_COUNT))) {
+                        bitrate = 0;
+                        WARN_ON_ONCE(1);
+                } else {
+                        bitrate = iwl_rates[rate_idx].ieee / 2;
+                }
+
+                /* print frame summary.
+                 * MAC addresses show just the last byte (for brevity),
+                 *    but you can hack it to show more, if you'd like to. */
+                if (dataframe)
+                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
+                                     "len=%u, rssi=%d, chnl=%d, rate=%u,\n",
+                                     title, le16_to_cpu(fc), header->addr1[5],
+                                     length, rssi, channel, bitrate);
+                else {
+                        /* src/dst addresses assume managed mode */
+                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, src=0x%02x, "
+                                     "len=%u, rssi=%d, tim=%lu usec, "
+                                     "phy=0x%02x, chnl=%d\n",
+                                     title, le16_to_cpu(fc), header->addr1[5],
+                                     header->addr3[5], length, rssi,
+                                     tsf_low - priv->scan_start_tsf,
+                                     phy_flags, channel);
+                }
+        }
+        if (print_dump)
+                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
+}
+#endif
+
+static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
+{
+        u32 decrypt_out = 0;
+
+        if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
+                                        RX_RES_STATUS_STATION_FOUND)
+                decrypt_out |= (RX_RES_STATUS_STATION_FOUND |
+                                RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
+
+        decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
+
+        /* packet was not encrypted */
+        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
+                                        RX_RES_STATUS_SEC_TYPE_NONE)
+                return decrypt_out;
+
+        /* packet was encrypted with unknown alg */
+        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
+                                        RX_RES_STATUS_SEC_TYPE_ERR)
+                return decrypt_out;
+
+        /* decryption was not done in HW */
+        if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
+                                        RX_MPDU_RES_STATUS_DEC_DONE_MSK)
+                return decrypt_out;
+
+        switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
+
+        case RX_RES_STATUS_SEC_TYPE_CCMP:
+                /* alg is CCM: check MIC only */
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
+                        /* Bad MIC */
+                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
+                else
+                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
+
+                break;
+
+        case RX_RES_STATUS_SEC_TYPE_TKIP:
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
+                        /* Bad TTAK */
+                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
+                        break;
+                }
+                /* fall through if TTAK OK */
+        default:
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
+                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
+                else
+                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
+                break;
+        }
+
+        IWL_DEBUG_RX(priv, "decrypt_in:0x%x  decrypt_out = 0x%x\n",
+                                        decrypt_in, decrypt_out);
+
+        return decrypt_out;
+}
+
+static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
+                                        struct ieee80211_hdr *hdr,
+                                        u16 len,
+                                        u32 ampdu_status,
+                                        struct iwl_rx_mem_buffer *rxb,
+                                        struct ieee80211_rx_status *stats)
+{
+        struct sk_buff *skb;
+        __le16 fc = hdr->frame_control;
+
+        /* We only process data packets if the interface is open */
+        if (unlikely(!priv->is_open)) {
+                IWL_DEBUG_DROP_LIMIT(priv,
+                    "Dropping packet while interface is not open.\n");
+                return;
+        }
+
+        /* In case of HW accelerated crypto and bad decryption, drop */
+        if (!priv->cfg->mod_params->sw_crypto &&
+            iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
+                return;
+
+        skb = dev_alloc_skb(128);
+        if (!skb) {
+                IWL_ERR(priv, "dev_alloc_skb failed\n");
+                return;
+        }
+
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+
+        ieee80211_rx(priv->hw, skb);
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
+}
+
+/* Called for REPLY_RX (legacy ABG frames), or
+ * REPLY_RX_MPDU_CMD (HT high-throughput N frames). */
+void iwlagn_rx_reply_rx(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb)
+{
+        struct ieee80211_hdr *header;
+        struct ieee80211_rx_status rx_status;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_rx_phy_res *phy_res;
+        __le32 rx_pkt_status;
+        struct iwl4965_rx_mpdu_res_start *amsdu;
+        u32 len;
+        u32 ampdu_status;
+        u32 rate_n_flags;
+
+        /**
+         * REPLY_RX and REPLY_RX_MPDU_CMD are handled differently.
+         *      REPLY_RX: physical layer info is in this buffer
+         *      REPLY_RX_MPDU_CMD: physical layer info was sent in separate
+         *              command and cached in priv->last_phy_res
+         *
+         * Here we set up local variables depending on which command is
+         * received.
+         */
+        if (pkt->hdr.cmd == REPLY_RX) {
+                phy_res = (struct iwl_rx_phy_res *)pkt->u.raw;
+                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res)
+                                + phy_res->cfg_phy_cnt);
+
+                len = le16_to_cpu(phy_res->byte_count);
+                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*phy_res) +
+                                phy_res->cfg_phy_cnt + len);
+                ampdu_status = le32_to_cpu(rx_pkt_status);
+        } else {
+                if (!priv->_agn.last_phy_res_valid) {
+                        IWL_ERR(priv, "MPDU frame without cached PHY data\n");
+                        return;
+                }
+                phy_res = &priv->_agn.last_phy_res;
+                amsdu = (struct iwl4965_rx_mpdu_res_start *)pkt->u.raw;
+                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
+                len = le16_to_cpu(amsdu->byte_count);
+                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
+                ampdu_status = iwlagn_translate_rx_status(priv,
+                                le32_to_cpu(rx_pkt_status));
+        }
+
+        if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
+                IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d/n",
+                                phy_res->cfg_phy_cnt);
+                return;
+        }
+
+        if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
+            !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
+                IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
+                                le32_to_cpu(rx_pkt_status));
+                return;
+        }
+
+        /* This will be used in several places later */
+        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
+
+        /* rx_status carries information about the packet to mac80211 */
+        rx_status.mactime = le64_to_cpu(phy_res->timestamp);
+        rx_status.freq =
+                ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel));
+        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+        rx_status.rate_idx =
+                iwlagn_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
+        rx_status.flag = 0;
+
+        /* TSF isn't reliable. In order to allow smooth user experience,
+         * this W/A doesn't propagate it to the mac80211 */
+        /*rx_status.flag |= RX_FLAG_TSFT;*/
+
+        priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
+
+        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
+        rx_status.signal = iwlagn_calc_rssi(priv, phy_res);
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        /* Set "1" to report good data frames in groups of 100 */
+        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
+                iwlagn_dbg_report_frame(priv, phy_res, len, header, 1);
+#endif
+        iwl_dbg_log_rx_data_frame(priv, len, header);
+        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, TSF %llu\n",
+                rx_status.signal, (unsigned long long)rx_status.mactime);
+
+        /*
+         * "antenna number"
+         *
+         * It seems that the antenna field in the phy flags value
+         * is actually a bit field. This is undefined by radiotap,
+         * it wants an actual antenna number but I always get "7"
+         * for most legacy frames I receive indicating that the
+         * same frame was received on all three RX chains.
+         *
+         * I think this field should be removed in favor of a
+         * new 802.11n radiotap field "RX chains" that is defined
+         * as a bitmask.
+         */
+        rx_status.antenna =
+                (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
+                >> RX_RES_PHY_FLAGS_ANTENNA_POS;
+
+        /* set the preamble flag if appropriate */
+        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
+                rx_status.flag |= RX_FLAG_SHORTPRE;
+
+        /* Set up the HT phy flags */
+        if (rate_n_flags & RATE_MCS_HT_MSK)
+                rx_status.flag |= RX_FLAG_HT;
+        if (rate_n_flags & RATE_MCS_HT40_MSK)
+                rx_status.flag |= RX_FLAG_40MHZ;
+        if (rate_n_flags & RATE_MCS_SGI_MSK)
+                rx_status.flag |= RX_FLAG_SHORT_GI;
+
+        iwlagn_pass_packet_to_mac80211(priv, header, len, ampdu_status,
+                                    rxb, &rx_status);
+}
+
+/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).
+ * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
+void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
+                            struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        priv->_agn.last_phy_res_valid = true;
+        memcpy(&priv->_agn.last_phy_res, pkt->u.raw,
+               sizeof(struct iwl_rx_phy_res));
+}
+
+static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
+                                           struct ieee80211_vif *vif,
+                                           enum ieee80211_band band,
+                                           struct iwl_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int i, added = 0;
+        u16 channel = 0;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+        if (channel) {
+                scan_ch->channel = cpu_to_le16(channel);
+                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
+
+static int iwl_get_channels_for_scan(struct iwl_priv *priv,
+                                     struct ieee80211_vif *vif,
+                                     enum ieee80211_band band,
+                                     u8 is_active, u8 n_probes,
+                                     struct iwl_scan_channel *scan_ch)
+{
+        struct ieee80211_channel *chan;
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int added, i;
+        u16 channel;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband)
+                return 0;
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, n_probes);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+        for (i = 0, added = 0; i < priv->scan_request->n_channels; i++) {
+                chan = priv->scan_request->channels[i];
+
+                if (chan->band != band)
+                        continue;
+
+                channel = ieee80211_frequency_to_channel(chan->center_freq);
+                scan_ch->channel = cpu_to_le16(channel);
+
+                ch_info = iwl_get_channel_info(priv, band, channel);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_SCAN(priv, "Channel %d is INVALID for this band.\n",
+                                        channel);
+                        continue;
+                }
+
+                if (!is_active || is_channel_passive(ch_info) ||
+                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                        scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                else
+                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
+
+                if (n_probes)
+                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
+
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+
+                /* NOTE: if we were doing 6Mb OFDM for scans we'd use
+                 * power level:
+                 * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
+                 */
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+
+                IWL_DEBUG_SCAN(priv, "Scanning ch=%d prob=0x%X [%s %d]\n",
+                               channel, le32_to_cpu(scan_ch->type),
+                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
+                                "ACTIVE" : "PASSIVE",
+                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
+                               active_dwell : passive_dwell);
+
+                scan_ch++;
+                added++;
+        }
+
+        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
+        return added;
+}
+
+void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+{
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_SCAN_CMD,
+                .len = sizeof(struct iwl_scan_cmd),
+                .flags = CMD_SIZE_HUGE,
+        };
+        struct iwl_scan_cmd *scan;
+        struct ieee80211_conf *conf = NULL;
+        u32 rate_flags = 0;
+        u16 cmd_len;
+        u16 rx_chain = 0;
+        enum ieee80211_band band;
+        u8 n_probes = 0;
+        u8 rx_ant = priv->hw_params.valid_rx_ant;
+        u8 rate;
+        bool is_active = false;
+        int  chan_mod;
+        u8 active_chains;
+
+        conf = ieee80211_get_hw_conf(priv->hw);
+
+        cancel_delayed_work(&priv->scan_check);
+
+        if (!iwl_is_ready(priv)) {
+                IWL_WARN(priv, "request scan called when driver not ready.\n");
+                goto done;
+        }
+
+        /* Make sure the scan wasn't canceled before this queued work
+         * was given the chance to run... */
+        if (!test_bit(STATUS_SCANNING, &priv->status))
+                goto done;
+
+        /* This should never be called or scheduled if there is currently
+         * a scan active in the hardware. */
+        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
+                               "Ignoring second request.\n");
+                goto done;
+        }
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
+                goto done;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
+                goto done;
+        }
+
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
+                goto done;
+        }
+
+        if (!test_bit(STATUS_READY, &priv->status)) {
+                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
+                goto done;
+        }
+
+        if (!priv->scan_cmd) {
+                priv->scan_cmd = kmalloc(sizeof(struct iwl_scan_cmd) +
+                                         IWL_MAX_SCAN_SIZE, GFP_KERNEL);
+                if (!priv->scan_cmd) {
+                        IWL_DEBUG_SCAN(priv,
+                                       "fail to allocate memory for scan\n");
+                        goto done;
+                }
+        }
+        scan = priv->scan_cmd;
+        memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
+
+        scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
+        scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
+
+        if (iwl_is_associated(priv)) {
+                u16 interval = 0;
+                u32 extra;
+                u32 suspend_time = 100;
+                u32 scan_suspend_time = 100;
+                unsigned long flags;
+
+                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
+                spin_lock_irqsave(&priv->lock, flags);
+                interval = vif ? vif->bss_conf.beacon_int : 0;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                scan->suspend_time = 0;
+                scan->max_out_time = cpu_to_le32(200 * 1024);
+                if (!interval)
+                        interval = suspend_time;
+
+                extra = (suspend_time / interval) << 22;
+                scan_suspend_time = (extra |
+                    ((suspend_time % interval) * 1024));
+                scan->suspend_time = cpu_to_le32(scan_suspend_time);
+                IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
+                               scan_suspend_time, interval);
+        }
+
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
+                int i, p = 0;
+                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+                for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                        /* always does wildcard anyway */
+                        if (!priv->scan_request->ssids[i].ssid_len)
+                                continue;
+                        scan->direct_scan[p].id = WLAN_EID_SSID;
+                        scan->direct_scan[p].len =
+                                priv->scan_request->ssids[i].ssid_len;
+                        memcpy(scan->direct_scan[p].ssid,
+                               priv->scan_request->ssids[i].ssid,
+                               priv->scan_request->ssids[i].ssid_len);
+                        n_probes++;
+                        p++;
+                }
+                is_active = true;
+        } else
+                IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
+
+        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
+        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
+        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+
+        switch (priv->scan_band) {
+        case IEEE80211_BAND_2GHZ:
+                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
+                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
+                                       >> RXON_FLG_CHANNEL_MODE_POS;
+                if (chan_mod == CHANNEL_MODE_PURE_40) {
+                        rate = IWL_RATE_6M_PLCP;
+                } else {
+                        rate = IWL_RATE_1M_PLCP;
+                        rate_flags = RATE_MCS_CCK_MSK;
+                }
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                rate = IWL_RATE_6M_PLCP;
+                /*
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
+                 */
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
+                break;
+        default:
+                IWL_WARN(priv, "Invalid scan band count\n");
+                goto done;
+        }
+
+        band = priv->scan_band;
+
+        if (priv->cfg->scan_antennas[band])
+                rx_ant = priv->cfg->scan_antennas[band];
+
+        priv->scan_tx_ant[band] =
+                        iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band]);
+        rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
+        scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
+
+        /* In power save mode use one chain, otherwise use all chains */
+        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
+                /* rx_ant has been set to all valid chains previously */
+                active_chains = rx_ant &
+                                ((u8)(priv->chain_noise_data.active_chains));
+                if (!active_chains)
+                        active_chains = rx_ant;
+
+                IWL_DEBUG_SCAN(priv, "chain_noise_data.active_chains: %u\n",
+                                priv->chain_noise_data.active_chains);
+
+                rx_ant = first_antenna(active_chains);
+        }
+        /* MIMO is not used here, but value is required */
+        rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
+        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
+        scan->rx_chain = cpu_to_le16(rx_chain);
+        if (!priv->is_internal_short_scan) {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        priv->scan_request->ie,
+                                        priv->scan_request->ie_len,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        } else {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        NULL, 0,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+
+        }
+        scan->tx_cmd.len = cpu_to_le16(cmd_len);
+
+        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
+                               RXON_FILTER_BCON_AWARE_MSK);
+
+        if (priv->is_internal_short_scan) {
+                scan->channel_count =
+                        iwl_get_single_channel_for_scan(priv, vif, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl_get_channels_for_scan(priv, vif, band,
+                                is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        }
+        if (scan->channel_count == 0) {
+                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
+                goto done;
+        }
+
+        cmd.len += le16_to_cpu(scan->tx_cmd.len) +
+            scan->channel_count * sizeof(struct iwl_scan_channel);
+        cmd.data = scan;
+        scan->len = cpu_to_le16(cmd.len);
+
+        set_bit(STATUS_SCAN_HW, &priv->status);
+        if (iwl_send_cmd_sync(priv, &cmd))
+                goto done;
+
+        queue_delayed_work(priv->workqueue, &priv->scan_check,
+                           IWL_SCAN_CHECK_WATCHDOG);
+
+        return;
+
+ done:
+        /* Cannot perform scan. Make sure we clear scanning
+        * bits from status so next scan request can be performed.
+        * If we don't clear scanning status bit here all next scan
+        * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
+        /* inform mac80211 scan aborted */
+        queue_work(priv->workqueue, &priv->scan_completed);
+}
+
+int iwlagn_manage_ibss_station(struct iwl_priv *priv,
+                               struct ieee80211_vif *vif, bool add)
+{
+        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
+
+        if (add)
+                return iwl_add_bssid_station(priv, vif->bss_conf.bssid, true,
+                                             &vif_priv->ibss_bssid_sta_id);
+        return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
+                                  vif->bss_conf.bssid);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 1460116d329f..cf4a95bae4ff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -295,11 +295,11 @@ static u32 rs_tl_get_load(struct iwl_lq_sta *lq_data, u8 tid)
         return tl->total;
 }
 
-static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
+static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                                       struct iwl_lq_sta *lq_data, u8 tid,
                                       struct ieee80211_sta *sta)
 {
-        int ret;
+        int ret = -EAGAIN;
 
         if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
                 IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
@@ -313,29 +313,29 @@ static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                          */
                         IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
                                 tid);
-                        ret = ieee80211_stop_tx_ba_session(sta, tid,
+                        ieee80211_stop_tx_ba_session(sta, tid,
                                                 WLAN_BACK_INITIATOR);
                 }
-        }
+        } else
+                IWL_ERR(priv, "Fail finding valid aggregation tid: %d\n", tid);
+        return ret;
 }
 
 static void rs_tl_turn_on_agg(struct iwl_priv *priv, u8 tid,
                               struct iwl_lq_sta *lq_data,
                               struct ieee80211_sta *sta)
 {
-        if ((tid < TID_MAX_LOAD_COUNT))
-                rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
-        else if (tid == IWL_AGG_ALL_TID)
-                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
-                        rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
-        if (priv->cfg->use_rts_for_ht) {
-                /*
-                 * switch to RTS/CTS if it is the prefer protection method
-                 * for HT traffic
-                 */
-                IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
-                priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
-                iwlcore_commit_rxon(priv);
+        if ((tid < TID_MAX_LOAD_COUNT) &&
+            !rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta)) {
+                if (priv->cfg->use_rts_for_ht) {
+                        /*
+                         * switch to RTS/CTS if it is the prefer protection
+                         * method for HT traffic
+                         */
+                        IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
+                        priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+                        iwlcore_commit_rxon(priv);
+                }
         }
 }
 
@@ -611,10 +611,6 @@ static u16 rs_get_supported_rates(struct iwl_lq_sta *lq_sta,
                                   struct ieee80211_hdr *hdr,
                                   enum iwl_table_type rate_type)
 {
-        if (hdr && is_multicast_ether_addr(hdr->addr1) &&
-            lq_sta->active_rate_basic)
-                return lq_sta->active_rate_basic;
-
         if (is_legacy(rate_type)) {
                 return lq_sta->active_legacy_rate;
         } else {
@@ -775,6 +771,15 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
 
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (!lq_sta) {
+                IWL_DEBUG_RATE(priv, "Station rate scaling not created yet.\n");
+                return;
+        } else if (!lq_sta->drv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling not initialized yet.\n");
+                return;
+        }
+
         if (!ieee80211_is_data(hdr->frame_control) ||
             info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
@@ -784,10 +789,6 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
             !(info->flags & IEEE80211_TX_STAT_AMPDU))
                 return;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !lq_sta->ibss_sta_added)
-                return;
-
         /*
          * Ignore this Tx frame response if its initial rate doesn't match
          * that of latest Link Quality command.  There may be stragglers
@@ -833,7 +834,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 lq_sta->missed_rate_counter++;
                 if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
                 }
                 /* Regardless, ignore this status info for outdated rate */
                 return;
@@ -867,14 +868,14 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type,
                                 &rs_index);
                 rs_collect_tx_data(curr_tbl, rs_index,
-                                   info->status.ampdu_ack_len,
-                                   info->status.ampdu_ack_map);
+                                   info->status.ampdu_len,
+                                   info->status.ampdu_ack_len);
 
                 /* Update success/fail counts if not searching for new mode */
                 if (lq_sta->stay_in_tbl) {
-                        lq_sta->total_success += info->status.ampdu_ack_map;
-                        lq_sta->total_failed += (info->status.ampdu_ack_len -
-                                        info->status.ampdu_ack_map);
+                        lq_sta->total_success += info->status.ampdu_ack_len;
+                        lq_sta->total_failed += (info->status.ampdu_len -
+                                        info->status.ampdu_ack_len);
                 }
         } else {
         /*
@@ -1913,7 +1914,7 @@ static u32 rs_update_rate_tbl(struct iwl_priv *priv,
         /* Update uCode's rate table. */
         rate = rate_n_flags_from_tbl(priv, tbl, index, is_green);
         rs_fill_link_cmd(priv, lq_sta, rate);
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
 
         return rate;
 }
@@ -2002,7 +2003,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         /* rates available for this association, and for modulation mode */
         rate_mask = rs_get_supported_rates(lq_sta, hdr, tbl->lq_type);
 
-        IWL_DEBUG_RATE(priv, "mask 0x%04X \n", rate_mask);
+        IWL_DEBUG_RATE(priv, "mask 0x%04X\n", rate_mask);
 
         /* mask with station rate restriction */
         if (is_legacy(tbl->lq_type)) {
@@ -2077,10 +2078,12 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         }
         /* Else we have enough samples; calculate estimate of
          * actual average throughput */
-
-        /* Sanity-check TPT calculations */
-        BUG_ON(window->average_tpt != ((window->success_ratio *
-                        tbl->expected_tpt[index] + 64) / 128));
+        if (window->average_tpt != ((window->success_ratio *
+                        tbl->expected_tpt[index] + 64) / 128)) {
+                IWL_ERR(priv, "expected_tpt should have been calculated by now\n");
+                window->average_tpt = ((window->success_ratio *
+                                        tbl->expected_tpt[index] + 64) / 128);
+        }
 
         /* If we are searching for better modulation mode, check success. */
         if (lq_sta->search_better_tbl &&
@@ -2289,7 +2292,7 @@ lq_update:
                         IWL_DEBUG_RATE(priv, "Switch current  mcs: %X index: %d\n",
                                      tbl->current_rate, index);
                         rs_fill_link_cmd(priv, lq_sta, tbl->current_rate);
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
                 } else
                         done_search = 1;
         }
@@ -2334,11 +2337,22 @@ out:
         tbl->current_rate = rate_n_flags_from_tbl(priv, tbl, index, is_green);
         i = index;
         lq_sta->last_txrate_idx = i;
-
-        return;
 }
 
-
+/**
+ * rs_initialize_lq - Initialize a station's hardware rate table
+ *
+ * The uCode's station table contains a table of fallback rates
+ * for automatic fallback during transmission.
+ *
+ * NOTE: This sets up a default set of values.  These will be replaced later
+ *       if the driver's iwl-agn-rs rate scaling algorithm is used, instead of
+ *       rc80211_simple.
+ *
+ * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
+ *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
+ *       which requires station table entry to exist).
+ */
 static void rs_initialize_lq(struct iwl_priv *priv,
                              struct ieee80211_conf *conf,
                              struct ieee80211_sta *sta,
@@ -2357,10 +2371,6 @@ static void rs_initialize_lq(struct iwl_priv *priv,
 
         i = lq_sta->last_txrate_idx;
 
-        if ((lq_sta->lq.sta_id == 0xff) &&
-            (priv->iw_mode == NL80211_IFTYPE_ADHOC))
-                goto out;
-
         valid_tx_ant = priv->hw_params.valid_tx_ant;
 
         if (!lq_sta->search_better_tbl)
@@ -2388,7 +2398,8 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         tbl->current_rate = rate;
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_link_cmd(NULL, lq_sta, rate);
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+        priv->stations[lq_sta->lq.sta_id].lq = &lq_sta->lq;
+        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_SYNC, true);
  out:
         return;
 }
@@ -2399,10 +2410,7 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
 
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_supported_band *sband = txrc->sband;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
-        struct ieee80211_conf *conf = &priv->hw->conf;
-        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct iwl_priv *priv __maybe_unused = (struct iwl_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = priv_sta;
         int rate_idx;
@@ -2420,30 +2428,18 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
                         lq_sta->max_rate_idx = -1;
         }
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (lq_sta && !lq_sta->drv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling not initialized yet.\n");
+                priv_sta = NULL;
+        }
+
         /* Send management frames and NO_ACK data using lowest rate. */
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
 
         rate_idx  = lq_sta->last_txrate_idx;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !lq_sta->ibss_sta_added) {
-                u8 sta_id = iwl_find_station(priv, hdr->addr1);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
-                                       hdr->addr1);
-                        sta_id = iwl_add_station(priv, hdr->addr1,
-                                                false, CMD_ASYNC, ht_cap);
-                }
-                if ((sta_id != IWL_INVALID_STATION)) {
-                        lq_sta->lq.sta_id = sta_id;
-                        lq_sta->lq.rs_table[0].rate_n_flags = 0;
-                        lq_sta->ibss_sta_added = 1;
-                        rs_initialize_lq(priv, conf, sta, lq_sta);
-                }
-        }
-
         if (lq_sta->last_rate_n_flags & RATE_MCS_HT_MSK) {
                 rate_idx -= IWL_FIRST_OFDM_RATE;
                 /* 6M and 9M shared same MCS index */
@@ -2493,16 +2489,25 @@ static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
         return lq_sta;
 }
 
-static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
-                         struct ieee80211_sta *sta, void *priv_sta)
+/*
+ * Called after adding a new station to initialize rate scaling
+ */
+void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_id)
 {
         int i, j;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
+        struct ieee80211_hw *hw = priv->hw;
         struct ieee80211_conf *conf = &priv->hw->conf;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        struct iwl_lq_sta *lq_sta = priv_sta;
+        struct iwl_station_priv *sta_priv;
+        struct iwl_lq_sta *lq_sta;
+        struct ieee80211_supported_band *sband;
+
+        sta_priv = (struct iwl_station_priv *) sta->drv_priv;
+        lq_sta = &sta_priv->lq_sta;
+        sband = hw->wiphy->bands[conf->channel->band];
 
-        lq_sta->lq.sta_id = 0xff;
+
+        lq_sta->lq.sta_id = sta_id;
 
         for (j = 0; j < LQ_SIZE; j++)
                 for (i = 0; i < IWL_RATE_COUNT; i++)
@@ -2514,39 +2519,18 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
                 for (i = 0; i < IWL_RATE_COUNT; i++)
                         rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
 
-        IWL_DEBUG_RATE(priv, "LQ: *** rate scale station global init ***\n");
+        IWL_DEBUG_RATE(priv, "LQ: *** rate scale station global init for station %d ***\n",
+                       sta_id);
         /* TODO: what is a good starting rate for STA? About middle? Maybe not
          * the lowest or the highest rate.. Could consider using RSSI from
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
          * after assoc.. */
 
-        lq_sta->ibss_sta_added = 0;
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                u8 sta_id = iwl_find_station(priv,
-                                                                sta->addr);
-
-                /* for IBSS the call are from tasklet */
-                IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-                        sta_id = iwl_add_station(priv, sta->addr, false,
-                                                CMD_ASYNC, ht_cap);
-                }
-                if ((sta_id != IWL_INVALID_STATION)) {
-                        lq_sta->lq.sta_id = sta_id;
-                        lq_sta->lq.rs_table[0].rate_n_flags = 0;
-                }
-                /* FIXME: this is w/a remove it later */
-                priv->assoc_station_added = 1;
-        }
-
         lq_sta->is_dup = 0;
         lq_sta->max_rate_idx = -1;
         lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
         lq_sta->is_green = rs_use_green(sta, &priv->current_ht_config);
         lq_sta->active_legacy_rate = priv->active_rate & ~(0x1000);
-        lq_sta->active_rate_basic = priv->active_rate_basic;
         lq_sta->band = priv->band;
         /*
          * active_siso_rate mask includes 9 MBits (bit 5), and CCK (bits 0-3),
@@ -2574,8 +2558,17 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
                      lq_sta->active_mimo3_rate);
 
         /* These values will be overridden later */
-        lq_sta->lq.general_params.single_stream_ant_msk = ANT_A;
-        lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
+        lq_sta->lq.general_params.single_stream_ant_msk =
+                first_antenna(priv->hw_params.valid_tx_ant);
+        lq_sta->lq.general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!lq_sta->lq.general_params.dual_stream_ant_msk) {
+                lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                lq_sta->lq.general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
@@ -2794,7 +2787,7 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
 
         if (lq_sta->dbg_fixed_rate) {
                 rs_fill_link_cmd(NULL, lq_sta, lq_sta->dbg_fixed_rate);
-                iwl_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC);
+                iwl_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC, false);
         }
 
         return count;
@@ -2950,12 +2943,6 @@ static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,
                 desc += sprintf(buff+desc,
                                 "Bit Rate= %d Mb/s\n",
                                 iwl_rates[lq_sta->last_txrate_idx].ieee >> 1);
-        desc += sprintf(buff+desc,
-                        "Signal Level= %d dBm\tNoise Level= %d dBm\n",
-                        priv->last_rx_rssi, priv->last_rx_noise);
-        desc += sprintf(buff+desc,
-                        "Tsf= 0x%llx\tBeacon time= 0x%08X\n",
-                        priv->last_tsf, priv->last_beacon_time);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
         return ret;
@@ -2995,12 +2982,21 @@ static void rs_remove_debugfs(void *priv, void *priv_sta)
 }
 #endif
 
+/*
+ * Initialization of rate scaling information is done by driver after
+ * the station is added. Since mac80211 calls this function before a
+ * station is added we ignore it.
+ */
+static void rs_rate_init_stub(void *priv_r, struct ieee80211_supported_band *sband,
+                         struct ieee80211_sta *sta, void *priv_sta)
+{
+}
 static struct rate_control_ops rs_ops = {
         .module = NULL,
         .name = RS_NAME,
         .tx_status = rs_tx_status,
         .get_rate = rs_get_rate,
-        .rate_init = rs_rate_init,
+        .rate_init = rs_rate_init_stub,
         .alloc = rs_alloc,
         .free = rs_free,
         .alloc_sta = rs_alloc_sta,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index e71923961e69..8292f6d48ec6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -403,7 +403,6 @@ struct iwl_lq_sta {
         u8 is_green;
         u8 is_dup;
         enum ieee80211_band band;
-        u8 ibss_sta_added;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
         u32 supp_rates;
@@ -411,7 +410,6 @@ struct iwl_lq_sta {
         u16 active_siso_rate;
         u16 active_mimo2_rate;
         u16 active_mimo3_rate;
-        u16 active_rate_basic;
         s8 max_rate_idx;     /* Max rate set by user */
         u8 missed_rate_counter;
 
@@ -479,6 +477,12 @@ static inline u8 iwl3945_get_prev_ieee_rate(u8 rate_index)
  */
 extern void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id);
 
+/* Initialize station's rate scaling information after adding station */
+extern void iwl_rs_rate_init(struct iwl_priv *priv,
+                             struct ieee80211_sta *sta, u8 sta_id);
+extern void iwl3945_rs_rate_init(struct iwl_priv *priv,
+                                 struct ieee80211_sta *sta, u8 sta_id);
+
 /**
  * iwl_rate_control_register - Register the rate control algorithm callbacks
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
new file mode 100644
index 000000000000..c402bfc83f36
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -0,0 +1,1340 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-sta.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+/*
+ * mac80211 queues, ACs, hardware queues, FIFOs.
+ *
+ * Cf. http://wireless.kernel.org/en/developers/Documentation/mac80211/queues
+ *
+ * Mac80211 uses the following numbers, which we get as from it
+ * by way of skb_get_queue_mapping(skb):
+ *
+ *      VO      0
+ *      VI      1
+ *      BE      2
+ *      BK      3
+ *
+ *
+ * Regular (not A-MPDU) frames are put into hardware queues corresponding
+ * to the FIFOs, see comments in iwl-prph.h. Aggregated frames get their
+ * own queue per aggregation session (RA/TID combination), such queues are
+ * set up to map into FIFOs too, for which we need an AC->FIFO mapping. In
+ * order to map frames to the right queue, we also need an AC->hw queue
+ * mapping. This is implemented here.
+ *
+ * Due to the way hw queues are set up (by the hw specific modules like
+ * iwl-4965.c, iwl-5000.c etc.), the AC->hw queue mapping is the identity
+ * mapping.
+ */
+
+static const u8 tid_to_ac[] = {
+        /* this matches the mac80211 numbers */
+        2, 3, 3, 2, 1, 1, 0, 0
+};
+
+static const u8 ac_to_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+};
+
+static inline int get_fifo_from_ac(u8 ac)
+{
+        return ac_to_fifo[ac];
+}
+
+static inline int get_ac_from_tid(u16 tid)
+{
+        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
+                return tid_to_ac[tid];
+
+        /* no support for TIDs 8-15 yet */
+        return -EINVAL;
+}
+
+static inline int get_fifo_from_tid(u16 tid)
+{
+        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
+                return get_fifo_from_ac(tid_to_ac[tid]);
+
+        /* no support for TIDs 8-15 yet */
+        return -EINVAL;
+}
+
+/**
+ * iwlagn_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
+ */
+void iwlagn_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
+                                            struct iwl_tx_queue *txq,
+                                            u16 byte_cnt)
+{
+        struct iwlagn_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
+        int write_ptr = txq->q.write_ptr;
+        int txq_id = txq->q.id;
+        u8 sec_ctl = 0;
+        u8 sta_id = 0;
+        u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
+        __le16 bc_ent;
+
+        WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX);
+
+        if (txq_id != IWL_CMD_QUEUE_NUM) {
+                sta_id = txq->cmd[txq->q.write_ptr]->cmd.tx.sta_id;
+                sec_ctl = txq->cmd[txq->q.write_ptr]->cmd.tx.sec_ctl;
+
+                switch (sec_ctl & TX_CMD_SEC_MSK) {
+                case TX_CMD_SEC_CCM:
+                        len += CCMP_MIC_LEN;
+                        break;
+                case TX_CMD_SEC_TKIP:
+                        len += TKIP_ICV_LEN;
+                        break;
+                case TX_CMD_SEC_WEP:
+                        len += WEP_IV_LEN + WEP_ICV_LEN;
+                        break;
+                }
+        }
+
+        bc_ent = cpu_to_le16((len & 0xFFF) | (sta_id << 12));
+
+        scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
+
+        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+                scd_bc_tbl[txq_id].
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
+}
+
+void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
+                                           struct iwl_tx_queue *txq)
+{
+        struct iwlagn_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
+        int txq_id = txq->q.id;
+        int read_ptr = txq->q.read_ptr;
+        u8 sta_id = 0;
+        __le16 bc_ent;
+
+        WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
+
+        if (txq_id != IWL_CMD_QUEUE_NUM)
+                sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
+
+        bc_ent = cpu_to_le16(1 | (sta_id << 12));
+        scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
+
+        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
+                scd_bc_tbl[txq_id].
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
+}
+
+static int iwlagn_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
+                                        u16 txq_id)
+{
+        u32 tbl_dw_addr;
+        u32 tbl_dw;
+        u16 scd_q2ratid;
+
+        scd_q2ratid = ra_tid & IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
+
+        tbl_dw_addr = priv->scd_base_addr +
+                        IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
+
+        tbl_dw = iwl_read_targ_mem(priv, tbl_dw_addr);
+
+        if (txq_id & 0x1)
+                tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
+        else
+                tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
+
+        iwl_write_targ_mem(priv, tbl_dw_addr, tbl_dw);
+
+        return 0;
+}
+
+static void iwlagn_tx_queue_stop_scheduler(struct iwl_priv *priv, u16 txq_id)
+{
+        /* Simply stop the queue, but don't change any configuration;
+         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
+        iwl_write_prph(priv,
+                IWLAGN_SCD_QUEUE_STATUS_BITS(txq_id),
+                (0 << IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                (1 << IWLAGN_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+}
+
+void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
+                                int txq_id, u32 index)
+{
+        iwl_write_direct32(priv, HBUS_TARG_WRPTR,
+                        (index & 0xff) | (txq_id << 8));
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUE_RDPTR(txq_id), index);
+}
+
+void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
+                                        struct iwl_tx_queue *txq,
+                                        int tx_fifo_id, int scd_retry)
+{
+        int txq_id = txq->q.id;
+        int active = test_bit(txq_id, &priv->txq_ctx_active_msk) ? 1 : 0;
+
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUE_STATUS_BITS(txq_id),
+                        (active << IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
+                        (tx_fifo_id << IWLAGN_SCD_QUEUE_STTS_REG_POS_TXF) |
+                        (1 << IWLAGN_SCD_QUEUE_STTS_REG_POS_WSL) |
+                        IWLAGN_SCD_QUEUE_STTS_REG_MSK);
+
+        txq->sched_retry = scd_retry;
+
+        IWL_DEBUG_INFO(priv, "%s %s Queue %d on FIFO %d\n",
+                       active ? "Activate" : "Deactivate",
+                       scd_retry ? "BA" : "AC/CMD", txq_id, tx_fifo_id);
+}
+
+int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
+                          int tx_fifo, int sta_id, int tid, u16 ssn_idx)
+{
+        unsigned long flags;
+        u16 ra_tid;
+
+        if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
+            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
+                IWL_WARN(priv,
+                        "queue number out of range: %d, must be %d to %d\n",
+                        txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
+                        IWLAGN_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
+                return -EINVAL;
+        }
+
+        ra_tid = BUILD_RAxTID(sta_id, tid);
+
+        /* Modify device's station table to Tx this TID */
+        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Stop this Tx queue before configuring it */
+        iwlagn_tx_queue_stop_scheduler(priv, txq_id);
+
+        /* Map receiver-address / traffic-ID to this queue */
+        iwlagn_tx_queue_set_q2ratid(priv, ra_tid, txq_id);
+
+        /* Set this queue as a chain-building queue */
+        iwl_set_bits_prph(priv, IWLAGN_SCD_QUEUECHAIN_SEL, (1<<txq_id));
+
+        /* enable aggregations for the queue */
+        iwl_set_bits_prph(priv, IWLAGN_SCD_AGGR_SEL, (1<<txq_id));
+
+        /* Place first TFD at index corresponding to start sequence number.
+         * Assumes that ssn_idx is valid (!= 0xFFF) */
+        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
+        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
+        iwlagn_set_wr_ptrs(priv, txq_id, ssn_idx);
+
+        /* Set up Tx window size and frame limit for this queue */
+        iwl_write_targ_mem(priv, priv->scd_base_addr +
+                        IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
+                        sizeof(u32),
+                        ((SCD_WIN_SIZE <<
+                        IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                        IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                        ((SCD_FRAME_LIMIT <<
+                        IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                        IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+
+        iwl_set_bits_prph(priv, IWLAGN_SCD_INTERRUPT_MASK, (1 << txq_id));
+
+        /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
+        iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+
+int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
+                           u16 ssn_idx, u8 tx_fifo)
+{
+        if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
+            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
+                IWL_ERR(priv,
+                        "queue number out of range: %d, must be %d to %d\n",
+                        txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
+                        IWLAGN_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
+                return -EINVAL;
+        }
+
+        iwlagn_tx_queue_stop_scheduler(priv, txq_id);
+
+        iwl_clear_bits_prph(priv, IWLAGN_SCD_AGGR_SEL, (1 << txq_id));
+
+        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
+        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
+        /* supposes that ssn_idx is valid (!= 0xFFF) */
+        iwlagn_set_wr_ptrs(priv, txq_id, ssn_idx);
+
+        iwl_clear_bits_prph(priv, IWLAGN_SCD_INTERRUPT_MASK, (1 << txq_id));
+        iwl_txq_ctx_deactivate(priv, txq_id);
+        iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
+
+        return 0;
+}
+
+/*
+ * Activate/Deactivate Tx DMA/FIFO channels according tx fifos mask
+ * must be called under priv->lock and mac access
+ */
+void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask)
+{
+        iwl_write_prph(priv, IWLAGN_SCD_TXFACT, mask);
+}
+
+static inline int get_queue_from_ac(u16 ac)
+{
+        return ac;
+}
+
+/*
+ * handle build REPLY_TX command notification.
+ */
+static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
+                                  struct iwl_tx_cmd *tx_cmd,
+                                  struct ieee80211_tx_info *info,
+                                  struct ieee80211_hdr *hdr,
+                                  u8 std_id)
+{
+        __le16 fc = hdr->frame_control;
+        __le32 tx_flags = tx_cmd->tx_flags;
+
+        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                tx_flags |= TX_CMD_FLG_ACK_MSK;
+                if (ieee80211_is_mgmt(fc))
+                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+                if (ieee80211_is_probe_resp(fc) &&
+                    !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
+                        tx_flags |= TX_CMD_FLG_TSF_MSK;
+        } else {
+                tx_flags &= (~TX_CMD_FLG_ACK_MSK);
+                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+        }
+
+        if (ieee80211_is_back_req(fc))
+                tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
+
+
+        tx_cmd->sta_id = std_id;
+        if (ieee80211_has_morefrags(fc))
+                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
+
+        if (ieee80211_is_data_qos(fc)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                tx_cmd->tid_tspec = qc[0] & 0xf;
+                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
+        } else {
+                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+        }
+
+        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
+
+        if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
+                tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
+
+        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
+        if (ieee80211_is_mgmt(fc)) {
+                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
+                else
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
+        } else {
+                tx_cmd->timeout.pm_frame_timeout = 0;
+        }
+
+        tx_cmd->driver_txop = 0;
+        tx_cmd->tx_flags = tx_flags;
+        tx_cmd->next_frame_len = 0;
+}
+
+#define RTS_DFAULT_RETRY_LIMIT          60
+
+static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
+                              struct iwl_tx_cmd *tx_cmd,
+                              struct ieee80211_tx_info *info,
+                              __le16 fc)
+{
+        u32 rate_flags;
+        int rate_idx;
+        u8 rts_retry_limit;
+        u8 data_retry_limit;
+        u8 rate_plcp;
+
+        /* Set retry limit on DATA packets and Probe Responses*/
+        if (ieee80211_is_probe_resp(fc))
+                data_retry_limit = 3;
+        else
+                data_retry_limit = IWLAGN_DEFAULT_TX_RETRY;
+        tx_cmd->data_retry_limit = data_retry_limit;
+
+        /* Set retry limit on RTS packets */
+        rts_retry_limit = RTS_DFAULT_RETRY_LIMIT;
+        if (data_retry_limit < rts_retry_limit)
+                rts_retry_limit = data_retry_limit;
+        tx_cmd->rts_retry_limit = rts_retry_limit;
+
+        /* DATA packets will use the uCode station table for rate/antenna
+         * selection */
+        if (ieee80211_is_data(fc)) {
+                tx_cmd->initial_rate_index = 0;
+                tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
+                return;
+        }
+
+        /**
+         * If the current TX rate stored in mac80211 has the MCS bit set, it's
+         * not really a TX rate.  Thus, we use the lowest supported rate for
+         * this band.  Also use the lowest supported rate if the stored rate
+         * index is invalid.
+         */
+        rate_idx = info->control.rates[0].idx;
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
+                        (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
+                rate_idx = rate_lowest_index(&priv->bands[info->band],
+                                info->control.sta);
+        /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
+        if (info->band == IEEE80211_BAND_5GHZ)
+                rate_idx += IWL_FIRST_OFDM_RATE;
+        /* Get PLCP rate for tx_cmd->rate_n_flags */
+        rate_plcp = iwl_rates[rate_idx].plcp;
+        /* Zero out flags for this packet */
+        rate_flags = 0;
+
+        /* Set CCK flag as needed */
+        if ((rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE))
+                rate_flags |= RATE_MCS_CCK_MSK;
+
+        /* Set up RTS and CTS flags for certain packets */
+        switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
+        case cpu_to_le16(IEEE80211_STYPE_AUTH):
+        case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+        case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
+        case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
+                if (tx_cmd->tx_flags & TX_CMD_FLG_RTS_MSK) {
+                        tx_cmd->tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                        tx_cmd->tx_flags |= TX_CMD_FLG_CTS_MSK;
+                }
+                break;
+        default:
+                break;
+        }
+
+        /* Set up antennas */
+        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
+        rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
+
+        /* Set the rate in the TX cmd */
+        tx_cmd->rate_n_flags = iwl_hw_set_rate_n_flags(rate_plcp, rate_flags);
+}
+
+static void iwlagn_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
+                                      struct ieee80211_tx_info *info,
+                                      struct iwl_tx_cmd *tx_cmd,
+                                      struct sk_buff *skb_frag,
+                                      int sta_id)
+{
+        struct ieee80211_key_conf *keyconf = info->control.hw_key;
+
+        switch (keyconf->alg) {
+        case ALG_CCMP:
+                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
+                memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
+                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                        tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
+                IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
+                break;
+
+        case ALG_TKIP:
+                tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
+                ieee80211_get_tkip_key(keyconf, skb_frag,
+                        IEEE80211_TKIP_P2_KEY, tx_cmd->key);
+                IWL_DEBUG_TX(priv, "tx_cmd with tkip hwcrypto\n");
+                break;
+
+        case ALG_WEP:
+                tx_cmd->sec_ctl |= (TX_CMD_SEC_WEP |
+                        (keyconf->keyidx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT);
+
+                if (keyconf->keylen == WEP_KEY_LEN_128)
+                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
+
+                memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
+
+                IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
+                             "with key %d\n", keyconf->keyidx);
+                break;
+
+        default:
+                IWL_ERR(priv, "Unknown encode alg %d\n", keyconf->alg);
+                break;
+        }
+}
+
+/*
+ * start REPLY_TX command process
+ */
+int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = info->control.sta;
+        struct iwl_station_priv *sta_priv = NULL;
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+        struct iwl_device_cmd *out_cmd;
+        struct iwl_cmd_meta *out_meta;
+        struct iwl_tx_cmd *tx_cmd;
+        int swq_id, txq_id;
+        dma_addr_t phys_addr;
+        dma_addr_t txcmd_phys;
+        dma_addr_t scratch_phys;
+        u16 len, len_org, firstlen, secondlen;
+        u16 seq_number = 0;
+        __le16 fc;
+        u8 hdr_len;
+        u8 sta_id;
+        u8 wait_write_ptr = 0;
+        u8 tid = 0;
+        u8 *qc = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_DROP(priv, "Dropping - RF KILL\n");
+                goto drop_unlock;
+        }
+
+        fc = hdr->frame_control;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (ieee80211_is_auth(fc))
+                IWL_DEBUG_TX(priv, "Sending AUTH frame\n");
+        else if (ieee80211_is_assoc_req(fc))
+                IWL_DEBUG_TX(priv, "Sending ASSOC frame\n");
+        else if (ieee80211_is_reassoc_req(fc))
+                IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
+#endif
+
+        hdr_len = ieee80211_hdrlen(fc);
+
+        /* Find index into station table for destination station */
+        if (!info->control.sta)
+                sta_id = priv->hw_params.bcast_sta_id;
+        else
+                sta_id = iwl_sta_id(info->control.sta);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                               hdr->addr1);
+                goto drop_unlock;
+        }
+
+        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
+
+        if (sta)
+                sta_priv = (void *)sta->drv_priv;
+
+        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
+            sta_priv->asleep) {
+                WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
+                /*
+                 * This sends an asynchronous command to the device,
+                 * but we can rely on it being processed before the
+                 * next frame is processed -- and the next frame to
+                 * this station is the one that will consume this
+                 * counter.
+                 * For now set the counter to just 1 since we do not
+                 * support uAPSD yet.
+                 */
+                iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
+        }
+
+        txq_id = get_queue_from_ac(skb_get_queue_mapping(skb));
+        if (ieee80211_is_data_qos(fc)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+                if (unlikely(tid >= MAX_TID_COUNT))
+                        goto drop_unlock;
+                seq_number = priv->stations[sta_id].tid[tid].seq_number;
+                seq_number &= IEEE80211_SCTL_SEQ;
+                hdr->seq_ctrl = hdr->seq_ctrl &
+                                cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(seq_number);
+                seq_number += 0x10;
+                /* aggregation is on for this <sta,tid> */
+                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
+                    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
+                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
+                }
+        }
+
+        txq = &priv->txq[txq_id];
+        swq_id = txq->swq_id;
+        q = &txq->q;
+
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
+
+        /* Set up driver data for this TFD */
+        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
+        txq->txb[q->write_ptr].skb[0] = skb;
+
+        /* Set up first empty entry in queue's array of Tx/cmd buffers */
+        out_cmd = txq->cmd[q->write_ptr];
+        out_meta = &txq->meta[q->write_ptr];
+        tx_cmd = &out_cmd->cmd.tx;
+        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
+        memset(tx_cmd, 0, sizeof(struct iwl_tx_cmd));
+
+        /*
+         * Set up the Tx-command (not MAC!) header.
+         * Store the chosen Tx queue and TFD index within the sequence field;
+         * after Tx, uCode's Tx response will return this value so driver can
+         * locate the frame within the tx queue and do post-tx processing.
+         */
+        out_cmd->hdr.cmd = REPLY_TX;
+        out_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
+                                INDEX_TO_SEQ(q->write_ptr)));
+
+        /* Copy MAC header from skb into command buffer */
+        memcpy(tx_cmd->hdr, hdr, hdr_len);
+
+
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx_cmd->len = cpu_to_le16(len);
+
+        if (info->control.hw_key)
+                iwlagn_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+
+        /* TODO need this for burst mode later on */
+        iwlagn_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+        iwl_dbg_log_tx_data_frame(priv, len, hdr);
+
+        iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, fc);
+
+        iwl_update_stats(priv, true, fc, len);
+        /*
+         * Use the first empty entry in this queue's command buffer array
+         * to contain the Tx command and MAC header concatenated together
+         * (payload data will be in another buffer).
+         * Size of this varies, due to varying MAC header length.
+         * If end is not dword aligned, we'll have 2 extra bytes at the end
+         * of the MAC header (device reads on dword boundaries).
+         * We'll tell device about this padding later.
+         */
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+
+        len_org = len;
+        firstlen = len = (len + 3) & ~3;
+
+        if (len_org != len)
+                len_org = 1;
+        else
+                len_org = 0;
+
+        /* Tell NIC about any 2-byte padding after MAC header */
+        if (len_org)
+                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
+
+        /* Physical address of this Tx command's header (not MAC header!),
+         * within command buffer array. */
+        txcmd_phys = pci_map_single(priv->pci_dev,
+                                    &out_cmd->hdr, len,
+                                    PCI_DMA_BIDIRECTIONAL);
+        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        pci_unmap_len_set(out_meta, len, len);
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                   txcmd_phys, len, 1, 0);
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
+
+        /* Set up TFD's 2nd entry to point directly to remainder of skb,
+         * if any (802.11 null frames have no payload). */
+        secondlen = len = skb->len - hdr_len;
+        if (len) {
+                phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
+                                           len, PCI_DMA_TODEVICE);
+                priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                           phys_addr, len,
+                                                           0, 0);
+        }
+
+        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
+                                offsetof(struct iwl_tx_cmd, scratch);
+
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+        /* take back ownership of DMA buffer to enable update */
+        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
+                                    len, PCI_DMA_BIDIRECTIONAL);
+        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
+        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
+
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x\n",
+                     le16_to_cpu(out_cmd->hdr.sequence));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
+
+        /* Set up entry for this TFD in Tx byte-count array */
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+                                                     le16_to_cpu(tx_cmd->len));
+
+        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
+                                       len, PCI_DMA_BIDIRECTIONAL);
+
+        trace_iwlwifi_dev_tx(priv,
+                             &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
+                             sizeof(struct iwl_tfd),
+                             &out_cmd->hdr, firstlen,
+                             skb->data + hdr_len, secondlen);
+
+        /* Tell device the write index *just past* this latest filled TFD */
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        iwl_txq_update_write_ptr(priv, txq);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /*
+         * At this point the frame is "transmitted" successfully
+         * and we will get a TX status notification eventually,
+         * regardless of the value of ret. "ret" only indicates
+         * whether or not we should update the write pointer.
+         */
+
+        /* avoid atomic ops if it isn't an associated client */
+        if (sta_priv && sta_priv->client)
+                atomic_inc(&sta_priv->pending_frames);
+
+        if ((iwl_queue_space(q) < q->high_mark) && priv->mac80211_registered) {
+                if (wait_write_ptr) {
+                        spin_lock_irqsave(&priv->lock, flags);
+                        txq->need_update = 1;
+                        iwl_txq_update_write_ptr(priv, txq);
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                } else {
+                        iwl_stop_queue(priv, txq->swq_id);
+                }
+        }
+
+        return 0;
+
+drop_unlock:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return -1;
+}
+
+static inline int iwlagn_alloc_dma_ptr(struct iwl_priv *priv,
+                                    struct iwl_dma_ptr *ptr, size_t size)
+{
+        ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
+                                       GFP_KERNEL);
+        if (!ptr->addr)
+                return -ENOMEM;
+        ptr->size = size;
+        return 0;
+}
+
+static inline void iwlagn_free_dma_ptr(struct iwl_priv *priv,
+                                    struct iwl_dma_ptr *ptr)
+{
+        if (unlikely(!ptr->addr))
+                return;
+
+        dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
+        memset(ptr, 0, sizeof(*ptr));
+}
+
+/**
+ * iwlagn_hw_txq_ctx_free - Free TXQ Context
+ *
+ * Destroy all TX DMA queues and structures
+ */
+void iwlagn_hw_txq_ctx_free(struct iwl_priv *priv)
+{
+        int txq_id;
+
+        /* Tx queues */
+        if (priv->txq) {
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
+        }
+        iwlagn_free_dma_ptr(priv, &priv->kw);
+
+        iwlagn_free_dma_ptr(priv, &priv->scd_bc_tbls);
+
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
+}
+
+/**
+ * iwlagn_txq_ctx_alloc - allocate TX queue context
+ * Allocate all Tx DMA structures and initialize them
+ *
+ * @param priv
+ * @return error code
+ */
+int iwlagn_txq_ctx_alloc(struct iwl_priv *priv)
+{
+        int ret;
+        int txq_id, slots_num;
+        unsigned long flags;
+
+        /* Free all tx/cmd queues and keep-warm buffer */
+        iwlagn_hw_txq_ctx_free(priv);
+
+        ret = iwlagn_alloc_dma_ptr(priv, &priv->scd_bc_tbls,
+                                priv->hw_params.scd_bc_tbls_size);
+        if (ret) {
+                IWL_ERR(priv, "Scheduler BC Table allocation failed\n");
+                goto error_bc_tbls;
+        }
+        /* Alloc keep-warm buffer */
+        ret = iwlagn_alloc_dma_ptr(priv, &priv->kw, IWL_KW_SIZE);
+        if (ret) {
+                IWL_ERR(priv, "Keep Warm allocation failed\n");
+                goto error_kw;
+        }
+
+        /* allocate tx queue structure */
+        ret = iwl_alloc_txq_mem(priv);
+        if (ret)
+                goto error;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
+                                        TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                ret = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
+                                       txq_id);
+                if (ret) {
+                        IWL_ERR(priv, "Tx %d queue init failed\n", txq_id);
+                        goto error;
+                }
+        }
+
+        return ret;
+
+ error:
+        iwlagn_hw_txq_ctx_free(priv);
+        iwlagn_free_dma_ptr(priv, &priv->kw);
+ error_kw:
+        iwlagn_free_dma_ptr(priv, &priv->scd_bc_tbls);
+ error_bc_tbls:
+        return ret;
+}
+
+void iwlagn_txq_ctx_reset(struct iwl_priv *priv)
+{
+        int txq_id, slots_num;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
+                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
+        }
+}
+
+/**
+ * iwlagn_txq_ctx_stop - Stop all Tx DMA channels
+ */
+void iwlagn_txq_ctx_stop(struct iwl_priv *priv)
+{
+        int ch;
+        unsigned long flags;
+
+        /* Turn off all Tx DMA fifos */
+        spin_lock_irqsave(&priv->lock, flags);
+
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Stop each Tx DMA channel, and wait for it to be idle */
+        for (ch = 0; ch < priv->hw_params.dma_chnl_num; ch++) {
+                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
+                iwl_poll_direct_bit(priv, FH_TSSR_TX_STATUS_REG,
+                                    FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
+                                    1000);
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+/*
+ * Find first available (lowest unused) Tx Queue, mark it "active".
+ * Called only when finding queue for aggregation.
+ * Should never return anything < 7, because they should already
+ * be in use as EDCA AC (0-3), Command (4), reserved (5, 6)
+ */
+static int iwlagn_txq_ctx_activate_free(struct iwl_priv *priv)
+{
+        int txq_id;
+
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+                if (!test_and_set_bit(txq_id, &priv->txq_ctx_active_msk))
+                        return txq_id;
+        return -1;
+}
+
+int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+{
+        int sta_id;
+        int tx_fifo;
+        int txq_id;
+        int ret;
+        unsigned long flags;
+        struct iwl_tid_data *tid_data;
+
+        tx_fifo = get_fifo_from_tid(tid);
+        if (unlikely(tx_fifo < 0))
+                return tx_fifo;
+
+        IWL_WARN(priv, "%s on ra = %pM tid = %d\n",
+                        __func__, sta->addr, tid);
+
+        sta_id = iwl_sta_id(sta);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Start AGG on invalid station\n");
+                return -ENXIO;
+        }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
+
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
+                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
+                return -ENXIO;
+        }
+
+        txq_id = iwlagn_txq_ctx_activate_free(priv);
+        if (txq_id == -1) {
+                IWL_ERR(priv, "No free aggregation queue available\n");
+                return -ENXIO;
+        }
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        tid_data = &priv->stations[sta_id].tid[tid];
+        *ssn = SEQ_TO_SN(tid_data->seq_number);
+        tid_data->agg.txq_id = txq_id;
+        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(get_ac_from_tid(tid), txq_id);
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
+                                                  sta_id, tid, *ssn);
+        if (ret)
+                return ret;
+
+        if (tid_data->tfds_in_queue == 0) {
+                IWL_DEBUG_HT(priv, "HW queue is empty\n");
+                tid_data->agg.state = IWL_AGG_ON;
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+        } else {
+                IWL_DEBUG_HT(priv, "HW queue is NOT empty: %d packets in HW queue\n",
+                             tid_data->tfds_in_queue);
+                tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
+        }
+        return ret;
+}
+
+int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta, u16 tid)
+{
+        int tx_fifo_id, txq_id, sta_id, ssn = -1;
+        struct iwl_tid_data *tid_data;
+        int write_ptr, read_ptr;
+        unsigned long flags;
+
+        tx_fifo_id = get_fifo_from_tid(tid);
+        if (unlikely(tx_fifo_id < 0))
+                return tx_fifo_id;
+
+        sta_id = iwl_sta_id(sta);
+
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
+                return -ENXIO;
+        }
+
+        if (priv->stations[sta_id].tid[tid].agg.state ==
+                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
+                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+                return 0;
+        }
+
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
+                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
+
+        tid_data = &priv->stations[sta_id].tid[tid];
+        ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
+        txq_id = tid_data->agg.txq_id;
+        write_ptr = priv->txq[txq_id].q.write_ptr;
+        read_ptr = priv->txq[txq_id].q.read_ptr;
+
+        /* The queue is not empty */
+        if (write_ptr != read_ptr) {
+                IWL_DEBUG_HT(priv, "Stopping a non empty AGG HW QUEUE\n");
+                priv->stations[sta_id].tid[tid].agg.state =
+                                IWL_EMPTYING_HW_QUEUE_DELBA;
+                return 0;
+        }
+
+        IWL_DEBUG_HT(priv, "HW queue is empty\n");
+        priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        /*
+         * the only reason this call can fail is queue number out of range,
+         * which can happen if uCode is reloaded and all the station
+         * information are lost. if it is outside the range, there is no need
+         * to deactivate the uCode queue, just return "success" to allow
+         *  mac80211 to clean up it own data.
+         */
+        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
+                                                   tx_fifo_id);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+
+        return 0;
+}
+
+int iwlagn_txq_check_empty(struct iwl_priv *priv,
+                           int sta_id, u8 tid, int txq_id)
+{
+        struct iwl_queue *q = &priv->txq[txq_id].q;
+        u8 *addr = priv->stations[sta_id].sta.sta.addr;
+        struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
+
+        switch (priv->stations[sta_id].tid[tid].agg.state) {
+        case IWL_EMPTYING_HW_QUEUE_DELBA:
+                /* We are reclaiming the last packet of the */
+                /* aggregated HW queue */
+                if ((txq_id  == tid_data->agg.txq_id) &&
+                    (q->read_ptr == q->write_ptr)) {
+                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
+                        int tx_fifo = get_fifo_from_tid(tid);
+                        IWL_DEBUG_HT(priv, "HW queue empty: continue DELBA flow\n");
+                        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
+                                                             ssn, tx_fifo);
+                        tid_data->agg.state = IWL_AGG_OFF;
+                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                }
+                break;
+        case IWL_EMPTYING_HW_QUEUE_ADDBA:
+                /* We are reclaiming the last packet of the queue */
+                if (tid_data->tfds_in_queue == 0) {
+                        IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
+                        tid_data->agg.state = IWL_AGG_ON;
+                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                }
+                break;
+        }
+        return 0;
+}
+
+static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_sta *sta;
+        struct iwl_station_priv *sta_priv;
+
+        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+        if (sta) {
+                sta_priv = (void *)sta->drv_priv;
+                /* avoid atomic ops if this isn't a client */
+                if (sta_priv->client &&
+                    atomic_dec_return(&sta_priv->pending_frames) == 0)
+                        ieee80211_sta_block_awake(priv->hw, sta, false);
+        }
+
+        ieee80211_tx_status_irqsafe(priv->hw, skb);
+}
+
+int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
+{
+        struct iwl_tx_queue *txq = &priv->txq[txq_id];
+        struct iwl_queue *q = &txq->q;
+        struct iwl_tx_info *tx_info;
+        int nfreed = 0;
+        struct ieee80211_hdr *hdr;
+
+        if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
+                IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
+                          "is out of range [0-%d] %d %d.\n", txq_id,
+                          index, q->n_bd, q->write_ptr, q->read_ptr);
+                return 0;
+        }
+
+        for (index = iwl_queue_inc_wrap(index, q->n_bd);
+             q->read_ptr != index;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+
+                tx_info = &txq->txb[txq->q.read_ptr];
+                iwlagn_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
+                tx_info->skb[0] = NULL;
+
+                if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
+                        priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
+
+                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
+        }
+        return nfreed;
+}
+
+/**
+ * iwlagn_tx_status_reply_compressed_ba - Update tx status from block-ack
+ *
+ * Go through block-ack's bitmap of ACK'd frames, update driver's record of
+ * ACK vs. not.  This gets sent to mac80211, then to rate scaling algo.
+ */
+static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
+                                 struct iwl_ht_agg *agg,
+                                 struct iwl_compressed_ba_resp *ba_resp)
+
+{
+        int i, sh, ack;
+        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
+        u64 bitmap;
+        int successes = 0;
+        struct ieee80211_tx_info *info;
+
+        if (unlikely(!agg->wait_for_ba))  {
+                IWL_ERR(priv, "Received BA when not expected\n");
+                return -EINVAL;
+        }
+
+        /* Mark that the expected block-ack response arrived */
+        agg->wait_for_ba = 0;
+        IWL_DEBUG_TX_REPLY(priv, "BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
+
+        /* Calculate shift to align block-ack bits with our Tx window bits */
+        sh = agg->start_idx - SEQ_TO_INDEX(seq_ctl >> 4);
+        if (sh < 0) /* tbw something is wrong with indices */
+                sh += 0x100;
+
+        /* don't use 64-bit values for now */
+        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
+
+        if (agg->frame_count > (64 - sh)) {
+                IWL_DEBUG_TX_REPLY(priv, "more frames than bitmap size");
+                return -1;
+        }
+
+        /* check for success or failure according to the
+         * transmitted bitmap and block-ack bitmap */
+        bitmap &= agg->bitmap;
+
+        /* For each frame attempted in aggregation,
+         * update driver's record of tx frame's status. */
+        for (i = 0; i < agg->frame_count ; i++) {
+                ack = bitmap & (1ULL << i);
+                successes += !!ack;
+                IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
+                        ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
+                        agg->start_idx + i);
+        }
+
+        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
+        memset(&info->status, 0, sizeof(info->status));
+        info->flags |= IEEE80211_TX_STAT_ACK;
+        info->flags |= IEEE80211_TX_STAT_AMPDU;
+        info->status.ampdu_ack_len = successes;
+        info->status.ampdu_ack_map = bitmap;
+        info->status.ampdu_len = agg->frame_count;
+        iwlagn_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
+
+        IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
+
+        return 0;
+}
+
+/**
+ * translate ucode response to mac80211 tx status control values
+ */
+void iwlagn_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
+                                  struct ieee80211_tx_info *info)
+{
+        struct ieee80211_tx_rate *r = &info->control.rates[0];
+
+        info->antenna_sel_tx =
+                ((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
+        if (rate_n_flags & RATE_MCS_HT_MSK)
+                r->flags |= IEEE80211_TX_RC_MCS;
+        if (rate_n_flags & RATE_MCS_GF_MSK)
+                r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
+        if (rate_n_flags & RATE_MCS_HT40_MSK)
+                r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+        if (rate_n_flags & RATE_MCS_DUP_MSK)
+                r->flags |= IEEE80211_TX_RC_DUP_DATA;
+        if (rate_n_flags & RATE_MCS_SGI_MSK)
+                r->flags |= IEEE80211_TX_RC_SHORT_GI;
+        r->idx = iwlagn_hwrate_to_mac80211_idx(rate_n_flags, info->band);
+}
+
+/**
+ * iwlagn_rx_reply_compressed_ba - Handler for REPLY_COMPRESSED_BA
+ *
+ * Handles block-acknowledge notification from device, which reports success
+ * of frames sent via aggregation.
+ */
+void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+                                           struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
+        struct iwl_tx_queue *txq = NULL;
+        struct iwl_ht_agg *agg;
+        int index;
+        int sta_id;
+        int tid;
+
+        /* "flow" corresponds to Tx queue */
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
+
+        /* "ssn" is start of block-ack Tx window, corresponds to index
+         * (in Tx queue's circular buffer) of first TFD/frame in window */
+        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
+
+        if (scd_flow >= priv->hw_params.max_txq_num) {
+                IWL_ERR(priv,
+                        "BUG_ON scd_flow is bigger than number of queues\n");
+                return;
+        }
+
+        txq = &priv->txq[scd_flow];
+        sta_id = ba_resp->sta_id;
+        tid = ba_resp->tid;
+        agg = &priv->stations[sta_id].tid[tid].agg;
+
+        /* Find index just before block-ack window */
+        index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
+
+        /* TODO: Need to get this copy more safely - now good for debug */
+
+        IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
+                           "sta_id = %d\n",
+                           agg->wait_for_ba,
+                           (u8 *) &ba_resp->sta_addr_lo32,
+                           ba_resp->sta_id);
+        IWL_DEBUG_TX_REPLY(priv, "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = "
+                           "%d, scd_ssn = %d\n",
+                           ba_resp->tid,
+                           ba_resp->seq_ctl,
+                           (unsigned long long)le64_to_cpu(ba_resp->bitmap),
+                           ba_resp->scd_flow,
+                           ba_resp->scd_ssn);
+        IWL_DEBUG_TX_REPLY(priv, "DAT start_idx = %d, bitmap = 0x%llx\n",
+                           agg->start_idx,
+                           (unsigned long long)agg->bitmap);
+
+        /* Update driver's record of ACK vs. not for each frame in window */
+        iwlagn_tx_status_reply_compressed_ba(priv, agg, ba_resp);
+
+        /* Release all TFDs before the SSN, i.e. all TFDs in front of
+         * block-ack window (we assume that they've been successfully
+         * transmitted ... if not, it's too late anyway). */
+        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
+                /* calculate mac80211 ampdu sw queue to wake */
+                int freed = iwlagn_tx_queue_reclaim(priv, scd_flow, index);
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+                    priv->mac80211_registered &&
+                    (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
+                        iwl_wake_queue(priv, txq->swq_id);
+
+                iwlagn_txq_check_empty(priv, sta_id, tid, scd_flow);
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
new file mode 100644
index 000000000000..637286c396fe
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -0,0 +1,425 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+static const s8 iwlagn_default_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+        IWLAGN_CMD_FIFO_NUM,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+};
+
+static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
+        {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
+         0, COEX_UNASSOC_IDLE_FLAGS},
+        {COEX_CU_UNASSOC_MANUAL_SCAN_RP, COEX_CU_UNASSOC_MANUAL_SCAN_WP,
+         0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
+        {COEX_CU_UNASSOC_AUTO_SCAN_RP, COEX_CU_UNASSOC_AUTO_SCAN_WP,
+         0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
+        {COEX_CU_CALIBRATION_RP, COEX_CU_CALIBRATION_WP,
+         0, COEX_CALIBRATION_FLAGS},
+        {COEX_CU_PERIODIC_CALIBRATION_RP, COEX_CU_PERIODIC_CALIBRATION_WP,
+         0, COEX_PERIODIC_CALIBRATION_FLAGS},
+        {COEX_CU_CONNECTION_ESTAB_RP, COEX_CU_CONNECTION_ESTAB_WP,
+         0, COEX_CONNECTION_ESTAB_FLAGS},
+        {COEX_CU_ASSOCIATED_IDLE_RP, COEX_CU_ASSOCIATED_IDLE_WP,
+         0, COEX_ASSOCIATED_IDLE_FLAGS},
+        {COEX_CU_ASSOC_MANUAL_SCAN_RP, COEX_CU_ASSOC_MANUAL_SCAN_WP,
+         0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
+        {COEX_CU_ASSOC_AUTO_SCAN_RP, COEX_CU_ASSOC_AUTO_SCAN_WP,
+         0, COEX_ASSOC_AUTO_SCAN_FLAGS},
+        {COEX_CU_ASSOC_ACTIVE_LEVEL_RP, COEX_CU_ASSOC_ACTIVE_LEVEL_WP,
+         0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
+        {COEX_CU_RF_ON_RP, COEX_CU_RF_ON_WP, 0, COEX_CU_RF_ON_FLAGS},
+        {COEX_CU_RF_OFF_RP, COEX_CU_RF_OFF_WP, 0, COEX_RF_OFF_FLAGS},
+        {COEX_CU_STAND_ALONE_DEBUG_RP, COEX_CU_STAND_ALONE_DEBUG_WP,
+         0, COEX_STAND_ALONE_DEBUG_FLAGS},
+        {COEX_CU_IPAN_ASSOC_LEVEL_RP, COEX_CU_IPAN_ASSOC_LEVEL_WP,
+         0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
+        {COEX_CU_RSRVD1_RP, COEX_CU_RSRVD1_WP, 0, COEX_RSRVD1_FLAGS},
+        {COEX_CU_RSRVD2_RP, COEX_CU_RSRVD2_WP, 0, COEX_RSRVD2_FLAGS}
+};
+
+/*
+ * ucode
+ */
+static int iwlagn_load_section(struct iwl_priv *priv, const char *name,
+                                struct fw_desc *image, u32 dst_addr)
+{
+        dma_addr_t phy_addr = image->p_addr;
+        u32 byte_cnt = image->len;
+        int ret;
+
+        priv->ucode_write_complete = 0;
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
+
+        iwl_write_direct32(priv,
+                FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL), dst_addr);
+
+        iwl_write_direct32(priv,
+                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
+                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
+
+        iwl_write_direct32(priv,
+                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                (iwl_get_dma_hi_addr(phy_addr)
+                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
+                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
+                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
+                FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE       |
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
+                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
+
+        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
+        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+                                        priv->ucode_write_complete, 5 * HZ);
+        if (ret == -ERESTARTSYS) {
+                IWL_ERR(priv, "Could not load the %s uCode section due "
+                        "to interrupt\n", name);
+                return ret;
+        }
+        if (!ret) {
+                IWL_ERR(priv, "Could not load the %s uCode section\n",
+                        name);
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static int iwlagn_load_given_ucode(struct iwl_priv *priv,
+                struct fw_desc *inst_image,
+                struct fw_desc *data_image)
+{
+        int ret = 0;
+
+        ret = iwlagn_load_section(priv, "INST", inst_image,
+                                   IWLAGN_RTC_INST_LOWER_BOUND);
+        if (ret)
+                return ret;
+
+        return iwlagn_load_section(priv, "DATA", data_image,
+                                    IWLAGN_RTC_DATA_LOWER_BOUND);
+}
+
+int iwlagn_load_ucode(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        /* check whether init ucode should be loaded, or rather runtime ucode */
+        if (priv->ucode_init.len && (priv->ucode_type == UCODE_NONE)) {
+                IWL_DEBUG_INFO(priv, "Init ucode found. Loading init ucode...\n");
+                ret = iwlagn_load_given_ucode(priv,
+                        &priv->ucode_init, &priv->ucode_init_data);
+                if (!ret) {
+                        IWL_DEBUG_INFO(priv, "Init ucode load complete.\n");
+                        priv->ucode_type = UCODE_INIT;
+                }
+        } else {
+                IWL_DEBUG_INFO(priv, "Init ucode not found, or already loaded. "
+                        "Loading runtime ucode...\n");
+                ret = iwlagn_load_given_ucode(priv,
+                        &priv->ucode_code, &priv->ucode_data);
+                if (!ret) {
+                        IWL_DEBUG_INFO(priv, "Runtime ucode load complete.\n");
+                        priv->ucode_type = UCODE_RT;
+                }
+        }
+
+        return ret;
+}
+
+/*
+ *  Calibration
+ */
+static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
+{
+        struct iwl_calib_xtal_freq_cmd cmd;
+        __le16 *xtal_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_XTAL);
+
+        cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
+        cmd.hdr.first_group = 0;
+        cmd.hdr.groups_num = 1;
+        cmd.hdr.data_valid = 1;
+        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
+        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
+        return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
+                             (u8 *)&cmd, sizeof(cmd));
+}
+
+static int iwlagn_send_calib_cfg(struct iwl_priv *priv)
+{
+        struct iwl_calib_cfg_cmd calib_cfg_cmd;
+        struct iwl_host_cmd cmd = {
+                .id = CALIBRATION_CFG_CMD,
+                .len = sizeof(struct iwl_calib_cfg_cmd),
+                .data = &calib_cfg_cmd,
+        };
+
+        memset(&calib_cfg_cmd, 0, sizeof(calib_cfg_cmd));
+        calib_cfg_cmd.ucd_calib_cfg.once.is_enable = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.once.start = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.once.send_res = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.flags = IWL_CALIB_INIT_CFG_ALL;
+
+        return iwl_send_cmd(priv, &cmd);
+}
+
+void iwlagn_rx_calib_result(struct iwl_priv *priv,
+                             struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
+        int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        int index;
+
+        /* reduce the size of the length field itself */
+        len -= 4;
+
+        /* Define the order in which the results will be sent to the runtime
+         * uCode. iwl_send_calib_results sends them in a row according to
+         * their index. We sort them here
+         */
+        switch (hdr->op_code) {
+        case IWL_PHY_CALIBRATE_DC_CMD:
+                index = IWL_CALIB_DC;
+                break;
+        case IWL_PHY_CALIBRATE_LO_CMD:
+                index = IWL_CALIB_LO;
+                break;
+        case IWL_PHY_CALIBRATE_TX_IQ_CMD:
+                index = IWL_CALIB_TX_IQ;
+                break;
+        case IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD:
+                index = IWL_CALIB_TX_IQ_PERD;
+                break;
+        case IWL_PHY_CALIBRATE_BASE_BAND_CMD:
+                index = IWL_CALIB_BASE_BAND;
+                break;
+        default:
+                IWL_ERR(priv, "Unknown calibration notification %d\n",
+                          hdr->op_code);
+                return;
+        }
+        iwl_calib_set(&priv->calib_results[index], pkt->u.raw, len);
+}
+
+void iwlagn_rx_calib_complete(struct iwl_priv *priv,
+                               struct iwl_rx_mem_buffer *rxb)
+{
+        IWL_DEBUG_INFO(priv, "Init. calibration is completed, restarting fw.\n");
+        queue_work(priv->workqueue, &priv->restart);
+}
+
+void iwlagn_init_alive_start(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        /* Check alive response for "valid" sign from uCode */
+        if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
+                /* We had an error bringing up the hardware, so take it
+                 * all the way back down so we can try again */
+                IWL_DEBUG_INFO(priv, "Initialize Alive failed.\n");
+                goto restart;
+        }
+
+        /* initialize uCode was loaded... verify inst image.
+         * This is a paranoid check, because we would not have gotten the
+         * "initialize" alive if code weren't properly loaded.  */
+        if (iwl_verify_ucode(priv)) {
+                /* Runtime instruction load was bad;
+                 * take it all the way back down so we can try again */
+                IWL_DEBUG_INFO(priv, "Bad \"initialize\" uCode load.\n");
+                goto restart;
+        }
+
+        ret = priv->cfg->ops->lib->alive_notify(priv);
+        if (ret) {
+                IWL_WARN(priv,
+                        "Could not complete ALIVE transition: %d\n", ret);
+                goto restart;
+        }
+
+        iwlagn_send_calib_cfg(priv);
+        return;
+
+restart:
+        /* real restart (first load init_ucode) */
+        queue_work(priv->workqueue, &priv->restart);
+}
+
+static int iwlagn_send_wimax_coex(struct iwl_priv *priv)
+{
+        struct iwl_wimax_coex_cmd coex_cmd;
+
+        if (priv->cfg->support_wimax_coexist) {
+                /* UnMask wake up src at associated sleep */
+                coex_cmd.flags = COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
+
+                /* UnMask wake up src at unassociated sleep */
+                coex_cmd.flags |= COEX_FLAGS_UNASSOC_WA_UNMASK_MSK;
+                memcpy(coex_cmd.sta_prio, cu_priorities,
+                        sizeof(struct iwl_wimax_coex_event_entry) *
+                         COEX_NUM_OF_EVENTS);
+
+                /* enabling the coexistence feature */
+                coex_cmd.flags |= COEX_FLAGS_COEX_ENABLE_MSK;
+
+                /* enabling the priorities tables */
+                coex_cmd.flags |= COEX_FLAGS_STA_TABLE_VALID_MSK;
+        } else {
+                /* coexistence is disabled */
+                memset(&coex_cmd, 0, sizeof(coex_cmd));
+        }
+        return iwl_send_cmd_pdu(priv, COEX_PRIORITY_TABLE_CMD,
+                                sizeof(coex_cmd), &coex_cmd);
+}
+
+int iwlagn_alive_notify(struct iwl_priv *priv)
+{
+        u32 a;
+        unsigned long flags;
+        int i, chan;
+        u32 reg_val;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        priv->scd_base_addr = iwl_read_prph(priv, IWLAGN_SCD_SRAM_BASE_ADDR);
+        a = priv->scd_base_addr + IWLAGN_SCD_CONTEXT_DATA_OFFSET;
+        for (; a < priv->scd_base_addr + IWLAGN_SCD_TX_STTS_BITMAP_OFFSET;
+                a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+        for (; a < priv->scd_base_addr + IWLAGN_SCD_TRANSLATE_TBL_OFFSET;
+                a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+        for (; a < priv->scd_base_addr +
+               IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+
+        iwl_write_prph(priv, IWLAGN_SCD_DRAM_BASE_ADDR,
+                       priv->scd_bc_tbls.dma >> 10);
+
+        /* Enable DMA channel */
+        for (chan = 0; chan < FH50_TCSR_CHNL_NUM ; chan++)
+                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
+                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
+                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
+
+        /* Update FH chicken bits */
+        reg_val = iwl_read_direct32(priv, FH_TX_CHICKEN_BITS_REG);
+        iwl_write_direct32(priv, FH_TX_CHICKEN_BITS_REG,
+                           reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
+
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUECHAIN_SEL,
+                IWLAGN_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
+        iwl_write_prph(priv, IWLAGN_SCD_AGGR_SEL, 0);
+
+        /* initiate the queues */
+        for (i = 0; i < priv->hw_params.max_txq_num; i++) {
+                iwl_write_prph(priv, IWLAGN_SCD_QUEUE_RDPTR(i), 0);
+                iwl_write_direct32(priv, HBUS_TARG_WRPTR, 0 | (i << 8));
+                iwl_write_targ_mem(priv, priv->scd_base_addr +
+                                IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
+                iwl_write_targ_mem(priv, priv->scd_base_addr +
+                                IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(i) +
+                                sizeof(u32),
+                                ((SCD_WIN_SIZE <<
+                                IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                                IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                                ((SCD_FRAME_LIMIT <<
+                                IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                                IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+        }
+
+        iwl_write_prph(priv, IWLAGN_SCD_INTERRUPT_MASK,
+                        IWL_MASK(0, priv->hw_params.max_txq_num));
+
+        /* Activate all Tx DMA/FIFO channels */
+        priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 7));
+
+        iwlagn_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+
+        /* make sure all queue are not stopped */
+        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
+        for (i = 0; i < 4; i++)
+                atomic_set(&priv->queue_stop_count[i], 0);
+
+        /* reset to 0 to enable all the queue first */
+        priv->txq_ctx_active_msk = 0;
+        /* map qos queues to fifos one-to-one */
+        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo) != 10);
+
+        for (i = 0; i < ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo); i++) {
+                int ac = iwlagn_default_queue_to_tx_fifo[i];
+
+                iwl_txq_ctx_activate(priv, i);
+
+                if (ac == IWL_TX_FIFO_UNUSED)
+                        continue;
+
+                iwlagn_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
+        }
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        iwlagn_send_wimax_coex(priv);
+
+        iwlagn_set_Xtal_calib(priv);
+        iwl_send_calib_results(priv);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..aef4f71f1981 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -55,6 +55,7 @@
 #include "iwl-helpers.h"
 #include "iwl-sta.h"
 #include "iwl-calib.h"
+#include "iwl-agn.h"
 
 
 /******************************************************************************
@@ -83,13 +84,6 @@ MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("iwl4965");
 
-/*************** STATION TABLE MANAGEMENT ****
- * mac80211 should be examined to determine if sta_info is duplicating
- * the functionality provided here
- */
-
-/**************************************************************/
-
 /**
  * iwl_commit_rxon - commit staging_rxon to hardware
  *
@@ -144,9 +138,6 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 return 0;
         }
 
-        /* station table will be cleared */
-        priv->assoc_station_added = 0;
-
         /* If we are currently associated and the new config requires
          * an RXON_ASSOC and the new config wants the associated mask enabled,
          * we must clear the associated from the active configuration
@@ -166,6 +157,13 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                         IWL_ERR(priv, "Error clearing ASSOC_MSK (%d)\n", ret);
                         return ret;
                 }
+                iwl_clear_ucode_stations(priv);
+                iwl_restore_stations(priv);
+                ret = iwl_restore_default_wep_keys(priv);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
+                        return ret;
+                }
         }
 
         IWL_DEBUG_INFO(priv, "Sending RXON\n"
@@ -179,9 +177,8 @@ int iwl_commit_rxon(struct iwl_priv *priv)
         iwl_set_rxon_hwcrypto(priv, !priv->cfg->mod_params->sw_crypto);
 
         /* Apply the new configuration
-         * RXON unassoc clears the station table in uCode, send it before
-         * we add the bcast station. If assoc bit is set, we will send RXON
-         * after having added the bcast and bssid station.
+         * RXON unassoc clears the station table in uCode so restoration of
+         * stations is needed after it (the RXON command) completes
          */
         if (!new_assoc) {
                 ret = iwl_send_cmd_pdu(priv, REPLY_RXON,
@@ -190,35 +187,19 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                         IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
                         return ret;
                 }
+                IWL_DEBUG_INFO(priv, "Return from !new_assoc RXON.\n");
                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
+                iwl_clear_ucode_stations(priv);
+                iwl_restore_stations(priv);
+                ret = iwl_restore_default_wep_keys(priv);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
+                        return ret;
+                }
         }
 
-        iwl_clear_stations_table(priv);
-
         priv->start_calib = 0;
-
-        /* Add the broadcast address so we can send broadcast frames */
-        priv->cfg->ops->lib->add_bcast_station(priv);
-
-
-        /* If we have set the ASSOC_MSK and we are in BSS mode then
-         * add the IWL_AP_ID to the station rate table */
         if (new_assoc) {
-                if (priv->iw_mode == NL80211_IFTYPE_STATION) {
-                        ret = iwl_rxon_add_station(priv,
-                                           priv->active_rxon.bssid_addr, 1);
-                        if (ret == IWL_INVALID_STATION) {
-                                IWL_ERR(priv,
-                                        "Error adding AP address for TX.\n");
-                                return -EIO;
-                        }
-                        priv->assoc_station_added = 1;
-                        if (priv->default_wep_key &&
-                            iwl_send_static_wepkey_cmd(priv, 0))
-                                IWL_ERR(priv,
-                                        "Could not send WEP static key.\n");
-                }
-
                 /*
                  * allow CTS-to-self if possible for new association.
                  * this is relevant only for 5000 series and up,
@@ -907,10 +888,10 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[MISSED_BEACONS_NOTIFICATION] =
             iwl_rx_missed_beacon_notif;
         /* Rx handlers */
-        priv->rx_handlers[REPLY_RX_PHY_CMD] = iwl_rx_reply_rx_phy;
-        priv->rx_handlers[REPLY_RX_MPDU_CMD] = iwl_rx_reply_rx;
+        priv->rx_handlers[REPLY_RX_PHY_CMD] = iwlagn_rx_reply_rx_phy;
+        priv->rx_handlers[REPLY_RX_MPDU_CMD] = iwlagn_rx_reply_rx;
         /* block ack */
-        priv->rx_handlers[REPLY_COMPRESSED_BA] = iwl_rx_reply_compressed_ba;
+        priv->rx_handlers[REPLY_COMPRESSED_BA] = iwlagn_rx_reply_compressed_ba;
         /* Set up hardware specific Rx handlers */
         priv->cfg->ops->lib->rx_handler_setup(priv);
 }
@@ -1038,7 +1019,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 rxq->read = i;
-                                iwl_rx_replenish_now(priv);
+                                iwlagn_rx_replenish_now(priv);
                                 count = 0;
                         }
                 }
@@ -1047,9 +1028,9 @@ void iwl_rx_handle(struct iwl_priv *priv)
         /* Backtrack one entry */
         rxq->read = i;
         if (fill_rx)
-                iwl_rx_replenish_now(priv);
+                iwlagn_rx_replenish_now(priv);
         else
-                iwl_rx_queue_restock(priv);
+                iwlagn_rx_queue_restock(priv);
 }
 
 /* call this function to flush any scheduled tasklet */
@@ -1267,9 +1248,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
          * hardware bugs here by ACKing all the possible interrupts so that
          * interrupt coalescing can still be achieved.
          */
-        iwl_write32(priv, CSR_INT, priv->inta | ~priv->inta_mask);
+        iwl_write32(priv, CSR_INT, priv->_agn.inta | ~priv->inta_mask);
 
-        inta = priv->inta;
+        inta = priv->_agn.inta;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
@@ -1282,8 +1263,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* saved interrupt in inta variable now we can reset priv->inta */
-        priv->inta = 0;
+        /* saved interrupt in inta variable now we can reset priv->_agn.inta */
+        priv->_agn.inta = 0;
 
         /* Now service all interrupt bits discovered above. */
         if (inta & CSR_INT_BIT_HW_ERR) {
@@ -1448,6 +1429,60 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 iwl_enable_interrupts(priv);
 }
 
+/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
+#define ACK_CNT_RATIO (50)
+#define BA_TIMEOUT_CNT (5)
+#define BA_TIMEOUT_MAX (16)
+
+/**
+ * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
+ *
+ * When the ACK count ratio is 0 and aggregated BA timeout retries exceeding
+ * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
+ * operation state.
+ */
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        bool rc = true;
+        int actual_ack_cnt_delta, expected_ack_cnt_delta;
+        int ba_timeout_delta;
+
+        actual_ack_cnt_delta =
+                le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
+                le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
+        expected_ack_cnt_delta =
+                le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
+                le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
+        ba_timeout_delta =
+                le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
+                le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
+        if ((priv->_agn.agg_tids_count > 0) &&
+            (expected_ack_cnt_delta > 0) &&
+            (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
+                < ACK_CNT_RATIO) &&
+            (ba_timeout_delta > BA_TIMEOUT_CNT)) {
+                IWL_DEBUG_RADIO(priv, "actual_ack_cnt delta = %d,"
+                                " expected_ack_cnt = %d\n",
+                                actual_ack_cnt_delta, expected_ack_cnt_delta);
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+                IWL_DEBUG_RADIO(priv, "rx_detected_cnt delta = %d\n",
+                                priv->delta_statistics.tx.rx_detected_cnt);
+                IWL_DEBUG_RADIO(priv,
+                                "ack_or_ba_timeout_collision delta = %d\n",
+                                priv->delta_statistics.tx.
+                                ack_or_ba_timeout_collision);
+#endif
+                IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
+                                ba_timeout_delta);
+                if (!actual_ack_cnt_delta &&
+                    (ba_timeout_delta >= BA_TIMEOUT_MAX))
+                        rc = false;
+        }
+        return rc;
+}
+
 
 /******************************************************************************
  *
@@ -1471,9 +1506,13 @@ static void iwl_nic_start(struct iwl_priv *priv)
         iwl_write32(priv, CSR_RESET, 0);
 }
 
+struct iwlagn_ucode_capabilities {
+        u32 max_probe_length;
+};
 
 static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
-static int iwl_mac_setup_register(struct iwl_priv *priv);
+static int iwl_mac_setup_register(struct iwl_priv *priv,
+                                  struct iwlagn_ucode_capabilities *capa);
 
 static int __must_check iwl_request_firmware(struct iwl_priv *priv, bool first)
 {
@@ -1500,6 +1539,199 @@ static int __must_check iwl_request_firmware(struct iwl_priv *priv, bool first)
                                        iwl_ucode_callback);
 }
 
+struct iwlagn_firmware_pieces {
+        const void *inst, *data, *init, *init_data, *boot;
+        size_t inst_size, data_size, init_size, init_data_size, boot_size;
+
+        u32 build;
+};
+
+static int iwlagn_load_legacy_firmware(struct iwl_priv *priv,
+                                       const struct firmware *ucode_raw,
+                                       struct iwlagn_firmware_pieces *pieces)
+{
+        struct iwl_ucode_header *ucode = (void *)ucode_raw->data;
+        u32 api_ver, hdr_size;
+        const u8 *src;
+
+        priv->ucode_ver = le32_to_cpu(ucode->ver);
+        api_ver = IWL_UCODE_API(priv->ucode_ver);
+
+        switch (api_ver) {
+        default:
+                /*
+                 * 4965 doesn't revision the firmware file format
+                 * along with the API version, it always uses v1
+                 * file format.
+                 */
+                if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) !=
+                                CSR_HW_REV_TYPE_4965) {
+                        hdr_size = 28;
+                        if (ucode_raw->size < hdr_size) {
+                                IWL_ERR(priv, "File size too small!\n");
+                                return -EINVAL;
+                        }
+                        pieces->build = le32_to_cpu(ucode->u.v2.build);
+                        pieces->inst_size = le32_to_cpu(ucode->u.v2.inst_size);
+                        pieces->data_size = le32_to_cpu(ucode->u.v2.data_size);
+                        pieces->init_size = le32_to_cpu(ucode->u.v2.init_size);
+                        pieces->init_data_size = le32_to_cpu(ucode->u.v2.init_data_size);
+                        pieces->boot_size = le32_to_cpu(ucode->u.v2.boot_size);
+                        src = ucode->u.v2.data;
+                        break;
+                }
+                /* fall through for 4965 */
+        case 0:
+        case 1:
+        case 2:
+                hdr_size = 24;
+                if (ucode_raw->size < hdr_size) {
+                        IWL_ERR(priv, "File size too small!\n");
+                        return -EINVAL;
+                }
+                pieces->build = 0;
+                pieces->inst_size = le32_to_cpu(ucode->u.v1.inst_size);
+                pieces->data_size = le32_to_cpu(ucode->u.v1.data_size);
+                pieces->init_size = le32_to_cpu(ucode->u.v1.init_size);
+                pieces->init_data_size = le32_to_cpu(ucode->u.v1.init_data_size);
+                pieces->boot_size = le32_to_cpu(ucode->u.v1.boot_size);
+                src = ucode->u.v1.data;
+                break;
+        }
+
+        /* Verify size of file vs. image size info in file's header */
+        if (ucode_raw->size != hdr_size + pieces->inst_size +
+                                pieces->data_size + pieces->init_size +
+                                pieces->init_data_size + pieces->boot_size) {
+
+                IWL_ERR(priv,
+                        "uCode file size %d does not match expected size\n",
+                        (int)ucode_raw->size);
+                return -EINVAL;
+        }
+
+        pieces->inst = src;
+        src += pieces->inst_size;
+        pieces->data = src;
+        src += pieces->data_size;
+        pieces->init = src;
+        src += pieces->init_size;
+        pieces->init_data = src;
+        src += pieces->init_data_size;
+        pieces->boot = src;
+        src += pieces->boot_size;
+
+        return 0;
+}
+
+static int iwlagn_wanted_ucode_alternative = 1;
+
+static int iwlagn_load_firmware(struct iwl_priv *priv,
+                                const struct firmware *ucode_raw,
+                                struct iwlagn_firmware_pieces *pieces,
+                                struct iwlagn_ucode_capabilities *capa)
+{
+        struct iwl_tlv_ucode_header *ucode = (void *)ucode_raw->data;
+        struct iwl_ucode_tlv *tlv;
+        size_t len = ucode_raw->size;
+        const u8 *data;
+        int wanted_alternative = iwlagn_wanted_ucode_alternative, tmp;
+        u64 alternatives;
+
+        if (len < sizeof(*ucode))
+                return -EINVAL;
+
+        if (ucode->magic != cpu_to_le32(IWL_TLV_UCODE_MAGIC))
+                return -EINVAL;
+
+        /*
+         * Check which alternatives are present, and "downgrade"
+         * when the chosen alternative is not present, warning
+         * the user when that happens. Some files may not have
+         * any alternatives, so don't warn in that case.
+         */
+        alternatives = le64_to_cpu(ucode->alternatives);
+        tmp = wanted_alternative;
+        if (wanted_alternative > 63)
+                wanted_alternative = 63;
+        while (wanted_alternative && !(alternatives & BIT(wanted_alternative)))
+                wanted_alternative--;
+        if (wanted_alternative && wanted_alternative != tmp)
+                IWL_WARN(priv,
+                         "uCode alternative %d not available, choosing %d\n",
+                         tmp, wanted_alternative);
+
+        priv->ucode_ver = le32_to_cpu(ucode->ver);
+        pieces->build = le32_to_cpu(ucode->build);
+        data = ucode->data;
+
+        len -= sizeof(*ucode);
+
+        while (len >= sizeof(*tlv)) {
+                u32 tlv_len;
+                enum iwl_ucode_tlv_type tlv_type;
+                u16 tlv_alt;
+                const u8 *tlv_data;
+
+                len -= sizeof(*tlv);
+                tlv = (void *)data;
+
+                tlv_len = le32_to_cpu(tlv->length);
+                tlv_type = le16_to_cpu(tlv->type);
+                tlv_alt = le16_to_cpu(tlv->alternative);
+                tlv_data = tlv->data;
+
+                if (len < tlv_len)
+                        return -EINVAL;
+                len -= ALIGN(tlv_len, 4);
+                data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+
+                /*
+                 * Alternative 0 is always valid.
+                 *
+                 * Skip alternative TLVs that are not selected.
+                 */
+                if (tlv_alt != 0 && tlv_alt != wanted_alternative)
+                        continue;
+
+                switch (tlv_type) {
+                case IWL_UCODE_TLV_INST:
+                        pieces->inst = tlv_data;
+                        pieces->inst_size = tlv_len;
+                        break;
+                case IWL_UCODE_TLV_DATA:
+                        pieces->data = tlv_data;
+                        pieces->data_size = tlv_len;
+                        break;
+                case IWL_UCODE_TLV_INIT:
+                        pieces->init = tlv_data;
+                        pieces->init_size = tlv_len;
+                        break;
+                case IWL_UCODE_TLV_INIT_DATA:
+                        pieces->init_data = tlv_data;
+                        pieces->init_data_size = tlv_len;
+                        break;
+                case IWL_UCODE_TLV_BOOT:
+                        pieces->boot = tlv_data;
+                        pieces->boot_size = tlv_len;
+                        break;
+                case IWL_UCODE_TLV_PROBE_MAX_LEN:
+                        if (tlv_len != 4)
+                                return -EINVAL;
+                        capa->max_probe_length =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        if (len)
+                return -EINVAL;
+
+        return 0;
+}
+
 /**
  * iwl_ucode_callback - callback when firmware was loaded
  *
@@ -1510,14 +1742,18 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 {
         struct iwl_priv *priv = context;
         struct iwl_ucode_header *ucode;
+        int err;
+        struct iwlagn_firmware_pieces pieces;
         const unsigned int api_max = priv->cfg->ucode_api_max;
         const unsigned int api_min = priv->cfg->ucode_api_min;
-        u8 *src;
-        size_t len;
-        u32 api_ver, build;
-        u32 inst_size, data_size, init_size, init_data_size, boot_size;
-        int err;
-        u16 eeprom_ver;
+        u32 api_ver;
+        char buildstr[25];
+        u32 build;
+        struct iwlagn_ucode_capabilities ucode_capa = {
+                .max_probe_length = 200,
+        };
+
+        memset(&pieces, 0, sizeof(pieces));
 
         if (!ucode_raw) {
                 IWL_ERR(priv, "request for firmware file '%s' failed.\n",
@@ -1528,8 +1764,8 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         IWL_DEBUG_INFO(priv, "Loaded firmware file '%s' (%zd bytes).\n",
                        priv->firmware_name, ucode_raw->size);
 
-        /* Make sure that we got at least the v1 header! */
-        if (ucode_raw->size < priv->cfg->ops->ucode->get_header_size(1)) {
+        /* Make sure that we got at least the API version number */
+        if (ucode_raw->size < 4) {
                 IWL_ERR(priv, "File size way too small!\n");
                 goto try_again;
         }
@@ -1537,21 +1773,23 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         /* Data from ucode file:  header followed by uCode images */
         ucode = (struct iwl_ucode_header *)ucode_raw->data;
 
-        priv->ucode_ver = le32_to_cpu(ucode->ver);
+        if (ucode->ver)
+                err = iwlagn_load_legacy_firmware(priv, ucode_raw, &pieces);
+        else
+                err = iwlagn_load_firmware(priv, ucode_raw, &pieces,
+                                           &ucode_capa);
+
+        if (err)
+                goto try_again;
+
         api_ver = IWL_UCODE_API(priv->ucode_ver);
-        build = priv->cfg->ops->ucode->get_build(ucode, api_ver);
-        inst_size = priv->cfg->ops->ucode->get_inst_size(ucode, api_ver);
-        data_size = priv->cfg->ops->ucode->get_data_size(ucode, api_ver);
-        init_size = priv->cfg->ops->ucode->get_init_size(ucode, api_ver);
-        init_data_size =
-                priv->cfg->ops->ucode->get_init_data_size(ucode, api_ver);
-        boot_size = priv->cfg->ops->ucode->get_boot_size(ucode, api_ver);
-        src = priv->cfg->ops->ucode->get_data(ucode, api_ver);
-
-        /* api_ver should match the api version forming part of the
-         * firmware filename ... but we don't check for that and only rely
-         * on the API version read from firmware header from here on forward */
+        build = pieces.build;
 
+        /*
+         * api_ver should match the api version forming part of the
+         * firmware filename ... but we don't check for that and only rely
+         * on the API version read from firmware header from here on forward
+         */
         if (api_ver < api_min || api_ver > api_max) {
                 IWL_ERR(priv, "Driver unable to support your firmware API. "
                           "Driver supports v%u, firmware is v%u.\n",
@@ -1565,40 +1803,26 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                           "from http://www.intellinuxwireless.org.\n",
                           api_max, api_ver);
 
-        IWL_INFO(priv, "loaded firmware version %u.%u.%u.%u\n",
-               IWL_UCODE_MAJOR(priv->ucode_ver),
-               IWL_UCODE_MINOR(priv->ucode_ver),
-               IWL_UCODE_API(priv->ucode_ver),
-               IWL_UCODE_SERIAL(priv->ucode_ver));
+        if (build)
+                sprintf(buildstr, " build %u", build);
+        else
+                buildstr[0] = '\0';
+
+        IWL_INFO(priv, "loaded firmware version %u.%u.%u.%u%s\n",
+                 IWL_UCODE_MAJOR(priv->ucode_ver),
+                 IWL_UCODE_MINOR(priv->ucode_ver),
+                 IWL_UCODE_API(priv->ucode_ver),
+                 IWL_UCODE_SERIAL(priv->ucode_ver),
+                 buildstr);
 
         snprintf(priv->hw->wiphy->fw_version,
                  sizeof(priv->hw->wiphy->fw_version),
-                 "%u.%u.%u.%u",
+                 "%u.%u.%u.%u%s",
                  IWL_UCODE_MAJOR(priv->ucode_ver),
                  IWL_UCODE_MINOR(priv->ucode_ver),
                  IWL_UCODE_API(priv->ucode_ver),
-                 IWL_UCODE_SERIAL(priv->ucode_ver));
-
-        if (build)
-                IWL_DEBUG_INFO(priv, "Build %u\n", build);
-
-        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
-        IWL_DEBUG_INFO(priv, "NVM Type: %s, version: 0x%x\n",
-                       (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-                       ? "OTP" : "EEPROM", eeprom_ver);
-
-        IWL_DEBUG_INFO(priv, "f/w package hdr ucode version raw = 0x%x\n",
-                       priv->ucode_ver);
-        IWL_DEBUG_INFO(priv, "f/w package hdr runtime inst size = %u\n",
-                       inst_size);
-        IWL_DEBUG_INFO(priv, "f/w package hdr runtime data size = %u\n",
-                       data_size);
-        IWL_DEBUG_INFO(priv, "f/w package hdr init inst size = %u\n",
-                       init_size);
-        IWL_DEBUG_INFO(priv, "f/w package hdr init data size = %u\n",
-                       init_data_size);
-        IWL_DEBUG_INFO(priv, "f/w package hdr boot inst size = %u\n",
-                       boot_size);
+                 IWL_UCODE_SERIAL(priv->ucode_ver),
+                 buildstr);
 
         /*
          * For any of the failures below (before allocating pci memory)
@@ -1606,43 +1830,47 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
          * user just got a corrupted version of the latest API.
          */
 
-        /* Verify size of file vs. image size info in file's header */
-        if (ucode_raw->size !=
-                priv->cfg->ops->ucode->get_header_size(api_ver) +
-                inst_size + data_size + init_size +
-                init_data_size + boot_size) {
-
-                IWL_DEBUG_INFO(priv,
-                        "uCode file size %d does not match expected size\n",
-                        (int)ucode_raw->size);
-                goto try_again;
-        }
+        IWL_DEBUG_INFO(priv, "f/w package hdr ucode version raw = 0x%x\n",
+                       priv->ucode_ver);
+        IWL_DEBUG_INFO(priv, "f/w package hdr runtime inst size = %Zd\n",
+                       pieces.inst_size);
+        IWL_DEBUG_INFO(priv, "f/w package hdr runtime data size = %Zd\n",
+                       pieces.data_size);
+        IWL_DEBUG_INFO(priv, "f/w package hdr init inst size = %Zd\n",
+                       pieces.init_size);
+        IWL_DEBUG_INFO(priv, "f/w package hdr init data size = %Zd\n",
+                       pieces.init_data_size);
+        IWL_DEBUG_INFO(priv, "f/w package hdr boot inst size = %Zd\n",
+                       pieces.boot_size);
 
         /* Verify that uCode images will fit in card's SRAM */
-        if (inst_size > priv->hw_params.max_inst_size) {
-                IWL_DEBUG_INFO(priv, "uCode instr len %d too large to fit in\n",
-                               inst_size);
+        if (pieces.inst_size > priv->hw_params.max_inst_size) {
+                IWL_ERR(priv, "uCode instr len %Zd too large to fit in\n",
+                        pieces.inst_size);
                 goto try_again;
         }
 
-        if (data_size > priv->hw_params.max_data_size) {
-                IWL_DEBUG_INFO(priv, "uCode data len %d too large to fit in\n",
-                                data_size);
+        if (pieces.data_size > priv->hw_params.max_data_size) {
+                IWL_ERR(priv, "uCode data len %Zd too large to fit in\n",
+                        pieces.data_size);
                 goto try_again;
         }
-        if (init_size > priv->hw_params.max_inst_size) {
-                IWL_INFO(priv, "uCode init instr len %d too large to fit in\n",
-                        init_size);
+
+        if (pieces.init_size > priv->hw_params.max_inst_size) {
+                IWL_ERR(priv, "uCode init instr len %Zd too large to fit in\n",
+                        pieces.init_size);
                 goto try_again;
         }
-        if (init_data_size > priv->hw_params.max_data_size) {
-                IWL_INFO(priv, "uCode init data len %d too large to fit in\n",
-                      init_data_size);
+
+        if (pieces.init_data_size > priv->hw_params.max_data_size) {
+                IWL_ERR(priv, "uCode init data len %Zd too large to fit in\n",
+                        pieces.init_data_size);
                 goto try_again;
         }
-        if (boot_size > priv->hw_params.max_bsm_size) {
-                IWL_INFO(priv, "uCode boot instr len %d too large to fit in\n",
-                        boot_size);
+
+        if (pieces.boot_size > priv->hw_params.max_bsm_size) {
+                IWL_ERR(priv, "uCode boot instr len %Zd too large to fit in\n",
+                        pieces.boot_size);
                 goto try_again;
         }
 
@@ -1651,13 +1879,13 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         /* Runtime instructions and 2 copies of data:
          * 1) unmodified from disk
          * 2) backup cache for save/restore during power-downs */
-        priv->ucode_code.len = inst_size;
+        priv->ucode_code.len = pieces.inst_size;
         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_code);
 
-        priv->ucode_data.len = data_size;
+        priv->ucode_data.len = pieces.data_size;
         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data);
 
-        priv->ucode_data_backup.len = data_size;
+        priv->ucode_data_backup.len = pieces.data_size;
         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
 
         if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
@@ -1665,11 +1893,11 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
                 goto err_pci_alloc;
 
         /* Initialization instructions and data */
-        if (init_size && init_data_size) {
-                priv->ucode_init.len = init_size;
+        if (pieces.init_size && pieces.init_data_size) {
+                priv->ucode_init.len = pieces.init_size;
                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init);
 
-                priv->ucode_init_data.len = init_data_size;
+                priv->ucode_init_data.len = pieces.init_data_size;
                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init_data);
 
                 if (!priv->ucode_init.v_addr || !priv->ucode_init_data.v_addr)
@@ -1677,8 +1905,8 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         }
 
         /* Bootstrap (instructions only, no data) */
-        if (boot_size) {
-                priv->ucode_boot.len = boot_size;
+        if (pieces.boot_size) {
+                priv->ucode_boot.len = pieces.boot_size;
                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_boot);
 
                 if (!priv->ucode_boot.v_addr)
@@ -1688,51 +1916,48 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         /* Copy images into buffers for card's bus-master reads ... */
 
         /* Runtime instructions (first block of data in file) */
-        len = inst_size;
-        IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode instr len %Zd\n", len);
-        memcpy(priv->ucode_code.v_addr, src, len);
-        src += len;
+        IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode instr len %Zd\n",
+                        pieces.inst_size);
+        memcpy(priv->ucode_code.v_addr, pieces.inst, pieces.inst_size);
 
         IWL_DEBUG_INFO(priv, "uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
                 priv->ucode_code.v_addr, (u32)priv->ucode_code.p_addr);
 
-        /* Runtime data (2nd block)
-         * NOTE:  Copy into backup buffer will be done in iwl_up()  */
-        len = data_size;
-        IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode data len %Zd\n", len);
-        memcpy(priv->ucode_data.v_addr, src, len);
-        memcpy(priv->ucode_data_backup.v_addr, src, len);
-        src += len;
-
-        /* Initialization instructions (3rd block) */
-        if (init_size) {
-                len = init_size;
+        /*
+         * Runtime data
+         * NOTE:  Copy into backup buffer will be done in iwl_up()
+         */
+        IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode data len %Zd\n",
+                        pieces.data_size);
+        memcpy(priv->ucode_data.v_addr, pieces.data, pieces.data_size);
+        memcpy(priv->ucode_data_backup.v_addr, pieces.data, pieces.data_size);
+
+        /* Initialization instructions */
+        if (pieces.init_size) {
                 IWL_DEBUG_INFO(priv, "Copying (but not loading) init instr len %Zd\n",
-                                len);
-                memcpy(priv->ucode_init.v_addr, src, len);
-                src += len;
+                                pieces.init_size);
+                memcpy(priv->ucode_init.v_addr, pieces.init, pieces.init_size);
         }
 
-        /* Initialization data (4th block) */
-        if (init_data_size) {
-                len = init_data_size;
+        /* Initialization data */
+        if (pieces.init_data_size) {
                 IWL_DEBUG_INFO(priv, "Copying (but not loading) init data len %Zd\n",
-                               len);
-                memcpy(priv->ucode_init_data.v_addr, src, len);
-                src += len;
+                               pieces.init_data_size);
+                memcpy(priv->ucode_init_data.v_addr, pieces.init_data,
+                       pieces.init_data_size);
         }
 
-        /* Bootstrap instructions (5th block) */
-        len = boot_size;
-        IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n", len);
-        memcpy(priv->ucode_boot.v_addr, src, len);
+        /* Bootstrap instructions */
+        IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n",
+                        pieces.boot_size);
+        memcpy(priv->ucode_boot.v_addr, pieces.boot, pieces.boot_size);
 
         /**************************************************
          * This is still part of probe() in a sense...
          *
          * 9. Setup and register with mac80211 and debugfs
          **************************************************/
-        err = iwl_mac_setup_register(priv);
+        err = iwl_mac_setup_register(priv, &ucode_capa);
         if (err)
                 goto out_unbind;
 
@@ -1742,6 +1967,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
+        complete(&priv->_agn.firmware_loading_complete);
         return;
 
  try_again:
@@ -1755,6 +1981,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         IWL_ERR(priv, "failed to allocate pci memory\n");
         iwl_dealloc_ucode_pci(priv);
  out_unbind:
+        complete(&priv->_agn.firmware_loading_complete);
         device_release_driver(&priv->pci_dev->dev);
         release_firmware(ucode_raw);
 }
@@ -1809,6 +2036,7 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         u32 data2, line;
         u32 desc, time, count, base, data1;
         u32 blink1, blink2, ilink1, ilink2;
+        u32 pc, hcmd;
 
         if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
@@ -1831,6 +2059,7 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         }
 
         desc = iwl_read_targ_mem(priv, base + 1 * sizeof(u32));
+        pc = iwl_read_targ_mem(priv, base + 2 * sizeof(u32));
         blink1 = iwl_read_targ_mem(priv, base + 3 * sizeof(u32));
         blink2 = iwl_read_targ_mem(priv, base + 4 * sizeof(u32));
         ilink1 = iwl_read_targ_mem(priv, base + 5 * sizeof(u32));
@@ -1839,6 +2068,7 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         data2 = iwl_read_targ_mem(priv, base + 8 * sizeof(u32));
         line = iwl_read_targ_mem(priv, base + 9 * sizeof(u32));
         time = iwl_read_targ_mem(priv, base + 11 * sizeof(u32));
+        hcmd = iwl_read_targ_mem(priv, base + 22 * sizeof(u32));
 
         trace_iwlwifi_dev_ucode_error(priv, desc, time, data1, data2, line,
                                       blink1, blink2, ilink1, ilink2);
@@ -1847,10 +2077,9 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
                 "data1      data2      line\n");
         IWL_ERR(priv, "%-28s (#%02d) %010u 0x%08X 0x%08X %u\n",
                 desc_lookup(desc), desc, time, data1, data2, line);
-        IWL_ERR(priv, "blink1  blink2  ilink1  ilink2\n");
-        IWL_ERR(priv, "0x%05X 0x%05X 0x%05X 0x%05X\n", blink1, blink2,
-                ilink1, ilink2);
-
+        IWL_ERR(priv, "pc      blink1  blink2  ilink1  ilink2  hcmd\n");
+        IWL_ERR(priv, "0x%05X 0x%05X 0x%05X 0x%05X 0x%05X 0x%05X\n",
+                pc, blink1, blink2, ilink1, ilink2, hcmd);
 }
 
 #define EVENT_START_OFFSET  (4 * sizeof(u32))
@@ -1966,9 +2195,6 @@ static int iwl_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         return pos;
 }
 
-/* For sanity check only.  Actual size is determined by uCode, typ. 512 */
-#define MAX_EVENT_LOG_SIZE (512)
-
 #define DEFAULT_DUMP_EVENT_LOG_ENTRIES (20)
 
 int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
@@ -2001,16 +2227,16 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
-        if (capacity > MAX_EVENT_LOG_SIZE) {
+        if (capacity > priv->cfg->max_event_log_size) {
                 IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
-                        capacity, MAX_EVENT_LOG_SIZE);
-                capacity = MAX_EVENT_LOG_SIZE;
+                        capacity, priv->cfg->max_event_log_size);
+                capacity = priv->cfg->max_event_log_size;
         }
 
-        if (next_entry > MAX_EVENT_LOG_SIZE) {
+        if (next_entry > priv->cfg->max_event_log_size) {
                 IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
-                        next_entry, MAX_EVENT_LOG_SIZE);
-                next_entry = MAX_EVENT_LOG_SIZE;
+                        next_entry, priv->cfg->max_event_log_size);
+                next_entry = priv->cfg->max_event_log_size;
         }
 
         size = num_wraps ? capacity : next_entry;
@@ -2095,7 +2321,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        iwl_clear_stations_table(priv);
         ret = priv->cfg->ops->lib->alive_notify(priv);
         if (ret) {
                 IWL_WARN(priv,
@@ -2106,13 +2331,19 @@ static void iwl_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send host commands to the uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                /* Enable timer to monitor the driver queues */
+                mod_timer(&priv->monitor_recover,
+                        jiffies +
+                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+        }
+
         if (iwl_is_rfkill(priv))
                 return;
 
         ieee80211_wake_queues(priv->hw);
 
-        priv->active_rate = priv->rates_mask;
-        priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
+        priv->active_rate = IWL_RATES_MASK;
 
         /* Configure Tx antenna selection based on H/W config */
         if (priv->cfg->ops->hcmd->set_tx_ant)
@@ -2126,7 +2357,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         } else {
                 /* Initialize our rx_config data */
-                iwl_connection_init_rx_config(priv, priv->iw_mode);
+                iwl_connection_init_rx_config(priv, NULL);
 
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv);
@@ -2135,7 +2366,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
         }
 
         /* Configure Bluetooth device coexistence support */
-        iwl_send_bt_config(priv);
+        priv->cfg->ops->hcmd->send_bt_config(priv);
 
         iwl_reset_run_time_calib(priv);
 
@@ -2152,18 +2383,8 @@ static void iwl_alive_start(struct iwl_priv *priv)
         wake_up_interruptible(&priv->wait_command_queue);
 
         iwl_power_update_mode(priv, true);
+        IWL_DEBUG_INFO(priv, "Updated power mode\n");
 
-        /* reassociate for ADHOC mode */
-        if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
-                struct sk_buff *beacon = ieee80211_beacon_get(priv->hw,
-                                                                priv->vif);
-                if (beacon)
-                        iwl_mac_beacon_update(priv->hw, beacon);
-        }
-
-
-        if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
-                iwl_set_mode(priv, priv->iw_mode);
 
         return;
 
@@ -2183,7 +2404,9 @@ static void __iwl_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl_clear_stations_table(priv);
+        iwl_clear_ucode_stations(priv);
+        iwl_dealloc_bcast_station(priv);
+        iwl_clear_driver_stations(priv);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -2231,8 +2454,8 @@ static void __iwl_down(struct iwl_priv *priv)
         /* device going down, Stop using ICT table */
         iwl_disable_ict(priv);
 
-        iwl_txq_ctx_stop(priv);
-        iwl_rxq_stop(priv);
+        iwlagn_txq_ctx_stop(priv);
+        iwlagn_rxq_stop(priv);
 
         /* Power-down device's busmaster DMA clocks */
         iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
@@ -2292,7 +2515,7 @@ static int iwl_prepare_card_hw(struct iwl_priv *priv)
 {
         int ret = 0;
 
-        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter \n");
+        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter\n");
 
         ret = iwl_set_hw_ready(priv);
         if (priv->hw_ready)
@@ -2330,6 +2553,10 @@ static int __iwl_up(struct iwl_priv *priv)
                 return -EIO;
         }
 
+        ret = iwl_alloc_bcast_station(priv, true);
+        if (ret)
+                return ret;
+
         iwl_prepare_card_hw(priv);
 
         if (!priv->hw_ready) {
@@ -2353,7 +2580,7 @@ static int __iwl_up(struct iwl_priv *priv)
 
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
-        ret = iwl_hw_nic_init(priv);
+        ret = iwlagn_hw_nic_init(priv);
         if (ret) {
                 IWL_ERR(priv, "Unable to init nic\n");
                 return ret;
@@ -2380,8 +2607,6 @@ static int __iwl_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                iwl_clear_stations_table(priv);
-
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
                  * prepare to load the "initialize" uCode */
@@ -2467,7 +2692,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
         }
 
         mutex_unlock(&priv->mutex);
-        return;
 }
 
 static void iwl_bg_restart(struct work_struct *data)
@@ -2505,34 +2729,28 @@ static void iwl_bg_rx_replenish(struct work_struct *data)
                 return;
 
         mutex_lock(&priv->mutex);
-        iwl_rx_replenish(priv);
+        iwlagn_rx_replenish(priv);
         mutex_unlock(&priv->mutex);
 }
 
 #define IWL_DELAY_NEXT_SCAN (HZ*2)
 
-void iwl_post_associate(struct iwl_priv *priv)
+void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         struct ieee80211_conf *conf = NULL;
         int ret = 0;
-        unsigned long flags;
 
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
+        if (!vif || !priv->is_open)
+                return;
+
+        if (vif->type == NL80211_IFTYPE_AP) {
                 IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
                 return;
         }
 
-        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        priv->assoc_id, priv->active_rxon.bssid_addr);
-
-
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-
-        if (!priv->vif || !priv->is_open)
-                return;
-
         iwl_scan_cancel_timeout(priv, 200);
 
         conf = ieee80211_get_hw_conf(priv->hw);
@@ -2540,7 +2758,7 @@ void iwl_post_associate(struct iwl_priv *priv)
         priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         iwlcore_commit_rxon(priv);
 
-        iwl_setup_rxon_timing(priv);
+        iwl_setup_rxon_timing(priv, vif);
         ret = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
                               sizeof(priv->rxon_timing), &priv->rxon_timing);
         if (ret)
@@ -2554,56 +2772,44 @@ void iwl_post_associate(struct iwl_priv *priv)
         if (priv->cfg->ops->hcmd->set_rxon_chain)
                 priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
-        priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
+        priv->staging_rxon.assoc_id = cpu_to_le16(vif->bss_conf.aid);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
-                        priv->assoc_id, priv->beacon_int);
+                        vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
-        if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+        if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif->bss_conf.assoc_capability &
+                                        WLAN_CAPABILITY_SHORT_SLOT_TIME)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
+                if (vif->type == NL80211_IFTYPE_ADHOC)
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
         }
 
         iwlcore_commit_rxon(priv);
 
-        switch (priv->iw_mode) {
+        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
+                        vif->bss_conf.aid, priv->active_rxon.bssid_addr);
+
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 break;
-
         case NL80211_IFTYPE_ADHOC:
-
-                /* assume default assoc id */
-                priv->assoc_id = 1;
-
-                iwl_rxon_add_station(priv, priv->bssid, 0);
                 iwl_send_beacon_cmd(priv);
-
                 break;
-
         default:
                 IWL_ERR(priv, "%s Should not be called in %d mode\n",
-                          __func__, priv->iw_mode);
+                          __func__, vif->type);
                 break;
         }
 
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
-                priv->assoc_station_added = 1;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_activate_qos(priv, 0);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         /* the chain noise calibration will enabled PM upon completion
          * If chain noise has already been run, then we need to enable
          * power management here */
@@ -2628,7 +2834,8 @@ void iwl_post_associate(struct iwl_priv *priv)
  * Not a mac80211 entry point function, but it fits in with all the
  * other mac80211 functions grouped here.
  */
-static int iwl_mac_setup_register(struct iwl_priv *priv)
+static int iwl_mac_setup_register(struct iwl_priv *priv,
+                                  struct iwlagn_ucode_capabilities *capa)
 {
         int ret;
         struct ieee80211_hw *hw = priv->hw;
@@ -2636,7 +2843,6 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
@@ -2649,6 +2855,8 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
                              IEEE80211_HW_SUPPORTS_STATIC_SMPS;
 
         hw->sta_data_size = sizeof(struct iwl_station_priv);
+        hw->vif_data_size = sizeof(struct iwl_vif_priv);
+
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
@@ -2664,7 +2872,7 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
 
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
         /* we create the 802.11 header and a zero-length SSID element */
-        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
+        hw->wiphy->max_scan_ie_len = capa->max_probe_length - 24 - 2;
 
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
@@ -2770,17 +2978,16 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         IWL_DEBUG_TX(priv, "dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
                      ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
-        if (iwl_tx_skb(priv, skb))
+        if (iwlagn_tx_skb(priv, skb))
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MACDUMP(priv, "leave\n");
         return NETDEV_TX_OK;
 }
 
-void iwl_config_ap(struct iwl_priv *priv)
+void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         int ret = 0;
-        unsigned long flags;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -2793,7 +3000,7 @@ void iwl_config_ap(struct iwl_priv *priv)
                 iwlcore_commit_rxon(priv);
 
                 /* RXON Timing */
-                iwl_setup_rxon_timing(priv);
+                iwl_setup_rxon_timing(priv, vif);
                 ret = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
                                 sizeof(priv->rxon_timing), &priv->rxon_timing);
                 if (ret)
@@ -2807,9 +3014,10 @@ void iwl_config_ap(struct iwl_priv *priv)
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
-                /* FIXME: what should be the assoc_id for AP? */
-                priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
-                if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+                priv->staging_rxon.assoc_id = 0;
+
+                if (vif->bss_conf.assoc_capability &
+                                                WLAN_CAPABILITY_SHORT_PREAMBLE)
                         priv->staging_rxon.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
@@ -2817,26 +3025,21 @@ void iwl_config_ap(struct iwl_priv *priv)
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
                 if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                        if (priv->assoc_capability &
-                                WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                        if (vif->bss_conf.assoc_capability &
+                                                WLAN_CAPABILITY_SHORT_SLOT_TIME)
                                 priv->staging_rxon.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
 
-                        if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
+                        if (vif->type == NL80211_IFTYPE_ADHOC)
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
-                iwl_reset_qos(priv);
-                spin_lock_irqsave(&priv->lock, flags);
-                iwl_activate_qos(priv, 1);
-                spin_unlock_irqrestore(&priv->lock, flags);
-                iwl_add_bcast_station(priv);
         }
         iwl_send_beacon_cmd(priv);
 
@@ -2855,8 +3058,7 @@ static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
         struct iwl_priv *priv = hw->priv;
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
-        iwl_update_tkip_key(priv, keyconf,
-                            sta ? sta->addr : iwl_bcast_addr,
+        iwl_update_tkip_key(priv, keyconf, sta,
                             iv32, phase1key);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -2868,7 +3070,6 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                            struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = hw->priv;
-        const u8 *addr;
         int ret;
         u8 sta_id;
         bool is_default_wep_key = false;
@@ -2879,25 +3080,29 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 IWL_DEBUG_MAC80211(priv, "leave - hwcrypto disabled\n");
                 return -EOPNOTSUPP;
         }
-        addr = sta ? sta->addr : iwl_bcast_addr;
-        sta_id = iwl_find_station(priv, addr);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
-                                   addr);
-                return -EINVAL;
 
+        if (sta) {
+                sta_id = iwl_sta_id(sta);
+
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
+                                           sta->addr);
+                        return -EINVAL;
+                }
+        } else {
+                sta_id = priv->hw_params.bcast_sta_id;
         }
 
         mutex_lock(&priv->mutex);
         iwl_scan_cancel_timeout(priv, 100);
-        mutex_unlock(&priv->mutex);
 
-        /* If we are getting WEP group key and we didn't receive any key mapping
+        /*
+         * If we are getting WEP group key and we didn't receive any key mapping
          * so far, we are in legacy wep mode (group key only), otherwise we are
          * in 1X mode.
-         * In legacy wep mode, we use another host command to the uCode */
-        if (key->alg == ALG_WEP && sta_id == priv->hw_params.bcast_sta_id &&
-                priv->iw_mode != NL80211_IFTYPE_AP) {
+         * In legacy wep mode, we use another host command to the uCode.
+         */
+        if (key->alg == ALG_WEP && !sta && vif->type != NL80211_IFTYPE_AP) {
                 if (cmd == SET_KEY)
                         is_default_wep_key = !priv->key_mapping_key;
                 else
@@ -2926,6 +3131,7 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = -EINVAL;
         }
 
+        mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
         return ret;
@@ -2933,8 +3139,8 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
 static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
-                             enum ieee80211_ampdu_mlme_action action,
-                             struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                                enum ieee80211_ampdu_mlme_action action,
+                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
         struct iwl_priv *priv = hw->priv;
         int ret;
@@ -2948,20 +3154,31 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
                 IWL_DEBUG_HT(priv, "start Rx\n");
-                return iwl_sta_rx_agg_start(priv, sta->addr, tid, *ssn);
+                return iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
         case IEEE80211_AMPDU_RX_STOP:
                 IWL_DEBUG_HT(priv, "stop Rx\n");
-                ret = iwl_sta_rx_agg_stop(priv, sta->addr, tid);
+                ret = iwl_sta_rx_agg_stop(priv, sta, tid);
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                         return 0;
                 else
                         return ret;
         case IEEE80211_AMPDU_TX_START:
                 IWL_DEBUG_HT(priv, "start Tx\n");
-                return iwl_tx_agg_start(priv, sta->addr, tid, ssn);
+                ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
+                if (ret == 0) {
+                        priv->_agn.agg_tids_count++;
+                        IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
+                                     priv->_agn.agg_tids_count);
+                }
+                return ret;
         case IEEE80211_AMPDU_TX_STOP:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
-                ret = iwl_tx_agg_stop(priv, sta->addr, tid);
+                ret = iwlagn_tx_agg_stop(priv, vif, sta, tid);
+                if ((ret == 0) && (priv->_agn.agg_tids_count > 0)) {
+                        priv->_agn.agg_tids_count--;
+                        IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
+                                     priv->_agn.agg_tids_count);
+                }
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                         return 0;
                 else
@@ -2977,18 +3194,6 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int iwl_mac_get_stats(struct ieee80211_hw *hw,
-                             struct ieee80211_low_level_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        priv = hw->priv;
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-
 static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                enum sta_notify_cmd cmd,
@@ -2998,18 +3203,7 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
         struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
         int sta_id;
 
-        /*
-         * TODO: We really should use this callback to
-         *       actually maintain the station table in
-         *       the device.
-         */
-
         switch (cmd) {
-        case STA_NOTIFY_ADD:
-                atomic_set(&sta_priv->pending_frames, 0);
-                if (vif->type == NL80211_IFTYPE_AP)
-                        sta_priv->client = true;
-                break;
         case STA_NOTIFY_SLEEP:
                 WARN_ON(!sta_priv->client);
                 sta_priv->asleep = true;
@@ -3021,7 +3215,7 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
                 if (!sta_priv->asleep)
                         break;
                 sta_priv->asleep = false;
-                sta_id = iwl_find_station(priv, sta->addr);
+                sta_id = iwl_sta_id(sta);
                 if (sta_id != IWL_INVALID_STATION)
                         iwl_sta_modify_ps_wake(priv, sta_id);
                 break;
@@ -3030,6 +3224,44 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
         }
 }
 
+static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        bool is_ap = vif->type == NL80211_IFTYPE_STATION;
+        int ret;
+        u8 sta_id;
+
+        sta_priv->common.sta_id = IWL_INVALID_STATION;
+
+        IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
+                        sta->addr);
+
+        atomic_set(&sta_priv->pending_frames, 0);
+        if (vif->type == NL80211_IFTYPE_AP)
+                sta_priv->client = true;
+
+        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
+                                     &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM (%d)\n",
+                        sta->addr, ret);
+                /* Should we return success if return code is EEXIST ? */
+                return ret;
+        }
+
+        sta_priv->common.sta_id = sta_id;
+
+        /* Initialize rate scaling */
+        IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
+                       sta->addr);
+        iwl_rs_rate_init(priv, sta, sta_id);
+
+        return 0;
+}
+
 /*****************************************************************************
  *
  * sysfs attributes
@@ -3130,125 +3362,6 @@ static ssize_t store_tx_power(struct device *d,
 
 static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 
-static ssize_t show_flags(struct device *d,
-                          struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
-}
-
-static ssize_t store_flags(struct device *d,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        u32 flags;
-        int ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                return ret;
-        flags = (u32)val;
-
-        mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.flags) != flags) {
-                /* Cancel any currently running scans... */
-                if (iwl_scan_cancel_timeout(priv, 100))
-                        IWL_WARN(priv, "Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO(priv, "Commit rxon.flags = 0x%04X\n", flags);
-                        priv->staging_rxon.flags = cpu_to_le32(flags);
-                        iwlcore_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
-
-static ssize_t show_filter_flags(struct device *d,
-                                 struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        return sprintf(buf, "0x%04X\n",
-                le32_to_cpu(priv->active_rxon.filter_flags));
-}
-
-static ssize_t store_filter_flags(struct device *d,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        u32 filter_flags;
-        int ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                return ret;
-        filter_flags = (u32)val;
-
-        mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.filter_flags) != filter_flags) {
-                /* Cancel any currently running scans... */
-                if (iwl_scan_cancel_timeout(priv, 100))
-                        IWL_WARN(priv, "Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO(priv, "Committing rxon.filter_flags = "
-                                       "0x%04X\n", filter_flags);
-                        priv->staging_rxon.filter_flags =
-                                cpu_to_le32(filter_flags);
-                        iwlcore_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
-                   store_filter_flags);
-
-
-static ssize_t show_statistics(struct device *d,
-                               struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        u32 size = sizeof(struct iwl_notif_statistics);
-        u32 len = 0, ofs = 0;
-        u8 *data = (u8 *)&priv->statistics;
-        int rc = 0;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-
-        if (rc) {
-                len = sprintf(buf,
-                              "Error sending statistics request: 0x%08X\n", rc);
-                return len;
-        }
-
-        while (size && (PAGE_SIZE - len)) {
-                hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
-                                   PAGE_SIZE - len, 1);
-                len = strlen(buf);
-                if (PAGE_SIZE - len)
-                        buf[len++] = '\n';
-
-                ofs += 16;
-                size -= min(size, 16U);
-        }
-
-        return len;
-}
-
-static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
-
 static ssize_t show_rts_ht_protection(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
@@ -3316,6 +3429,13 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         priv->ucode_trace.data = (unsigned long)priv;
         priv->ucode_trace.function = iwl_bg_ucode_trace;
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                init_timer(&priv->monitor_recover);
+                priv->monitor_recover.data = (unsigned long)priv;
+                priv->monitor_recover.function =
+                        priv->cfg->ops->lib->recover_from_tx_stall;
+        }
+
         if (!priv->cfg->use_isr_legacy)
                 tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                         iwl_irq_tasklet, (unsigned long)priv);
@@ -3331,10 +3451,13 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
 }
 
 static void iwl_init_hw_rates(struct iwl_priv *priv,
@@ -3372,9 +3495,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
         mutex_init(&priv->sync_cmd_mutex);
 
-        /* Clear the driver's (not device's) station table */
-        iwl_clear_stations_table(priv);
-
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -3382,6 +3502,7 @@ static int iwl_init_drv(struct iwl_priv *priv)
         priv->iw_mode = NL80211_IFTYPE_STATION;
         priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
+        priv->_agn.agg_tids_count = 0;
 
         /* initialize force reset */
         priv->force_reset[IWL_RF_RESET].reset_duration =
@@ -3395,16 +3516,10 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         iwl_init_scan_params(priv);
 
-        iwl_reset_qos(priv);
-
-        priv->qos_data.qos_active = 0;
-        priv->qos_data.qos_cap.val = 0;
-
-        priv->rates_mask = IWL_RATES_MASK;
         /* Set the tx_power_user_lmt to the lowest power level
          * this value will get overwritten by channel max power avg
          * from eeprom */
-        priv->tx_power_user_lmt = IWL_TX_POWER_TARGET_POWER_MIN;
+        priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
 
         ret = iwl_init_channel_map(priv);
         if (ret) {
@@ -3432,13 +3547,10 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
         iwl_calib_free_results(priv);
         iwlcore_free_geos(priv);
         iwl_free_channel_map(priv);
-        kfree(priv->scan);
+        kfree(priv->scan_cmd);
 }
 
 static struct attribute *iwl_sysfs_entries[] = {
-        &dev_attr_flags.attr,
-        &dev_attr_filter_flags.attr,
-        &dev_attr_statistics.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
         &dev_attr_rts_ht_protection.attr,
@@ -3463,13 +3575,14 @@ static struct ieee80211_ops iwl_hw_ops = {
         .configure_filter = iwl_configure_filter,
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
-        .get_stats = iwl_mac_get_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
         .ampdu_action = iwl_mac_ampdu_action,
         .hw_scan = iwl_mac_hw_scan,
         .sta_notify = iwl_mac_sta_notify,
+        .sta_add = iwlagn_mac_sta_add,
+        .sta_remove = iwl_mac_sta_remove,
 };
 
 static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -3573,7 +3686,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 
         iwl_hw_detect(priv);
-        IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
+        IWL_INFO(priv, "Detected %s, REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
 
         /* We disable the RETRY_TIMEOUT register (0x41) to keep
@@ -3671,6 +3784,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         iwl_power_initialize(priv);
         iwl_tt_initialize(priv);
 
+        init_completion(&priv->_agn.firmware_loading_complete);
+
         err = iwl_request_firmware(priv, true);
         if (err)
                 goto out_remove_sysfs;
@@ -3711,6 +3826,8 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
         if (!priv)
                 return;
 
+        wait_for_completion(&priv->_agn.firmware_loading_complete);
+
         IWL_DEBUG_INFO(priv, "*** UNLOAD DRIVER ***\n");
 
         iwl_dbgfs_unregister(priv);
@@ -3751,10 +3868,9 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
         iwl_dealloc_ucode_pci(priv);
 
         if (priv->rxq.bd)
-                iwl_rx_queue_free(priv, &priv->rxq);
-        iwl_hw_txq_ctx_free(priv);
+                iwlagn_rx_queue_free(priv, &priv->rxq);
+        iwlagn_hw_txq_ctx_free(priv);
 
-        iwl_clear_stations_table(priv);
         iwl_eeprom_free(priv);
 
 
@@ -3869,6 +3985,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
 
+/* 6x00 Series Gen2a */
+        {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1211, iwl6000g2a_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1221, iwl6000g2a_2agn_cfg)},
+
 /* 6x50 WiFi/WiMax Series */
         {IWL_PCI_DEVICE(0x0087, 0x1301, iwl6050_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0087, 0x1306, iwl6050_2abg_cfg)},
@@ -3950,3 +4071,38 @@ module_param_named(debug, iwl_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
 #endif
 
+module_param_named(swcrypto50, iwlagn_mod_params.sw_crypto, bool, S_IRUGO);
+MODULE_PARM_DESC(swcrypto50,
+                 "using crypto in software (default 0 [hardware]) (deprecated)");
+module_param_named(swcrypto, iwlagn_mod_params.sw_crypto, int, S_IRUGO);
+MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
+module_param_named(queues_num50,
+                   iwlagn_mod_params.num_of_queues, int, S_IRUGO);
+MODULE_PARM_DESC(queues_num50,
+                 "number of hw queues in 50xx series (deprecated)");
+module_param_named(queues_num, iwlagn_mod_params.num_of_queues, int, S_IRUGO);
+MODULE_PARM_DESC(queues_num, "number of hw queues.");
+module_param_named(11n_disable50, iwlagn_mod_params.disable_11n, int, S_IRUGO);
+MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality (deprecated)");
+module_param_named(11n_disable, iwlagn_mod_params.disable_11n, int, S_IRUGO);
+MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
+module_param_named(amsdu_size_8K50, iwlagn_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
+MODULE_PARM_DESC(amsdu_size_8K50,
+                 "enable 8K amsdu size in 50XX series (deprecated)");
+module_param_named(amsdu_size_8K, iwlagn_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
+MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
+module_param_named(fw_restart50, iwlagn_mod_params.restart_fw, int, S_IRUGO);
+MODULE_PARM_DESC(fw_restart50,
+                 "restart firmware in case of error (deprecated)");
+module_param_named(fw_restart, iwlagn_mod_params.restart_fw, int, S_IRUGO);
+MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
+module_param_named(
+        disable_hw_scan, iwlagn_mod_params.disable_hw_scan, int, S_IRUGO);
+MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
+
+module_param_named(ucode_alternative, iwlagn_wanted_ucode_alternative, int,
+                   S_IRUGO);
+MODULE_PARM_DESC(ucode_alternative,
+                 "specify ucode alternative to use from ucode file");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
new file mode 100644
index 000000000000..2d748053358e
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -0,0 +1,181 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_agn_h__
+#define __iwl_agn_h__
+
+#include "iwl-dev.h"
+
+extern struct iwl_mod_params iwlagn_mod_params;
+extern struct iwl_hcmd_ops iwlagn_hcmd;
+extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
+
+int iwl_reset_ict(struct iwl_priv *priv);
+void iwl_disable_ict(struct iwl_priv *priv);
+int iwl_alloc_isr_ict(struct iwl_priv *priv);
+void iwl_free_isr_ict(struct iwl_priv *priv);
+irqreturn_t iwl_isr_ict(int irq, void *data);
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                         struct iwl_rx_packet *pkt);
+
+/* tx queue */
+void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
+                     int txq_id, u32 index);
+void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
+                             struct iwl_tx_queue *txq,
+                             int tx_fifo_id, int scd_retry);
+void iwlagn_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
+                                    struct iwl_tx_queue *txq,
+                                    u16 byte_cnt);
+void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
+                                   struct iwl_tx_queue *txq);
+int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
+                          int tx_fifo, int sta_id, int tid, u16 ssn_idx);
+int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
+                           u16 ssn_idx, u8 tx_fifo);
+void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask);
+
+/* uCode */
+int iwlagn_load_ucode(struct iwl_priv *priv);
+void iwlagn_rx_calib_result(struct iwl_priv *priv,
+                         struct iwl_rx_mem_buffer *rxb);
+void iwlagn_rx_calib_complete(struct iwl_priv *priv,
+                           struct iwl_rx_mem_buffer *rxb);
+void iwlagn_init_alive_start(struct iwl_priv *priv);
+int iwlagn_alive_notify(struct iwl_priv *priv);
+
+/* lib */
+void iwl_check_abort_status(struct iwl_priv *priv,
+                            u8 frame_count, u32 status);
+void iwlagn_rx_handler_setup(struct iwl_priv *priv);
+void iwlagn_setup_deferred_work(struct iwl_priv *priv);
+int iwlagn_hw_valid_rtc_data_addr(u32 addr);
+int iwlagn_send_tx_power(struct iwl_priv *priv);
+void iwlagn_temperature(struct iwl_priv *priv);
+u16 iwlagn_eeprom_calib_version(struct iwl_priv *priv);
+const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
+                                   size_t offset);
+void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_hw_nic_init(struct iwl_priv *priv);
+
+/* rx */
+void iwlagn_rx_queue_restock(struct iwl_priv *priv);
+void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority);
+void iwlagn_rx_replenish(struct iwl_priv *priv);
+void iwlagn_rx_replenish_now(struct iwl_priv *priv);
+void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_rxq_stop(struct iwl_priv *priv);
+int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band);
+void iwlagn_rx_reply_rx(struct iwl_priv *priv,
+                     struct iwl_rx_mem_buffer *rxb);
+void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
+                         struct iwl_rx_mem_buffer *rxb);
+
+/* tx */
+void iwlagn_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
+                              struct ieee80211_tx_info *info);
+int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
+int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta, u16 tid);
+int iwlagn_txq_check_empty(struct iwl_priv *priv,
+                           int sta_id, u8 tid, int txq_id);
+void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb);
+int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
+void iwlagn_hw_txq_ctx_free(struct iwl_priv *priv);
+int iwlagn_txq_ctx_alloc(struct iwl_priv *priv);
+void iwlagn_txq_ctx_reset(struct iwl_priv *priv);
+void iwlagn_txq_ctx_stop(struct iwl_priv *priv);
+
+static inline u32 iwl_tx_status_to_mac80211(u32 status)
+{
+        status &= TX_STATUS_MSK;
+
+        switch (status) {
+        case TX_STATUS_SUCCESS:
+        case TX_STATUS_DIRECT_DONE:
+                return IEEE80211_TX_STAT_ACK;
+        case TX_STATUS_FAIL_DEST_PS:
+                return IEEE80211_TX_STAT_TX_FILTERED;
+        default:
+                return 0;
+        }
+}
+
+static inline bool iwl_is_tx_success(u32 status)
+{
+        status &= TX_STATUS_MSK;
+        return (status == TX_STATUS_SUCCESS) ||
+               (status == TX_STATUS_DIRECT_DONE);
+}
+
+/* scan */
+void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif);
+
+/* station mgmt */
+int iwlagn_manage_ibss_station(struct iwl_priv *priv,
+                               struct ieee80211_vif *vif, bool add);
+
+#endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 8b516c5ff0bb..7e8227773213 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -593,7 +593,7 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
         IWL_DEBUG_CALIB(priv, "rx_enable_time = %u usecs\n", rx_enable_time);
 
         if (!rx_enable_time) {
-                IWL_DEBUG_CALIB(priv, "<< RX Enable Time == 0! \n");
+                IWL_DEBUG_CALIB(priv, "<< RX Enable Time == 0!\n");
                 return;
         }
 
@@ -638,8 +638,6 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
         iwl_sens_auto_corr_ofdm(priv, norm_fa_ofdm, rx_enable_time);
         iwl_sens_energy_cck(priv, norm_fa_cck, rx_enable_time, &statis);
         iwl_sensitivity_write(priv);
-
-        return;
 }
 EXPORT_SYMBOL(iwl_sensitivity_calibration);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b3..9aab020c474b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -106,7 +106,7 @@ enum {
         REPLY_TX = 0x1c,
         REPLY_RATE_SCALE = 0x47,        /* 3945 only */
         REPLY_LEDS_CMD = 0x48,
-        REPLY_TX_LINK_QUALITY_CMD = 0x4e, /* 4965 only */
+        REPLY_TX_LINK_QUALITY_CMD = 0x4e, /* for 4965 and up */
 
         /* WiMAX coexistence */
         COEX_PRIORITY_TABLE_CMD = 0x5a, /* for 5000 series and up */
@@ -512,8 +512,9 @@ struct iwl_init_alive_resp {
  *
  *     Entries without timestamps contain only event_id and data.
  *
+ *
  * 2)  error_event_table_ptr indicates base of the error log.  This contains
- *     information about any uCode error that occurs.  For 4965, the format
+ *     information about any uCode error that occurs.  For agn, the format
  *     of the error log is:
  *
  *      __le32 valid;        (nonzero) valid, (0) log is empty
@@ -529,6 +530,30 @@ struct iwl_init_alive_resp {
  *      __le32 bcon_time;    beacon timer
  *      __le32 tsf_low;      network timestamp function timer
  *      __le32 tsf_hi;       network timestamp function timer
+ *      __le32 gp1;          GP1 timer register
+ *      __le32 gp2;          GP2 timer register
+ *      __le32 gp3;          GP3 timer register
+ *      __le32 ucode_ver;    uCode version
+ *      __le32 hw_ver;       HW Silicon version
+ *      __le32 brd_ver;      HW board version
+ *      __le32 log_pc;       log program counter
+ *      __le32 frame_ptr;    frame pointer
+ *      __le32 stack_ptr;    stack pointer
+ *      __le32 hcmd;         last host command
+ *      __le32 isr0;         isr status register LMPM_NIC_ISR0: rxtx_flag
+ *      __le32 isr1;         isr status register LMPM_NIC_ISR1: host_flag
+ *      __le32 isr2;         isr status register LMPM_NIC_ISR2: enc_flag
+ *      __le32 isr3;         isr status register LMPM_NIC_ISR3: time_flag
+ *      __le32 isr4;         isr status register LMPM_NIC_ISR4: wico interrupt
+ *      __le32 isr_pref;     isr status register LMPM_NIC_PREF_STAT
+ *      __le32 wait_event;   wait event() caller address
+ *      __le32 l2p_control;  L2pControlField
+ *      __le32 l2p_duration; L2pDurationField
+ *      __le32 l2p_mhvalid;  L2pMhValidBits
+ *      __le32 l2p_addr_match; L2pAddrMatchStat
+ *      __le32 lmpm_pmg_sel; indicate which clocks are turned on (LMPM_PMG_SEL)
+ *      __le32 u_timestamp;  indicate when the date and time of the compilation
+ *      __le32 reserved;
  *
  * The Linux driver can print both logs to the system log when a uCode error
  * occurs.
@@ -1418,7 +1443,7 @@ struct iwl4965_rx_mpdu_res_start {
 
 /* 1: Ignore Bluetooth priority for this frame.
  * 0: Delay Tx until Bluetooth device is done (normal usage). */
-#define TX_CMD_FLG_BT_DIS_MSK cpu_to_le32(1 << 12)
+#define TX_CMD_FLG_IGNORE_BT cpu_to_le32(1 << 12)
 
 /* 1: uCode overrides sequence control field in MAC header.
  * 0: Driver provides sequence control field in MAC header.
@@ -1637,7 +1662,7 @@ struct iwl_tx_cmd {
         struct ieee80211_hdr hdr[0];
 } __attribute__ ((packed));
 
-/* TX command response is sent after *all* transmission attempts.
+/* TX command response is sent after *3945* transmission attempts.
  *
  * NOTES:
  *
@@ -1665,24 +1690,65 @@ struct iwl_tx_cmd {
  * control line.  Receiving is still allowed in this case.
  */
 enum {
+        TX_3945_STATUS_SUCCESS = 0x01,
+        TX_3945_STATUS_DIRECT_DONE = 0x02,
+        TX_3945_STATUS_FAIL_SHORT_LIMIT = 0x82,
+        TX_3945_STATUS_FAIL_LONG_LIMIT = 0x83,
+        TX_3945_STATUS_FAIL_FIFO_UNDERRUN = 0x84,
+        TX_3945_STATUS_FAIL_MGMNT_ABORT = 0x85,
+        TX_3945_STATUS_FAIL_NEXT_FRAG = 0x86,
+        TX_3945_STATUS_FAIL_LIFE_EXPIRE = 0x87,
+        TX_3945_STATUS_FAIL_DEST_PS = 0x88,
+        TX_3945_STATUS_FAIL_ABORTED = 0x89,
+        TX_3945_STATUS_FAIL_BT_RETRY = 0x8a,
+        TX_3945_STATUS_FAIL_STA_INVALID = 0x8b,
+        TX_3945_STATUS_FAIL_FRAG_DROPPED = 0x8c,
+        TX_3945_STATUS_FAIL_TID_DISABLE = 0x8d,
+        TX_3945_STATUS_FAIL_FRAME_FLUSHED = 0x8e,
+        TX_3945_STATUS_FAIL_INSUFFICIENT_CF_POLL = 0x8f,
+        TX_3945_STATUS_FAIL_TX_LOCKED = 0x90,
+        TX_3945_STATUS_FAIL_NO_BEACON_ON_RADAR = 0x91,
+};
+
+/*
+ * TX command response is sent after *agn* transmission attempts.
+ *
+ * both postpone and abort status are expected behavior from uCode. there is
+ * no special operation required from driver; except for RFKILL_FLUSH,
+ * which required tx flush host command to flush all the tx frames in queues
+ */
+enum {
         TX_STATUS_SUCCESS = 0x01,
         TX_STATUS_DIRECT_DONE = 0x02,
+        /* postpone TX */
+        TX_STATUS_POSTPONE_DELAY = 0x40,
+        TX_STATUS_POSTPONE_FEW_BYTES = 0x41,
+        TX_STATUS_POSTPONE_BT_PRIO = 0x42,
+        TX_STATUS_POSTPONE_QUIET_PERIOD = 0x43,
+        TX_STATUS_POSTPONE_CALC_TTAK = 0x44,
+        /* abort TX */
+        TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY = 0x81,
         TX_STATUS_FAIL_SHORT_LIMIT = 0x82,
         TX_STATUS_FAIL_LONG_LIMIT = 0x83,
         TX_STATUS_FAIL_FIFO_UNDERRUN = 0x84,
-        TX_STATUS_FAIL_MGMNT_ABORT = 0x85,
-        TX_STATUS_FAIL_NEXT_FRAG = 0x86,
+        TX_STATUS_FAIL_DRAIN_FLOW = 0x85,
+        TX_STATUS_FAIL_RFKILL_FLUSH = 0x86,
         TX_STATUS_FAIL_LIFE_EXPIRE = 0x87,
         TX_STATUS_FAIL_DEST_PS = 0x88,
-        TX_STATUS_FAIL_ABORTED = 0x89,
+        TX_STATUS_FAIL_HOST_ABORTED = 0x89,
         TX_STATUS_FAIL_BT_RETRY = 0x8a,
         TX_STATUS_FAIL_STA_INVALID = 0x8b,
         TX_STATUS_FAIL_FRAG_DROPPED = 0x8c,
         TX_STATUS_FAIL_TID_DISABLE = 0x8d,
-        TX_STATUS_FAIL_FRAME_FLUSHED = 0x8e,
+        TX_STATUS_FAIL_FIFO_FLUSHED = 0x8e,
         TX_STATUS_FAIL_INSUFFICIENT_CF_POLL = 0x8f,
-        TX_STATUS_FAIL_TX_LOCKED = 0x90,
-        TX_STATUS_FAIL_NO_BEACON_ON_RADAR = 0x91,
+        /* uCode drop due to FW drop request */
+        TX_STATUS_FAIL_FW_DROP = 0x90,
+        /*
+         * uCode drop due to station color mismatch
+         * between tx command and station table
+         */
+        TX_STATUS_FAIL_STA_COLOR_MISMATCH_DROP = 0x91,
 };
 
 #define TX_PACKET_MODE_REGULAR          0x0000
@@ -1704,30 +1770,6 @@ enum {
         TX_ABORT_REQUIRED_MSK = 0x80000000,     /* bits 31:31 */
 };
 
-static inline u32 iwl_tx_status_to_mac80211(u32 status)
-{
-        status &= TX_STATUS_MSK;
-
-        switch (status) {
-        case TX_STATUS_SUCCESS:
-        case TX_STATUS_DIRECT_DONE:
-                return IEEE80211_TX_STAT_ACK;
-        case TX_STATUS_FAIL_DEST_PS:
-                return IEEE80211_TX_STAT_TX_FILTERED;
-        default:
-                return 0;
-        }
-}
-
-static inline bool iwl_is_tx_success(u32 status)
-{
-        status &= TX_STATUS_MSK;
-        return (status == TX_STATUS_SUCCESS) ||
-               (status == TX_STATUS_DIRECT_DONE);
-}
-
-
-
 /* *******************************
  * TX aggregation status
  ******************************* */
@@ -2621,10 +2663,11 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
-#define IWL_MAX_PROBE_REQUEST           200
 
 /*
  * REPLY_SCAN_CMD = 0x80 (command)
@@ -3084,6 +3127,11 @@ struct statistics_tx {
         __le32 cts_timeout_collision;
         __le32 ack_or_ba_timeout_collision;
         struct statistics_tx_non_phy_agg agg;
+        /*
+         * "tx_power" are optional parameters provided by uCode,
+         * 6000 series is the only device provide the information,
+         * Those are reserved fields for all the other devices
+         */
         struct statistics_tx_power tx_power;
         __le32 reserved1;
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f7086632..5a7eca8fb789 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -66,38 +66,7 @@ MODULE_LICENSE("GPL");
  */
 static bool bt_coex_active = true;
 module_param(bt_coex_active, bool, S_IRUGO);
-MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist\n");
-
-static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
-        {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
-         0, COEX_UNASSOC_IDLE_FLAGS},
-        {COEX_CU_UNASSOC_MANUAL_SCAN_RP, COEX_CU_UNASSOC_MANUAL_SCAN_WP,
-         0, COEX_UNASSOC_MANUAL_SCAN_FLAGS},
-        {COEX_CU_UNASSOC_AUTO_SCAN_RP, COEX_CU_UNASSOC_AUTO_SCAN_WP,
-         0, COEX_UNASSOC_AUTO_SCAN_FLAGS},
-        {COEX_CU_CALIBRATION_RP, COEX_CU_CALIBRATION_WP,
-         0, COEX_CALIBRATION_FLAGS},
-        {COEX_CU_PERIODIC_CALIBRATION_RP, COEX_CU_PERIODIC_CALIBRATION_WP,
-         0, COEX_PERIODIC_CALIBRATION_FLAGS},
-        {COEX_CU_CONNECTION_ESTAB_RP, COEX_CU_CONNECTION_ESTAB_WP,
-         0, COEX_CONNECTION_ESTAB_FLAGS},
-        {COEX_CU_ASSOCIATED_IDLE_RP, COEX_CU_ASSOCIATED_IDLE_WP,
-         0, COEX_ASSOCIATED_IDLE_FLAGS},
-        {COEX_CU_ASSOC_MANUAL_SCAN_RP, COEX_CU_ASSOC_MANUAL_SCAN_WP,
-         0, COEX_ASSOC_MANUAL_SCAN_FLAGS},
-        {COEX_CU_ASSOC_AUTO_SCAN_RP, COEX_CU_ASSOC_AUTO_SCAN_WP,
-         0, COEX_ASSOC_AUTO_SCAN_FLAGS},
-        {COEX_CU_ASSOC_ACTIVE_LEVEL_RP, COEX_CU_ASSOC_ACTIVE_LEVEL_WP,
-         0, COEX_ASSOC_ACTIVE_LEVEL_FLAGS},
-        {COEX_CU_RF_ON_RP, COEX_CU_RF_ON_WP, 0, COEX_CU_RF_ON_FLAGS},
-        {COEX_CU_RF_OFF_RP, COEX_CU_RF_OFF_WP, 0, COEX_RF_OFF_FLAGS},
-        {COEX_CU_STAND_ALONE_DEBUG_RP, COEX_CU_STAND_ALONE_DEBUG_WP,
-         0, COEX_STAND_ALONE_DEBUG_FLAGS},
-        {COEX_CU_IPAN_ASSOC_LEVEL_RP, COEX_CU_IPAN_ASSOC_LEVEL_WP,
-         0, COEX_IPAN_ASSOC_LEVEL_FLAGS},
-        {COEX_CU_RSRVD1_RP, COEX_CU_RSRVD1_WP, 0, COEX_RSRVD1_FLAGS},
-        {COEX_CU_RSRVD2_RP, COEX_CU_RSRVD2_WP, 0, COEX_RSRVD2_FLAGS}
-};
+MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist");
 
 #define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
@@ -115,8 +84,6 @@ static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
 u32 iwl_debug_level;
 EXPORT_SYMBOL(iwl_debug_level);
 
-static irqreturn_t iwl_isr(int irq, void *data);
-
 /*
  * Parameter order:
  *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
@@ -143,30 +110,6 @@ const struct iwl_rate_info iwl_rates[IWL_RATE_COUNT] = {
 };
 EXPORT_SYMBOL(iwl_rates);
 
-/**
- * translate ucode response to mac80211 tx status control values
- */
-void iwl_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
-                                  struct ieee80211_tx_info *info)
-{
-        struct ieee80211_tx_rate *r = &info->control.rates[0];
-
-        info->antenna_sel_tx =
-                ((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
-        if (rate_n_flags & RATE_MCS_HT_MSK)
-                r->flags |= IEEE80211_TX_RC_MCS;
-        if (rate_n_flags & RATE_MCS_GF_MSK)
-                r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
-        if (rate_n_flags & RATE_MCS_HT40_MSK)
-                r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
-        if (rate_n_flags & RATE_MCS_DUP_MSK)
-                r->flags |= IEEE80211_TX_RC_DUP_DATA;
-        if (rate_n_flags & RATE_MCS_SGI_MSK)
-                r->flags |= IEEE80211_TX_RC_SHORT_GI;
-        r->idx = iwl_hwrate_to_mac80211_idx(rate_n_flags, info->band);
-}
-EXPORT_SYMBOL(iwl_hwrate_to_tx_control);
-
 int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
 {
         int idx = 0;
@@ -198,27 +141,6 @@ int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
 }
 EXPORT_SYMBOL(iwl_hwrate_to_plcp_idx);
 
-int iwl_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band)
-{
-        int idx = 0;
-        int band_offset = 0;
-
-        /* HT rate format: mac80211 wants an MCS number, which is just LSB */
-        if (rate_n_flags & RATE_MCS_HT_MSK) {
-                idx = (rate_n_flags & 0xff);
-                return idx;
-        /* Legacy rate format, search for match in table */
-        } else {
-                if (band == IEEE80211_BAND_5GHZ)
-                        band_offset = IWL_FIRST_OFDM_RATE;
-                for (idx = band_offset; idx < IWL_RATE_COUNT_LEGACY; idx++)
-                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
-                                return idx - band_offset;
-        }
-
-        return -1;
-}
-
 u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant)
 {
         int i;
@@ -268,74 +190,16 @@ void iwl_hw_detect(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_hw_detect);
 
-int iwl_hw_nic_init(struct iwl_priv *priv)
-{
-        unsigned long flags;
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        int ret;
-
-        /* nic_init */
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->cfg->ops->lib->apm_ops.init(priv);
-
-        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
-
-        priv->cfg->ops->lib->apm_ops.config(priv);
-
-        /* Allocate the RX queue, or reset if it is already allocated */
-        if (!rxq->bd) {
-                ret = iwl_rx_queue_alloc(priv);
-                if (ret) {
-                        IWL_ERR(priv, "Unable to initialize Rx queue\n");
-                        return -ENOMEM;
-                }
-        } else
-                iwl_rx_queue_reset(priv, rxq);
-
-        iwl_rx_replenish(priv);
-
-        iwl_rx_init(priv, rxq);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        rxq->need_update = 1;
-        iwl_rx_queue_update_write_ptr(priv, rxq);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Allocate or reset and init all Tx and Command queues */
-        if (!priv->txq) {
-                ret = iwl_txq_ctx_alloc(priv);
-                if (ret)
-                        return ret;
-        } else
-                iwl_txq_ctx_reset(priv);
-
-        set_bit(STATUS_INIT, &priv->status);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_hw_nic_init);
-
 /*
  * QoS  support
 */
-void iwl_activate_qos(struct iwl_priv *priv, u8 force)
+static void iwl_update_qos(struct iwl_priv *priv)
 {
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         priv->qos_data.def_qos_parm.qos_flags = 0;
 
-        if (priv->qos_data.qos_cap.q_AP.queue_request &&
-            !priv->qos_data.qos_cap.q_AP.txop_request)
-                priv->qos_data.def_qos_parm.qos_flags |=
-                        QOS_PARAM_FLG_TXOP_TYPE_MSK;
         if (priv->qos_data.qos_active)
                 priv->qos_data.def_qos_parm.qos_flags |=
                         QOS_PARAM_FLG_UPDATE_EDCA_MSK;
@@ -343,118 +207,14 @@ void iwl_activate_qos(struct iwl_priv *priv, u8 force)
         if (priv->current_ht_config.is_ht)
                 priv->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
 
-        if (force || iwl_is_associated(priv)) {
-                IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
-                                priv->qos_data.qos_active,
-                                priv->qos_data.def_qos_parm.qos_flags);
+        IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
+                      priv->qos_data.qos_active,
+                      priv->qos_data.def_qos_parm.qos_flags);
 
-                iwl_send_cmd_pdu_async(priv, REPLY_QOS_PARAM,
-                                       sizeof(struct iwl_qosparam_cmd),
-                                       &priv->qos_data.def_qos_parm, NULL);
-        }
+        iwl_send_cmd_pdu_async(priv, REPLY_QOS_PARAM,
+                               sizeof(struct iwl_qosparam_cmd),
+                               &priv->qos_data.def_qos_parm, NULL);
 }
-EXPORT_SYMBOL(iwl_activate_qos);
-
-/*
- * AC        CWmin         CW max      AIFSN      TXOP Limit    TXOP Limit
- *                                              (802.11b)      (802.11a/g)
- * AC_BK      15            1023        7           0               0
- * AC_BE      15            1023        3           0               0
- * AC_VI       7              15        2          6.016ms       3.008ms
- * AC_VO       3               7        2          3.264ms       1.504ms
- */
-void iwl_reset_qos(struct iwl_priv *priv)
-{
-        u16 cw_min = 15;
-        u16 cw_max = 1023;
-        u8 aifs = 2;
-        bool is_legacy = false;
-        unsigned long flags;
-        int i;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        /* QoS always active in AP and ADHOC mode
-         * In STA mode wait for association
-         */
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC ||
-            priv->iw_mode == NL80211_IFTYPE_AP)
-                priv->qos_data.qos_active = 1;
-        else
-                priv->qos_data.qos_active = 0;
-
-        /* check for legacy mode */
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            (priv->active_rate & IWL_OFDM_RATES_MASK) == 0) ||
-            (priv->iw_mode == NL80211_IFTYPE_STATION &&
-            (priv->staging_rxon.flags & RXON_FLG_SHORT_SLOT_MSK) == 0)) {
-                cw_min = 31;
-                is_legacy = 1;
-        }
-
-        if (priv->qos_data.qos_active)
-                aifs = 3;
-
-        /* AC_BE */
-        priv->qos_data.def_qos_parm.ac[0].cw_min = cpu_to_le16(cw_min);
-        priv->qos_data.def_qos_parm.ac[0].cw_max = cpu_to_le16(cw_max);
-        priv->qos_data.def_qos_parm.ac[0].aifsn = aifs;
-        priv->qos_data.def_qos_parm.ac[0].edca_txop = 0;
-        priv->qos_data.def_qos_parm.ac[0].reserved1 = 0;
-
-        if (priv->qos_data.qos_active) {
-                /* AC_BK */
-                i = 1;
-                priv->qos_data.def_qos_parm.ac[i].cw_min = cpu_to_le16(cw_min);
-                priv->qos_data.def_qos_parm.ac[i].cw_max = cpu_to_le16(cw_max);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 7;
-                priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-
-                /* AC_VI */
-                i = 2;
-                priv->qos_data.def_qos_parm.ac[i].cw_min =
-                        cpu_to_le16((cw_min + 1) / 2 - 1);
-                priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16(cw_min);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
-                if (is_legacy)
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(6016);
-                else
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(3008);
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-
-                /* AC_VO */
-                i = 3;
-                priv->qos_data.def_qos_parm.ac[i].cw_min =
-                        cpu_to_le16((cw_min + 1) / 4 - 1);
-                priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16((cw_min + 1) / 2 - 1);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-                if (is_legacy)
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(3264);
-                else
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(1504);
-        } else {
-                for (i = 1; i < 4; i++) {
-                        priv->qos_data.def_qos_parm.ac[i].cw_min =
-                                cpu_to_le16(cw_min);
-                        priv->qos_data.def_qos_parm.ac[i].cw_max =
-                                cpu_to_le16(cw_max);
-                        priv->qos_data.def_qos_parm.ac[i].aifsn = aifs;
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
-                        priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-                }
-        }
-        IWL_DEBUG_QOS(priv, "set QoS to default \n");
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_reset_qos);
 
 #define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
 #define MAX_BIT_RATE_20_MHZ 72 /* Mbps */
@@ -721,7 +481,7 @@ static u16 iwl_adjust_beacon_interval(u16 beacon_val, u16 max_beacon_val)
         return new_val;
 }
 
-void iwl_setup_rxon_timing(struct iwl_priv *priv)
+void iwl_setup_rxon_timing(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         u64 tsf;
         s32 interval_tm, rem;
@@ -735,15 +495,14 @@ void iwl_setup_rxon_timing(struct iwl_priv *priv)
         priv->rxon_timing.timestamp = cpu_to_le64(priv->timestamp);
         priv->rxon_timing.listen_interval = cpu_to_le16(conf->listen_interval);
 
-        if (priv->iw_mode == NL80211_IFTYPE_STATION) {
-                beacon_int = priv->beacon_int;
-                priv->rxon_timing.atim_window = 0;
-        } else {
-                beacon_int = priv->vif->bss_conf.beacon_int;
+        beacon_int = vif->bss_conf.beacon_int;
 
+        if (vif->type == NL80211_IFTYPE_ADHOC) {
                 /* TODO: we need to get atim_window from upper stack
                  * for now we set to 0 */
                 priv->rxon_timing.atim_window = 0;
+        } else {
+                priv->rxon_timing.atim_window = 0;
         }
 
         beacon_int = iwl_adjust_beacon_interval(beacon_int,
@@ -903,23 +662,10 @@ EXPORT_SYMBOL(iwl_full_rxon_required);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv)
 {
-        int i;
-        int rate_mask;
-
-        /* Set rate mask*/
-        if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)
-                rate_mask = priv->active_rate_basic & IWL_CCK_RATES_MASK;
-        else
-                rate_mask = priv->active_rate_basic & IWL_OFDM_RATES_MASK;
-
-        /* Find lowest valid rate */
-        for (i = IWL_RATE_1M_INDEX; i != IWL_RATE_INVALID;
-                                        i = iwl_rates[i].next_ieee) {
-                if (rate_mask & (1 << i))
-                        return iwl_rates[i].plcp;
-        }
-
-        /* No valid rate was found. Assign the lowest one */
+        /*
+         * Assign the lowest rate -- should really get this from
+         * the beacon skb from mac80211.
+         */
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)
                 return IWL_RATE_1M_PLCP;
         else
@@ -991,7 +737,6 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf)
                         "extension channel offset 0x%x\n",
                         le32_to_cpu(rxon->flags), ht_conf->ht_protection,
                         ht_conf->extension_chan_offset);
-        return;
 }
 EXPORT_SYMBOL(iwl_set_rxon_ht);
 
@@ -1051,19 +796,6 @@ static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
 }
 
 /**
- * iwl_is_monitor_mode - Determine if interface in monitor mode
- *
- * priv->iw_mode is set in add_interface, but add_interface is
- * never called for monitor mode. The only way mac80211 informs us about
- * monitor mode is through configuring filters (call to configure_filter).
- */
-bool iwl_is_monitor_mode(struct iwl_priv *priv)
-{
-        return !!(priv->staging_rxon.filter_flags & RXON_FILTER_PROMISC_MSK);
-}
-EXPORT_SYMBOL(iwl_is_monitor_mode);
-
-/**
  * iwl_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
  *
  * Selects how many and which Rx receivers/antennas/chains to use.
@@ -1106,19 +838,6 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
         rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
         rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
 
-        /* copied from 'iwl_bg_request_scan()' */
-        /* Force use of chains B and C (0x6) for Rx for 4965
-         * Avoid A (0x1) because of its off-channel reception on A-band.
-         * MIMO is not used here, but value is required */
-        if (iwl_is_monitor_mode(priv) &&
-            !(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) &&
-            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)) {
-                rx_chain = ANT_ABC << RXON_RX_CHAIN_VALID_POS;
-                rx_chain |= ANT_BC << RXON_RX_CHAIN_FORCE_SEL_POS;
-                rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
-                rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
-        }
-
         priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
 
         if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
@@ -1174,8 +893,9 @@ int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch)
 }
 EXPORT_SYMBOL(iwl_set_rxon_channel);
 
-void iwl_set_flags_for_band(struct iwl_priv *priv,
-                            enum ieee80211_band band)
+static void iwl_set_flags_for_band(struct iwl_priv *priv,
+                                   enum ieee80211_band band,
+                                   struct ieee80211_vif *vif)
 {
         if (band == IEEE80211_BAND_5GHZ) {
                 priv->staging_rxon.flags &=
@@ -1184,12 +904,12 @@ void iwl_set_flags_for_band(struct iwl_priv *priv,
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
         } else {
                 /* Copied from iwl_post_associate() */
-                if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif && vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
+                if (vif && vif->type == NL80211_IFTYPE_ADHOC)
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
@@ -1201,13 +921,18 @@ void iwl_set_flags_for_band(struct iwl_priv *priv,
 /*
  * initialize rxon structure with default values from eeprom
  */
-void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
+void iwl_connection_init_rx_config(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif)
 {
         const struct iwl_channel_info *ch_info;
+        enum nl80211_iftype type = NL80211_IFTYPE_STATION;
+
+        if (vif)
+                type = vif->type;
 
         memset(&priv->staging_rxon, 0, sizeof(priv->staging_rxon));
 
-        switch (mode) {
+        switch (type) {
         case NL80211_IFTYPE_AP:
                 priv->staging_rxon.dev_type = RXON_DEV_TYPE_AP;
                 break;
@@ -1225,7 +950,7 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
                 break;
 
         default:
-                IWL_ERR(priv, "Unsupported interface type %d\n", mode);
+                IWL_ERR(priv, "Unsupported interface type %d\n", type);
                 break;
         }
 
@@ -1244,18 +969,10 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
         if (!ch_info)
                 ch_info = &priv->channel_info[0];
 
-        /*
-         * in some case A channels are all non IBSS
-         * in this case force B/G channel
-         */
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !(is_channel_ibss(ch_info)))
-                ch_info = &priv->channel_info[0];
-
         priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
         priv->band = ch_info->band;
 
-        iwl_set_flags_for_band(priv, priv->band);
+        iwl_set_flags_for_band(priv, priv->band, vif);
 
         priv->staging_rxon.ofdm_basic_rates =
             (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
@@ -1286,7 +1003,6 @@ static void iwl_set_rate(struct iwl_priv *priv)
         }
 
         priv->active_rate = 0;
-        priv->active_rate_basic = 0;
 
         for (i = 0; i < hw->n_bitrates; i++) {
                 rate = &(hw->bitrates[i]);
@@ -1294,30 +1010,13 @@ static void iwl_set_rate(struct iwl_priv *priv)
                         priv->active_rate |= (1 << rate->hw_value);
         }
 
-        IWL_DEBUG_RATE(priv, "Set active_rate = %0x, active_rate_basic = %0x\n",
-                       priv->active_rate, priv->active_rate_basic);
+        IWL_DEBUG_RATE(priv, "Set active_rate = %0x\n", priv->active_rate);
 
-        /*
-         * If a basic rate is configured, then use it (adding IWL_RATE_1M_MASK)
-         * otherwise set it to the default of all CCK rates and 6, 12, 24 for
-         * OFDM
-         */
-        if (priv->active_rate_basic & IWL_CCK_BASIC_RATES_MASK)
-                priv->staging_rxon.cck_basic_rates =
-                    ((priv->active_rate_basic &
-                      IWL_CCK_RATES_MASK) >> IWL_FIRST_CCK_RATE) & 0xF;
-        else
-                priv->staging_rxon.cck_basic_rates =
-                    (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
-
-        if (priv->active_rate_basic & IWL_OFDM_BASIC_RATES_MASK)
-                priv->staging_rxon.ofdm_basic_rates =
-                    ((priv->active_rate_basic &
-                      (IWL_OFDM_BASIC_RATES_MASK | IWL_RATE_6M_MASK)) >>
-                      IWL_FIRST_OFDM_RATE) & 0xFF;
-        else
-                priv->staging_rxon.ofdm_basic_rates =
-                   (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+        priv->staging_rxon.cck_basic_rates =
+            (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
+
+        priv->staging_rxon.ofdm_basic_rates =
+           (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
 }
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
@@ -1374,6 +1073,9 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
         /* Cancel currently queued command. */
         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
 
+        IWL_ERR(priv, "Loaded firmware version: %s\n",
+                priv->hw->wiphy->fw_version);
+
         priv->cfg->ops->lib->dump_nic_error_log(priv);
         if (priv->cfg->ops->lib->dump_csr)
                 priv->cfg->ops->lib->dump_csr(priv);
@@ -1401,7 +1103,7 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_irq_handle_error);
 
-int iwl_apm_stop_master(struct iwl_priv *priv)
+static int iwl_apm_stop_master(struct iwl_priv *priv)
 {
         int ret = 0;
 
@@ -1417,7 +1119,6 @@ int iwl_apm_stop_master(struct iwl_priv *priv)
 
         return ret;
 }
-EXPORT_SYMBOL(iwl_apm_stop_master);
 
 void iwl_apm_stop(struct iwl_priv *priv)
 {
@@ -1561,41 +1262,33 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                           u64 multicast)
 {
         struct iwl_priv *priv = hw->priv;
-        __le32 *filter_flags = &priv->staging_rxon.filter_flags;
+        __le32 filter_or = 0, filter_nand = 0;
+
+#define CHK(test, flag) do { \
+        if (*total_flags & (test))              \
+                filter_or |= (flag);            \
+        else                                    \
+                filter_nand |= (flag);          \
+        } while (0)
 
         IWL_DEBUG_MAC80211(priv, "Enter: changed: 0x%x, total: 0x%x\n",
                         changed_flags, *total_flags);
 
-        if (changed_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS)) {
-                if (*total_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS))
-                        *filter_flags |= RXON_FILTER_PROMISC_MSK;
-                else
-                        *filter_flags &= ~RXON_FILTER_PROMISC_MSK;
-        }
-        if (changed_flags & FIF_ALLMULTI) {
-                if (*total_flags & FIF_ALLMULTI)
-                        *filter_flags |= RXON_FILTER_ACCEPT_GRP_MSK;
-                else
-                        *filter_flags &= ~RXON_FILTER_ACCEPT_GRP_MSK;
-        }
-        if (changed_flags & FIF_CONTROL) {
-                if (*total_flags & FIF_CONTROL)
-                        *filter_flags |= RXON_FILTER_CTL2HOST_MSK;
-                else
-                        *filter_flags &= ~RXON_FILTER_CTL2HOST_MSK;
-        }
-        if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
-                if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
-                        *filter_flags |= RXON_FILTER_BCON_AWARE_MSK;
-                else
-                        *filter_flags &= ~RXON_FILTER_BCON_AWARE_MSK;
-        }
+        CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
+        CHK(FIF_ALLMULTI, RXON_FILTER_ACCEPT_GRP_MSK);
+        CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
+        CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
 
-        /* We avoid iwl_commit_rxon here to commit the new filter flags
-         * since mac80211 will call ieee80211_hw_config immediately.
-         * (mc_list is not supported at this time). Otherwise, we need to
-         * queue a background iwl_commit_rxon work.
-         */
+#undef CHK
+
+        mutex_lock(&priv->mutex);
+
+        priv->staging_rxon.filter_flags &= ~filter_nand;
+        priv->staging_rxon.filter_flags |= filter_or;
+
+        iwlcore_commit_rxon(priv);
+
+        mutex_unlock(&priv->mutex);
 
         *total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
@@ -1626,10 +1319,11 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
         int ret = 0;
         s8 prev_tx_power = priv->tx_power_user_lmt;
 
-        if (tx_power < IWL_TX_POWER_TARGET_POWER_MIN) {
-                IWL_WARN(priv, "Requested user TXPOWER %d below lower limit %d.\n",
+        if (tx_power < IWLAGN_TX_POWER_TARGET_POWER_MIN) {
+                IWL_WARN(priv,
+                         "Requested user TXPOWER %d below lower limit %d.\n",
                          tx_power,
-                         IWL_TX_POWER_TARGET_POWER_MIN);
+                         IWLAGN_TX_POWER_TARGET_POWER_MIN);
                 return -EINVAL;
         }
 
@@ -1668,286 +1362,16 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 }
 EXPORT_SYMBOL(iwl_set_tx_power);
 
-#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
-
-/* Free dram table */
-void iwl_free_isr_ict(struct iwl_priv *priv)
-{
-        if (priv->ict_tbl_vir) {
-                dma_free_coherent(&priv->pci_dev->dev,
-                                  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
-                                  priv->ict_tbl_vir, priv->ict_tbl_dma);
-                priv->ict_tbl_vir = NULL;
-        }
-}
-EXPORT_SYMBOL(iwl_free_isr_ict);
-
-
-/* allocate dram shared table it is a PAGE_SIZE aligned
- * also reset all data related to ICT table interrupt.
- */
-int iwl_alloc_isr_ict(struct iwl_priv *priv)
-{
-
-        if (priv->cfg->use_isr_legacy)
-                return 0;
-        /* allocate shrared data table */
-        priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
-                                        (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
-                                        &priv->ict_tbl_dma, GFP_KERNEL);
-        if (!priv->ict_tbl_vir)
-                return -ENOMEM;
-
-        /* align table to PAGE_SIZE boundry */
-        priv->aligned_ict_tbl_dma = ALIGN(priv->ict_tbl_dma, PAGE_SIZE);
-
-        IWL_DEBUG_ISR(priv, "ict dma addr %Lx dma aligned %Lx diff %d\n",
-                             (unsigned long long)priv->ict_tbl_dma,
-                             (unsigned long long)priv->aligned_ict_tbl_dma,
-                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
-
-        priv->ict_tbl =  priv->ict_tbl_vir +
-                          (priv->aligned_ict_tbl_dma - priv->ict_tbl_dma);
-
-        IWL_DEBUG_ISR(priv, "ict vir addr %p vir aligned %p diff %d\n",
-                             priv->ict_tbl, priv->ict_tbl_vir,
-                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
-
-        /* reset table and index to all 0 */
-        memset(priv->ict_tbl_vir,0, (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
-        priv->ict_index = 0;
-
-        /* add periodic RX interrupt */
-        priv->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
-        return 0;
-}
-EXPORT_SYMBOL(iwl_alloc_isr_ict);
-
-/* Device is going up inform it about using ICT interrupt table,
- * also we need to tell the driver to start using ICT interrupt.
- */
-int iwl_reset_ict(struct iwl_priv *priv)
-{
-        u32 val;
-        unsigned long flags;
-
-        if (!priv->ict_tbl_vir)
-                return 0;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_disable_interrupts(priv);
-
-        memset(&priv->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
-
-        val = priv->aligned_ict_tbl_dma >> PAGE_SHIFT;
-
-        val |= CSR_DRAM_INT_TBL_ENABLE;
-        val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
-
-        IWL_DEBUG_ISR(priv, "CSR_DRAM_INT_TBL_REG =0x%X "
-                        "aligned dma address %Lx\n",
-                        val, (unsigned long long)priv->aligned_ict_tbl_dma);
-
-        iwl_write32(priv, CSR_DRAM_INT_TBL_REG, val);
-        priv->use_ict = true;
-        priv->ict_index = 0;
-        iwl_write32(priv, CSR_INT, priv->inta_mask);
-        iwl_enable_interrupts(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_reset_ict);
-
-/* Device is going down disable ict interrupt usage */
-void iwl_disable_ict(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->use_ict = false;
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_disable_ict);
-
-/* interrupt handler using ict table, with this interrupt driver will
- * stop using INTA register to get device's interrupt, reading this register
- * is expensive, device will write interrupts in ICT dram table, increment
- * index then will fire interrupt to driver, driver will OR all ICT table
- * entries from current index up to table entry with 0 value. the result is
- * the interrupt we need to service, driver will set the entries back to 0 and
- * set index.
- */
-irqreturn_t iwl_isr_ict(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-        u32 val = 0;
-
-        if (!priv)
-                return IRQ_NONE;
-
-        /* dram interrupt table not set yet,
-         * use legacy interrupt.
-         */
-        if (!priv->use_ict)
-                return iwl_isr(irq, data);
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         * back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here.
-         */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!priv->ict_tbl[priv->ict_index]) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        /* read all entries that not 0 start with ict_index */
-        while (priv->ict_tbl[priv->ict_index]) {
-
-                val |= le32_to_cpu(priv->ict_tbl[priv->ict_index]);
-                IWL_DEBUG_ISR(priv, "ICT index %d value 0x%08X\n",
-                                priv->ict_index,
-                                le32_to_cpu(priv->ict_tbl[priv->ict_index]));
-                priv->ict_tbl[priv->ict_index] = 0;
-                priv->ict_index = iwl_queue_inc_wrap(priv->ict_index,
-                                                     ICT_COUNT);
-
-        }
-
-        /* We should not get this value, just ignore it. */
-        if (val == 0xffffffff)
-                val = 0;
-
-        /*
-         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
-         * (bit 15 before shifting it to 31) to clear when using interrupt
-         * coalescing. fortunately, bits 18 and 19 stay set when this happens
-         * so we use them to decide on the real state of the Rx bit.
-         * In order words, bit 15 is set if bit 18 or bit 19 are set.
-         */
-        if (val & 0xC0000)
-                val |= 0x8000;
-
-        inta = (0xff & val) | ((0xff00 & val) << 16);
-        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
-                        inta, inta_mask, val);
-
-        inta &= priv->inta_mask;
-        priv->inta |= inta;
-
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta))
-                tasklet_schedule(&priv->irq_tasklet);
-        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta) {
-                /* Allow interrupt if was disabled by this handler and
-                 * no tasklet was schedules, We should not enable interrupt,
-                 * tasklet will enable it.
-                 */
-                iwl_enable_interrupts(priv);
-        }
-
-        spin_unlock(&priv->lock);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service.
-         * only Re-enable if disabled by irq.
-         */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-EXPORT_SYMBOL(iwl_isr_ict);
-
-
-static irqreturn_t iwl_isr(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        u32 inta_fh;
-#endif
-        if (!priv)
-                return IRQ_NONE;
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(priv, CSR_INT);
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                goto unplugged;
-        }
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
-                inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
-                IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
-                              "fh 0x%08x\n", inta, inta_mask, inta_fh);
-        }
-#endif
-
-        priv->inta |= inta;
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta))
-                tasklet_schedule(&priv->irq_tasklet);
-        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
- unplugged:
-        spin_unlock(&priv->lock);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if diabled by irq  and no schedules tasklet. */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-
 irqreturn_t iwl_isr_legacy(int irq, void *data)
 {
         struct iwl_priv *priv = data;
         u32 inta, inta_mask;
         u32 inta_fh;
+        unsigned long flags;
         if (!priv)
                 return IRQ_NONE;
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         /* Disable (but don't clear!) interrupts here to avoid
          *    back-to-back ISRs and sporadic interrupts from our NIC.
@@ -1985,7 +1409,7 @@ irqreturn_t iwl_isr_legacy(int irq, void *data)
                 tasklet_schedule(&priv->irq_tasklet);
 
  unplugged:
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
         return IRQ_HANDLED;
 
  none:
@@ -1993,12 +1417,12 @@ irqreturn_t iwl_isr_legacy(int irq, void *data)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
         return IRQ_NONE;
 }
 EXPORT_SYMBOL(iwl_isr_legacy);
 
-int iwl_send_bt_config(struct iwl_priv *priv)
+void iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
                 .lead_time = BT_LEAD_TIME_DEF,
@@ -2015,8 +1439,9 @@ int iwl_send_bt_config(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "BT coex %s\n",
                 (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
 
-        return iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                                sizeof(struct iwl_bt_cmd), &bt_cmd);
+        if (iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
+                             sizeof(struct iwl_bt_cmd), &bt_cmd))
+                IWL_ERR(priv, "failed to send BT Coex Config\n");
 }
 EXPORT_SYMBOL(iwl_send_bt_config);
 
@@ -2306,12 +1731,6 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                         cpu_to_le16((params->txop * 32));
 
         priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
-        priv->qos_data.qos_active = 1;
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP)
-                iwl_activate_qos(priv, 1);
-        else if (priv->assoc_id && iwl_is_associated(priv))
-                iwl_activate_qos(priv, 0);
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2321,12 +1740,13 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
 EXPORT_SYMBOL(iwl_mac_conf_tx);
 
 static void iwl_ht_conf(struct iwl_priv *priv,
-                        struct ieee80211_bss_conf *bss_conf)
+                        struct ieee80211_vif *vif)
 {
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
         struct ieee80211_sta *sta;
+        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
-        IWL_DEBUG_MAC80211(priv, "enter: \n");
+        IWL_DEBUG_MAC80211(priv, "enter:\n");
 
         if (!ht_conf->is_ht)
                 return;
@@ -2338,10 +1758,10 @@ static void iwl_ht_conf(struct iwl_priv *priv,
 
         ht_conf->single_chain_sufficient = false;
 
-        switch (priv->iw_mode) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 rcu_read_lock();
-                sta = ieee80211_find_sta(priv->vif, priv->bssid);
+                sta = ieee80211_find_sta(vif, bss_conf->bssid);
                 if (sta) {
                         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
                         int maxstreams;
@@ -2379,7 +1799,6 @@ static void iwl_ht_conf(struct iwl_priv *priv,
 
 static inline void iwl_set_no_assoc(struct iwl_priv *priv)
 {
-        priv->assoc_id = 0;
         iwl_led_disassociate(priv);
         /*
          * inform the ucode that there is no longer an
@@ -2392,7 +1811,6 @@ static inline void iwl_set_no_assoc(struct iwl_priv *priv)
         iwlcore_commit_rxon(priv);
 }
 
-#define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
                           struct ieee80211_bss_conf *bss_conf,
@@ -2408,14 +1826,12 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        if (changes & BSS_CHANGED_BEACON &&
-            priv->iw_mode == NL80211_IFTYPE_AP) {
+        if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_AP) {
                 dev_kfree_skb(priv->ibss_beacon);
                 priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
         }
 
         if (changes & BSS_CHANGED_BEACON_INT) {
-                priv->beacon_int = bss_conf->beacon_int;
                 /* TODO: in AP mode, do something to make this take effect */
         }
 
@@ -2435,8 +1851,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 }
 
                 /* mac80211 only sets assoc when in STATION mode */
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC ||
-                    bss_conf->assoc) {
+                if (vif->type == NL80211_IFTYPE_ADHOC || bss_conf->assoc) {
                         memcpy(priv->staging_rxon.bssid_addr,
                                bss_conf->bssid, ETH_ALEN);
 
@@ -2454,7 +1869,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
          * mac80211 decides to do both changes at once because
          * it will invoke post_associate.
          */
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+        if (vif->type == NL80211_IFTYPE_ADHOC &&
             changes & BSS_CHANGED_BEACON) {
                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
 
@@ -2497,7 +1912,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changes & BSS_CHANGED_HT) {
-                iwl_ht_conf(priv, bss_conf);
+                iwl_ht_conf(priv, vif);
 
                 if (priv->cfg->ops->hcmd->set_rxon_chain)
                         priv->cfg->ops->hcmd->set_rxon_chain(priv);
@@ -2506,28 +1921,17 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
         if (changes & BSS_CHANGED_ASSOC) {
                 IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
                 if (bss_conf->assoc) {
-                        priv->assoc_id = bss_conf->aid;
-                        priv->beacon_int = bss_conf->beacon_int;
                         priv->timestamp = bss_conf->timestamp;
-                        priv->assoc_capability = bss_conf->assoc_capability;
 
                         iwl_led_associate(priv);
 
-                        /*
-                         * We have just associated, don't start scan too early
-                         * leave time for EAPOL exchange to complete.
-                         *
-                         * XXX: do this in mac80211
-                         */
-                        priv->next_scan_jiffies = jiffies +
-                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
                         if (!iwl_is_rfkill(priv))
-                                priv->cfg->ops->lib->post_associate(priv);
+                                priv->cfg->ops->lib->post_associate(priv, vif);
                 } else
                         iwl_set_no_assoc(priv);
         }
 
-        if (changes && iwl_is_associated(priv) && priv->assoc_id) {
+        if (changes && iwl_is_associated(priv) && bss_conf->aid) {
                 IWL_DEBUG_MAC80211(priv, "Changes (%#x) while associated\n",
                                    changes);
                 ret = iwl_send_rxon_assoc(priv);
@@ -2544,11 +1948,20 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                         memcpy(priv->staging_rxon.bssid_addr,
                                bss_conf->bssid, ETH_ALEN);
                         memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
-                        iwlcore_config_ap(priv);
+                        iwlcore_config_ap(priv, vif);
                 } else
                         iwl_set_no_assoc(priv);
         }
 
+        if (changes & BSS_CHANGED_IBSS) {
+                ret = priv->cfg->ops->lib->manage_ibss_station(priv, vif,
+                                                        bss_conf->ibss_joined);
+                if (ret)
+                        IWL_ERR(priv, "failed to %s IBSS station %pM\n",
+                                bss_conf->ibss_joined ? "add" : "remove",
+                                bss_conf->bssid);
+        }
+
         mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -2568,11 +1981,6 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return -EIO;
         }
 
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not IBSS\n");
-                return -EIO;
-        }
-
         spin_lock_irqsave(&priv->lock, flags);
 
         if (priv->ibss_beacon)
@@ -2580,59 +1988,31 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         priv->ibss_beacon = skb;
 
-        priv->assoc_id = 0;
         timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
         priv->timestamp = le64_to_cpu(timestamp);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        iwl_reset_qos(priv);
-
-        priv->cfg->ops->lib->post_associate(priv);
-
+        priv->cfg->ops->lib->post_associate(priv, priv->vif);
 
         return 0;
 }
 EXPORT_SYMBOL(iwl_mac_beacon_update);
 
-int iwl_set_mode(struct iwl_priv *priv, int mode)
+static int iwl_set_mode(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
-        if (mode == NL80211_IFTYPE_ADHOC) {
-                const struct iwl_channel_info *ch_info;
-
-                ch_info = iwl_get_channel_info(priv,
-                        priv->band,
-                        le16_to_cpu(priv->staging_rxon.channel));
-
-                if (!ch_info || !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d not IBSS channel\n",
-                                  le16_to_cpu(priv->staging_rxon.channel));
-                        return -EINVAL;
-                }
-        }
-
-        iwl_connection_init_rx_config(priv, mode);
+        iwl_connection_init_rx_config(priv, vif);
 
         if (priv->cfg->ops->hcmd->set_rxon_chain)
                 priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
         memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
 
-        iwl_clear_stations_table(priv);
-
-        /* dont commit rxon if rf-kill is on*/
-        if (!iwl_is_ready_rf(priv))
-                return -EAGAIN;
-
-        iwlcore_commit_rxon(priv);
-
-        return 0;
+        return iwlcore_commit_rxon(priv);
 }
-EXPORT_SYMBOL(iwl_set_mode);
 
-int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif)
+int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
         int err = 0;
@@ -2641,6 +2021,11 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        if (WARN_ON(!iwl_is_ready_rf(priv))) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (priv->vif) {
                 IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
                 err = -EOPNOTSUPP;
@@ -2650,15 +2035,18 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
         priv->vif = vif;
         priv->iw_mode = vif->type;
 
-        if (vif->addr) {
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
-                memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
-        }
+        IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
+        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
+
+        err = iwl_set_mode(priv, vif);
+        if (err)
+                goto out_err;
 
-        if (iwl_set_mode(priv, vif->type) == -EAGAIN)
-                /* we are not ready, will run again when ready */
-                set_bit(STATUS_MODE_PENDING, &priv->status);
+        goto out;
 
+ out_err:
+        priv->vif = NULL;
+        priv->iw_mode = NL80211_IFTYPE_STATION;
  out:
         mutex_unlock(&priv->mutex);
 
@@ -2668,7 +2056,7 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
 EXPORT_SYMBOL(iwl_mac_add_interface);
 
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif)
+                              struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -2694,10 +2082,6 @@ EXPORT_SYMBOL(iwl_mac_remove_interface);
 
 /**
  * iwl_mac_config - mac80211 config callback
- *
- * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
- * be set inappropriately and the driver currently sets the hardware up to
- * use it whenever needed.
  */
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
@@ -2752,15 +2136,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         goto set_ch_out;
                 }
 
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-                        !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d in band %d not "
-                                "IBSS channel\n",
-                                conf->channel->hw_value, conf->channel->band);
-                        ret = -EINVAL;
-                        goto set_ch_out;
-                }
-
                 spin_lock_irqsave(&priv->lock, flags);
 
                 /* Configure HT40 channels */
@@ -2794,7 +2169,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_rxon_channel(priv, conf->channel);
                 iwl_set_rxon_ht(priv, ht_conf);
 
-                iwl_set_flags_for_band(priv, conf->channel->band);
+                iwl_set_flags_for_band(priv, conf->channel->band, priv->vif);
                 spin_unlock_irqrestore(&priv->lock, flags);
                 if (iwl_is_associated(priv) &&
                     (le16_to_cpu(priv->active_rxon.channel) != ch) &&
@@ -2833,6 +2208,15 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_tx_power(priv, conf->power_level, false);
         }
 
+        if (changed & IEEE80211_CONF_CHANGE_QOS) {
+                bool qos_active = !!(conf->flags & IEEE80211_CONF_QOS);
+
+                spin_lock_irqsave(&priv->lock, flags);
+                priv->qos_data.qos_active = qos_active;
+                iwl_update_qos(priv);
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+
         if (!iwl_is_ready(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 goto out;
@@ -2867,12 +2251,7 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_config));
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        iwl_reset_qos(priv);
-
         spin_lock_irqsave(&priv->lock, flags);
-        priv->assoc_id = 0;
-        priv->assoc_capability = 0;
-        priv->assoc_station_added = 0;
 
         /* new association get rid of ibss beacon skb */
         if (priv->ibss_beacon)
@@ -2880,10 +2259,7 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 
         priv->ibss_beacon = NULL;
 
-        priv->beacon_int = priv->vif->bss_conf.beacon_int;
         priv->timestamp = 0;
-        if ((priv->iw_mode == NL80211_IFTYPE_STATION))
-                priv->beacon_int = 0;
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2896,17 +2272,9 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         /* we are restarting association process
          * clear RXON_FILTER_ASSOC_MSK bit
          */
-        if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
-        }
-
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not in IBSS\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
+        iwl_scan_cancel_timeout(priv, 100);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv);
 
         iwl_set_rate(priv);
 
@@ -2923,7 +2291,7 @@ int iwl_alloc_txq_mem(struct iwl_priv *priv)
                         sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
                         GFP_KERNEL);
         if (!priv->txq) {
-                IWL_ERR(priv, "Not enough memory for txq \n");
+                IWL_ERR(priv, "Not enough memory for txq\n");
                 return -ENOMEM;
         }
         return 0;
@@ -2937,34 +2305,6 @@ void iwl_free_txq_mem(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_free_txq_mem);
 
-int iwl_send_wimax_coex(struct iwl_priv *priv)
-{
-        struct iwl_wimax_coex_cmd uninitialized_var(coex_cmd);
-
-        if (priv->cfg->support_wimax_coexist) {
-                /* UnMask wake up src at associated sleep */
-                coex_cmd.flags |= COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
-
-                /* UnMask wake up src at unassociated sleep */
-                coex_cmd.flags |= COEX_FLAGS_UNASSOC_WA_UNMASK_MSK;
-                memcpy(coex_cmd.sta_prio, cu_priorities,
-                        sizeof(struct iwl_wimax_coex_event_entry) *
-                         COEX_NUM_OF_EVENTS);
-
-                /* enabling the coexistence feature */
-                coex_cmd.flags |= COEX_FLAGS_COEX_ENABLE_MSK;
-
-                /* enabling the priorities tables */
-                coex_cmd.flags |= COEX_FLAGS_STA_TABLE_VALID_MSK;
-        } else {
-                /* coexistence is disabled */
-                memset(&coex_cmd, 0, sizeof(coex_cmd));
-        }
-        return iwl_send_cmd_pdu(priv, COEX_PRIORITY_TABLE_CMD,
-                                sizeof(coex_cmd), &coex_cmd);
-}
-EXPORT_SYMBOL(iwl_send_wimax_coex);
-
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 
 #define IWL_TRAFFIC_DUMP_SIZE   (IWL_TRAFFIC_ENTRY_SIZE * IWL_TRAFFIC_ENTRIES)
@@ -3358,7 +2698,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
@@ -3404,6 +2743,99 @@ int iwl_force_reset(struct iwl_priv *priv, int mode)
         }
         return 0;
 }
+EXPORT_SYMBOL(iwl_force_reset);
+
+/**
+ * iwl_bg_monitor_recover - Timer callback to check for stuck queue and recover
+ *
+ * During normal condition (no queue is stuck), the timer is continually set to
+ * execute every monitor_recover_period milliseconds after the last timer
+ * expired.  When the queue read_ptr is at the same place, the timer is
+ * shorten to 100mSecs.  This is
+ *      1) to reduce the chance that the read_ptr may wrap around (not stuck)
+ *      2) to detect the stuck queues quicker before the station and AP can
+ *      disassociate each other.
+ *
+ * This function monitors all the tx queues and recover from it if any
+ * of the queues are stuck.
+ * 1. It first check the cmd queue for stuck conditions.  If it is stuck,
+ *      it will recover by resetting the firmware and return.
+ * 2. Then, it checks for station association.  If it associates it will check
+ *      other queues.  If any queue is stuck, it will recover by resetting
+ *      the firmware.
+ * Note: It the number of times the queue read_ptr to be at the same place to
+ *      be MAX_REPEAT+1 in order to consider to be stuck.
+ */
+/*
+ * The maximum number of times the read pointer of the tx queue at the
+ * same place without considering to be stuck.
+ */
+#define MAX_REPEAT      (2)
+static int iwl_check_stuck_queue(struct iwl_priv *priv, int cnt)
+{
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+
+        txq = &priv->txq[cnt];
+        q = &txq->q;
+        /* queue is empty, skip */
+        if (q->read_ptr != q->write_ptr) {
+                if (q->read_ptr == q->last_read_ptr) {
+                        /* a queue has not been read from last time */
+                        if (q->repeat_same_read_ptr > MAX_REPEAT) {
+                                IWL_ERR(priv,
+                                        "queue %d stuck %d time. Fw reload.\n",
+                                        q->id, q->repeat_same_read_ptr);
+                                q->repeat_same_read_ptr = 0;
+                                iwl_force_reset(priv, IWL_FW_RESET);
+                        } else {
+                                q->repeat_same_read_ptr++;
+                                IWL_DEBUG_RADIO(priv,
+                                                "queue %d, not read %d time\n",
+                                                q->id,
+                                                q->repeat_same_read_ptr);
+                                mod_timer(&priv->monitor_recover, jiffies +
+                                        msecs_to_jiffies(IWL_ONE_HUNDRED_MSECS));
+                        }
+                        return 1;
+                } else {
+                        q->last_read_ptr = q->read_ptr;
+                        q->repeat_same_read_ptr = 0;
+                }
+        }
+        return 0;
+}
+
+void iwl_bg_monitor_recover(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        int cnt;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* monitor and check for stuck cmd queue */
+        if (iwl_check_stuck_queue(priv, IWL_CMD_QUEUE_NUM))
+                return;
+
+        /* monitor and check for other stuck queues */
+        if (iwl_is_associated(priv)) {
+                for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
+                        /* skip as we already checked the command queue */
+                        if (cnt == IWL_CMD_QUEUE_NUM)
+                                continue;
+                        if (iwl_check_stuck_queue(priv, cnt))
+                                return;
+                }
+        }
+        /*
+         * Reschedule the timer to occur in
+         * priv->cfg->monitor_recover_period
+         */
+        mod_timer(&priv->monitor_recover,
+                jiffies + msecs_to_jiffies(priv->cfg->monitor_recover_period));
+}
+EXPORT_SYMBOL(iwl_bg_monitor_recover);
 
 #ifdef CONFIG_PM
 
@@ -3433,6 +2865,12 @@ int iwl_pci_resume(struct pci_dev *pdev)
         struct iwl_priv *priv = pci_get_drvdata(pdev);
         int ret;
 
+        /*
+         * We disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state.
+         */
+        pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
+
         pci_set_power_state(pdev, PCI_D0);
         ret = pci_enable_device(pdev);
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..7e5a5ba41fd2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -90,6 +90,7 @@ struct iwl_hcmd_ops {
         int (*commit_rxon)(struct iwl_priv *priv);
         void (*set_rxon_chain)(struct iwl_priv *priv);
         int (*set_tx_ant)(struct iwl_priv *priv, u8 valid_tx_ant);
+        void (*send_bt_config)(struct iwl_priv *priv);
 };
 
 struct iwl_hcmd_utils_ops {
@@ -105,6 +106,7 @@ struct iwl_hcmd_utils_ops {
                         __le32 *tx_flags);
         int  (*calc_rssi)(struct iwl_priv *priv,
                           struct iwl_rx_phy_res *rx_resp);
+        void (*request_scan)(struct iwl_priv *priv, struct ieee80211_vif *vif);
 };
 
 struct iwl_apm_ops {
@@ -114,23 +116,21 @@ struct iwl_apm_ops {
         int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
 };
 
+struct iwl_debugfs_ops {
+        ssize_t (*rx_stats_read)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
+        ssize_t (*tx_stats_read)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
+        ssize_t (*general_stats_read)(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos);
+};
+
 struct iwl_temp_ops {
         void (*temperature)(struct iwl_priv *priv);
         void (*set_ct_kill)(struct iwl_priv *priv);
         void (*set_calib_version)(struct iwl_priv *priv);
 };
 
-struct iwl_ucode_ops {
-        u32 (*get_header_size)(u32);
-        u32 (*get_build)(const struct iwl_ucode_header *, u32);
-        u32 (*get_inst_size)(const struct iwl_ucode_header *, u32);
-        u32 (*get_data_size)(const struct iwl_ucode_header *, u32);
-        u32 (*get_init_size)(const struct iwl_ucode_header *, u32);
-        u32 (*get_init_data_size)(const struct iwl_ucode_header *, u32);
-        u32 (*get_boot_size)(const struct iwl_ucode_header *, u32);
-        u8 * (*get_data)(const struct iwl_ucode_header *, u32);
-};
-
 struct iwl_lib_ops {
         /* set hw dependent parameters */
         int (*set_hw_params)(struct iwl_priv *priv);
@@ -180,8 +180,9 @@ struct iwl_lib_ops {
         /* power */
         int (*send_tx_power) (struct iwl_priv *priv);
         void (*update_chain_flags)(struct iwl_priv *priv);
-        void (*post_associate) (struct iwl_priv *priv);
-        void (*config_ap) (struct iwl_priv *priv);
+        void (*post_associate)(struct iwl_priv *priv,
+                               struct ieee80211_vif *vif);
+        void (*config_ap)(struct iwl_priv *priv, struct ieee80211_vif *vif);
         irqreturn_t (*isr) (int irq, void *data);
 
         /* eeprom operations (as defined in iwl-eeprom.h) */
@@ -190,7 +191,17 @@ struct iwl_lib_ops {
         /* temperature */
         struct iwl_temp_ops temp_ops;
         /* station management */
-        void (*add_bcast_station)(struct iwl_priv *priv);
+        int (*manage_ibss_station)(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif, bool add);
+        /* recover from tx queue stall */
+        void (*recover_from_tx_stall)(unsigned long data);
+        /* check for plcp health */
+        bool (*check_plcp_health)(struct iwl_priv *priv,
+                                        struct iwl_rx_packet *pkt);
+        /* check for ack health */
+        bool (*check_ack_health)(struct iwl_priv *priv,
+                                        struct iwl_rx_packet *pkt);
+        struct iwl_debugfs_ops debugfs_ops;
 };
 
 struct iwl_led_ops {
@@ -200,7 +211,6 @@ struct iwl_led_ops {
 };
 
 struct iwl_ops {
-        const struct iwl_ucode_ops *ucode;
         const struct iwl_lib_ops *lib;
         const struct iwl_hcmd_ops *hcmd;
         const struct iwl_hcmd_utils_ops *utils;
@@ -237,6 +247,18 @@ struct iwl_mod_params {
  * @support_wimax_coexist: support wimax/wifi co-exist
  * @plcp_delta_threshold: plcp error rate threshold used to trigger
  *      radio tuning when there is a high receiving plcp error rate
+ * @chain_noise_scale: default chain noise scale used for gain computation
+ * @monitor_recover_period: default timer used to check stuck queues
+ * @temperature_kelvin: temperature report by uCode in kelvin
+ * @max_event_log_size: size of event log buffer size for ucode event logging
+ * @tx_power_by_driver: tx power calibration performed by driver
+ *      instead of uCode
+ * @ucode_tracing: support ucode continuous tracing
+ * @sensitivity_calib_by_driver: driver has the capability to perform
+ *      sensitivity calibration operation
+ * @chain_noise_calib_by_driver: driver has the capability to perform
+ *      chain noise calibration operation
+ * @scan_antennas: available antenna for scan operation
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -295,6 +317,15 @@ struct iwl_cfg {
         const bool support_wimax_coexist;
         u8 plcp_delta_threshold;
         s32 chain_noise_scale;
+        /* timer period for monitor the driver queues */
+        u32 monitor_recover_period;
+        bool temperature_kelvin;
+        u32 max_event_log_size;
+        const bool tx_power_by_driver;
+        const bool ucode_tracing;
+        const bool sensitivity_calib_by_driver;
+        const bool chain_noise_calib_by_driver;
+        u8 scan_antennas[IEEE80211_NUM_BANDS];
 };
 
 /***************************
@@ -304,8 +335,7 @@ struct iwl_cfg {
 struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
                 struct ieee80211_ops *hw_ops);
 void iwl_hw_detect(struct iwl_priv *priv);
-void iwl_reset_qos(struct iwl_priv *priv);
-void iwl_activate_qos(struct iwl_priv *priv, u8 force);
+void iwl_activate_qos(struct iwl_priv *priv);
 int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                     const struct ieee80211_tx_queue_params *params);
 void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, int hw_decrypt);
@@ -316,8 +346,8 @@ int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf);
-void iwl_set_flags_for_band(struct iwl_priv *priv, enum ieee80211_band band);
-void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode);
+void iwl_connection_init_rx_config(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif);
 int iwl_set_decrypted_flag(struct iwl_priv *priv,
                            struct ieee80211_hdr *hdr,
                            u32 decrypt_res,
@@ -326,29 +356,25 @@ void iwl_irq_handle_error(struct iwl_priv *priv);
 void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags, u64 multicast);
-int iwl_hw_nic_init(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
-bool iwl_is_monitor_mode(struct iwl_priv *priv);
-void iwl_post_associate(struct iwl_priv *priv);
+void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif);
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_bss_conf *bss_conf,
                                      u32 changes);
 int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
 int iwl_commit_rxon(struct iwl_priv *priv);
-int iwl_set_mode(struct iwl_priv *priv, int mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
-void iwl_config_ap(struct iwl_priv *priv);
+void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
 int iwl_alloc_txq_mem(struct iwl_priv *priv);
 void iwl_free_txq_mem(struct iwl_priv *priv);
 void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                                 __le32 *tx_flags);
-int iwl_send_wimax_coex(struct iwl_priv *priv);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
 void iwl_free_traffic_mem(struct iwl_priv *priv);
@@ -411,26 +437,24 @@ void iwl_rx_reply_error(struct iwl_priv *priv,
 /*****************************************************
 * RX
 ******************************************************/
-void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 void iwl_cmd_queue_free(struct iwl_priv *priv);
 int iwl_rx_queue_alloc(struct iwl_priv *priv);
 void iwl_rx_handle(struct iwl_priv *priv);
 void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
                                   struct iwl_rx_queue *q);
-void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-void iwl_rx_replenish(struct iwl_priv *priv);
-void iwl_rx_replenish_now(struct iwl_priv *priv);
-int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-void iwl_rx_queue_restock(struct iwl_priv *priv);
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
-void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority);
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
-int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
 /* Handlers */
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb);
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                                 struct iwl_rx_packet *pkt);
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                                 struct iwl_rx_packet *pkt);
+void iwl_recover_from_statistics(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt);
 void iwl_rx_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb);
 void iwl_reply_statistics(struct iwl_priv *priv,
@@ -442,14 +466,10 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-int iwl_txq_ctx_alloc(struct iwl_priv *priv);
-void iwl_txq_ctx_reset(struct iwl_priv *priv);
 void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                  struct iwl_tx_queue *txq,
                                  dma_addr_t addr, u16 len, u8 reset, u8 pad);
-int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
-void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
 void iwl_free_tfds_in_queue(struct iwl_priv *priv,
@@ -460,9 +480,6 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                         int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
-int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn);
-int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
-int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id);
 /*****************************************************
  * TX power
  ****************************************************/
@@ -472,10 +489,7 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
  * Rate
  ******************************************************************************/
 
-void iwl_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
-                              struct ieee80211_tx_info *info);
 int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
-int iwl_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv);
 
@@ -505,8 +519,11 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
-int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+int iwl_mac_hw_scan(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    struct cfg80211_scan_request *req);
+void iwl_bg_start_internal_scan(struct work_struct *work);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
@@ -515,7 +532,8 @@ u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
                               enum ieee80211_band band,
                               u8 n_probes);
 u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
-                               enum ieee80211_band band);
+                               enum ieee80211_band band,
+                               struct ieee80211_vif *vif);
 void iwl_bg_scan_check(struct work_struct *data);
 void iwl_bg_abort_scan(struct work_struct *work);
 void iwl_bg_scan_completed(struct work_struct *work);
@@ -530,6 +548,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
 #define IWL_ACTIVE_QUIET_TIME       cpu_to_le16(10)  /* msec */
 #define IWL_PLCP_QUIET_THRESH       cpu_to_le16(1)  /* packets */
 
+#define IWL_SCAN_CHECK_WATCHDOG         (HZ * 7)
 
 /*******************************************************************************
  * Calibrations - implemented in iwl-calib.c
@@ -563,11 +582,6 @@ int iwl_send_card_state(struct iwl_priv *priv, u32 flags,
  * PCI                                               *
  *****************************************************/
 irqreturn_t iwl_isr_legacy(int irq, void *data);
-int iwl_reset_ict(struct iwl_priv *priv);
-void iwl_disable_ict(struct iwl_priv *priv);
-int iwl_alloc_isr_ict(struct iwl_priv *priv);
-void iwl_free_isr_ict(struct iwl_priv *priv);
-irqreturn_t iwl_isr_ict(int irq, void *data);
 
 static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 {
@@ -577,6 +591,9 @@ static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
         pci_read_config_word(priv->pci_dev, pos + PCI_EXP_LNKCTL, &pci_lnk_ctl);
         return pci_lnk_ctl;
 }
+
+void iwl_bg_monitor_recover(unsigned long data);
+
 #ifdef CONFIG_PM
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
 int iwl_pci_resume(struct pci_dev *pdev);
@@ -625,7 +642,6 @@ void iwlcore_free_geos(struct iwl_priv *priv);
 #define STATUS_SCAN_HW          15
 #define STATUS_POWER_PMI        16
 #define STATUS_FW_ERROR         17
-#define STATUS_MODE_PENDING     18
 
 
 static inline int iwl_is_ready(struct iwl_priv *priv)
@@ -672,23 +688,16 @@ static inline int iwl_is_ready_rf(struct iwl_priv *priv)
 }
 
 extern void iwl_rf_kill_ct_config(struct iwl_priv *priv);
-extern int iwl_send_bt_config(struct iwl_priv *priv);
+extern void iwl_send_bt_config(struct iwl_priv *priv);
 extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
 extern int iwl_verify_ucode(struct iwl_priv *priv);
 extern int iwl_send_lq_cmd(struct iwl_priv *priv,
-                struct iwl_link_quality_cmd *lq, u8 flags);
-extern void iwl_rx_reply_rx(struct iwl_priv *priv,
-                struct iwl_rx_mem_buffer *rxb);
-extern void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
-                                    struct iwl_rx_mem_buffer *rxb);
-void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
-                                           struct iwl_rx_mem_buffer *rxb);
+                struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 void iwl_apm_stop(struct iwl_priv *priv);
-int iwl_apm_stop_master(struct iwl_priv *priv);
 int iwl_apm_init(struct iwl_priv *priv);
 
-void iwl_setup_rxon_timing(struct iwl_priv *priv);
+void iwl_setup_rxon_timing(struct iwl_priv *priv, struct ieee80211_vif *vif);
 static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
 {
         return priv->cfg->ops->hcmd->rxon_assoc(priv);
@@ -697,9 +706,10 @@ static inline int iwlcore_commit_rxon(struct iwl_priv *priv)
 {
         return priv->cfg->ops->hcmd->commit_rxon(priv);
 }
-static inline void iwlcore_config_ap(struct iwl_priv *priv)
+static inline void iwlcore_config_ap(struct iwl_priv *priv,
+                                     struct ieee80211_vif *vif)
 {
-        priv->cfg->ops->lib->config_ap(priv);
+        priv->cfg->ops->lib->config_ap(priv, vif);
 }
 static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
                         struct iwl_priv *priv, enum ieee80211_band band)
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 808b7146bead..254c35ae8b38 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -298,6 +298,7 @@
 #define CSR_HW_REV_TYPE_1000           (0x0000060)
 #define CSR_HW_REV_TYPE_6x00           (0x0000070)
 #define CSR_HW_REV_TYPE_6x50           (0x0000080)
+#define CSR_HW_REV_TYPE_6x00g2         (0x00000B0)
 #define CSR_HW_REV_TYPE_NONE           (0x00000F0)
 
 /* EEPROM REG */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 1c7b53d511c7..5c2bcef5df0c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -78,6 +78,8 @@ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
 void iwl_dbgfs_unregister(struct iwl_priv *priv);
+extern int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
+                                     int bufsz);
 #else
 static inline int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index b6e1b0ebe230..9659c5d01df9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -106,6 +106,26 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {          \
         .open = iwl_dbgfs_open_file_generic,                            \
 };
 
+int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
+{
+        int p = 0;
+
+        p += scnprintf(buf + p, bufsz - p, "Statistics Flag(0x%X):\n",
+                       le32_to_cpu(priv->statistics.flag));
+        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
+                p += scnprintf(buf + p, bufsz - p,
+                               "\tStatistics have been cleared\n");
+        p += scnprintf(buf + p, bufsz - p, "\tOperational Frequency: %s\n",
+                       (le32_to_cpu(priv->statistics.flag) &
+                        UCODE_STATISTICS_FREQUENCY_MSK)
+                        ? "2.4 GHz" : "5.2 GHz");
+        p += scnprintf(buf + p, bufsz - p, "\tTGj Narrow Band: %s\n",
+                       (le32_to_cpu(priv->statistics.flag) &
+                        UCODE_STATISTICS_NARROW_BAND_MSK)
+                        ? "enabled" : "disabled");
+        return p;
+}
+EXPORT_SYMBOL(iwl_dbgfs_statistics_flag);
 
 static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                 char __user *user_buf,
@@ -561,8 +581,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                 test_bit(STATUS_POWER_PMI, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_FW_ERROR:\t %d\n",
                 test_bit(STATUS_FW_ERROR, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_MODE_PENDING:\t %d\n",
-                test_bit(STATUS_MODE_PENDING, &priv->status));
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
@@ -661,7 +679,6 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
         int pos = 0, i;
         char buf[256];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         for (i = 0; i < AC_NUM; i++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
@@ -673,8 +690,7 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
                                 priv->qos_data.def_qos_parm.ac[i].aifsn,
                                 priv->qos_data.def_qos_parm.ac[i].edca_txop);
         }
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
@@ -684,7 +700,6 @@ static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
         int pos = 0;
         char buf[256];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                          "allow blinking: %s\n",
@@ -698,8 +713,7 @@ static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
                                  priv->last_blink_time);
         }
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
@@ -712,7 +726,6 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
         char buf[100];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                         "Thermal Throttling Mode: %s\n",
@@ -732,8 +745,7 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
                                 "HT mode: %d\n",
                                 restriction->is_ht);
         }
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
@@ -770,13 +782,11 @@ static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,
         char buf[100];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                         "11n 40MHz Mode: %s\n",
                         priv->disable_ht40 ? "Disabled" : "Enabled");
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
@@ -1044,474 +1054,13 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
-                                     int bufsz)
-{
-        int p = 0;
-
-        p += scnprintf(buf + p, bufsz - p,
-                "Statistics Flag(0x%X):\n",
-                le32_to_cpu(priv->statistics.flag));
-        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
-                p += scnprintf(buf + p, bufsz - p,
-                "\tStatistics have been cleared\n");
-        p += scnprintf(buf + p, bufsz - p,
-                "\tOperational Frequency: %s\n",
-                (le32_to_cpu(priv->statistics.flag) &
-                UCODE_STATISTICS_FREQUENCY_MSK)
-                 ? "2.4 GHz" : "5.2 GHz");
-        p += scnprintf(buf + p, bufsz - p,
-                "\tTGj Narrow Band: %s\n",
-                (le32_to_cpu(priv->statistics.flag) &
-                UCODE_STATISTICS_NARROW_BAND_MSK)
-                 ? "enabled" : "disabled");
-        return p;
-}
-
-static const char ucode_stats_header[] =
-        "%-32s     current  acumulative       delta         max\n";
-static const char ucode_stats_short_format[] =
-        "  %-30s %10u\n";
-static const char ucode_stats_format[] =
-        "  %-30s %10u  %10u  %10u  %10u\n";
-
 static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
-                sizeof(struct statistics_rx_non_phy) * 40 +
-                sizeof(struct statistics_rx_ht_phy) * 40 + 400;
-        ssize_t ret;
-        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
-        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
-        struct statistics_rx_non_phy *general, *accum_general;
-        struct statistics_rx_non_phy *delta_general, *max_general;
-        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        ofdm = &priv->statistics.rx.ofdm;
-        cck = &priv->statistics.rx.cck;
-        general = &priv->statistics.rx.general;
-        ht = &priv->statistics.rx.ofdm_ht;
-        accum_ofdm = &priv->accum_statistics.rx.ofdm;
-        accum_cck = &priv->accum_statistics.rx.cck;
-        accum_general = &priv->accum_statistics.rx.general;
-        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
-        delta_ofdm = &priv->delta_statistics.rx.ofdm;
-        delta_cck = &priv->delta_statistics.rx.cck;
-        delta_general = &priv->delta_statistics.rx.general;
-        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
-        max_ofdm = &priv->max_delta.rx.ofdm;
-        max_cck = &priv->max_delta.rx.cck;
-        max_general = &priv->max_delta.rx.general;
-        max_ht = &priv->max_delta.rx.ofdm_ht;
-
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                         "Statistics_Rx - OFDM:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
-                         accum_ofdm->ina_cnt,
-                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_cnt:",
-                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
-                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
-                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
-                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(ofdm->overrun_err),
-                         accum_ofdm->overrun_err,
-                         delta_ofdm->overrun_err, max_ofdm->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(ofdm->early_overrun_err),
-                         accum_ofdm->early_overrun_err,
-                         delta_ofdm->early_overrun_err,
-                         max_ofdm->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(ofdm->crc32_good),
-                         accum_ofdm->crc32_good,
-                         delta_ofdm->crc32_good, max_ofdm->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "false_alarm_cnt:",
-                         le32_to_cpu(ofdm->false_alarm_cnt),
-                         accum_ofdm->false_alarm_cnt,
-                         delta_ofdm->false_alarm_cnt,
-                         max_ofdm->false_alarm_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_sync_err_cnt:",
-                         le32_to_cpu(ofdm->fina_sync_err_cnt),
-                         accum_ofdm->fina_sync_err_cnt,
-                         delta_ofdm->fina_sync_err_cnt,
-                         max_ofdm->fina_sync_err_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sfd_timeout:",
-                         le32_to_cpu(ofdm->sfd_timeout),
-                         accum_ofdm->sfd_timeout,
-                         delta_ofdm->sfd_timeout,
-                         max_ofdm->sfd_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_timeout:",
-                         le32_to_cpu(ofdm->fina_timeout),
-                         accum_ofdm->fina_timeout,
-                         delta_ofdm->fina_timeout,
-                         max_ofdm->fina_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unresponded_rts:",
-                         le32_to_cpu(ofdm->unresponded_rts),
-                         accum_ofdm->unresponded_rts,
-                         delta_ofdm->unresponded_rts,
-                         max_ofdm->unresponded_rts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "rxe_frame_lmt_ovrun:",
-                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
-                         accum_ofdm->rxe_frame_limit_overrun,
-                         delta_ofdm->rxe_frame_limit_overrun,
-                         max_ofdm->rxe_frame_limit_overrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ack_cnt:",
-                         le32_to_cpu(ofdm->sent_ack_cnt),
-                         accum_ofdm->sent_ack_cnt,
-                         delta_ofdm->sent_ack_cnt,
-                         max_ofdm->sent_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_cts_cnt:",
-                         le32_to_cpu(ofdm->sent_cts_cnt),
-                         accum_ofdm->sent_cts_cnt,
-                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ba_rsp_cnt:",
-                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
-                         accum_ofdm->sent_ba_rsp_cnt,
-                         delta_ofdm->sent_ba_rsp_cnt,
-                         max_ofdm->sent_ba_rsp_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_self_kill:",
-                         le32_to_cpu(ofdm->dsp_self_kill),
-                         accum_ofdm->dsp_self_kill,
-                         delta_ofdm->dsp_self_kill,
-                         max_ofdm->dsp_self_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(ofdm->mh_format_err),
-                         accum_ofdm->mh_format_err,
-                         delta_ofdm->mh_format_err,
-                         max_ofdm->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "re_acq_main_rssi_sum:",
-                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
-                         accum_ofdm->re_acq_main_rssi_sum,
-                         delta_ofdm->re_acq_main_rssi_sum,
-                        max_ofdm->re_acq_main_rssi_sum);
-
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                         "Statistics_Rx - CCK:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ina_cnt:",
-                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
-                         delta_cck->ina_cnt, max_cck->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_cnt:",
-                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
-                         delta_cck->fina_cnt, max_cck->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
-                         delta_cck->plcp_err, max_cck->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
-                         delta_cck->crc32_err, max_cck->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(cck->overrun_err),
-                         accum_cck->overrun_err,
-                         delta_cck->overrun_err, max_cck->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(cck->early_overrun_err),
-                         accum_cck->early_overrun_err,
-                         delta_cck->early_overrun_err,
-                         max_cck->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
-                         delta_cck->crc32_good,
-                         max_cck->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "false_alarm_cnt:",
-                         le32_to_cpu(cck->false_alarm_cnt),
-                         accum_cck->false_alarm_cnt,
-                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_sync_err_cnt:",
-                         le32_to_cpu(cck->fina_sync_err_cnt),
-                         accum_cck->fina_sync_err_cnt,
-                         delta_cck->fina_sync_err_cnt,
-                         max_cck->fina_sync_err_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sfd_timeout:",
-                         le32_to_cpu(cck->sfd_timeout),
-                         accum_cck->sfd_timeout,
-                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_timeout:",
-                         le32_to_cpu(cck->fina_timeout),
-                         accum_cck->fina_timeout,
-                         delta_cck->fina_timeout, max_cck->fina_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unresponded_rts:",
-                         le32_to_cpu(cck->unresponded_rts),
-                         accum_cck->unresponded_rts,
-                         delta_cck->unresponded_rts,
-                         max_cck->unresponded_rts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "rxe_frame_lmt_ovrun:",
-                         le32_to_cpu(cck->rxe_frame_limit_overrun),
-                         accum_cck->rxe_frame_limit_overrun,
-                         delta_cck->rxe_frame_limit_overrun,
-                         max_cck->rxe_frame_limit_overrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ack_cnt:",
-                         le32_to_cpu(cck->sent_ack_cnt),
-                         accum_cck->sent_ack_cnt,
-                         delta_cck->sent_ack_cnt,
-                         max_cck->sent_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_cts_cnt:",
-                         le32_to_cpu(cck->sent_cts_cnt),
-                         accum_cck->sent_cts_cnt,
-                         delta_cck->sent_cts_cnt,
-                         max_cck->sent_cts_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ba_rsp_cnt:",
-                         le32_to_cpu(cck->sent_ba_rsp_cnt),
-                         accum_cck->sent_ba_rsp_cnt,
-                         delta_cck->sent_ba_rsp_cnt,
-                         max_cck->sent_ba_rsp_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_self_kill:",
-                         le32_to_cpu(cck->dsp_self_kill),
-                         accum_cck->dsp_self_kill,
-                         delta_cck->dsp_self_kill,
-                         max_cck->dsp_self_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(cck->mh_format_err),
-                         accum_cck->mh_format_err,
-                         delta_cck->mh_format_err, max_cck->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "re_acq_main_rssi_sum:",
-                         le32_to_cpu(cck->re_acq_main_rssi_sum),
-                         accum_cck->re_acq_main_rssi_sum,
-                         delta_cck->re_acq_main_rssi_sum,
-                         max_cck->re_acq_main_rssi_sum);
-
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_Rx - GENERAL:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bogus_cts:",
-                         le32_to_cpu(general->bogus_cts),
-                         accum_general->bogus_cts,
-                         delta_general->bogus_cts, max_general->bogus_cts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bogus_ack:",
-                         le32_to_cpu(general->bogus_ack),
-                         accum_general->bogus_ack,
-                         delta_general->bogus_ack, max_general->bogus_ack);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "non_bssid_frames:",
-                         le32_to_cpu(general->non_bssid_frames),
-                         accum_general->non_bssid_frames,
-                         delta_general->non_bssid_frames,
-                         max_general->non_bssid_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "filtered_frames:",
-                         le32_to_cpu(general->filtered_frames),
-                         accum_general->filtered_frames,
-                         delta_general->filtered_frames,
-                         max_general->filtered_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "non_channel_beacons:",
-                         le32_to_cpu(general->non_channel_beacons),
-                         accum_general->non_channel_beacons,
-                         delta_general->non_channel_beacons,
-                         max_general->non_channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "channel_beacons:",
-                         le32_to_cpu(general->channel_beacons),
-                         accum_general->channel_beacons,
-                         delta_general->channel_beacons,
-                         max_general->channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "num_missed_bcon:",
-                         le32_to_cpu(general->num_missed_bcon),
-                         accum_general->num_missed_bcon,
-                         delta_general->num_missed_bcon,
-                         max_general->num_missed_bcon);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "adc_rx_saturation_time:",
-                         le32_to_cpu(general->adc_rx_saturation_time),
-                         accum_general->adc_rx_saturation_time,
-                         delta_general->adc_rx_saturation_time,
-                         max_general->adc_rx_saturation_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "ina_detect_search_tm:",
-                         le32_to_cpu(general->ina_detection_search_time),
-                         accum_general->ina_detection_search_time,
-                         delta_general->ina_detection_search_time,
-                         max_general->ina_detection_search_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_a:",
-                         le32_to_cpu(general->beacon_silence_rssi_a),
-                         accum_general->beacon_silence_rssi_a,
-                         delta_general->beacon_silence_rssi_a,
-                         max_general->beacon_silence_rssi_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_b:",
-                         le32_to_cpu(general->beacon_silence_rssi_b),
-                         accum_general->beacon_silence_rssi_b,
-                         delta_general->beacon_silence_rssi_b,
-                         max_general->beacon_silence_rssi_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_c:",
-                         le32_to_cpu(general->beacon_silence_rssi_c),
-                         accum_general->beacon_silence_rssi_c,
-                         delta_general->beacon_silence_rssi_c,
-                         max_general->beacon_silence_rssi_c);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "interference_data_flag:",
-                         le32_to_cpu(general->interference_data_flag),
-                         accum_general->interference_data_flag,
-                         delta_general->interference_data_flag,
-                         max_general->interference_data_flag);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "channel_load:",
-                         le32_to_cpu(general->channel_load),
-                         accum_general->channel_load,
-                         delta_general->channel_load,
-                         max_general->channel_load);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_false_alarms:",
-                         le32_to_cpu(general->dsp_false_alarms),
-                         accum_general->dsp_false_alarms,
-                         delta_general->dsp_false_alarms,
-                         max_general->dsp_false_alarms);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_a:",
-                         le32_to_cpu(general->beacon_rssi_a),
-                         accum_general->beacon_rssi_a,
-                         delta_general->beacon_rssi_a,
-                         max_general->beacon_rssi_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_b:",
-                         le32_to_cpu(general->beacon_rssi_b),
-                         accum_general->beacon_rssi_b,
-                         delta_general->beacon_rssi_b,
-                         max_general->beacon_rssi_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_c:",
-                         le32_to_cpu(general->beacon_rssi_c),
-                         accum_general->beacon_rssi_c,
-                         delta_general->beacon_rssi_c,
-                         max_general->beacon_rssi_c);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_a:",
-                         le32_to_cpu(general->beacon_energy_a),
-                         accum_general->beacon_energy_a,
-                         delta_general->beacon_energy_a,
-                         max_general->beacon_energy_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_b:",
-                         le32_to_cpu(general->beacon_energy_b),
-                         accum_general->beacon_energy_b,
-                         delta_general->beacon_energy_b,
-                         max_general->beacon_energy_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_c:",
-                         le32_to_cpu(general->beacon_energy_c),
-                         accum_general->beacon_energy_c,
-                         delta_general->beacon_energy_c,
-                         max_general->beacon_energy_c);
-
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_Rx - OFDM_HT:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
-                         delta_ht->plcp_err, max_ht->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
-                         delta_ht->overrun_err, max_ht->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(ht->early_overrun_err),
-                         accum_ht->early_overrun_err,
-                         delta_ht->early_overrun_err,
-                         max_ht->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
-                         delta_ht->crc32_good, max_ht->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
-                         delta_ht->crc32_err, max_ht->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(ht->mh_format_err),
-                         accum_ht->mh_format_err,
-                         delta_ht->mh_format_err, max_ht->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_crc32_good:",
-                         le32_to_cpu(ht->agg_crc32_good),
-                         accum_ht->agg_crc32_good,
-                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_mpdu_cnt:",
-                         le32_to_cpu(ht->agg_mpdu_cnt),
-                         accum_ht->agg_mpdu_cnt,
-                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_cnt:",
-                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
-                         delta_ht->agg_cnt, max_ht->agg_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unsupport_mcs:",
-                         le32_to_cpu(ht->unsupport_mcs),
-                         accum_ht->unsupport_mcs,
-                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
-
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.rx_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
@@ -1519,173 +1068,8 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
-        ssize_t ret;
-        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        tx = &priv->statistics.tx;
-        accum_tx = &priv->accum_statistics.tx;
-        delta_tx = &priv->delta_statistics.tx;
-        max_tx = &priv->max_delta.tx;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos,  ucode_stats_header,
-                        "Statistics_Tx:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "preamble:",
-                         le32_to_cpu(tx->preamble_cnt),
-                         accum_tx->preamble_cnt,
-                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "rx_detected_cnt:",
-                         le32_to_cpu(tx->rx_detected_cnt),
-                         accum_tx->rx_detected_cnt,
-                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bt_prio_defer_cnt:",
-                         le32_to_cpu(tx->bt_prio_defer_cnt),
-                         accum_tx->bt_prio_defer_cnt,
-                         delta_tx->bt_prio_defer_cnt,
-                         max_tx->bt_prio_defer_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bt_prio_kill_cnt:",
-                         le32_to_cpu(tx->bt_prio_kill_cnt),
-                         accum_tx->bt_prio_kill_cnt,
-                         delta_tx->bt_prio_kill_cnt,
-                         max_tx->bt_prio_kill_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "few_bytes_cnt:",
-                         le32_to_cpu(tx->few_bytes_cnt),
-                         accum_tx->few_bytes_cnt,
-                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "cts_timeout:",
-                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
-                         delta_tx->cts_timeout, max_tx->cts_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ack_timeout:",
-                         le32_to_cpu(tx->ack_timeout),
-                         accum_tx->ack_timeout,
-                         delta_tx->ack_timeout, max_tx->ack_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "expected_ack_cnt:",
-                         le32_to_cpu(tx->expected_ack_cnt),
-                         accum_tx->expected_ack_cnt,
-                         delta_tx->expected_ack_cnt,
-                         max_tx->expected_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "actual_ack_cnt:",
-                         le32_to_cpu(tx->actual_ack_cnt),
-                         accum_tx->actual_ack_cnt,
-                         delta_tx->actual_ack_cnt,
-                         max_tx->actual_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dump_msdu_cnt:",
-                         le32_to_cpu(tx->dump_msdu_cnt),
-                         accum_tx->dump_msdu_cnt,
-                         delta_tx->dump_msdu_cnt,
-                         max_tx->dump_msdu_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "abort_nxt_frame_mismatch:",
-                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
-                         accum_tx->burst_abort_next_frame_mismatch_cnt,
-                         delta_tx->burst_abort_next_frame_mismatch_cnt,
-                         max_tx->burst_abort_next_frame_mismatch_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "abort_missing_nxt_frame:",
-                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
-                         accum_tx->burst_abort_missing_next_frame_cnt,
-                         delta_tx->burst_abort_missing_next_frame_cnt,
-                         max_tx->burst_abort_missing_next_frame_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "cts_timeout_collision:",
-                         le32_to_cpu(tx->cts_timeout_collision),
-                         accum_tx->cts_timeout_collision,
-                         delta_tx->cts_timeout_collision,
-                         max_tx->cts_timeout_collision);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "ack_ba_timeout_collision:",
-                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
-                         accum_tx->ack_or_ba_timeout_collision,
-                         delta_tx->ack_or_ba_timeout_collision,
-                         max_tx->ack_or_ba_timeout_collision);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg ba_timeout:",
-                         le32_to_cpu(tx->agg.ba_timeout),
-                         accum_tx->agg.ba_timeout,
-                         delta_tx->agg.ba_timeout,
-                         max_tx->agg.ba_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg ba_resched_frames:",
-                         le32_to_cpu(tx->agg.ba_reschedule_frames),
-                         accum_tx->agg.ba_reschedule_frames,
-                         delta_tx->agg.ba_reschedule_frames,
-                         max_tx->agg.ba_reschedule_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg scd_query_agg_frame:",
-                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
-                         accum_tx->agg.scd_query_agg_frame_cnt,
-                         delta_tx->agg.scd_query_agg_frame_cnt,
-                         max_tx->agg.scd_query_agg_frame_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg scd_query_no_agg:",
-                         le32_to_cpu(tx->agg.scd_query_no_agg),
-                         accum_tx->agg.scd_query_no_agg,
-                         delta_tx->agg.scd_query_no_agg,
-                         max_tx->agg.scd_query_no_agg);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg scd_query_agg:",
-                         le32_to_cpu(tx->agg.scd_query_agg),
-                         accum_tx->agg.scd_query_agg,
-                         delta_tx->agg.scd_query_agg,
-                         max_tx->agg.scd_query_agg);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg scd_query_mismatch:",
-                         le32_to_cpu(tx->agg.scd_query_mismatch),
-                         accum_tx->agg.scd_query_mismatch,
-                         delta_tx->agg.scd_query_mismatch,
-                         max_tx->agg.scd_query_mismatch);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg frame_not_ready:",
-                         le32_to_cpu(tx->agg.frame_not_ready),
-                         accum_tx->agg.frame_not_ready,
-                         delta_tx->agg.frame_not_ready,
-                         max_tx->agg.frame_not_ready);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg underrun:",
-                         le32_to_cpu(tx->agg.underrun),
-                         accum_tx->agg.underrun,
-                         delta_tx->agg.underrun, max_tx->agg.underrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg bt_prio_kill:",
-                         le32_to_cpu(tx->agg.bt_prio_kill),
-                         accum_tx->agg.bt_prio_kill,
-                         delta_tx->agg.bt_prio_kill,
-                         max_tx->agg.bt_prio_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg rx_ba_rsp_cnt:",
-                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
-                         accum_tx->agg.rx_ba_rsp_cnt,
-                         delta_tx->agg.rx_ba_rsp_cnt,
-                         max_tx->agg.rx_ba_rsp_cnt);
-
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.tx_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
@@ -1693,107 +1077,8 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = sizeof(struct statistics_general) * 10 + 300;
-        ssize_t ret;
-        struct statistics_general *general, *accum_general;
-        struct statistics_general *delta_general, *max_general;
-        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
-        struct statistics_div *div, *accum_div, *delta_div, *max_div;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        general = &priv->statistics.general;
-        dbg = &priv->statistics.general.dbg;
-        div = &priv->statistics.general.div;
-        accum_general = &priv->accum_statistics.general;
-        delta_general = &priv->delta_statistics.general;
-        max_general = &priv->max_delta.general;
-        accum_dbg = &priv->accum_statistics.general.dbg;
-        delta_dbg = &priv->delta_statistics.general.dbg;
-        max_dbg = &priv->max_delta.general.dbg;
-        accum_div = &priv->accum_statistics.general.div;
-        delta_div = &priv->delta_statistics.general.div;
-        max_div = &priv->max_delta.general.div;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_General:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
-                         "temperature:",
-                         le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
-                         "temperature_m:",
-                         le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "burst_check:",
-                         le32_to_cpu(dbg->burst_check),
-                         accum_dbg->burst_check,
-                         delta_dbg->burst_check, max_dbg->burst_check);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "burst_count:",
-                         le32_to_cpu(dbg->burst_count),
-                         accum_dbg->burst_count,
-                         delta_dbg->burst_count, max_dbg->burst_count);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sleep_time:",
-                         le32_to_cpu(general->sleep_time),
-                         accum_general->sleep_time,
-                         delta_general->sleep_time, max_general->sleep_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "slots_out:",
-                         le32_to_cpu(general->slots_out),
-                         accum_general->slots_out,
-                         delta_general->slots_out, max_general->slots_out);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "slots_idle:",
-                         le32_to_cpu(general->slots_idle),
-                         accum_general->slots_idle,
-                         delta_general->slots_idle, max_general->slots_idle);
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
-                         le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "tx_on_a:",
-                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
-                         delta_div->tx_on_a, max_div->tx_on_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "tx_on_b:",
-                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
-                         delta_div->tx_on_b, max_div->tx_on_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "exec_time:",
-                         le32_to_cpu(div->exec_time), accum_div->exec_time,
-                         delta_div->exec_time, max_div->exec_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "probe_time:",
-                         le32_to_cpu(div->probe_time), accum_div->probe_time,
-                         delta_div->probe_time, max_div->probe_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "rx_enable_counter:",
-                         le32_to_cpu(general->rx_enable_counter),
-                         accum_general->rx_enable_counter,
-                         delta_general->rx_enable_counter,
-                         max_general->rx_enable_counter);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "num_of_sos_states:",
-                         le32_to_cpu(general->num_of_sos_states),
-                         accum_general->num_of_sos_states,
-                         delta_general->num_of_sos_states,
-                         max_general->num_of_sos_states);
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.general_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,
@@ -1935,46 +1220,6 @@ static ssize_t iwl_dbgfs_chain_noise_read(struct file *file,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
-                                        char __user *user_buf,
-                                        size_t count, loff_t *ppos) {
-
-        struct iwl_priv *priv = file->private_data;
-        char buf[128];
-        int pos = 0;
-        const size_t bufsz = sizeof(buf);
-        struct statistics_tx *tx;
-
-        if (!iwl_is_alive(priv))
-                pos += scnprintf(buf + pos, bufsz - pos, "N/A\n");
-        else {
-                tx = &priv->statistics.tx;
-                if (tx->tx_power.ant_a ||
-                    tx->tx_power.ant_b ||
-                    tx->tx_power.ant_c) {
-                        pos += scnprintf(buf + pos, bufsz - pos,
-                                "tx power: (1/2 dB step)\n");
-                        if ((priv->cfg->valid_tx_ant & ANT_A) &&
-                            tx->tx_power.ant_a)
-                                pos += scnprintf(buf + pos, bufsz - pos,
-                                                "\tantenna A: 0x%X\n",
-                                                tx->tx_power.ant_a);
-                        if ((priv->cfg->valid_tx_ant & ANT_B) &&
-                            tx->tx_power.ant_b)
-                                pos += scnprintf(buf + pos, bufsz - pos,
-                                                "\tantenna B: 0x%X\n",
-                                                tx->tx_power.ant_b);
-                        if ((priv->cfg->valid_tx_ant & ANT_C) &&
-                            tx->tx_power.ant_c)
-                                pos += scnprintf(buf + pos, bufsz - pos,
-                                                "\tantenna C: 0x%X\n",
-                                                tx->tx_power.ant_c);
-                } else
-                        pos += scnprintf(buf + pos, bufsz - pos, "N/A\n");
-        }
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-}
-
 static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,
                                                     char __user *user_buf,
                                                     size_t count, loff_t *ppos)
@@ -2052,7 +1297,6 @@ static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
         int pos = 0;
         char buf[128];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "ucode trace timer is %s\n",
                         priv->event_log.ucode_trace ? "On" : "Off");
@@ -2063,8 +1307,7 @@ static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
         pos += scnprintf(buf + pos, bufsz - pos, "wraps_more_count:\t\t %u\n",
                         priv->event_log.wraps_more_count);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
@@ -2096,6 +1339,31 @@ static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_rxon_flags_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int len = 0;
+        char buf[20];
+
+        len = sprintf(buf, "0x%04X\n", le32_to_cpu(priv->active_rxon.flags));
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t iwl_dbgfs_rxon_filter_flags_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int len = 0;
+        char buf[20];
+
+        len = sprintf(buf, "0x%04X\n",
+                      le32_to_cpu(priv->active_rxon.filter_flags));
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
 static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
@@ -2125,13 +1393,11 @@ static ssize_t iwl_dbgfs_missed_beacon_read(struct file *file,
         int pos = 0;
         char buf[12];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "%d\n",
                         priv->missed_beacon_threshold);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
@@ -2160,27 +1426,6 @@ static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
         return count;
 }
 
-static ssize_t iwl_dbgfs_internal_scan_write(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct iwl_priv *priv = file->private_data;
-        char buf[8];
-        int buf_size;
-        int scan;
-
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-        if (sscanf(buf, "%d", &scan) != 1)
-                return -EINVAL;
-
-        iwl_internal_short_hw_scan(priv);
-
-        return count;
-}
-
 static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
@@ -2189,13 +1434,11 @@ static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
         int pos = 0;
         char buf[12];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
                         priv->cfg->plcp_delta_threshold);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
@@ -2288,7 +1531,6 @@ DEBUGFS_READ_FILE_OPS(ucode_tx_stats);
 DEBUGFS_READ_FILE_OPS(ucode_general_stats);
 DEBUGFS_READ_FILE_OPS(sensitivity);
 DEBUGFS_READ_FILE_OPS(chain_noise);
-DEBUGFS_READ_FILE_OPS(tx_power);
 DEBUGFS_READ_FILE_OPS(power_save_status);
 DEBUGFS_WRITE_FILE_OPS(clear_ucode_statistics);
 DEBUGFS_WRITE_FILE_OPS(clear_traffic_statistics);
@@ -2296,9 +1538,10 @@ DEBUGFS_WRITE_FILE_OPS(csr);
 DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
 DEBUGFS_READ_FILE_OPS(fh_reg);
 DEBUGFS_READ_WRITE_FILE_OPS(missed_beacon);
-DEBUGFS_WRITE_FILE_OPS(internal_scan);
 DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
 DEBUGFS_READ_WRITE_FILE_OPS(force_reset);
+DEBUGFS_READ_FILE_OPS(rxon_flags);
+DEBUGFS_READ_FILE_OPS(rxon_filter_flags);
 
 /*
  * Create the debugfs files and directories
@@ -2334,8 +1577,11 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(interrupt, dir_data, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(qos, dir_data, S_IRUSR);
         DEBUGFS_ADD_FILE(led, dir_data, S_IRUSR);
-        DEBUGFS_ADD_FILE(sleep_level_override, dir_data, S_IWUSR | S_IRUSR);
-        DEBUGFS_ADD_FILE(current_sleep_command, dir_data, S_IRUSR);
+        if (!priv->cfg->broken_powersave) {
+                DEBUGFS_ADD_FILE(sleep_level_override, dir_data,
+                                 S_IWUSR | S_IRUSR);
+                DEBUGFS_ADD_FILE(current_sleep_command, dir_data, S_IRUSR);
+        }
         DEBUGFS_ADD_FILE(thermal_throttling, dir_data, S_IRUSR);
         DEBUGFS_ADD_FILE(disable_ht40, dir_data, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(rx_statistics, dir_debug, S_IRUSR);
@@ -2343,29 +1589,33 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(traffic_log, dir_debug, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(rx_queue, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(tx_queue, dir_debug, S_IRUSR);
-        DEBUGFS_ADD_FILE(tx_power, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(power_save_status, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(clear_ucode_statistics, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(clear_traffic_statistics, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(csr, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(fh_reg, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(internal_scan, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(force_reset, dir_debug, S_IWUSR | S_IRUSR);
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
+
+        if (priv->cfg->sensitivity_calib_by_driver)
                 DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
+        if (priv->cfg->chain_noise_calib_by_driver)
                 DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
+        if (priv->cfg->ucode_tracing)
                 DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
-        }
-        DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf, &priv->disable_sens_cal);
-        DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
-                         &priv->disable_chain_noise_cal);
-        if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
-            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_3945))
+        DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
+        if (priv->cfg->sensitivity_calib_by_driver)
+                DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf,
+                                 &priv->disable_sens_cal);
+        if (priv->cfg->chain_noise_calib_by_driver)
+                DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
+                                 &priv->disable_chain_noise_cal);
+        if (priv->cfg->tx_power_by_driver)
                 DEBUGFS_ADD_BOOL(disable_tx_power, dir_rf,
                                 &priv->disable_tx_power_cal);
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..f3f3473c5c7e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -43,6 +43,7 @@
 #include "iwl-debug.h"
 #include "iwl-4965-hw.h"
 #include "iwl-3945-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-led.h"
 #include "iwl-power.h"
 #include "iwl-agn-rs.h"
@@ -56,6 +57,7 @@ extern struct iwl_cfg iwl5100_bgn_cfg;
 extern struct iwl_cfg iwl5100_abg_cfg;
 extern struct iwl_cfg iwl5150_agn_cfg;
 extern struct iwl_cfg iwl5150_abg_cfg;
+extern struct iwl_cfg iwl6000g2a_2agn_cfg;
 extern struct iwl_cfg iwl6000i_2agn_cfg;
 extern struct iwl_cfg iwl6000i_2abg_cfg;
 extern struct iwl_cfg iwl6000i_2bg_cfg;
@@ -67,45 +69,6 @@ extern struct iwl_cfg iwl1000_bg_cfg;
 
 struct iwl_tx_queue;
 
-/* shared structures from iwl-5000.c */
-extern struct iwl_mod_params iwl50_mod_params;
-extern struct iwl_ucode_ops iwl5000_ucode;
-extern struct iwl_lib_ops iwl5000_lib;
-extern struct iwl_hcmd_ops iwl5000_hcmd;
-extern struct iwl_hcmd_utils_ops iwl5000_hcmd_utils;
-
-/* shared functions from iwl-5000.c */
-extern u16 iwl5000_get_hcmd_size(u8 cmd_id, u16 len);
-extern u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd,
-                                     u8 *data);
-extern void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                                    __le32 *tx_flags);
-extern int iwl5000_calc_rssi(struct iwl_priv *priv,
-                             struct iwl_rx_phy_res *rx_resp);
-extern void iwl5000_nic_config(struct iwl_priv *priv);
-extern u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv);
-extern const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
-                                    size_t offset);
-extern void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
-                                            struct iwl_tx_queue *txq,
-                                            u16 byte_cnt);
-extern void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
-                                    struct iwl_tx_queue *txq);
-extern int iwl5000_load_ucode(struct iwl_priv *priv);
-extern void iwl5000_init_alive_start(struct iwl_priv *priv);
-extern int iwl5000_alive_notify(struct iwl_priv *priv);
-extern int iwl5000_hw_set_hw_params(struct iwl_priv *priv);
-extern int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
-                           int tx_fifo, int sta_id, int tid, u16 ssn_idx);
-extern int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
-                            u16 ssn_idx, u8 tx_fifo);
-extern void iwl5000_txq_set_sched(struct iwl_priv *priv, u32 mask);
-extern void iwl5000_setup_deferred_work(struct iwl_priv *priv);
-extern void iwl5000_rx_handler_setup(struct iwl_priv *priv);
-extern int iwl5000_hw_valid_rtc_data_addr(u32 addr);
-extern int iwl5000_send_tx_power(struct iwl_priv *priv);
-extern void iwl5000_temperature(struct iwl_priv *priv);
-
 /* CT-KILL constants */
 #define CT_KILL_THRESHOLD_LEGACY   110 /* in Celsius */
 #define CT_KILL_THRESHOLD          114 /* in Celsius */
@@ -183,6 +146,10 @@ struct iwl_queue {
         int n_bd;              /* number of BDs in this queue */
         int write_ptr;       /* 1-st empty entry (index) host_w*/
         int read_ptr;         /* last used entry (index) host_r*/
+        /* use for monitoring and recovering the stuck queue */
+        int last_read_ptr;      /* storing the last read_ptr */
+        /* number of time read_ptr and last_read_ptr are the same */
+        u8 repeat_same_read_ptr;
         dma_addr_t dma_addr;   /* physical addr for BD's */
         int n_window;          /* safe queue window */
         u32 id;
@@ -304,13 +271,11 @@ struct iwl_channel_info {
         struct iwl3945_scan_power_info scan_pwr_info[IWL_NUM_SCAN_RATES];
 };
 
-#define IWL_TX_FIFO_AC0 0
-#define IWL_TX_FIFO_AC1 1
-#define IWL_TX_FIFO_AC2 2
-#define IWL_TX_FIFO_AC3 3
-#define IWL_TX_FIFO_HCCA_1      5
-#define IWL_TX_FIFO_HCCA_2      6
-#define IWL_TX_FIFO_NONE        7
+#define IWL_TX_FIFO_BK          0
+#define IWL_TX_FIFO_BE          1
+#define IWL_TX_FIFO_VI          2
+#define IWL_TX_FIFO_VO          3
+#define IWL_TX_FIFO_UNUSED      -1
 
 /* Minimum number of queues. MAX_NUM is defined in hw specific files.
  * Set the minimum to accommodate the 4 standard TX queues, 1 command
@@ -361,13 +326,6 @@ enum {
 
 #define DEF_CMD_PAYLOAD_SIZE 320
 
-/*
- * IWL_LINK_HDR_MAX should include ieee80211_hdr, radiotap header,
- * SNAP header and alignment. It should also be big enough for 802.11
- * control frames.
- */
-#define IWL_LINK_HDR_MAX 64
-
 /**
  * struct iwl_device_cmd
  *
@@ -519,38 +477,28 @@ struct iwl_ht_config {
         u8 non_GF_STA_present;
 };
 
-union iwl_qos_capabity {
-        struct {
-                u8 edca_count:4;        /* bit 0-3 */
-                u8 q_ack:1;             /* bit 4 */
-                u8 queue_request:1;     /* bit 5 */
-                u8 txop_request:1;      /* bit 6 */
-                u8 reserved:1;          /* bit 7 */
-        } q_AP;
-        struct {
-                u8 acvo_APSD:1;         /* bit 0 */
-                u8 acvi_APSD:1;         /* bit 1 */
-                u8 ac_bk_APSD:1;        /* bit 2 */
-                u8 ac_be_APSD:1;        /* bit 3 */
-                u8 q_ack:1;             /* bit 4 */
-                u8 max_len:2;           /* bit 5-6 */
-                u8 more_data_ack:1;     /* bit 7 */
-        } q_STA;
-        u8 val;
-};
-
 /* QoS structures */
 struct iwl_qos_info {
         int qos_active;
-        union iwl_qos_capabity qos_cap;
         struct iwl_qosparam_cmd def_qos_parm;
 };
 
+/*
+ * Structure should be accessed with sta_lock held. When station addition
+ * is in progress (IWL_STA_UCODE_INPROGRESS) it is possible to access only
+ * the commands (iwl_addsta_cmd and iwl_link_quality_cmd) without sta_lock
+ * held.
+ */
 struct iwl_station_entry {
         struct iwl_addsta_cmd sta;
         struct iwl_tid_data tid[MAX_TID_COUNT];
         u8 used;
         struct iwl_hw_key keyinfo;
+        struct iwl_link_quality_cmd *lq;
+};
+
+struct iwl_station_priv_common {
+        u8 sta_id;
 };
 
 /*
@@ -559,14 +507,28 @@ struct iwl_station_entry {
  * When mac80211 creates a station it reserves some space (hw->sta_data_size)
  * in the structure for use by driver. This structure is places in that
  * space.
+ *
+ * The common struct MUST be first because it is shared between
+ * 3945 and agn!
  */
 struct iwl_station_priv {
+        struct iwl_station_priv_common common;
         struct iwl_lq_sta lq_sta;
         atomic_t pending_frames;
         bool client;
         bool asleep;
 };
 
+/**
+ * struct iwl_vif_priv - driver's private per-interface information
+ *
+ * When mac80211 allocates a virtual interface, it can allocate
+ * space for us to put data into.
+ */
+struct iwl_vif_priv {
+        u8 ibss_bssid_sta_id;
+};
+
 /* one for each uCode image (inst/data, boot/init/runtime) */
 struct fw_desc {
         void *v_addr;           /* access by driver */
@@ -574,7 +536,7 @@ struct fw_desc {
         u32 len;                /* bytes */
 };
 
-/* uCode file layout */
+/* v1/v2 uCode file layout */
 struct iwl_ucode_header {
         __le32 ver;     /* major/minor/API/serial */
         union {
@@ -597,7 +559,62 @@ struct iwl_ucode_header {
                 } v2;
         } u;
 };
-#define UCODE_HEADER_SIZE(ver) ((ver) == 1 ? 24 : 28)
+
+/*
+ * new TLV uCode file layout
+ *
+ * The new TLV file format contains TLVs, that each specify
+ * some piece of data. To facilitate "groups", for example
+ * different instruction image with different capabilities,
+ * bundled with the same init image, an alternative mechanism
+ * is provided:
+ * When the alternative field is 0, that means that the item
+ * is always valid. When it is non-zero, then it is only
+ * valid in conjunction with items of the same alternative,
+ * in which case the driver (user) selects one alternative
+ * to use.
+ */
+
+enum iwl_ucode_tlv_type {
+        IWL_UCODE_TLV_INVALID           = 0, /* unused */
+        IWL_UCODE_TLV_INST              = 1,
+        IWL_UCODE_TLV_DATA              = 2,
+        IWL_UCODE_TLV_INIT              = 3,
+        IWL_UCODE_TLV_INIT_DATA         = 4,
+        IWL_UCODE_TLV_BOOT              = 5,
+        IWL_UCODE_TLV_PROBE_MAX_LEN     = 6, /* a u32 value */
+};
+
+struct iwl_ucode_tlv {
+        __le16 type;            /* see above */
+        __le16 alternative;     /* see comment */
+        __le32 length;          /* not including type/length fields */
+        u8 data[0];
+} __attribute__ ((packed));
+
+#define IWL_TLV_UCODE_MAGIC     0x0a4c5749
+
+struct iwl_tlv_ucode_header {
+        /*
+         * The TLV style ucode header is distinguished from
+         * the v1/v2 style header by first four bytes being
+         * zero, as such is an invalid combination of
+         * major/minor/API/serial versions.
+         */
+        __le32 zero;
+        __le32 magic;
+        u8 human_readable[64];
+        __le32 ver;             /* major/minor/API/serial */
+        __le32 build;
+        __le64 alternatives;    /* bitmask of valid alternatives */
+        /*
+         * The data contained herein has a TLV layout,
+         * see above for the TLV header and types.
+         * Note that each TLV is padded to a length
+         * that is a multiple of 4 for alignment.
+         */
+        u8 data[0];
+};
 
 struct iwl4965_ibss_seq {
         u8 mac[ETH_ALEN];
@@ -1039,6 +1056,11 @@ struct iwl_event_log {
 #define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
 #define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
 
+/* timer constants use to monitor and recover stuck tx queues in mSecs */
+#define IWL_MONITORING_PERIOD  (1000)
+#define IWL_ONE_HUNDRED_MSECS   (100)
+#define IWL_SIXTY_SECS          (60000)
+
 enum iwl_reset {
         IWL_RF_RESET = 0,
         IWL_FW_RESET,
@@ -1092,10 +1114,6 @@ struct iwl_priv {
         struct iwl_channel_info *channel_info;  /* channel info array */
         u8 channel_count;       /* # of channels */
 
-        /* each calibration channel group in the EEPROM has a derived
-         * clip setting for each rate. 3945 only.*/
-        const struct iwl3945_clip_group clip39_groups[5];
-
         /* thermal calibration */
         s32 temperature;        /* degrees Kelvin */
         s32 last_temperature;
@@ -1104,12 +1122,10 @@ struct iwl_priv {
         struct iwl_calib_result calib_results[IWL_CALIB_MAX];
 
         /* Scan related variables */
-        unsigned long next_scan_jiffies;
         unsigned long scan_start;
-        unsigned long scan_pass_start;
         unsigned long scan_start_tsf;
-        void *scan;
-        int scan_bands;
+        void *scan_cmd;
+        enum ieee80211_band scan_band;
         struct cfg80211_scan_request *scan_request;
         bool is_internal_short_scan;
         u8 scan_tx_ant[IEEE80211_NUM_BANDS];
@@ -1168,16 +1184,13 @@ struct iwl_priv {
         u64 led_tpt;
 
         u16 active_rate;
-        u16 active_rate_basic;
 
-        u8 assoc_station_added;
         u8 start_calib;
         struct iwl_sensitivity_data sensitivity_data;
         struct iwl_chain_noise_data chain_noise_data;
         __le16 sensitivity_tbl[HD_TABLE_SIZE];
 
         struct iwl_ht_config current_ht_config;
-        u8 last_phy_res[100];
 
         /* Rate scaling data */
         u8 retry_rate;
@@ -1197,9 +1210,6 @@ struct iwl_priv {
 
         unsigned long status;
 
-        int last_rx_rssi;       /* From Rx packet statistics */
-        int last_rx_noise;      /* From beacon statistics */
-
         /* counts mgmt, ctl, and data packets */
         struct traffic_stats tx_stats;
         struct traffic_stats rx_stats;
@@ -1218,18 +1228,14 @@ struct iwl_priv {
 #endif
 
         /* context information */
-        u16 rates_mask;
-
-        u8 bssid[ETH_ALEN];
-        u16 rts_threshold;
+        u8 bssid[ETH_ALEN]; /* used only on 3945 but filled by core */
         u8 mac_addr[ETH_ALEN];
 
         /*station table variables */
         spinlock_t sta_lock;
         int num_stations;
         struct iwl_station_entry stations[IWL_STATION_COUNT];
-        struct iwl_wep_key wep_keys[WEP_KEYS_MAX];
-        u8 default_wep_key;
+        struct iwl_wep_key wep_keys[WEP_KEYS_MAX]; /* protected by mutex */
         u8 key_mapping_key;
         unsigned long ucode_key_table;
 
@@ -1244,10 +1250,6 @@ struct iwl_priv {
 
         u8 mac80211_registered;
 
-        /* Rx'd packet timing information */
-        u32 last_beacon_time;
-        u64 last_tsf;
-
         /* eeprom -- this is in the card's little endian byte order */
         u8 *eeprom;
         int    nvm_device_type;
@@ -1259,29 +1261,67 @@ struct iwl_priv {
 
         /* Last Rx'd beacon timestamp */
         u64 timestamp;
-        u16 beacon_int;
         struct ieee80211_vif *vif;
 
-        /*Added for 3945 */
-        void *shared_virt;
-        dma_addr_t shared_phys;
-        /*End*/
-        struct iwl_hw_params hw_params;
+        union {
+#if defined(CONFIG_IWL3945) || defined(CONFIG_IWL3945_MODULE)
+                struct {
+                        void *shared_virt;
+                        dma_addr_t shared_phys;
 
-        /* INT ICT Table */
-        __le32 *ict_tbl;
-        dma_addr_t ict_tbl_dma;
-        dma_addr_t aligned_ict_tbl_dma;
-        int ict_index;
-        void *ict_tbl_vir;
-        u32 inta;
-        bool use_ict;
+                        struct delayed_work thermal_periodic;
+                        struct delayed_work rfkill_poll;
+
+                        struct iwl3945_notif_statistics statistics;
+#ifdef CONFIG_IWLWIFI_DEBUG
+                        struct iwl3945_notif_statistics accum_statistics;
+                        struct iwl3945_notif_statistics delta_statistics;
+                        struct iwl3945_notif_statistics max_delta;
+#endif
+
+                        u32 sta_supp_rates;
+                        int last_rx_rssi;       /* From Rx packet statistics */
+
+                        /* Rx'd packet timing information */
+                        u32 last_beacon_time;
+                        u64 last_tsf;
+
+                        /*
+                         * each calibration channel group in the
+                         * EEPROM has a derived clip setting for
+                         * each rate.
+                         */
+                        const struct iwl3945_clip_group clip_groups[5];
+
+                } _3945;
+#endif
+#if defined(CONFIG_IWLAGN) || defined(CONFIG_IWLAGN_MODULE)
+                struct {
+                        /* INT ICT Table */
+                        __le32 *ict_tbl;
+                        void *ict_tbl_vir;
+                        dma_addr_t ict_tbl_dma;
+                        dma_addr_t aligned_ict_tbl_dma;
+                        int ict_index;
+                        u32 inta;
+                        bool use_ict;
+                        /*
+                         * reporting the number of tids has AGG on. 0 means
+                         * no AGGREGATION
+                         */
+                        u8 agg_tids_count;
+
+                        struct iwl_rx_phy_res last_phy_res;
+                        bool last_phy_res_valid;
+
+                        struct completion firmware_loading_complete;
+                } _agn;
+#endif
+        };
+
+        struct iwl_hw_params hw_params;
 
         u32 inta_mask;
-        /* Current association information needed to configure the
-         * hardware */
-        u16 assoc_id;
-        u16 assoc_capability;
 
         struct iwl_qos_info qos_data;
 
@@ -1291,11 +1331,11 @@ struct iwl_priv {
         struct work_struct scan_completed;
         struct work_struct rx_replenish;
         struct work_struct abort_scan;
-        struct work_struct request_scan;
         struct work_struct beacon_update;
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
@@ -1303,10 +1343,6 @@ struct iwl_priv {
         struct delayed_work alive_start;
         struct delayed_work scan_check;
 
-        /*For 3945 only*/
-        struct delayed_work thermal_periodic;
-        struct delayed_work rfkill_poll;
-
         /* TX Power */
         s8 tx_power_user_lmt;
         s8 tx_power_device_lmt;
@@ -1338,13 +1374,8 @@ struct iwl_priv {
         struct work_struct run_time_calib_work;
         struct timer_list statistics_periodic;
         struct timer_list ucode_trace;
+        struct timer_list monitor_recover;
         bool hw_ready;
-        /*For 3945*/
-#define IWL_DEFAULT_TX_POWER 0x0F
-
-        struct iwl3945_notif_statistics statistics_39;
-
-        u32 sta_supp_rates;
 
         struct iwl_event_log event_log;
 }; /*iwl_priv */
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 2ffc2edbf4f0..4a487639d932 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -37,6 +37,7 @@ EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite8);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ioread32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_rx);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_tx);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index fb5bb487f3bc..ee11452519e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -590,9 +590,16 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                         e[addr / 2] = cpu_to_le16(r >> 16);
                 }
         }
+
+        IWL_DEBUG_INFO(priv, "NVM Type: %s, version: 0x%x\n",
+                       (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                       ? "OTP" : "EEPROM",
+                       iwl_eeprom_query16(priv, EEPROM_VERSION));
+
         ret = 0;
 done:
         priv->cfg->ops->lib->eeprom_ops.release_semaphore(priv);
+
 err:
         if (ret)
                 iwl_eeprom_free(priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..95aa202c85e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -172,37 +172,41 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_TX_POWER_VERSION    (4)
 #define EEPROM_5000_EEPROM_VERSION      (0x11A)
 
-/*5000 calibrations */
-#define EEPROM_5000_CALIB_ALL   (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
-#define EEPROM_5000_XTAL        ((2*0x128) | EEPROM_5000_CALIB_ALL)
-#define EEPROM_5000_TEMPERATURE ((2*0x12A) | EEPROM_5000_CALIB_ALL)
-
-/* 5000 links */
-#define EEPROM_5000_LINK_HOST             (2*0x64)
-#define EEPROM_5000_LINK_GENERAL          (2*0x65)
-#define EEPROM_5000_LINK_REGULATORY       (2*0x66)
-#define EEPROM_5000_LINK_CALIBRATION      (2*0x67)
-#define EEPROM_5000_LINK_PROCESS_ADJST    (2*0x68)
-#define EEPROM_5000_LINK_OTHERS           (2*0x69)
-
-/* 5000 regulatory - indirect access */
-#define EEPROM_5000_REG_SKU_ID ((0x02)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 4  bytes */
-#define EEPROM_5000_REG_BAND_1_CHANNELS       ((0x08)\
+/* 5000 and up calibration */
+#define EEPROM_CALIB_ALL        (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
+#define EEPROM_XTAL             ((2*0x128) | EEPROM_CALIB_ALL)
+
+/* 5000 temperature */
+#define EEPROM_5000_TEMPERATURE ((2*0x12A) | EEPROM_CALIB_ALL)
+
+/* agn links */
+#define EEPROM_LINK_HOST             (2*0x64)
+#define EEPROM_LINK_GENERAL          (2*0x65)
+#define EEPROM_LINK_REGULATORY       (2*0x66)
+#define EEPROM_LINK_CALIBRATION      (2*0x67)
+#define EEPROM_LINK_PROCESS_ADJST    (2*0x68)
+#define EEPROM_LINK_OTHERS           (2*0x69)
+
+/* agn regulatory - indirect access */
+#define EEPROM_REG_BAND_1_CHANNELS       ((0x08)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 28 bytes */
-#define EEPROM_5000_REG_BAND_2_CHANNELS       ((0x26)\
+#define EEPROM_REG_BAND_2_CHANNELS       ((0x26)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 26 bytes */
-#define EEPROM_5000_REG_BAND_3_CHANNELS       ((0x42)\
+#define EEPROM_REG_BAND_3_CHANNELS       ((0x42)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
-#define EEPROM_5000_REG_BAND_4_CHANNELS       ((0x5C)\
+#define EEPROM_REG_BAND_4_CHANNELS       ((0x5C)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22 bytes */
-#define EEPROM_5000_REG_BAND_5_CHANNELS       ((0x74)\
+#define EEPROM_REG_BAND_5_CHANNELS       ((0x74)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 12 bytes */
-#define EEPROM_5000_REG_BAND_24_HT40_CHANNELS  ((0x82)\
+#define EEPROM_REG_BAND_24_HT40_CHANNELS  ((0x82)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
-#define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
+#define EEPROM_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
@@ -261,14 +265,21 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5050_EEPROM_VERSION      (0x21E)
 
 /* 1000 Specific */
+#define EEPROM_1000_TX_POWER_VERSION    (4)
 #define EEPROM_1000_EEPROM_VERSION      (0x15C)
 
 /* 6x00 Specific */
+#define EEPROM_6000_TX_POWER_VERSION    (4)
 #define EEPROM_6000_EEPROM_VERSION      (0x434)
 
 /* 6x50 Specific */
+#define EEPROM_6050_TX_POWER_VERSION    (4)
 #define EEPROM_6050_EEPROM_VERSION      (0x532)
 
+/* 6x00g2 Specific */
+#define EEPROM_6000G2_TX_POWER_VERSION    (6)
+#define EEPROM_6000G2_EEPROM_VERSION    (0x709)
+
 /* OTP */
 /* lower blocks contain EEPROM image and calibration data */
 #define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 73681c4fefe7..51f89e7ba681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -169,7 +169,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         mutex_lock(&priv->sync_cmd_mutex);
 
         set_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s \n",
+        IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s\n",
                         get_cmd_string(cmd->id));
 
         cmd_idx = iwl_enqueue_hcmd(priv, cmd);
@@ -191,7 +191,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                                 jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 
                         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-                        IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                        IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                                        get_cmd_string(cmd->id));
                         ret = -ETIMEDOUT;
                         goto cancel;
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 51a67fb2e185..3ff6b9d25a10 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -31,6 +31,9 @@
 #define __iwl_helpers_h__
 
 #include <linux/ctype.h>
+#include <net/mac80211.h>
+
+#include "iwl-io.h"
 
 #define IWL_MASK(lo, hi) ((1 << (hi)) | ((1 << (hi)) - (1 << (lo))))
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 16eb3ced9b30..0203a3bbf872 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -298,7 +298,7 @@ static inline u32 __iwl_read_direct32(const char *f, u32 l,
                                         struct iwl_priv *priv, u32 reg)
 {
         u32 value = _iwl_read_direct32(priv, reg);
-        IWL_DEBUG_IO(priv, "read_direct32(0x%4X) = 0x%08x - %s %d \n", reg, value,
+        IWL_DEBUG_IO(priv, "read_direct32(0x%4X) = 0x%08x - %s %d\n", reg, value,
                      f, l);
         return value;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index a6f9c918aabc..db5bfcb036ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -46,7 +46,7 @@
 static int led_mode;
 module_param(led_mode, int, S_IRUGO);
 MODULE_PARM_DESC(led_mode, "led mode: 0=blinking, 1=On(RF On)/Off(RF Off), "
-                           "(default 0)\n");
+                           "(default 0)");
 
 
 static const struct {
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 548dac2f6a96..cda6a94d6cc9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -318,10 +318,7 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
         update_chains = priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE ||
                         priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
 
-        if (priv->vif)
-                dtimper = priv->hw->conf.ps_dtim_period;
-        else
-                dtimper = 1;
+        dtimper = priv->hw->conf.ps_dtim_period ?: 1;
 
         if (priv->cfg->broken_powersave)
                 iwl_power_sleep_cam_cmd(priv, &cmd);
@@ -384,10 +381,10 @@ EXPORT_SYMBOL(iwl_ht_enabled);
 
 bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
 {
-        s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
         bool within_margin = false;
 
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+        if (priv->cfg->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -840,12 +837,12 @@ EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
 static void iwl_bg_tt_work(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, tt_work);
-        s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+        if (priv->cfg->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -875,7 +872,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         int size = sizeof(struct iwl_tt_trans) * (IWL_TI_STATE_MAX - 1);
         struct iwl_tt_trans *transaction;
 
-        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling \n");
+        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling\n");
 
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index d2d2a9174900..b1f101caf19d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -254,7 +254,7 @@
  * device.  A queue maps to only one (selectable by driver) Tx DMA channel,
  * but one DMA channel may take input from several queues.
  *
- * Tx DMA channels have dedicated purposes.  For 4965, they are used as follows
+ * Tx DMA FIFOs have dedicated purposes.  For 4965, they are used as follows
  * (cf. default_queue_to_tx_fifo in iwl-4965.c):
  *
  * 0 -- EDCA BK (background) frames, lowest priority
@@ -262,20 +262,20 @@
  * 2 -- EDCA VI (video) frames, higher priority
  * 3 -- EDCA VO (voice) and management frames, highest priority
  * 4 -- Commands (e.g. RXON, etc.)
- * 5 -- HCCA short frames
- * 6 -- HCCA long frames
+ * 5 -- unused (HCCA)
+ * 6 -- unused (HCCA)
  * 7 -- not used by driver (device-internal only)
  *
- * For 5000 series and up, they are used slightly differently
+ * For 5000 series and up, they are used differently
  * (cf. iwl5000_default_queue_to_tx_fifo in iwl-5000.c):
  *
  * 0 -- EDCA BK (background) frames, lowest priority
  * 1 -- EDCA BE (best effort) frames, normal priority
  * 2 -- EDCA VI (video) frames, higher priority
  * 3 -- EDCA VO (voice) and management frames, highest priority
- * 4 -- (TBD)
- * 5 -- HCCA short frames
- * 6 -- HCCA long frames
+ * 4 -- unused
+ * 5 -- unused
+ * 6 -- unused
  * 7 -- Commands
  *
  * Driver should normally map queues 0-6 to Tx DMA/FIFO channels 0-6.
@@ -529,48 +529,48 @@
 #define IWL_SCD_TXFIFO_POS_RA                   (4)
 #define IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK      (0x01FF)
 
-/* 5000 SCD */
-#define IWL50_SCD_QUEUE_STTS_REG_POS_TXF        (0)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE     (3)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_WSL        (4)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN (19)
-#define IWL50_SCD_QUEUE_STTS_REG_MSK            (0x00FF0000)
-
-#define IWL50_SCD_QUEUE_CTX_REG1_CREDIT_POS             (8)
-#define IWL50_SCD_QUEUE_CTX_REG1_CREDIT_MSK             (0x00FFFF00)
-#define IWL50_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_POS       (24)
-#define IWL50_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_MSK       (0xFF000000)
-#define IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS           (0)
-#define IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK           (0x0000007F)
-#define IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS        (16)
-#define IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK        (0x007F0000)
-
-#define IWL50_SCD_CONTEXT_DATA_OFFSET           (0x600)
-#define IWL50_SCD_TX_STTS_BITMAP_OFFSET         (0x7B1)
-#define IWL50_SCD_TRANSLATE_TBL_OFFSET          (0x7E0)
-
-#define IWL50_SCD_CONTEXT_QUEUE_OFFSET(x)\
-        (IWL50_SCD_CONTEXT_DATA_OFFSET + ((x) * 8))
-
-#define IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
-        ((IWL50_SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffc)
-
-#define IWL50_SCD_QUEUECHAIN_SEL_ALL(x)         (((1<<(x)) - 1) &\
+/* agn SCD */
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_TXF       (0)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE    (3)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_WSL       (4)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN (19)
+#define IWLAGN_SCD_QUEUE_STTS_REG_MSK           (0x00FF0000)
+
+#define IWLAGN_SCD_QUEUE_CTX_REG1_CREDIT_POS            (8)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_CREDIT_MSK            (0x00FFFF00)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_POS      (24)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_MSK      (0xFF000000)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS          (0)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK          (0x0000007F)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS       (16)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK       (0x007F0000)
+
+#define IWLAGN_SCD_CONTEXT_DATA_OFFSET          (0x600)
+#define IWLAGN_SCD_TX_STTS_BITMAP_OFFSET                (0x7B1)
+#define IWLAGN_SCD_TRANSLATE_TBL_OFFSET         (0x7E0)
+
+#define IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(x)\
+        (IWLAGN_SCD_CONTEXT_DATA_OFFSET + ((x) * 8))
+
+#define IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
+        ((IWLAGN_SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffc)
+
+#define IWLAGN_SCD_QUEUECHAIN_SEL_ALL(x)                (((1<<(x)) - 1) &\
         (~(1<<IWL_CMD_QUEUE_NUM)))
 
-#define IWL50_SCD_BASE                  (PRPH_BASE + 0xa02c00)
-
-#define IWL50_SCD_SRAM_BASE_ADDR         (IWL50_SCD_BASE + 0x0)
-#define IWL50_SCD_DRAM_BASE_ADDR         (IWL50_SCD_BASE + 0x8)
-#define IWL50_SCD_AIT                    (IWL50_SCD_BASE + 0x0c)
-#define IWL50_SCD_TXFACT                 (IWL50_SCD_BASE + 0x10)
-#define IWL50_SCD_ACTIVE                 (IWL50_SCD_BASE + 0x14)
-#define IWL50_SCD_QUEUE_WRPTR(x)         (IWL50_SCD_BASE + 0x18 + (x) * 4)
-#define IWL50_SCD_QUEUE_RDPTR(x)         (IWL50_SCD_BASE + 0x68 + (x) * 4)
-#define IWL50_SCD_QUEUECHAIN_SEL         (IWL50_SCD_BASE + 0xe8)
-#define IWL50_SCD_AGGR_SEL               (IWL50_SCD_BASE + 0x248)
-#define IWL50_SCD_INTERRUPT_MASK         (IWL50_SCD_BASE + 0x108)
-#define IWL50_SCD_QUEUE_STATUS_BITS(x)   (IWL50_SCD_BASE + 0x10c + (x) * 4)
+#define IWLAGN_SCD_BASE                 (PRPH_BASE + 0xa02c00)
+
+#define IWLAGN_SCD_SRAM_BASE_ADDR       (IWLAGN_SCD_BASE + 0x0)
+#define IWLAGN_SCD_DRAM_BASE_ADDR       (IWLAGN_SCD_BASE + 0x8)
+#define IWLAGN_SCD_AIT                  (IWLAGN_SCD_BASE + 0x0c)
+#define IWLAGN_SCD_TXFACT               (IWLAGN_SCD_BASE + 0x10)
+#define IWLAGN_SCD_ACTIVE               (IWLAGN_SCD_BASE + 0x14)
+#define IWLAGN_SCD_QUEUE_WRPTR(x)       (IWLAGN_SCD_BASE + 0x18 + (x) * 4)
+#define IWLAGN_SCD_QUEUE_RDPTR(x)       (IWLAGN_SCD_BASE + 0x68 + (x) * 4)
+#define IWLAGN_SCD_QUEUECHAIN_SEL       (IWLAGN_SCD_BASE + 0xe8)
+#define IWLAGN_SCD_AGGR_SEL             (IWLAGN_SCD_BASE + 0x248)
+#define IWLAGN_SCD_INTERRUPT_MASK       (IWLAGN_SCD_BASE + 0x108)
+#define IWLAGN_SCD_QUEUE_STATUS_BITS(x) (IWLAGN_SCD_BASE + 0x10c + (x) * 4)
 
 /*********************** END TX SCHEDULER *************************************/
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index e5eb339107dd..0a5d7cf25196 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -163,197 +163,6 @@ void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q
         spin_unlock_irqrestore(&q->lock, flags);
 }
 EXPORT_SYMBOL(iwl_rx_queue_update_write_ptr);
-/**
- * iwl_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
- */
-static inline __le32 iwl_dma_addr2rbd_ptr(struct iwl_priv *priv,
-                                          dma_addr_t dma_addr)
-{
-        return cpu_to_le32((u32)(dma_addr >> 8));
-}
-
-/**
- * iwl_rx_queue_restock - refill RX queue from pre-allocated pool
- *
- * If there are slots in the RX queue that need to be restocked,
- * and we have free pre-allocated buffers, fill the ranks as much
- * as we can, pulling from rx_free.
- *
- * This moves the 'write' index forward to catch up with 'processed', and
- * also updates the memory address in the firmware to reference the new
- * target buffer.
- */
-void iwl_rx_queue_restock(struct iwl_priv *priv)
-{
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        struct list_head *element;
-        struct iwl_rx_mem_buffer *rxb;
-        unsigned long flags;
-        int write;
-
-        spin_lock_irqsave(&rxq->lock, flags);
-        write = rxq->write & ~0x7;
-        while ((iwl_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
-                /* Get next free Rx buffer, remove from free list */
-                element = rxq->rx_free.next;
-                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-                list_del(element);
-
-                /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->page_dma);
-                rxq->queue[rxq->write] = rxb;
-                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
-                rxq->free_count--;
-        }
-        spin_unlock_irqrestore(&rxq->lock, flags);
-        /* If the pre-allocated buffer pool is dropping low, schedule to
-         * refill it */
-        if (rxq->free_count <= RX_LOW_WATERMARK)
-                queue_work(priv->workqueue, &priv->rx_replenish);
-
-
-        /* If we've added more space for the firmware to place data, tell it.
-         * Increment device's write pointer in multiples of 8. */
-        if (rxq->write_actual != (rxq->write & ~0x7)) {
-                spin_lock_irqsave(&rxq->lock, flags);
-                rxq->need_update = 1;
-                spin_unlock_irqrestore(&rxq->lock, flags);
-                iwl_rx_queue_update_write_ptr(priv, rxq);
-        }
-}
-EXPORT_SYMBOL(iwl_rx_queue_restock);
-
-
-/**
- * iwl_rx_replenish - Move all used packet from rx_used to rx_free
- *
- * When moving to rx_free an SKB is allocated for the slot.
- *
- * Also restock the Rx queue via iwl_rx_queue_restock.
- * This is called as a scheduled work item (except for during initialization)
- */
-void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
-{
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        struct list_head *element;
-        struct iwl_rx_mem_buffer *rxb;
-        struct page *page;
-        unsigned long flags;
-        gfp_t gfp_mask = priority;
-
-        while (1) {
-                spin_lock_irqsave(&rxq->lock, flags);
-                if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        return;
-                }
-                spin_unlock_irqrestore(&rxq->lock, flags);
-
-                if (rxq->free_count > RX_LOW_WATERMARK)
-                        gfp_mask |= __GFP_NOWARN;
-
-                if (priv->hw_params.rx_page_order > 0)
-                        gfp_mask |= __GFP_COMP;
-
-                /* Alloc a new receive buffer */
-                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
-                if (!page) {
-                        if (net_ratelimit())
-                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
-                                               "order: %d\n",
-                                               priv->hw_params.rx_page_order);
-
-                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
-                            net_ratelimit())
-                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
-                                         priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
-                                         rxq->free_count);
-                        /* We don't reschedule replenish work here -- we will
-                         * call the restock method and if it still needs
-                         * more buffers it will schedule replenish */
-                        return;
-                }
-
-                spin_lock_irqsave(&rxq->lock, flags);
-
-                if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        __free_pages(page, priv->hw_params.rx_page_order);
-                        return;
-                }
-                element = rxq->rx_used.next;
-                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-                list_del(element);
-
-                spin_unlock_irqrestore(&rxq->lock, flags);
-
-                rxb->page = page;
-                /* Get physical address of the RB */
-                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                /* dma address must be no more than 36 bits */
-                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
-                /* and also 256 byte aligned! */
-                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
-
-                spin_lock_irqsave(&rxq->lock, flags);
-
-                list_add_tail(&rxb->list, &rxq->rx_free);
-                rxq->free_count++;
-                priv->alloc_rxb_page++;
-
-                spin_unlock_irqrestore(&rxq->lock, flags);
-        }
-}
-
-void iwl_rx_replenish(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        iwl_rx_allocate(priv, GFP_KERNEL);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_rx_queue_restock(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_rx_replenish);
-
-void iwl_rx_replenish_now(struct iwl_priv *priv)
-{
-        iwl_rx_allocate(priv, GFP_ATOMIC);
-
-        iwl_rx_queue_restock(priv);
-}
-EXPORT_SYMBOL(iwl_rx_replenish_now);
-
-
-/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
- * If an SKB has been detached, the POOL needs to have its SKB set to NULL
- * This free routine walks the list of POOL entries and if SKB is set to
- * non NULL it is unmapped and freed
- */
-void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        int i;
-        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                        __iwl_free_pages(priv, rxq->pool[i].page);
-                        rxq->pool[i].page = NULL;
-                }
-        }
-
-        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                          rxq->dma_addr);
-        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
-                          rxq->rb_stts, rxq->rb_stts_dma);
-        rxq->bd = NULL;
-        rxq->rb_stts  = NULL;
-}
-EXPORT_SYMBOL(iwl_rx_queue_free);
 
 int iwl_rx_queue_alloc(struct iwl_priv *priv)
 {
@@ -396,98 +205,6 @@ err_bd:
 }
 EXPORT_SYMBOL(iwl_rx_queue_alloc);
 
-void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        unsigned long flags;
-        int i;
-        spin_lock_irqsave(&rxq->lock, flags);
-        INIT_LIST_HEAD(&rxq->rx_free);
-        INIT_LIST_HEAD(&rxq->rx_used);
-        /* Fill the rx_used queue with _all_ of the Rx buffers */
-        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
-                /* In the reset function, these buffers may have been allocated
-                 * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                        __iwl_free_pages(priv, rxq->pool[i].page);
-                        rxq->pool[i].page = NULL;
-                }
-                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
-        }
-
-        /* Set us so that we have processed and used all buffers, but have
-         * not restocked the Rx queue with fresh buffers */
-        rxq->read = rxq->write = 0;
-        rxq->write_actual = 0;
-        rxq->free_count = 0;
-        spin_unlock_irqrestore(&rxq->lock, flags);
-}
-
-int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        u32 rb_size;
-        const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
-        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
-
-        if (!priv->cfg->use_isr_legacy)
-                rb_timeout = RX_RB_TIMEOUT;
-
-        if (priv->cfg->mod_params->amsdu_size_8K)
-                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
-        else
-                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
-
-        /* Stop Rx DMA */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
-
-        /* Reset driver's Rx queue write index */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
-
-        /* Tell device where to find RBD circular buffer in DRAM */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
-                           (u32)(rxq->dma_addr >> 8));
-
-        /* Tell device where in DRAM to update its Rx status */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_STTS_WPTR_REG,
-                           rxq->rb_stts_dma >> 4);
-
-        /* Enable Rx DMA
-         * FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY is set because of HW bug in
-         *      the credit mechanism in 5000 HW RX FIFO
-         * Direct rx interrupts to hosts
-         * Rx buffer size 4 or 8k
-         * RB timeout 0x10
-         * 256 RBDs
-         */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG,
-                           FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
-                           FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY |
-                           FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
-                           FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
-                           rb_size|
-                           (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
-                           (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
-
-        /* Set interrupt coalescing timer to default (2048 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
-
-        return 0;
-}
-
-int iwl_rxq_stop(struct iwl_priv *priv)
-{
-
-        /* stop Rx DMA */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
-        iwl_poll_direct_bit(priv, FH_MEM_RSSR_RX_STATUS_REG,
-                            FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_rxq_stop);
-
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 
@@ -543,6 +260,7 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
                 le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
         int bcn_silence_c =
                 le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
+        int last_rx_noise;
 
         if (bcn_silence_a) {
                 total_silence += bcn_silence_a;
@@ -559,13 +277,13 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
 
         /* Average among active antennas */
         if (num_active_rx)
-                priv->last_rx_noise = (total_silence / num_active_rx) - 107;
+                last_rx_noise = (total_silence / num_active_rx) - 107;
         else
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
+                last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
 
         IWL_DEBUG_CALIB(priv, "inband silence a %u, b %u, c %u, dBm %d\n",
                         bcn_silence_a, bcn_silence_b, bcn_silence_c,
-                        priv->last_rx_noise);
+                        last_rx_noise);
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -617,29 +335,20 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
 
 #define REG_RECALIB_PERIOD (60)
 
-#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
-void iwl_rx_statistics(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb)
+/**
+ * iwl_good_plcp_health - checks for plcp error.
+ *
+ * When the plcp error is exceeding the thresholds, reset the radio
+ * to improve the throughput.
+ */
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
 {
-        int change;
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        bool rc = true;
         int combined_plcp_delta;
         unsigned int plcp_msec;
         unsigned long plcp_received_jiffies;
 
-        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
-                     (int)sizeof(priv->statistics),
-                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
-
-        change = ((priv->statistics.general.temperature !=
-                   pkt->u.stats.general.temperature) ||
-                  ((priv->statistics.flag &
-                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
-                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
-#endif
         /*
          * check for plcp_err and trigger radio reset if it exceeds
          * the plcp error threshold plcp_delta.
@@ -660,11 +369,11 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                         le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
 
                 if ((combined_plcp_delta > 0) &&
-                        ((combined_plcp_delta * 100) / plcp_msec) >
+                    ((combined_plcp_delta * 100) / plcp_msec) >
                         priv->cfg->plcp_delta_threshold) {
                         /*
-                         * if plcp_err exceed the threshold, the following
-                         * data is printed in csv format:
+                         * if plcp_err exceed the threshold,
+                         * the following data is printed in csv format:
                          *    Text: plcp_err exceeded %d,
                          *    Received ofdm.plcp_err,
                          *    Current ofdm.plcp_err,
@@ -673,22 +382,76 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                          *    combined_plcp_delta,
                          *    plcp_msec
                          */
-                        IWL_DEBUG_RADIO(priv, PLCP_MSG,
+                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
+                                "%u, %u, %u, %u, %d, %u mSecs\n",
                                 priv->cfg->plcp_delta_threshold,
                                 le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
                                 le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
                                 le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
                                 le32_to_cpu(
-                                        priv->statistics.rx.ofdm_ht.plcp_err),
+                                  priv->statistics.rx.ofdm_ht.plcp_err),
                                 combined_plcp_delta, plcp_msec);
+                        rc = false;
+                }
+        }
+        return rc;
+}
+EXPORT_SYMBOL(iwl_good_plcp_health);
 
-                        /*
-                         * Reset the RF radio due to the high plcp
-                         * error rate
-                         */
-                        iwl_force_reset(priv, IWL_RF_RESET);
+void iwl_recover_from_statistics(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+        if (iwl_is_associated(priv)) {
+                if (priv->cfg->ops->lib->check_ack_health) {
+                        if (!priv->cfg->ops->lib->check_ack_health(
+                            priv, pkt)) {
+                                /*
+                                 * low ack count detected
+                                 * restart Firmware
+                                 */
+                                IWL_ERR(priv, "low ack count detected, "
+                                        "restart firmware\n");
+                                if (!iwl_force_reset(priv, IWL_FW_RESET))
+                                        return;
+                        }
+                }
+                if (priv->cfg->ops->lib->check_plcp_health) {
+                        if (!priv->cfg->ops->lib->check_plcp_health(
+                            priv, pkt)) {
+                                /*
+                                 * high plcp error detected
+                                 * reset Radio
+                                 */
+                                iwl_force_reset(priv, IWL_RF_RESET);
+                        }
                 }
         }
+}
+EXPORT_SYMBOL(iwl_recover_from_statistics);
+
+void iwl_rx_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        int change;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
+
+        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
+                     (int)sizeof(priv->statistics),
+                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+
+        change = ((priv->statistics.general.temperature !=
+                   pkt->u.stats.general.temperature) ||
+                  ((priv->statistics.flag &
+                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
+        iwl_recover_from_statistics(priv, pkt);
 
         memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
 
@@ -731,139 +494,6 @@ void iwl_reply_statistics(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_reply_statistics);
 
-/* Calc max signal level (dBm) among 3 possible receivers */
-static inline int iwl_calc_rssi(struct iwl_priv *priv,
-                                struct iwl_rx_phy_res *rx_resp)
-{
-        return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
-}
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-/**
- * iwl_dbg_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good data frames.
- *    All beacon and probe response frames are printed.
- */
-static void iwl_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_phy_res *phy_res, u16 length,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        __le16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        u32 rate_n_flags;
-        u32 tsf_low;
-        int rssi;
-
-        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
-                return;
-
-        /* MAC header */
-        fc = header->frame_control;
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(phy_res->channel);
-        phy_flags = le16_to_cpu(phy_res->phy_flags);
-        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-        /* signal statistics */
-        rssi = iwl_calc_rssi(priv, phy_res);
-        tsf_low = le64_to_cpu(phy_res->timestamp) & 0x0ffffffff;
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
-            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                int rate_idx;
-                u32 bitrate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (ieee80211_has_retry(fc))
-                        title = "Retry";
-                else if (ieee80211_is_assoc_resp(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_resp(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_resp(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
-                if (unlikely((rate_idx < 0) || (rate_idx >= IWL_RATE_COUNT))) {
-                        bitrate = 0;
-                        WARN_ON_ONCE(1);
-                } else {
-                        bitrate = iwl_rates[rate_idx].ieee / 2;
-                }
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     length, rssi, channel, bitrate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, src=0x%02x, "
-                                     "len=%u, rssi=%d, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     header->addr3[5], length, rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
-}
-#endif
-
 /*
  * returns non-zero if packet should be dropped
  */
@@ -911,305 +541,3 @@ int iwl_set_decrypted_flag(struct iwl_priv *priv,
         return 0;
 }
 EXPORT_SYMBOL(iwl_set_decrypted_flag);
-
-static u32 iwl_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
-{
-        u32 decrypt_out = 0;
-
-        if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
-                                        RX_RES_STATUS_STATION_FOUND)
-                decrypt_out |= (RX_RES_STATUS_STATION_FOUND |
-                                RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
-
-        decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
-
-        /* packet was not encrypted */
-        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                        RX_RES_STATUS_SEC_TYPE_NONE)
-                return decrypt_out;
-
-        /* packet was encrypted with unknown alg */
-        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                        RX_RES_STATUS_SEC_TYPE_ERR)
-                return decrypt_out;
-
-        /* decryption was not done in HW */
-        if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
-                                        RX_MPDU_RES_STATUS_DEC_DONE_MSK)
-                return decrypt_out;
-
-        switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
-
-        case RX_RES_STATUS_SEC_TYPE_CCMP:
-                /* alg is CCM: check MIC only */
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
-                        /* Bad MIC */
-                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-                else
-                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-
-                break;
-
-        case RX_RES_STATUS_SEC_TYPE_TKIP:
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
-                        /* Bad TTAK */
-                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
-                        break;
-                }
-                /* fall through if TTAK OK */
-        default:
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
-                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-                else
-                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-                break;
-        };
-
-        IWL_DEBUG_RX(priv, "decrypt_in:0x%x  decrypt_out = 0x%x\n",
-                                        decrypt_in, decrypt_out);
-
-        return decrypt_out;
-}
-
-static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
-                                        struct ieee80211_hdr *hdr,
-                                        u16 len,
-                                        u32 ampdu_status,
-                                        struct iwl_rx_mem_buffer *rxb,
-                                        struct ieee80211_rx_status *stats)
-{
-        struct sk_buff *skb;
-        int ret = 0;
-        __le16 fc = hdr->frame_control;
-
-        /* We only process data packets if the interface is open */
-        if (unlikely(!priv->is_open)) {
-                IWL_DEBUG_DROP_LIMIT(priv,
-                    "Dropping packet while interface is not open.\n");
-                return;
-        }
-
-        /* In case of HW accelerated crypto and bad decryption, drop */
-        if (!priv->cfg->mod_params->sw_crypto &&
-            iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
-                return;
-
-        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
-        if (!skb) {
-                IWL_ERR(priv, "alloc_skb failed\n");
-                return;
-        }
-
-        skb_reserve(skb, IWL_LINK_HDR_MAX);
-        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
-
-        /* mac80211 currently doesn't support paged SKB. Convert it to
-         * linear SKB for management frame and data frame requires
-         * software decryption or software defragementation. */
-        if (ieee80211_is_mgmt(fc) ||
-            ieee80211_has_protected(fc) ||
-            ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
-            (ieee80211_is_data_qos(fc) &&
-             *ieee80211_get_qos_ctl(hdr) &
-             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
-                ret = skb_linearize(skb);
-        else
-                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
-                         0 : -ENOMEM;
-
-        if (ret) {
-                kfree_skb(skb);
-                goto out;
-        }
-
-        /*
-         * XXX: We cannot touch the page and its virtual memory (hdr) after
-         * here. It might have already been freed by the above skb change.
-         */
-
-        iwl_update_stats(priv, false, fc, len);
-        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
-
-        ieee80211_rx(priv->hw, skb);
- out:
-        priv->alloc_rxb_page--;
-        rxb->page = NULL;
-}
-
-/* This is necessary only for a number of statistics, see the caller. */
-static int iwl_is_network_packet(struct iwl_priv *priv,
-                struct ieee80211_hdr *header)
-{
-        /* Filter incoming packets to determine if they are targeted toward
-         * this network, discarding packets coming from ourselves */
-        switch (priv->iw_mode) {
-        case NL80211_IFTYPE_ADHOC: /* Header: Dest. | Source    | BSSID */
-                /* packets to our IBSS update information */
-                return !compare_ether_addr(header->addr3, priv->bssid);
-        case NL80211_IFTYPE_STATION: /* Header: Dest. | AP{BSSID} | Source */
-                /* packets to our IBSS update information */
-                return !compare_ether_addr(header->addr2, priv->bssid);
-        default:
-                return 1;
-        }
-}
-
-/* Called for REPLY_RX (legacy ABG frames), or
- * REPLY_RX_MPDU_CMD (HT high-throughput N frames). */
-void iwl_rx_reply_rx(struct iwl_priv *priv,
-                                struct iwl_rx_mem_buffer *rxb)
-{
-        struct ieee80211_hdr *header;
-        struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_rx_phy_res *phy_res;
-        __le32 rx_pkt_status;
-        struct iwl4965_rx_mpdu_res_start *amsdu;
-        u32 len;
-        u32 ampdu_status;
-        u32 rate_n_flags;
-
-        /**
-         * REPLY_RX and REPLY_RX_MPDU_CMD are handled differently.
-         *      REPLY_RX: physical layer info is in this buffer
-         *      REPLY_RX_MPDU_CMD: physical layer info was sent in separate
-         *              command and cached in priv->last_phy_res
-         *
-         * Here we set up local variables depending on which command is
-         * received.
-         */
-        if (pkt->hdr.cmd == REPLY_RX) {
-                phy_res = (struct iwl_rx_phy_res *)pkt->u.raw;
-                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res)
-                                + phy_res->cfg_phy_cnt);
-
-                len = le16_to_cpu(phy_res->byte_count);
-                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*phy_res) +
-                                phy_res->cfg_phy_cnt + len);
-                ampdu_status = le32_to_cpu(rx_pkt_status);
-        } else {
-                if (!priv->last_phy_res[0]) {
-                        IWL_ERR(priv, "MPDU frame without cached PHY data\n");
-                        return;
-                }
-                phy_res = (struct iwl_rx_phy_res *)&priv->last_phy_res[1];
-                amsdu = (struct iwl4965_rx_mpdu_res_start *)pkt->u.raw;
-                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
-                len = le16_to_cpu(amsdu->byte_count);
-                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
-                ampdu_status = iwl_translate_rx_status(priv,
-                                le32_to_cpu(rx_pkt_status));
-        }
-
-        if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
-                IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d/n",
-                                phy_res->cfg_phy_cnt);
-                return;
-        }
-
-        if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
-            !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
-                IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
-                                le32_to_cpu(rx_pkt_status));
-                return;
-        }
-
-        /* This will be used in several places later */
-        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-        /* rx_status carries information about the packet to mac80211 */
-        rx_status.mactime = le64_to_cpu(phy_res->timestamp);
-        rx_status.freq =
-                ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel));
-        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
-        rx_status.rate_idx =
-                iwl_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
-        rx_status.flag = 0;
-
-        /* TSF isn't reliable. In order to allow smooth user experience,
-         * this W/A doesn't propagate it to the mac80211 */
-        /*rx_status.flag |= RX_FLAG_TSFT;*/
-
-        priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
-
-        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
-        rx_status.signal = iwl_calc_rssi(priv, phy_res);
-
-        /* Meaningful noise values are available only from beacon statistics,
-         *   which are gathered only when associated, and indicate noise
-         *   only for the associated network channel ...
-         * Ignore these noise values while scanning (other channels) */
-        if (iwl_is_associated(priv) &&
-            !test_bit(STATUS_SCANNING, &priv->status)) {
-                rx_status.noise = priv->last_rx_noise;
-        } else {
-                rx_status.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-        }
-
-        /* Reset beacon noise level if not associated. */
-        if (!iwl_is_associated(priv))
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        /* Set "1" to report good data frames in groups of 100 */
-        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
-                iwl_dbg_report_frame(priv, phy_res, len, header, 1);
-#endif
-        iwl_dbg_log_rx_data_frame(priv, len, header);
-        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, TSF %llu\n",
-                rx_status.signal, rx_status.noise,
-                (unsigned long long)rx_status.mactime);
-
-        /*
-         * "antenna number"
-         *
-         * It seems that the antenna field in the phy flags value
-         * is actually a bit field. This is undefined by radiotap,
-         * it wants an actual antenna number but I always get "7"
-         * for most legacy frames I receive indicating that the
-         * same frame was received on all three RX chains.
-         *
-         * I think this field should be removed in favor of a
-         * new 802.11n radiotap field "RX chains" that is defined
-         * as a bitmask.
-         */
-        rx_status.antenna =
-                (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
-                >> RX_RES_PHY_FLAGS_ANTENNA_POS;
-
-        /* set the preamble flag if appropriate */
-        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
-                rx_status.flag |= RX_FLAG_SHORTPRE;
-
-        /* Set up the HT phy flags */
-        if (rate_n_flags & RATE_MCS_HT_MSK)
-                rx_status.flag |= RX_FLAG_HT;
-        if (rate_n_flags & RATE_MCS_HT40_MSK)
-                rx_status.flag |= RX_FLAG_40MHZ;
-        if (rate_n_flags & RATE_MCS_SGI_MSK)
-                rx_status.flag |= RX_FLAG_SHORT_GI;
-
-        if (iwl_is_network_packet(priv, header)) {
-                priv->last_rx_rssi = rx_status.signal;
-                priv->last_beacon_time =  priv->ucode_beacon_time;
-                priv->last_tsf = le64_to_cpu(phy_res->timestamp);
-        }
-
-        iwl_pass_packet_to_mac80211(priv, header, len, ampdu_status,
-                                    rxb, &rx_status);
-}
-EXPORT_SYMBOL(iwl_rx_reply_rx);
-
-/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).
- * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
-void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
-                                    struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        priv->last_phy_res[0] = 1;
-        memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
-               sizeof(struct iwl_rx_phy_res));
-}
-EXPORT_SYMBOL(iwl_rx_reply_rx_phy);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..107e173112f6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -69,9 +69,8 @@ int iwl_scan_cancel(struct iwl_priv *priv)
         }
 
         if (test_bit(STATUS_SCANNING, &priv->status)) {
-                if (!test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                if (!test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                         IWL_DEBUG_SCAN(priv, "Queuing scan abort.\n");
-                        set_bit(STATUS_SCAN_ABORTING, &priv->status);
                         queue_work(priv->workqueue, &priv->abort_scan);
 
                 } else
@@ -201,9 +200,6 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
                        le32_to_cpu(notif->statistics[0]),
                        le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf);
 #endif
-
-        if (!priv->is_internal_short_scan)
-                priv->next_scan_jiffies = 0;
 }
 
 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
@@ -223,49 +219,24 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
-                                                "2.4" : "5.2",
+        IWL_DEBUG_INFO(priv, "Scan on %sGHz took %dms\n",
+                       (priv->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
-                                        (priv->scan_pass_start, jiffies)));
+                                        (priv->scan_start, jiffies)));
 
-        /* Remove this scanned band from the list of pending
-         * bands to scan, band G precedes A in order of scanning
-         * as seen in iwl_bg_request_scan */
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
-        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
-
-        /* If a request to abort was given, or the scan did not succeed
+        /*
+         * If a request to abort was given, or the scan did not succeed
          * then we reset the scan state machine and terminate,
-         * re-queuing another scan if one has been requested */
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+         * re-queuing another scan if one has been requested
+         */
+        if (test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status))
                 IWL_DEBUG_INFO(priv, "Aborted scan completed.\n");
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-        } else {
-                /* If there are more bands on this scan pass reschedule */
-                if (priv->scan_bands)
-                        goto reschedule;
-        }
-
-        if (!priv->is_internal_short_scan)
-                priv->next_scan_jiffies = 0;
 
         IWL_DEBUG_INFO(priv, "Setting scan to off\n");
 
         clear_bit(STATUS_SCANNING, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan took %dms\n",
-                jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
-
         queue_work(priv->workqueue, &priv->scan_completed);
-
-        return;
-
-reschedule:
-        priv->scan_pass_start = jiffies;
-        queue_work(priv->workqueue, &priv->request_scan);
 }
 
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
@@ -294,7 +265,8 @@ inline u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
 EXPORT_SYMBOL(iwl_get_active_dwell_time);
 
 u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
-                               enum ieee80211_band band)
+                               enum ieee80211_band band,
+                               struct ieee80211_vif *vif)
 {
         u16 passive = (band == IEEE80211_BAND_2GHZ) ?
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
@@ -304,7 +276,7 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
                 /* If we're associated, we clamp the maximum passive
                  * dwell time to be 98% of the beacon interval (minus
                  * 2 * channel tune time) */
-                passive = priv->beacon_int;
+                passive = vif ? vif->bss_conf.beacon_int : 0;
                 if ((passive > IWL_PASSIVE_DWELL_BASE) || !passive)
                         passive = IWL_PASSIVE_DWELL_BASE;
                 passive = (passive * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
@@ -314,150 +286,6 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_get_passive_dwell_time);
 
-static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     struct iwl_scan_channel *scan_ch)
-{
-        const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
-        u16 passive_dwell = 0;
-        u16 active_dwell = 0;
-        int i, added = 0;
-        u16 channel = 0;
-
-        sband = iwl_get_hw_mode(priv, band);
-        if (!sband) {
-                IWL_ERR(priv, "invalid band\n");
-                return added;
-        }
-
-        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
-        passive_dwell = iwl_get_passive_dwell_time(priv, band);
-
-        if (passive_dwell <= active_dwell)
-                passive_dwell = active_dwell + 1;
-
-        /* only scan single channel, good enough to reset the RF */
-        /* pick the first valid not in-use channel */
-        if (band == IEEE80211_BAND_5GHZ) {
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                channel = priv->channel_info[i].channel;
-                                ch_info = iwl_get_channel_info(priv,
-                                        band, channel);
-                                if (is_channel_valid(ch_info))
-                                        break;
-                        }
-                }
-        } else {
-                for (i = 0; i < 14; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                        channel =
-                                                priv->channel_info[i].channel;
-                                        ch_info = iwl_get_channel_info(priv,
-                                                band, channel);
-                                        if (is_channel_valid(ch_info))
-                                                break;
-                        }
-                }
-        }
-        if (channel) {
-                scan_ch->channel = cpu_to_le16(channel);
-                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                scan_ch->active_dwell = cpu_to_le16(active_dwell);
-                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
-                /* Set txpower levels to defaults */
-                scan_ch->dsp_atten = 110;
-                if (band == IEEE80211_BAND_5GHZ)
-                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
-                else
-                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
-                added++;
-        } else
-                IWL_ERR(priv, "no valid channel found\n");
-        return added;
-}
-
-static int iwl_get_channels_for_scan(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     u8 is_active, u8 n_probes,
-                                     struct iwl_scan_channel *scan_ch)
-{
-        struct ieee80211_channel *chan;
-        const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
-        u16 passive_dwell = 0;
-        u16 active_dwell = 0;
-        int added, i;
-        u16 channel;
-
-        sband = iwl_get_hw_mode(priv, band);
-        if (!sband)
-                return 0;
-
-        active_dwell = iwl_get_active_dwell_time(priv, band, n_probes);
-        passive_dwell = iwl_get_passive_dwell_time(priv, band);
-
-        if (passive_dwell <= active_dwell)
-                passive_dwell = active_dwell + 1;
-
-        for (i = 0, added = 0; i < priv->scan_request->n_channels; i++) {
-                chan = priv->scan_request->channels[i];
-
-                if (chan->band != band)
-                        continue;
-
-                channel = ieee80211_frequency_to_channel(chan->center_freq);
-                scan_ch->channel = cpu_to_le16(channel);
-
-                ch_info = iwl_get_channel_info(priv, band, channel);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN(priv, "Channel %d is INVALID for this band.\n",
-                                        channel);
-                        continue;
-                }
-
-                if (!is_active || is_channel_passive(ch_info) ||
-                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
-                        scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                else
-                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
-
-                if (n_probes)
-                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
-
-                scan_ch->active_dwell = cpu_to_le16(active_dwell);
-                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
-
-                /* Set txpower levels to defaults */
-                scan_ch->dsp_atten = 110;
-
-                /* NOTE: if we were doing 6Mb OFDM for scans we'd use
-                 * power level:
-                 * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
-                 */
-                if (band == IEEE80211_BAND_5GHZ)
-                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
-                else
-                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
-
-                IWL_DEBUG_SCAN(priv, "Scanning ch=%d prob=0x%X [%s %d]\n",
-                               channel, le32_to_cpu(scan_ch->type),
-                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
-                                "ACTIVE" : "PASSIVE",
-                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
-                               active_dwell : passive_dwell);
-
-                scan_ch++;
-                added++;
-        }
-
-        IWL_DEBUG_SCAN(priv, "total channels to scan %d \n", added);
-        return added;
-}
-
 void iwl_init_scan_params(struct iwl_priv *priv)
 {
         u8 ant_idx = fls(priv->hw_params.valid_tx_ant) - 1;
@@ -468,32 +296,36 @@ void iwl_init_scan_params(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_init_scan_params);
 
-static int iwl_scan_initiate(struct iwl_priv *priv)
+static int iwl_scan_initiate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
         priv->scan_start = jiffies;
-        priv->scan_pass_start = priv->scan_start;
 
-        queue_work(priv->workqueue, &priv->request_scan);
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                return -EOPNOTSUPP;
+
+        priv->cfg->ops->utils->request_scan(priv, vif);
 
         return 0;
 }
 
-#define IWL_DELAY_NEXT_SCAN (HZ*2)
-
 int iwl_mac_hw_scan(struct ieee80211_hw *hw,
-                     struct cfg80211_scan_request *req)
+                    struct ieee80211_vif *vif,
+                    struct cfg80211_scan_request *req)
 {
-        unsigned long flags;
         struct iwl_priv *priv = hw->priv;
-        int ret, i;
+        int ret;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
+        if (req->n_channels == 0)
+                return -EINVAL;
+
         mutex_lock(&priv->mutex);
-        spin_lock_irqsave(&priv->lock, flags);
 
         if (!iwl_is_ready_rf(priv)) {
                 ret = -EIO;
@@ -513,30 +345,15 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        /* We don't schedule scan within next_scan_jiffies period.
-         * Avoid scanning during possible EAPOL exchange, return
-         * success immediately.
-         */
-        if (priv->next_scan_jiffies &&
-            time_after(priv->next_scan_jiffies, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within next scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
-
-        priv->scan_bands = 0;
-        for (i = 0; i < req->n_channels; i++)
-                priv->scan_bands |= BIT(req->channels[i]->band);
-
+        /* mac80211 will only ask for one band at a time */
+        priv->scan_band = req->channels[0]->band;
         priv->scan_request = req;
 
-        ret = iwl_scan_initiate(priv);
+        ret = iwl_scan_initiate(priv, vif);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
 out_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
         mutex_unlock(&priv->mutex);
 
         return ret;
@@ -547,43 +364,47 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
-        priv->scan_bands = 0;
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
-        else
-                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        priv->scan_band = priv->band;
 
         IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
-        queue_work(priv->workqueue, &priv->request_scan);
 
-out:
-        return ret;
-}
-EXPORT_SYMBOL(iwl_internal_short_hw_scan);
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                goto unlock;
 
-#define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
+        priv->cfg->ops->utils->request_scan(priv, NULL);
+ unlock:
+        mutex_unlock(&priv->mutex);
+}
+EXPORT_SYMBOL(iwl_bg_start_internal_scan);
 
 void iwl_bg_scan_check(struct work_struct *data)
 {
@@ -646,276 +467,15 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
         if (WARN_ON(left < ie_len))
                 return len;
 
-        if (ies)
+        if (ies && ie_len) {
                 memcpy(pos, ies, ie_len);
-        len += ie_len;
-        left -= ie_len;
+                len += ie_len;
+        }
 
         return (u16)len;
 }
 EXPORT_SYMBOL(iwl_fill_probe_req);
 
-static void iwl_bg_request_scan(struct work_struct *data)
-{
-        struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, request_scan);
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SCAN_CMD,
-                .len = sizeof(struct iwl_scan_cmd),
-                .flags = CMD_SIZE_HUGE,
-        };
-        struct iwl_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
-        int ret = 0;
-        u32 rate_flags = 0;
-        u16 cmd_len;
-        u16 rx_chain = 0;
-        enum ieee80211_band band;
-        u8 n_probes = 0;
-        u8 rx_ant = priv->hw_params.valid_rx_ant;
-        u8 rate;
-        bool is_active = false;
-        int  chan_mod;
-        u8 active_chains;
-
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        mutex_lock(&priv->mutex);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
-                               "Ignoring second request.\n");
-                ret = -EIO;
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
-
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
-                goto done;
-        }
-
-        if (!priv->scan_bands) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to no requested bands\n");
-                goto done;
-        }
-
-        if (!priv->scan) {
-                priv->scan = kmalloc(sizeof(struct iwl_scan_cmd) +
-                                     IWL_MAX_SCAN_SIZE, GFP_KERNEL);
-                if (!priv->scan) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-        }
-        scan = priv->scan;
-        memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
-
-        scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
-        scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
-
-        if (iwl_is_associated(priv)) {
-                u16 interval = 0;
-                u32 extra;
-                u32 suspend_time = 100;
-                u32 scan_suspend_time = 100;
-                unsigned long flags;
-
-                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
-                spin_lock_irqsave(&priv->lock, flags);
-                interval = priv->beacon_int;
-                spin_unlock_irqrestore(&priv->lock, flags);
-
-                scan->suspend_time = 0;
-                scan->max_out_time = cpu_to_le32(200 * 1024);
-                if (!interval)
-                        interval = suspend_time;
-
-                extra = (suspend_time / interval) << 22;
-                scan_suspend_time = (extra |
-                    ((suspend_time % interval) * 1024));
-                scan->suspend_time = cpu_to_le32(scan_suspend_time);
-                IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
-                               scan_suspend_time, interval);
-        }
-
-        if (priv->is_internal_short_scan) {
-                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
-        } else if (priv->scan_request->n_ssids) {
-                int i, p = 0;
-                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-                for (i = 0; i < priv->scan_request->n_ssids; i++) {
-                        /* always does wildcard anyway */
-                        if (!priv->scan_request->ssids[i].ssid_len)
-                                continue;
-                        scan->direct_scan[p].id = WLAN_EID_SSID;
-                        scan->direct_scan[p].len =
-                                priv->scan_request->ssids[i].ssid_len;
-                        memcpy(scan->direct_scan[p].ssid,
-                               priv->scan_request->ssids[i].ssid,
-                               priv->scan_request->ssids[i].ssid_len);
-                        n_probes++;
-                        p++;
-                }
-                is_active = true;
-        } else
-                IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
-
-        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
-        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
-        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-
-
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
-                band = IEEE80211_BAND_2GHZ;
-                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
-                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
-                                       >> RXON_FLG_CHANNEL_MODE_POS;
-                if (chan_mod == CHANNEL_MODE_PURE_40) {
-                        rate = IWL_RATE_6M_PLCP;
-                } else {
-                        rate = IWL_RATE_1M_PLCP;
-                        rate_flags = RATE_MCS_CCK_MSK;
-                }
-                scan->good_CRC_th = 0;
-        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
-                band = IEEE80211_BAND_5GHZ;
-                rate = IWL_RATE_6M_PLCP;
-                /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
-                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
-
-                /* Force use of chains B and C (0x6) for scan Rx for 4965
-                 * Avoid A (0x1) because of its off-channel reception on A-band.
-                 */
-                if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
-                        rx_ant = ANT_BC;
-        } else {
-                IWL_WARN(priv, "Invalid scan band count\n");
-                goto done;
-        }
-
-        priv->scan_tx_ant[band] =
-                         iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band]);
-        rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
-        scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
-
-        /* In power save mode use one chain, otherwise use all chains */
-        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
-                /* rx_ant has been set to all valid chains previously */
-                active_chains = rx_ant &
-                                ((u8)(priv->chain_noise_data.active_chains));
-                if (!active_chains)
-                        active_chains = rx_ant;
-
-                IWL_DEBUG_SCAN(priv, "chain_noise_data.active_chains: %u\n",
-                                priv->chain_noise_data.active_chains);
-
-                rx_ant = first_antenna(active_chains);
-        }
-        /* MIMO is not used here, but value is required */
-        rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
-        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
-        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
-        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
-        scan->rx_chain = cpu_to_le16(rx_chain);
-        if (!priv->is_internal_short_scan) {
-                cmd_len = iwl_fill_probe_req(priv,
-                                        (struct ieee80211_mgmt *)scan->data,
-                                        priv->scan_request->ie,
-                                        priv->scan_request->ie_len,
-                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-        } else {
-                cmd_len = iwl_fill_probe_req(priv,
-                                        (struct ieee80211_mgmt *)scan->data,
-                                        NULL, 0,
-                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-
-        }
-        scan->tx_cmd.len = cpu_to_le16(cmd_len);
-        if (iwl_is_monitor_mode(priv))
-                scan->filter_flags = RXON_FILTER_PROMISC_MSK;
-
-        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
-                               RXON_FILTER_BCON_AWARE_MSK);
-
-        if (priv->is_internal_short_scan) {
-                scan->channel_count =
-                        iwl_get_single_channel_for_scan(priv, band,
-                                (void *)&scan->data[le16_to_cpu(
-                                scan->tx_cmd.len)]);
-        } else {
-                scan->channel_count =
-                        iwl_get_channels_for_scan(priv, band,
-                                is_active, n_probes,
-                                (void *)&scan->data[le16_to_cpu(
-                                scan->tx_cmd.len)]);
-        }
-        if (scan->channel_count == 0) {
-                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
-        }
-
-        cmd.len += le16_to_cpu(scan->tx_cmd.len) +
-            scan->channel_count * sizeof(struct iwl_scan_channel);
-        cmd.data = scan;
-        scan->len = cpu_to_le16(cmd.len);
-
-        set_bit(STATUS_SCAN_HW, &priv->status);
-        ret = iwl_send_cmd_sync(priv, &cmd);
-        if (ret)
-                goto done;
-
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
-
-        mutex_unlock(&priv->mutex);
-        return;
-
- done:
-        /* Cannot perform scan. Make sure we clear scanning
-        * bits from status so next scan request can be performed.
-        * If we don't clear scanning status bit here all next scan
-        * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
-        mutex_unlock(&priv->mutex);
-}
-
 void iwl_bg_abort_scan(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
@@ -963,8 +523,8 @@ EXPORT_SYMBOL(iwl_bg_scan_completed);
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 {
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
-        INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 4a6686fa6b36..85ed235ac901 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -29,57 +29,12 @@
 
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
+#include <linux/sched.h>
 
 #include "iwl-dev.h"
 #include "iwl-core.h"
 #include "iwl-sta.h"
 
-#define IWL_STA_DRIVER_ACTIVE BIT(0) /* driver entry is active */
-#define IWL_STA_UCODE_ACTIVE  BIT(1) /* ucode entry is active */
-
-u8 iwl_find_station(struct iwl_priv *priv, const u8 *addr)
-{
-        int i;
-        int start = 0;
-        int ret = IWL_INVALID_STATION;
-        unsigned long flags;
-
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) ||
-            (priv->iw_mode == NL80211_IFTYPE_AP))
-                start = IWL_STA_ID;
-
-        if (is_broadcast_ether_addr(addr))
-                return priv->hw_params.bcast_sta_id;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        for (i = start; i < priv->hw_params.max_stations; i++)
-                if (priv->stations[i].used &&
-                    (!compare_ether_addr(priv->stations[i].sta.sta.addr,
-                                         addr))) {
-                        ret = i;
-                        goto out;
-                }
-
-        IWL_DEBUG_ASSOC_LIMIT(priv, "can not find STA %pM total %d\n",
-                              addr, priv->num_stations);
-
- out:
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return ret;
-}
-EXPORT_SYMBOL(iwl_find_station);
-
-int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
-{
-        if (priv->iw_mode == NL80211_IFTYPE_STATION) {
-                return IWL_AP_ID;
-        } else {
-                u8 *da = ieee80211_get_DA(hdr);
-                return iwl_find_station(priv, da);
-        }
-}
-EXPORT_SYMBOL(iwl_get_ra_sta_id);
-
 /* priv->sta_lock must be held */
 static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 {
@@ -132,7 +87,7 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
                         sta_id);
                 break;
         case ADD_STA_MODIFY_NON_EXIST_STA:
-                IWL_ERR(priv, "Attempting to modify non-existing station %d \n",
+                IWL_ERR(priv, "Attempting to modify non-existing station %d\n",
                         sta_id);
                 break;
         default:
@@ -158,13 +113,6 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
                        priv->stations[sta_id].sta.mode ==
                        STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
                        addsta->sta.addr);
-
-        /*
-         * Determine if we wanted to modify or add a station,
-         * if adding a station succeeded we have some more initialization
-         * to do when using station notification. TODO
-         */
-
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
@@ -190,6 +138,10 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                 .flags = flags,
                 .data = data,
         };
+        u8 sta_id __maybe_unused = sta->sta.sta_id;
+
+        IWL_DEBUG_INFO(priv, "Adding sta %u (%pM) %ssynchronously\n",
+                       sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
 
         if (flags & CMD_ASYNC)
                 cmd.callback = iwl_add_sta_callback;
@@ -263,18 +215,19 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
 }
 
 /**
- * iwl_add_station - Add station to tables in driver and device
+ * iwl_prep_station - Prepare station information for addition
+ *
+ * should be called with sta_lock held
  */
-u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
-                struct ieee80211_sta_ht_cap *ht_info)
+static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
+                           bool is_ap,
+                           struct ieee80211_sta_ht_cap *ht_info)
 {
         struct iwl_station_entry *station;
-        unsigned long flags_spin;
         int i;
-        int sta_id = IWL_INVALID_STATION;
+        u8 sta_id = IWL_INVALID_STATION;
         u16 rate;
 
-        spin_lock_irqsave(&priv->sta_lock, flags_spin);
         if (is_ap)
                 sta_id = IWL_AP_ID;
         else if (is_broadcast_ether_addr(addr))
@@ -292,20 +245,32 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
                                 sta_id = i;
                 }
 
-        /* These two conditions have the same outcome, but keep them separate
-           since they have different meanings */
-        if (unlikely(sta_id == IWL_INVALID_STATION)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        /*
+         * These two conditions have the same outcome, but keep them
+         * separate
+         */
+        if (unlikely(sta_id == IWL_INVALID_STATION))
+                return sta_id;
+
+        /*
+         * uCode is not able to deal with multiple requests to add a
+         * station. Keep track if one is in progress so that we do not send
+         * another.
+         */
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
+                IWL_DEBUG_INFO(priv, "STA %d already in process of being added.\n",
+                                sta_id);
                 return sta_id;
         }
 
-        if (priv->stations[sta_id].used &&
+        if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
+            (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) &&
             !compare_ether_addr(priv->stations[sta_id].sta.sta.addr, addr)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not adding again.\n",
+                                sta_id, addr);
                 return sta_id;
         }
 
-
         station = &priv->stations[sta_id];
         station->used = IWL_STA_DRIVER_ACTIVE;
         IWL_DEBUG_ASSOC(priv, "Add STA to driver ID %d: %pM\n",
@@ -319,10 +284,12 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
         station->sta.sta.sta_id = sta_id;
         station->sta.station_flags = 0;
 
-        /* BCAST station and IBSS stations do not work in HT mode */
-        if (sta_id != priv->hw_params.bcast_sta_id &&
-            priv->iw_mode != NL80211_IFTYPE_ADHOC)
-                iwl_set_ht_add_station(priv, sta_id, ht_info);
+        /*
+         * OK to call unconditionally, since local stations (IBSS BSSID
+         * STA and broadcast STA) pass in a NULL ht_info, and mac80211
+         * doesn't allow HT IBSS.
+         */
+        iwl_set_ht_add_station(priv, sta_id, ht_info);
 
         /* 3945 only */
         rate = (priv->band == IEEE80211_BAND_5GHZ) ?
@@ -330,86 +297,221 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
         /* Turn on both antennas for the station... */
         station->sta.rate_n_flags = cpu_to_le16(rate | RATE_MCS_ANT_AB_MSK);
 
+        return sta_id;
+
+}
+
+#define STA_WAIT_TIMEOUT (HZ/2)
+
+/**
+ * iwl_add_station_common -
+ */
+int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
+                                  bool is_ap,
+                                  struct ieee80211_sta_ht_cap *ht_info,
+                                  u8 *sta_id_r)
+{
+        struct iwl_station_entry *station;
+        unsigned long flags_spin;
+        int ret = 0;
+        u8 sta_id;
+
+        *sta_id_r = 0;
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        sta_id = iwl_prep_station(priv, addr, is_ap, ht_info);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Unable to prepare station %pM for addition\n",
+                        addr);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EINVAL;
+        }
+
+        /*
+         * uCode is not able to deal with multiple requests to add a
+         * station. Keep track if one is in progress so that we do not send
+         * another.
+         */
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
+                IWL_DEBUG_INFO(priv, "STA %d already in process of being added.\n",
+                               sta_id);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EEXIST;
+        }
+
+        if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
+            (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
+                IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not adding again.\n",
+                                sta_id, addr);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EEXIST;
+        }
+
+        priv->stations[sta_id].used |= IWL_STA_UCODE_INPROGRESS;
+        station = &priv->stations[sta_id];
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
         /* Add station to device's station table */
-        iwl_send_add_sta(priv, &station->sta, flags);
-        return sta_id;
+        ret = iwl_send_add_sta(priv, &station->sta, CMD_SYNC);
+        if (ret) {
+                IWL_ERR(priv, "Adding station %pM failed.\n", station->sta.sta.addr);
+                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+                priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        }
+        *sta_id_r = sta_id;
+        return ret;
+}
+EXPORT_SYMBOL(iwl_add_station_common);
+
+static struct iwl_link_quality_cmd *iwl_sta_alloc_lq(struct iwl_priv *priv,
+                                                     u8 sta_id)
+{
+        int i, r;
+        struct iwl_link_quality_cmd *link_cmd;
+        u32 rate_flags;
+
+        link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
+        if (!link_cmd) {
+                IWL_ERR(priv, "Unable to allocate memory for LQ cmd.\n");
+                return NULL;
+        }
+        /* Set up the rate scaling to start at selected rate, fall back
+         * all the way down to 1M in IEEE order, and then spin on 1M */
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                r = IWL_RATE_6M_INDEX;
+        else
+                r = IWL_RATE_1M_INDEX;
 
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
+                rate_flags = 0;
+                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                        rate_flags |= RATE_MCS_CCK_MSK;
+
+                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+                                RATE_MCS_ANT_POS;
+
+                link_cmd->rs_table[i].rate_n_flags =
+                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+                r = iwl_get_prev_ieee_rate(r);
+        }
+
+        link_cmd->general_params.single_stream_ant_msk =
+                                first_antenna(priv->hw_params.valid_tx_ant);
+
+        link_cmd->general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!link_cmd->general_params.dual_stream_ant_msk) {
+                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                link_cmd->general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
+
+        link_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd->agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+
+        link_cmd->sta_id = sta_id;
+
+        return link_cmd;
 }
-EXPORT_SYMBOL(iwl_add_station);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
+/*
+ * iwl_add_bssid_station - Add the special IBSS BSSID station
+ *
+ * Function sleeps.
+ */
+int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
+                          u8 *sta_id_r)
 {
+        int ret;
+        u8 sta_id;
+        struct iwl_link_quality_cmd *link_cmd;
         unsigned long flags;
-        u8 sta_id = iwl_find_station(priv, addr);
 
-        BUG_ON(sta_id == IWL_INVALID_STATION);
+        if (*sta_id_r)
+                *sta_id_r = IWL_INVALID_STATION;
 
-        IWL_DEBUG_ASSOC(priv, "Removed STA from Ucode: %pM\n", addr);
+        ret = iwl_add_station_common(priv, addr, 0, NULL, &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM\n", addr);
+                return ret;
+        }
+
+        if (sta_id_r)
+                *sta_id_r = sta_id;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
+        priv->stations[sta_id].used |= IWL_STA_LOCAL;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        /* Ucode must be active and driver must be non active */
-        if (priv->stations[sta_id].used != IWL_STA_UCODE_ACTIVE)
-                IWL_ERR(priv, "removed non active STA %d\n", sta_id);
+        if (init_rs) {
+                /* Set up default rate scaling table in device's station table */
+                link_cmd = iwl_sta_alloc_lq(priv, sta_id);
+                if (!link_cmd) {
+                        IWL_ERR(priv, "Unable to initialize rate scaling for station %pM.\n",
+                                addr);
+                        return -ENOMEM;
+                }
 
-        priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
+                ret = iwl_send_lq_cmd(priv, link_cmd, CMD_SYNC, true);
+                if (ret)
+                        IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
 
-        memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+                spin_lock_irqsave(&priv->sta_lock, flags);
+                priv->stations[sta_id].lq = link_cmd;
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+        }
+
+        return 0;
 }
+EXPORT_SYMBOL(iwl_add_bssid_station);
 
-static void iwl_remove_sta_callback(struct iwl_priv *priv,
-                                    struct iwl_device_cmd *cmd,
-                                    struct iwl_rx_packet *pkt)
+/**
+ * iwl_sta_ucode_deactivate - deactivate ucode status for a station
+ *
+ * priv->sta_lock must be held
+ */
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
 {
-        struct iwl_rem_sta_cmd *rm_sta =
-                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const u8 *addr = rm_sta->addr;
+        /* Ucode must be active and driver must be non active */
+        if ((priv->stations[sta_id].used &
+             (IWL_STA_UCODE_ACTIVE | IWL_STA_DRIVER_ACTIVE)) != IWL_STA_UCODE_ACTIVE)
+                IWL_ERR(priv, "removed non active STA %u\n", sta_id);
 
-        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                pkt->hdr.flags);
-                return;
-        }
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
 
-        switch (pkt->u.rem_sta.status) {
-        case REM_STA_SUCCESS_MSK:
-                iwl_sta_ucode_deactivate(priv, addr);
-                break;
-        default:
-                IWL_ERR(priv, "REPLY_REMOVE_STA failed\n");
-                break;
-        }
+        memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
+        IWL_DEBUG_ASSOC(priv, "Removed STA %u\n", sta_id);
 }
 
-static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
-                                   u8 flags)
+static int iwl_send_remove_station(struct iwl_priv *priv,
+                                   struct iwl_station_entry *station)
 {
         struct iwl_rx_packet *pkt;
         int ret;
 
+        unsigned long flags_spin;
         struct iwl_rem_sta_cmd rm_sta_cmd;
 
         struct iwl_host_cmd cmd = {
                 .id = REPLY_REMOVE_STA,
                 .len = sizeof(struct iwl_rem_sta_cmd),
-                .flags = flags,
+                .flags = CMD_SYNC,
                 .data = &rm_sta_cmd,
         };
 
         memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
         rm_sta_cmd.num_sta = 1;
-        memcpy(&rm_sta_cmd.addr, addr , ETH_ALEN);
+        memcpy(&rm_sta_cmd.addr, &station->sta.sta.addr , ETH_ALEN);
+
+        cmd.flags |= CMD_WANT_SKB;
 
-        if (flags & CMD_ASYNC)
-                cmd.callback = iwl_remove_sta_callback;
-        else
-                cmd.flags |= CMD_WANT_SKB;
         ret = iwl_send_cmd(priv, &cmd);
 
-        if (ret || (flags & CMD_ASYNC))
+        if (ret)
                 return ret;
 
         pkt = (struct iwl_rx_packet *)cmd.reply_page;
@@ -422,7 +524,9 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
         if (!ret) {
                 switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
-                        iwl_sta_ucode_deactivate(priv, addr);
+                        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                        iwl_sta_ucode_deactivate(priv, station->sta.sta.sta_id);
+                        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
                         break;
                 default:
@@ -439,45 +543,48 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
 /**
  * iwl_remove_station - Remove driver's knowledge of station.
  */
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
+int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
+                       const u8 *addr)
 {
-        int sta_id = IWL_INVALID_STATION;
-        int i, ret = -EINVAL;
+        struct iwl_station_entry *station;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_INFO(priv,
+                        "Unable to remove station %pM, device not ready.\n",
+                        addr);
+                /*
+                 * It is typical for stations to be removed when we are
+                 * going down. Return success since device will be down
+                 * soon anyway
+                 */
+                return 0;
+        }
 
-        if (is_ap)
-                sta_id = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                sta_id = priv->hw_params.bcast_sta_id;
-        else
-                for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++)
-                        if (priv->stations[i].used &&
-                            !compare_ether_addr(priv->stations[i].sta.sta.addr,
-                                                addr)) {
-                                sta_id = i;
-                                break;
-                        }
+        IWL_DEBUG_ASSOC(priv, "Removing STA from driver:%d  %pM\n",
+                        sta_id, addr);
 
-        if (unlikely(sta_id == IWL_INVALID_STATION))
-                goto out;
+        if (WARN_ON(sta_id == IWL_INVALID_STATION))
+                return -EINVAL;
 
-        IWL_DEBUG_ASSOC(priv, "Removing STA from driver:%d  %pM\n",
-                sta_id, addr);
+        spin_lock_irqsave(&priv->sta_lock, flags);
 
         if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
-                IWL_ERR(priv, "Removing %pM but non DRIVER active\n",
+                IWL_DEBUG_INFO(priv, "Removing %pM but non DRIVER active\n",
                                 addr);
-                goto out;
+                goto out_err;
         }
 
         if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
-                IWL_ERR(priv, "Removing %pM but non UCODE active\n",
+                IWL_DEBUG_INFO(priv, "Removing %pM but non UCODE active\n",
                                 addr);
-                goto out;
+                goto out_err;
         }
 
+        if (priv->stations[sta_id].used & IWL_STA_LOCAL) {
+                kfree(priv->stations[sta_id].lq);
+                priv->stations[sta_id].lq = NULL;
+        }
 
         priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
 
@@ -485,47 +592,112 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 
         BUG_ON(priv->num_stations < 0);
 
+        station = &priv->stations[sta_id];
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        ret = iwl_send_remove_station(priv, addr, CMD_ASYNC);
-        return ret;
-out:
+        return iwl_send_remove_station(priv, station);
+out_err:
         spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return ret;
+        return -EINVAL;
 }
+EXPORT_SYMBOL_GPL(iwl_remove_station);
 
 /**
- * iwl_clear_stations_table - Clear the driver's station table
+ * iwl_clear_ucode_stations - clear ucode station table bits
  *
- * NOTE:  This does not clear or otherwise alter the device's station table.
+ * This function clears all the bits in the driver indicating
+ * which stations are active in the ucode. Call when something
+ * other than explicit station management would cause this in
+ * the ucode, e.g. unassociated RXON.
  */
-void iwl_clear_stations_table(struct iwl_priv *priv)
+void iwl_clear_ucode_stations(struct iwl_priv *priv)
 {
-        unsigned long flags;
         int i;
+        unsigned long flags_spin;
+        bool cleared = false;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+        IWL_DEBUG_INFO(priv, "Clearing ucode stations in driver\n");
 
-        if (iwl_is_alive(priv) &&
-           !test_bit(STATUS_EXIT_PENDING, &priv->status) &&
-           iwl_send_cmd_pdu_async(priv, REPLY_REMOVE_ALL_STA, 0, NULL, NULL))
-                IWL_ERR(priv, "Couldn't clear the station table\n");
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if (priv->stations[i].used & IWL_STA_UCODE_ACTIVE) {
+                        IWL_DEBUG_INFO(priv, "Clearing ucode active for station %d\n", i);
+                        priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
+                        cleared = true;
+                }
+        }
+        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+
+        if (!cleared)
+                IWL_DEBUG_INFO(priv, "No active stations found to be cleared\n");
+}
+EXPORT_SYMBOL(iwl_clear_ucode_stations);
+
+/**
+ * iwl_restore_stations() - Restore driver known stations to device
+ *
+ * All stations considered active by driver, but not present in ucode, is
+ * restored.
+ *
+ * Function sleeps.
+ */
+void iwl_restore_stations(struct iwl_priv *priv)
+{
+        struct iwl_station_entry *station;
+        unsigned long flags_spin;
+        int i;
+        bool found = false;
+        int ret;
 
-        priv->num_stations = 0;
-        memset(priv->stations, 0, sizeof(priv->stations));
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_INFO(priv, "Not ready yet, not restoring any stations.\n");
+                return;
+        }
 
-        /* clean ucode key table bit map */
-        priv->ucode_key_table = 0;
+        IWL_DEBUG_ASSOC(priv, "Restoring all known stations ... start.\n");
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if ((priv->stations[i].used & IWL_STA_DRIVER_ACTIVE) &&
+                            !(priv->stations[i].used & IWL_STA_UCODE_ACTIVE)) {
+                        IWL_DEBUG_ASSOC(priv, "Restoring sta %pM\n",
+                                        priv->stations[i].sta.sta.addr);
+                        priv->stations[i].sta.mode = 0;
+                        priv->stations[i].used |= IWL_STA_UCODE_INPROGRESS;
+                        found = true;
+                }
+        }
 
-        /* keep track of static keys */
-        for (i = 0; i < WEP_KEYS_MAX ; i++) {
-                if (priv->wep_keys[i].key_size)
-                        set_bit(i, &priv->ucode_key_table);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if ((priv->stations[i].used & IWL_STA_UCODE_INPROGRESS)) {
+                        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        station = &priv->stations[i];
+                        ret = iwl_send_add_sta(priv, &priv->stations[i].sta, CMD_SYNC);
+                        if (ret) {
+                                IWL_ERR(priv, "Adding station %pM failed.\n",
+                                        station->sta.sta.addr);
+                                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                                priv->stations[i].used &= ~IWL_STA_DRIVER_ACTIVE;
+                                priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
+                                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        }
+                        /*
+                         * Rate scaling has already been initialized, send
+                         * current LQ command
+                         */
+                        if (station->lq)
+                                iwl_send_lq_cmd(priv, station->lq, CMD_SYNC, true);
+                        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                        priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
+                }
         }
 
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        if (!found)
+                IWL_DEBUG_INFO(priv, "Restoring all known stations .... no stations to be restored.\n");
+        else
+                IWL_DEBUG_INFO(priv, "Restoring all known stations .... complete.\n");
 }
-EXPORT_SYMBOL(iwl_clear_stations_table);
+EXPORT_SYMBOL(iwl_restore_stations);
 
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 {
@@ -539,7 +711,7 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_get_free_ucode_key_index);
 
-int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
+static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
 {
         int i, not_empty = 0;
         u8 buff[sizeof(struct iwl_wep_cmd) +
@@ -549,9 +721,11 @@ int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_WEPKEY,
                 .data = wep_cmd,
-                .flags = CMD_ASYNC,
+                .flags = CMD_SYNC,
         };
 
+        might_sleep();
+
         memset(wep_cmd, 0, cmd_size +
                         (sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
 
@@ -581,33 +755,34 @@ int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
         else
                 return 0;
 }
-EXPORT_SYMBOL(iwl_send_static_wepkey_cmd);
+
+int iwl_restore_default_wep_keys(struct iwl_priv *priv)
+{
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
+        return iwl_send_static_wepkey_cmd(priv, 0);
+}
+EXPORT_SYMBOL(iwl_restore_default_wep_keys);
 
 int iwl_remove_default_wep_key(struct iwl_priv *priv,
                                struct ieee80211_key_conf *keyconf)
 {
         int ret;
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
                       keyconf->keyidx);
 
-        if (!test_and_clear_bit(keyconf->keyidx, &priv->ucode_key_table))
-                IWL_ERR(priv, "index %d not used in uCode key table.\n",
-                          keyconf->keyidx);
-
-        priv->default_wep_key--;
         memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
         if (iwl_is_rfkill(priv)) {
                 IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                /* but keys in device are clear anyway so return success */
                 return 0;
         }
         ret = iwl_send_static_wepkey_cmd(priv, 1);
         IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                       keyconf->keyidx, ret);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         return ret;
 }
@@ -617,7 +792,8 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
                             struct ieee80211_key_conf *keyconf)
 {
         int ret;
-        unsigned long flags;
+
+        WARN_ON(!mutex_is_locked(&priv->mutex));
 
         if (keyconf->keylen != WEP_KEY_LEN_128 &&
             keyconf->keylen != WEP_KEY_LEN_64) {
@@ -629,13 +805,6 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
         keyconf->hw_key_idx = HW_KEY_DEFAULT;
         priv->stations[IWL_AP_ID].keyinfo.alg = ALG_WEP;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->default_wep_key++;
-
-        if (test_and_set_bit(keyconf->keyidx, &priv->ucode_key_table))
-                IWL_ERR(priv, "index %d already used in uCode key table.\n",
-                        keyconf->keyidx);
-
         priv->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
         memcpy(&priv->wep_keys[keyconf->keyidx].key, &keyconf->key,
                                                         keyconf->keylen);
@@ -643,7 +812,6 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
         ret = iwl_send_static_wepkey_cmd(priv, 0);
         IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
                 keyconf->keylen, keyconf->keyidx, ret);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         return ret;
 }
@@ -798,18 +966,23 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 
 void iwl_update_tkip_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *keyconf,
-                        const u8 *addr, u32 iv32, u16 *phase1key)
+                        struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
 {
-        u8 sta_id = IWL_INVALID_STATION;
+        u8 sta_id;
         unsigned long flags;
         int i;
 
-        sta_id = iwl_find_station(priv, addr);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
-                                   addr);
-                return;
-        }
+        if (sta) {
+                sta_id = iwl_sta_id(sta);
+
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_MAC80211(priv, "leave - %pM not initialised.\n",
+                                           sta->addr);
+                        return;
+                }
+        } else
+                sta_id = priv->hw_params.bcast_sta_id;
+
 
         if (iwl_scan_cancel(priv)) {
                 /* cancel scan failed, just live w/ bad key and rely
@@ -885,7 +1058,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
         if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled.\n");
                 spin_unlock_irqrestore(&priv->sta_lock, flags);
                 return 0;
         }
@@ -948,253 +1121,149 @@ static inline void iwl_dump_lq_cmd(struct iwl_priv *priv,
 }
 #endif
 
-int iwl_send_lq_cmd(struct iwl_priv *priv,
-                    struct iwl_link_quality_cmd *lq, u8 flags)
-{
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_TX_LINK_QUALITY_CMD,
-                .len = sizeof(struct iwl_link_quality_cmd),
-                .flags = flags,
-                .data = lq,
-        };
-
-        if ((lq->sta_id == 0xFF) &&
-            (priv->iw_mode == NL80211_IFTYPE_ADHOC))
-                return -EINVAL;
-
-        if (lq->sta_id == 0xFF)
-                lq->sta_id = IWL_AP_ID;
-
-        iwl_dump_lq_cmd(priv, lq);
-
-        if (iwl_is_associated(priv) && priv->assoc_station_added)
-                return  iwl_send_cmd(priv, &cmd);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_send_lq_cmd);
-
 /**
- * iwl_sta_init_lq - Initialize a station's hardware rate table
- *
- * The uCode's station table contains a table of fallback rates
- * for automatic fallback during transmission.
- *
- * NOTE: This sets up a default set of values.  These will be replaced later
- *       if the driver's iwl-agn-rs rate scaling algorithm is used, instead of
- *       rc80211_simple.
+ * is_lq_table_valid() - Test one aspect of LQ cmd for validity
  *
- * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
- *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
- *       which requires station table entry to exist).
+ * It sometimes happens when a HT rate has been in use and we
+ * loose connectivity with AP then mac80211 will first tell us that the
+ * current channel is not HT anymore before removing the station. In such a
+ * scenario the RXON flags will be updated to indicate we are not
+ * communicating HT anymore, but the LQ command may still contain HT rates.
+ * Test for this to prevent driver from sending LQ command between the time
+ * RXON flags are updated and when LQ command is updated.
  */
-static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
+static bool is_lq_table_valid(struct iwl_priv *priv,
+                              struct iwl_link_quality_cmd *lq)
 {
-        int i, r;
-        struct iwl_link_quality_cmd link_cmd = {
-                .reserved1 = 0,
-        };
-        u32 rate_flags;
+        int i;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
 
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (is_ap)
-                r = IWL_RATE_54M_INDEX;
-        else if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
+        if (ht_conf->is_ht)
+                return true;
 
+        IWL_DEBUG_INFO(priv, "Channel %u is not an HT channel\n",
+                       priv->active_rxon.channel);
         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
-
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
-
-                link_cmd.rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
+                if (le32_to_cpu(lq->rs_table[i].rate_n_flags) & RATE_MCS_HT_MSK) {
+                        IWL_DEBUG_INFO(priv,
+                                       "index %d of LQ expects HT channel\n",
+                                       i);
+                        return false;
+                }
         }
-
-        link_cmd.general_params.single_stream_ant_msk =
-                                first_antenna(priv->hw_params.valid_tx_ant);
-        link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd.agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        /* Update the rate scaling for control frame Tx to AP */
-        link_cmd.sta_id = is_ap ? IWL_AP_ID : priv->hw_params.bcast_sta_id;
-
-        iwl_send_cmd_pdu_async(priv, REPLY_TX_LINK_QUALITY_CMD,
-                               sizeof(link_cmd), &link_cmd, NULL);
+        return true;
 }
 
 /**
- * iwl_rxon_add_station - add station into station table.
+ * iwl_send_lq_cmd() - Send link quality command
+ * @init: This command is sent as part of station initialization right
+ *        after station has been added.
  *
- * there is only one AP station with id= IWL_AP_ID
- * NOTE: mutex must be held before calling this function
+ * The link quality command is sent as the last step of station creation.
+ * This is the special case in which init is set and we call a callback in
+ * this case to clear the state indicating that station creation is in
+ * progress.
  */
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
+int iwl_send_lq_cmd(struct iwl_priv *priv,
+                    struct iwl_link_quality_cmd *lq, u8 flags, bool init)
 {
-        struct ieee80211_sta *sta;
-        struct ieee80211_sta_ht_cap ht_config;
-        struct ieee80211_sta_ht_cap *cur_ht_config = NULL;
-        u8 sta_id;
+        int ret = 0;
+        unsigned long flags_spin;
 
-        /*
-         * Set HT capabilities. It is ok to set this struct even if not using
-         * HT config: the priv->current_ht_config.is_ht flag will just be false
-         */
-        rcu_read_lock();
-        sta = ieee80211_find_sta(priv->vif, addr);
-        if (sta) {
-                memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
-                cur_ht_config = &ht_config;
-        }
-        rcu_read_unlock();
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_TX_LINK_QUALITY_CMD,
+                .len = sizeof(struct iwl_link_quality_cmd),
+                .flags = flags,
+                .data = lq,
+        };
 
-        /* Add station to device's station table */
-        sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
+        if (WARN_ON(lq->sta_id == IWL_INVALID_STATION))
+                return -EINVAL;
 
-        /* Set up default rate scaling table in device's station table */
-        iwl_sta_init_lq(priv, addr, is_ap);
+        iwl_dump_lq_cmd(priv, lq);
+        BUG_ON(init && (cmd.flags & CMD_ASYNC));
 
-        return sta_id;
+        if (is_lq_table_valid(priv, lq))
+                ret = iwl_send_cmd(priv, &cmd);
+        else
+                ret = -EINVAL;
+
+        if (cmd.flags & CMD_ASYNC)
+                return ret;
+
+        if (init) {
+                IWL_DEBUG_INFO(priv, "init LQ command complete, clearing sta addition status for sta %d\n",
+                               lq->sta_id);
+                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                priv->stations[lq->sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        }
+        return ret;
 }
-EXPORT_SYMBOL(iwl_rxon_add_station);
+EXPORT_SYMBOL(iwl_send_lq_cmd);
 
 /**
- * iwl_sta_init_bcast_lq - Initialize a bcast station's hardware rate table
+ * iwl_alloc_bcast_station - add broadcast station into driver's station table.
  *
- * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
- *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
- *       which requires station table entry to exist).
+ * This adds the broadcast station into the driver's station table
+ * and marks it driver active, so that it will be restored to the
+ * device at the next best time.
  */
-static void iwl_sta_init_bcast_lq(struct iwl_priv *priv)
+int iwl_alloc_bcast_station(struct iwl_priv *priv, bool init_lq)
 {
-        int i, r;
-        struct iwl_link_quality_cmd link_cmd = {
-                .reserved1 = 0,
-        };
-        u32 rate_flags;
-
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
-
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
+        struct iwl_link_quality_cmd *link_cmd;
+        unsigned long flags;
+        u8 sta_id;
 
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        sta_id = iwl_prep_station(priv, iwl_bcast_addr, false, NULL);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Unable to prepare broadcast station\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-                link_cmd.rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
+                return -EINVAL;
         }
 
-        link_cmd.general_params.single_stream_ant_msk =
-                                first_antenna(priv->hw_params.valid_tx_ant);
-        link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd.agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        /* Update the rate scaling for control frame Tx to AP */
-        link_cmd.sta_id = priv->hw_params.bcast_sta_id;
-
-        iwl_send_cmd_pdu_async(priv, REPLY_TX_LINK_QUALITY_CMD,
-                               sizeof(link_cmd), &link_cmd, NULL);
-}
-
+        priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used |= IWL_STA_BCAST;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-/**
- * iwl_add_bcast_station - add broadcast station into station table.
- */
-void iwl_add_bcast_station(struct iwl_priv *priv)
-{
-        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
-        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+        if (init_lq) {
+                link_cmd = iwl_sta_alloc_lq(priv, sta_id);
+                if (!link_cmd) {
+                        IWL_ERR(priv,
+                                "Unable to initialize rate scaling for bcast station.\n");
+                        return -ENOMEM;
+                }
 
-        /* Set up default rate scaling table in device's station table */
-        iwl_sta_init_bcast_lq(priv);
-}
-EXPORT_SYMBOL(iwl_add_bcast_station);
+                spin_lock_irqsave(&priv->sta_lock, flags);
+                priv->stations[sta_id].lq = link_cmd;
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+        }
 
-/**
- * iwl3945_add_bcast_station - add broadcast station into station table.
- */
-void iwl3945_add_bcast_station(struct iwl_priv *priv)
-{
-        IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
-        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+        return 0;
 }
-EXPORT_SYMBOL(iwl3945_add_bcast_station);
+EXPORT_SYMBOL_GPL(iwl_alloc_bcast_station);
 
-/**
- * iwl_get_sta_id - Find station's index within station table
- *
- * If new IBSS station, create new entry in station table
- */
-int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
+void iwl_dealloc_bcast_station(struct iwl_priv *priv)
 {
-        int sta_id;
-        __le16 fc = hdr->frame_control;
-
-        /* If this frame is broadcast or management, use broadcast station id */
-        if (!ieee80211_is_data(fc) ||  is_multicast_ether_addr(hdr->addr1))
-                return priv->hw_params.bcast_sta_id;
-
-        switch (priv->iw_mode) {
-
-        /* If we are a client station in a BSS network, use the special
-         * AP station entry (that's the only station we communicate with) */
-        case NL80211_IFTYPE_STATION:
-                return IWL_AP_ID;
-
-        /* If we are an AP, then find the station, or use BCAST */
-        case NL80211_IFTYPE_AP:
-                sta_id = iwl_find_station(priv, hdr->addr1);
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-                return priv->hw_params.bcast_sta_id;
-
-        /* If this frame is going out to an IBSS network, find the station,
-         * or create a new station table entry */
-        case NL80211_IFTYPE_ADHOC:
-                sta_id = iwl_find_station(priv, hdr->addr1);
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-
-                /* Create new station table entry */
-                sta_id = iwl_add_station(priv, hdr->addr1, false,
-                                        CMD_ASYNC, NULL);
-
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-
-                IWL_DEBUG_DROP(priv, "Station %pM not in station map. "
-                               "Defaulting to broadcast...\n",
-                               hdr->addr1);
-                iwl_print_hex_dump(priv, IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
-                return priv->hw_params.bcast_sta_id;
+        unsigned long flags;
+        int i;
 
-        default:
-                IWL_WARN(priv, "Unknown mode of operation: %d\n",
-                        priv->iw_mode);
-                return priv->hw_params.bcast_sta_id;
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if (!(priv->stations[i].used & IWL_STA_BCAST))
+                        continue;
+
+                priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
+                priv->num_stations--;
+                BUG_ON(priv->num_stations < 0);
+                kfree(priv->stations[i].lq);
+                priv->stations[i].lq = NULL;
         }
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
-EXPORT_SYMBOL(iwl_get_sta_id);
+EXPORT_SYMBOL_GPL(iwl_dealloc_bcast_station);
 
 /**
  * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
@@ -1214,13 +1283,13 @@ void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
 }
 EXPORT_SYMBOL(iwl_sta_tx_modify_enable_tid);
 
-int iwl_sta_rx_agg_start(struct iwl_priv *priv,
-                         const u8 *addr, int tid, u16 ssn)
+int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                         int tid, u16 ssn)
 {
         unsigned long flags;
         int sta_id;
 
-        sta_id = iwl_find_station(priv, addr);
+        sta_id = iwl_sta_id(sta);
         if (sta_id == IWL_INVALID_STATION)
                 return -ENXIO;
 
@@ -1233,16 +1302,17 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv,
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         return iwl_send_add_sta(priv, &priv->stations[sta_id].sta,
-                                        CMD_ASYNC);
+                                CMD_ASYNC);
 }
 EXPORT_SYMBOL(iwl_sta_rx_agg_start);
 
-int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid)
+int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                        int tid)
 {
         unsigned long flags;
         int sta_id;
 
-        sta_id = iwl_find_station(priv, addr);
+        sta_id = iwl_sta_id(sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
                 return -ENXIO;
@@ -1291,3 +1361,22 @@ void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
 
         iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
+EXPORT_SYMBOL(iwl_sta_modify_sleep_tx_count);
+
+int iwl_mac_sta_remove(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_station_priv_common *sta_common = (void *)sta->drv_priv;
+        int ret;
+
+        IWL_DEBUG_INFO(priv, "received request to remove station %pM\n",
+                        sta->addr);
+        ret = iwl_remove_station(priv, sta_common->sta_id, sta->addr);
+        if (ret)
+                IWL_ERR(priv, "Error removing station %pM\n",
+                        sta->addr);
+        return ret;
+}
+EXPORT_SYMBOL(iwl_mac_sta_remove);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 2dc35fe28f56..c2a453a1a991 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -29,44 +29,82 @@
 #ifndef __iwl_sta_h__
 #define __iwl_sta_h__
 
+#include "iwl-dev.h"
+
 #define HW_KEY_DYNAMIC 0
 #define HW_KEY_DEFAULT 1
 
-/**
- * iwl_find_station - Find station id for a given BSSID
- * @bssid: MAC address of station ID to find
- */
-u8 iwl_find_station(struct iwl_priv *priv, const u8 *bssid);
+#define IWL_STA_DRIVER_ACTIVE BIT(0) /* driver entry is active */
+#define IWL_STA_UCODE_ACTIVE  BIT(1) /* ucode entry is active */
+#define IWL_STA_UCODE_INPROGRESS  BIT(2) /* ucode entry is in process of
+                                            being activated */
+#define IWL_STA_LOCAL BIT(3) /* station state not directed by mac80211;
+                                (this is for the IBSS BSSID stations) */
+#define IWL_STA_BCAST BIT(4) /* this station is the special bcast station */
+
 
-int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty);
 int iwl_remove_default_wep_key(struct iwl_priv *priv,
                                struct ieee80211_key_conf *key);
 int iwl_set_default_wep_key(struct iwl_priv *priv,
                             struct ieee80211_key_conf *key);
+int iwl_restore_default_wep_keys(struct iwl_priv *priv);
 int iwl_set_dynamic_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *key, u8 sta_id);
 int iwl_remove_dynamic_key(struct iwl_priv *priv,
                            struct ieee80211_key_conf *key, u8 sta_id);
 void iwl_update_tkip_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *keyconf,
-                        const u8 *addr, u32 iv32, u16 *phase1key);
+                        struct ieee80211_sta *sta, u32 iv32, u16 *phase1key);
 
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
-void iwl_add_bcast_station(struct iwl_priv *priv);
-void iwl3945_add_bcast_station(struct iwl_priv *priv);
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
-void iwl_clear_stations_table(struct iwl_priv *priv);
+void iwl_restore_stations(struct iwl_priv *priv);
+void iwl_clear_ucode_stations(struct iwl_priv *priv);
+int iwl_alloc_bcast_station(struct iwl_priv *priv, bool init_lq);
+void iwl_dealloc_bcast_station(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
-int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
-int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
-                        struct ieee80211_sta_ht_cap *ht_info);
+int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
+                          u8 *sta_id_r);
+int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
+                                  bool is_ap,
+                                  struct ieee80211_sta_ht_cap *ht_info,
+                                  u8 *sta_id_r);
+int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
+                       const u8 *addr);
+int iwl_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta);
 void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
-int iwl_sta_rx_agg_start(struct iwl_priv *priv,
-                         const u8 *addr, int tid, u16 ssn);
-int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid);
+int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                         int tid, u16 ssn);
+int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
+                        int tid);
 void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id);
 void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
+
+/**
+ * iwl_clear_driver_stations - clear knowledge of all stations from driver
+ * @priv: iwl priv struct
+ *
+ * This is called during iwl_down() to make sure that in the case
+ * we're coming there from a hardware restart mac80211 will be
+ * able to reconfigure stations -- if we're getting there in the
+ * normal down flow then the stations will already be cleared.
+ */
+static inline void iwl_clear_driver_stations(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        memset(priv->stations, 0, sizeof(priv->stations));
+        priv->num_stations = 0;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+}
+
+static inline int iwl_sta_id(struct ieee80211_sta *sta)
+{
+        if (WARN_ON(!sta))
+                return IWL_INVALID_STATION;
+
+        return ((struct iwl_station_priv_common *)sta->drv_priv)->sta_id;
+}
 #endif /* __iwl_sta_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 8dd0c036d547..1ece2ea09773 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -38,47 +38,6 @@
 #include "iwl-io.h"
 #include "iwl-helpers.h"
 
-static const u16 default_tid_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_AC3
-};
-
-static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
-                                    struct iwl_dma_ptr *ptr, size_t size)
-{
-        ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
-                                       GFP_KERNEL);
-        if (!ptr->addr)
-                return -ENOMEM;
-        ptr->size = size;
-        return 0;
-}
-
-static inline void iwl_free_dma_ptr(struct iwl_priv *priv,
-                                    struct iwl_dma_ptr *ptr)
-{
-        if (unlikely(!ptr->addr))
-                return;
-
-        dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
-        memset(ptr, 0, sizeof(*ptr));
-}
-
 /**
  * iwl_txq_update_write_ptr - Send new write index to hardware
  */
@@ -310,6 +269,8 @@ static int iwl_queue_init(struct iwl_priv *priv, struct iwl_queue *q,
                 q->high_mark = 2;
 
         q->write_ptr = q->read_ptr = 0;
+        q->last_read_ptr = 0;
+        q->repeat_same_read_ptr = 0;
 
         return 0;
 }
@@ -454,611 +415,6 @@ void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 }
 EXPORT_SYMBOL(iwl_tx_queue_reset);
 
-/**
- * iwl_hw_txq_ctx_free - Free TXQ Context
- *
- * Destroy all TX DMA queues and structures
- */
-void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
-{
-        int txq_id;
-
-        /* Tx queues */
-        if (priv->txq) {
-                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                        if (txq_id == IWL_CMD_QUEUE_NUM)
-                                iwl_cmd_queue_free(priv);
-                        else
-                                iwl_tx_queue_free(priv, txq_id);
-        }
-        iwl_free_dma_ptr(priv, &priv->kw);
-
-        iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
-
-        /* free tx queue structure */
-        iwl_free_txq_mem(priv);
-}
-EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
-
-/**
- * iwl_txq_ctx_alloc - allocate TX queue context
- * Allocate all Tx DMA structures and initialize them
- *
- * @param priv
- * @return error code
- */
-int iwl_txq_ctx_alloc(struct iwl_priv *priv)
-{
-        int ret;
-        int txq_id, slots_num;
-        unsigned long flags;
-
-        /* Free all tx/cmd queues and keep-warm buffer */
-        iwl_hw_txq_ctx_free(priv);
-
-        ret = iwl_alloc_dma_ptr(priv, &priv->scd_bc_tbls,
-                                priv->hw_params.scd_bc_tbls_size);
-        if (ret) {
-                IWL_ERR(priv, "Scheduler BC Table allocation failed\n");
-                goto error_bc_tbls;
-        }
-        /* Alloc keep-warm buffer */
-        ret = iwl_alloc_dma_ptr(priv, &priv->kw, IWL_KW_SIZE);
-        if (ret) {
-                IWL_ERR(priv, "Keep Warm allocation failed\n");
-                goto error_kw;
-        }
-
-        /* allocate tx queue structure */
-        ret = iwl_alloc_txq_mem(priv);
-        if (ret)
-                goto error;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Turn off all Tx DMA fifos */
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Tell NIC where to find the "keep warm" buffer */
-        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Alloc and init all Tx queues, including the command queue (#4) */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
-                                        TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
-                ret = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
-                                       txq_id);
-                if (ret) {
-                        IWL_ERR(priv, "Tx %d queue init failed\n", txq_id);
-                        goto error;
-                }
-        }
-
-        return ret;
-
- error:
-        iwl_hw_txq_ctx_free(priv);
-        iwl_free_dma_ptr(priv, &priv->kw);
- error_kw:
-        iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
- error_bc_tbls:
-        return ret;
-}
-
-void iwl_txq_ctx_reset(struct iwl_priv *priv)
-{
-        int txq_id, slots_num;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Turn off all Tx DMA fifos */
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Tell NIC where to find the "keep warm" buffer */
-        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Alloc and init all Tx queues, including the command queue (#4) */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
-                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
-                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
-        }
-}
-
-/**
- * iwl_txq_ctx_stop - Stop all Tx DMA channels
- */
-void iwl_txq_ctx_stop(struct iwl_priv *priv)
-{
-        int ch;
-        unsigned long flags;
-
-        /* Turn off all Tx DMA fifos */
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Stop each Tx DMA channel, and wait for it to be idle */
-        for (ch = 0; ch < priv->hw_params.dma_chnl_num; ch++) {
-                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
-                iwl_poll_direct_bit(priv, FH_TSSR_TX_STATUS_REG,
-                                    FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
-                                    1000);
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_txq_ctx_stop);
-
-/*
- * handle build REPLY_TX command notification.
- */
-static void iwl_tx_cmd_build_basic(struct iwl_priv *priv,
-                                  struct iwl_tx_cmd *tx_cmd,
-                                  struct ieee80211_tx_info *info,
-                                  struct ieee80211_hdr *hdr,
-                                  u8 std_id)
-{
-        __le16 fc = hdr->frame_control;
-        __le32 tx_flags = tx_cmd->tx_flags;
-
-        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
-                tx_flags |= TX_CMD_FLG_ACK_MSK;
-                if (ieee80211_is_mgmt(fc))
-                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-                if (ieee80211_is_probe_resp(fc) &&
-                    !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
-                        tx_flags |= TX_CMD_FLG_TSF_MSK;
-        } else {
-                tx_flags &= (~TX_CMD_FLG_ACK_MSK);
-                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-        }
-
-        if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
-
-
-        tx_cmd->sta_id = std_id;
-        if (ieee80211_has_morefrags(fc))
-                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
-
-        if (ieee80211_is_data_qos(fc)) {
-                u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tx_cmd->tid_tspec = qc[0] & 0xf;
-                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
-        } else {
-                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-        }
-
-        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
-
-        if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
-                tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-
-        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
-        if (ieee80211_is_mgmt(fc)) {
-                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
-                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
-                else
-                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
-        } else {
-                tx_cmd->timeout.pm_frame_timeout = 0;
-        }
-
-        tx_cmd->driver_txop = 0;
-        tx_cmd->tx_flags = tx_flags;
-        tx_cmd->next_frame_len = 0;
-}
-
-#define RTS_HCCA_RETRY_LIMIT            3
-#define RTS_DFAULT_RETRY_LIMIT          60
-
-static void iwl_tx_cmd_build_rate(struct iwl_priv *priv,
-                              struct iwl_tx_cmd *tx_cmd,
-                              struct ieee80211_tx_info *info,
-                              __le16 fc, int is_hcca)
-{
-        u32 rate_flags;
-        int rate_idx;
-        u8 rts_retry_limit;
-        u8 data_retry_limit;
-        u8 rate_plcp;
-
-        /* Set retry limit on DATA packets and Probe Responses*/
-        if (ieee80211_is_probe_resp(fc))
-                data_retry_limit = 3;
-        else
-                data_retry_limit = IWL_DEFAULT_TX_RETRY;
-        tx_cmd->data_retry_limit = data_retry_limit;
-
-        /* Set retry limit on RTS packets */
-        rts_retry_limit = (is_hcca) ?  RTS_HCCA_RETRY_LIMIT :
-                RTS_DFAULT_RETRY_LIMIT;
-        if (data_retry_limit < rts_retry_limit)
-                rts_retry_limit = data_retry_limit;
-        tx_cmd->rts_retry_limit = rts_retry_limit;
-
-        /* DATA packets will use the uCode station table for rate/antenna
-         * selection */
-        if (ieee80211_is_data(fc)) {
-                tx_cmd->initial_rate_index = 0;
-                tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
-                return;
-        }
-
-        /**
-         * If the current TX rate stored in mac80211 has the MCS bit set, it's
-         * not really a TX rate.  Thus, we use the lowest supported rate for
-         * this band.  Also use the lowest supported rate if the stored rate
-         * index is invalid.
-         */
-        rate_idx = info->control.rates[0].idx;
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
-                        (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
-                rate_idx = rate_lowest_index(&priv->bands[info->band],
-                                info->control.sta);
-        /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
-        if (info->band == IEEE80211_BAND_5GHZ)
-                rate_idx += IWL_FIRST_OFDM_RATE;
-        /* Get PLCP rate for tx_cmd->rate_n_flags */
-        rate_plcp = iwl_rates[rate_idx].plcp;
-        /* Zero out flags for this packet */
-        rate_flags = 0;
-
-        /* Set CCK flag as needed */
-        if ((rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE))
-                rate_flags |= RATE_MCS_CCK_MSK;
-
-        /* Set up RTS and CTS flags for certain packets */
-        switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
-        case cpu_to_le16(IEEE80211_STYPE_AUTH):
-        case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
-        case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
-        case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
-                if (tx_cmd->tx_flags & TX_CMD_FLG_RTS_MSK) {
-                        tx_cmd->tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                        tx_cmd->tx_flags |= TX_CMD_FLG_CTS_MSK;
-                }
-                break;
-        default:
-                break;
-        }
-
-        /* Set up antennas */
-        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
-        rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
-
-        /* Set the rate in the TX cmd */
-        tx_cmd->rate_n_flags = iwl_hw_set_rate_n_flags(rate_plcp, rate_flags);
-}
-
-static void iwl_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
-                                      struct ieee80211_tx_info *info,
-                                      struct iwl_tx_cmd *tx_cmd,
-                                      struct sk_buff *skb_frag,
-                                      int sta_id)
-{
-        struct ieee80211_key_conf *keyconf = info->control.hw_key;
-
-        switch (keyconf->alg) {
-        case ALG_CCMP:
-                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
-                memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
-                if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                        tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
-                IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
-                break;
-
-        case ALG_TKIP:
-                tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
-                ieee80211_get_tkip_key(keyconf, skb_frag,
-                        IEEE80211_TKIP_P2_KEY, tx_cmd->key);
-                IWL_DEBUG_TX(priv, "tx_cmd with tkip hwcrypto\n");
-                break;
-
-        case ALG_WEP:
-                tx_cmd->sec_ctl |= (TX_CMD_SEC_WEP |
-                        (keyconf->keyidx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT);
-
-                if (keyconf->keylen == WEP_KEY_LEN_128)
-                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
-
-                memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
-
-                IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
-                             "with key %d\n", keyconf->keyidx);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown encode alg %d\n", keyconf->alg);
-                break;
-        }
-}
-
-/*
- * start REPLY_TX command process
- */
-int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
-        struct iwl_station_priv *sta_priv = NULL;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        struct iwl_device_cmd *out_cmd;
-        struct iwl_cmd_meta *out_meta;
-        struct iwl_tx_cmd *tx_cmd;
-        int swq_id, txq_id;
-        dma_addr_t phys_addr;
-        dma_addr_t txcmd_phys;
-        dma_addr_t scratch_phys;
-        u16 len, len_org, firstlen, secondlen;
-        u16 seq_number = 0;
-        __le16 fc;
-        u8 hdr_len;
-        u8 sta_id;
-        u8 wait_write_ptr = 0;
-        u8 tid = 0;
-        u8 *qc = NULL;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_DROP(priv, "Dropping - RF KILL\n");
-                goto drop_unlock;
-        }
-
-        fc = hdr->frame_control;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (ieee80211_is_auth(fc))
-                IWL_DEBUG_TX(priv, "Sending AUTH frame\n");
-        else if (ieee80211_is_assoc_req(fc))
-                IWL_DEBUG_TX(priv, "Sending ASSOC frame\n");
-        else if (ieee80211_is_reassoc_req(fc))
-                IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
-#endif
-
-        /* drop all non-injected data frame if we are not associated */
-        if (ieee80211_is_data(fc) &&
-            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-            (!iwl_is_associated(priv) ||
-             ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id) ||
-             !priv->assoc_station_added)) {
-                IWL_DEBUG_DROP(priv, "Dropping - !iwl_is_associated\n");
-                goto drop_unlock;
-        }
-
-        hdr_len = ieee80211_hdrlen(fc);
-
-        /* Find (or create) index into station table for destination station */
-        if (info->flags & IEEE80211_TX_CTL_INJECTED)
-                sta_id = priv->hw_params.bcast_sta_id;
-        else
-                sta_id = iwl_get_sta_id(priv, hdr);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
-        }
-
-        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
-
-        if (sta)
-                sta_priv = (void *)sta->drv_priv;
-
-        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
-            sta_priv->asleep) {
-                WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
-                /*
-                 * This sends an asynchronous command to the device,
-                 * but we can rely on it being processed before the
-                 * next frame is processed -- and the next frame to
-                 * this station is the one that will consume this
-                 * counter.
-                 * For now set the counter to just 1 since we do not
-                 * support uAPSD yet.
-                 */
-                iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
-        }
-
-        txq_id = skb_get_queue_mapping(skb);
-        if (ieee80211_is_data_qos(fc)) {
-                qc = ieee80211_get_qos_ctl(hdr);
-                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
-                if (unlikely(tid >= MAX_TID_COUNT))
-                        goto drop_unlock;
-                seq_number = priv->stations[sta_id].tid[tid].seq_number;
-                seq_number &= IEEE80211_SCTL_SEQ;
-                hdr->seq_ctrl = hdr->seq_ctrl &
-                                cpu_to_le16(IEEE80211_SCTL_FRAG);
-                hdr->seq_ctrl |= cpu_to_le16(seq_number);
-                seq_number += 0x10;
-                /* aggregation is on for this <sta,tid> */
-                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
-                    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
-                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-                }
-        }
-
-        txq = &priv->txq[txq_id];
-        swq_id = txq->swq_id;
-        q = &txq->q;
-
-        if (unlikely(iwl_queue_space(q) < q->high_mark))
-                goto drop_unlock;
-
-        if (ieee80211_is_data_qos(fc))
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
-
-        /* Set up driver data for this TFD */
-        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
-        txq->txb[q->write_ptr].skb[0] = skb;
-
-        /* Set up first empty entry in queue's array of Tx/cmd buffers */
-        out_cmd = txq->cmd[q->write_ptr];
-        out_meta = &txq->meta[q->write_ptr];
-        tx_cmd = &out_cmd->cmd.tx;
-        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
-        memset(tx_cmd, 0, sizeof(struct iwl_tx_cmd));
-
-        /*
-         * Set up the Tx-command (not MAC!) header.
-         * Store the chosen Tx queue and TFD index within the sequence field;
-         * after Tx, uCode's Tx response will return this value so driver can
-         * locate the frame within the tx queue and do post-tx processing.
-         */
-        out_cmd->hdr.cmd = REPLY_TX;
-        out_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
-                                INDEX_TO_SEQ(q->write_ptr)));
-
-        /* Copy MAC header from skb into command buffer */
-        memcpy(tx_cmd->hdr, hdr, hdr_len);
-
-
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx_cmd->len = cpu_to_le16(len);
-
-        if (info->control.hw_key)
-                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
-
-        /* TODO need this for burst mode later on */
-        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
-        iwl_dbg_log_tx_data_frame(priv, len, hdr);
-
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, 0);
-
-        iwl_update_stats(priv, true, fc, len);
-        /*
-         * Use the first empty entry in this queue's command buffer array
-         * to contain the Tx command and MAC header concatenated together
-         * (payload data will be in another buffer).
-         * Size of this varies, due to varying MAC header length.
-         * If end is not dword aligned, we'll have 2 extra bytes at the end
-         * of the MAC header (device reads on dword boundaries).
-         * We'll tell device about this padding later.
-         */
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
-
-        len_org = len;
-        firstlen = len = (len + 3) & ~3;
-
-        if (len_org != len)
-                len_org = 1;
-        else
-                len_org = 0;
-
-        /* Tell NIC about any 2-byte padding after MAC header */
-        if (len_org)
-                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
-
-        /* Physical address of this Tx command's header (not MAC header!),
-         * within command buffer array. */
-        txcmd_phys = pci_map_single(priv->pci_dev,
-                                    &out_cmd->hdr, len,
-                                    PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        pci_unmap_len_set(out_meta, len, len);
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                   txcmd_phys, len, 1, 0);
-
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-                if (qc)
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
-        /* Set up TFD's 2nd entry to point directly to remainder of skb,
-         * if any (802.11 null frames have no payload). */
-        secondlen = len = skb->len - hdr_len;
-        if (len) {
-                phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
-                                           len, PCI_DMA_TODEVICE);
-                priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                           phys_addr, len,
-                                                           0, 0);
-        }
-
-        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                                offsetof(struct iwl_tx_cmd, scratch);
-
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
-        /* take back ownership of DMA buffer to enable update */
-        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
-                                    len, PCI_DMA_BIDIRECTIONAL);
-        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
-        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
-
-        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
-                     le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
-
-        /* Set up entry for this TFD in Tx byte-count array */
-        if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
-                                                     le16_to_cpu(tx_cmd->len));
-
-        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
-                                       len, PCI_DMA_BIDIRECTIONAL);
-
-        trace_iwlwifi_dev_tx(priv,
-                             &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
-                             sizeof(struct iwl_tfd),
-                             &out_cmd->hdr, firstlen,
-                             skb->data + hdr_len, secondlen);
-
-        /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        iwl_txq_update_write_ptr(priv, txq);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /*
-         * At this point the frame is "transmitted" successfully
-         * and we will get a TX status notification eventually,
-         * regardless of the value of ret. "ret" only indicates
-         * whether or not we should update the write pointer.
-         */
-
-        /* avoid atomic ops if it isn't an associated client */
-        if (sta_priv && sta_priv->client)
-                atomic_inc(&sta_priv->pending_frames);
-
-        if ((iwl_queue_space(q) < q->high_mark) && priv->mac80211_registered) {
-                if (wait_write_ptr) {
-                        spin_lock_irqsave(&priv->lock, flags);
-                        txq->need_update = 1;
-                        iwl_txq_update_write_ptr(priv, txq);
-                        spin_unlock_irqrestore(&priv->lock, flags);
-                } else {
-                        iwl_stop_queue(priv, txq->swq_id);
-                }
-        }
-
-        return 0;
-
-drop_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return -1;
-}
-EXPORT_SYMBOL(iwl_tx_skb);
-
 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
 
 /**
@@ -1192,61 +548,6 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         return idx;
 }
 
-static void iwl_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sta *sta;
-        struct iwl_station_priv *sta_priv;
-
-        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
-        if (sta) {
-                sta_priv = (void *)sta->drv_priv;
-                /* avoid atomic ops if this isn't a client */
-                if (sta_priv->client &&
-                    atomic_dec_return(&sta_priv->pending_frames) == 0)
-                        ieee80211_sta_block_awake(priv->hw, sta, false);
-        }
-
-        ieee80211_tx_status_irqsafe(priv->hw, skb);
-}
-
-int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
-{
-        struct iwl_tx_queue *txq = &priv->txq[txq_id];
-        struct iwl_queue *q = &txq->q;
-        struct iwl_tx_info *tx_info;
-        int nfreed = 0;
-        struct ieee80211_hdr *hdr;
-
-        if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
-                IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
-                          "is out of range [0-%d] %d %d.\n", txq_id,
-                          index, q->n_bd, q->write_ptr, q->read_ptr);
-                return 0;
-        }
-
-        for (index = iwl_queue_inc_wrap(index, q->n_bd);
-             q->read_ptr != index;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
-
-                tx_info = &txq->txb[txq->q.read_ptr];
-                iwl_tx_status(priv, tx_info->skb[0]);
-
-                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
-                        nfreed++;
-                tx_info->skb[0] = NULL;
-
-                if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
-                        priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
-
-                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-        }
-        return nfreed;
-}
-EXPORT_SYMBOL(iwl_tx_queue_reclaim);
-
-
 /**
  * iwl_hcmd_queue_reclaim - Reclaim TX command queue entries already Tx'd
  *
@@ -1340,7 +641,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 
         if (!(meta->flags & CMD_ASYNC)) {
                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                                get_cmd_string(cmd->hdr.cmd));
                 wake_up_interruptible(&priv->wait_command_queue);
         }
@@ -1348,358 +649,37 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
 
-/*
- * Find first available (lowest unused) Tx Queue, mark it "active".
- * Called only when finding queue for aggregation.
- * Should never return anything < 7, because they should already
- * be in use as EDCA AC (0-3), Command (4), HCCA (5, 6).
- */
-static int iwl_txq_ctx_activate_free(struct iwl_priv *priv)
-{
-        int txq_id;
-
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (!test_and_set_bit(txq_id, &priv->txq_ctx_active_msk))
-                        return txq_id;
-        return -1;
-}
-
-int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
-{
-        int sta_id;
-        int tx_fifo;
-        int txq_id;
-        int ret;
-        unsigned long flags;
-        struct iwl_tid_data *tid_data;
-
-        if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
-                tx_fifo = default_tid_to_tx_fifo[tid];
-        else
-                return -EINVAL;
-
-        IWL_WARN(priv, "%s on ra = %pM tid = %d\n",
-                        __func__, ra, tid);
-
-        sta_id = iwl_find_station(priv, ra);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Start AGG on invalid station\n");
-                return -ENXIO;
-        }
-        if (unlikely(tid >= MAX_TID_COUNT))
-                return -EINVAL;
-
-        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
-                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
-                return -ENXIO;
-        }
-
-        txq_id = iwl_txq_ctx_activate_free(priv);
-        if (txq_id == -1) {
-                IWL_ERR(priv, "No free aggregation queue available\n");
-                return -ENXIO;
-        }
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        tid_data = &priv->stations[sta_id].tid[tid];
-        *ssn = SEQ_TO_SN(tid_data->seq_number);
-        tid_data->agg.txq_id = txq_id;
-        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(tx_fifo, txq_id);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
-                                                  sta_id, tid, *ssn);
-        if (ret)
-                return ret;
-
-        if (tid_data->tfds_in_queue == 0) {
-                IWL_DEBUG_HT(priv, "HW queue is empty\n");
-                tid_data->agg.state = IWL_AGG_ON;
-                ieee80211_start_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-        } else {
-                IWL_DEBUG_HT(priv, "HW queue is NOT empty: %d packets in HW queue\n",
-                             tid_data->tfds_in_queue);
-                tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
-        }
-        return ret;
-}
-EXPORT_SYMBOL(iwl_tx_agg_start);
-
-int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
-{
-        int tx_fifo_id, txq_id, sta_id, ssn = -1;
-        struct iwl_tid_data *tid_data;
-        int write_ptr, read_ptr;
-        unsigned long flags;
-
-        if (!ra) {
-                IWL_ERR(priv, "ra = NULL\n");
-                return -EINVAL;
-        }
-
-        if (unlikely(tid >= MAX_TID_COUNT))
-                return -EINVAL;
-
-        if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
-                tx_fifo_id = default_tid_to_tx_fifo[tid];
-        else
-                return -EINVAL;
-
-        sta_id = iwl_find_station(priv, ra);
-
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
-                return -ENXIO;
-        }
-
-        if (priv->stations[sta_id].tid[tid].agg.state ==
-                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
-                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
-                ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
-                return 0;
-        }
-
-        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
-                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
-
-        tid_data = &priv->stations[sta_id].tid[tid];
-        ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
-        txq_id = tid_data->agg.txq_id;
-        write_ptr = priv->txq[txq_id].q.write_ptr;
-        read_ptr = priv->txq[txq_id].q.read_ptr;
-
-        /* The queue is not empty */
-        if (write_ptr != read_ptr) {
-                IWL_DEBUG_HT(priv, "Stopping a non empty AGG HW QUEUE\n");
-                priv->stations[sta_id].tid[tid].agg.state =
-                                IWL_EMPTYING_HW_QUEUE_DELBA;
-                return 0;
-        }
-
-        IWL_DEBUG_HT(priv, "HW queue is empty\n");
-        priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        /*
-         * the only reason this call can fail is queue number out of range,
-         * which can happen if uCode is reloaded and all the station
-         * information are lost. if it is outside the range, there is no need
-         * to deactivate the uCode queue, just return "success" to allow
-         *  mac80211 to clean up it own data.
-         */
-        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
-                                                   tx_fifo_id);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_tx_agg_stop);
-
-int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id)
-{
-        struct iwl_queue *q = &priv->txq[txq_id].q;
-        u8 *addr = priv->stations[sta_id].sta.sta.addr;
-        struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
-
-        switch (priv->stations[sta_id].tid[tid].agg.state) {
-        case IWL_EMPTYING_HW_QUEUE_DELBA:
-                /* We are reclaiming the last packet of the */
-                /* aggregated HW queue */
-                if ((txq_id  == tid_data->agg.txq_id) &&
-                    (q->read_ptr == q->write_ptr)) {
-                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
-                        int tx_fifo = default_tid_to_tx_fifo[tid];
-                        IWL_DEBUG_HT(priv, "HW queue empty: continue DELBA flow\n");
-                        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
-                                                             ssn, tx_fifo);
-                        tid_data->agg.state = IWL_AGG_OFF;
-                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
-                }
-                break;
-        case IWL_EMPTYING_HW_QUEUE_ADDBA:
-                /* We are reclaiming the last packet of the queue */
-                if (tid_data->tfds_in_queue == 0) {
-                        IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
-                        tid_data->agg.state = IWL_AGG_ON;
-                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
-                }
-                break;
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iwl_txq_check_empty);
-
-/**
- * iwl_tx_status_reply_compressed_ba - Update tx status from block-ack
- *
- * Go through block-ack's bitmap of ACK'd frames, update driver's record of
- * ACK vs. not.  This gets sent to mac80211, then to rate scaling algo.
- */
-static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
-                                 struct iwl_ht_agg *agg,
-                                 struct iwl_compressed_ba_resp *ba_resp)
-
-{
-        int i, sh, ack;
-        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
-        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
-        u64 bitmap;
-        int successes = 0;
-        struct ieee80211_tx_info *info;
-
-        if (unlikely(!agg->wait_for_ba))  {
-                IWL_ERR(priv, "Received BA when not expected\n");
-                return -EINVAL;
-        }
-
-        /* Mark that the expected block-ack response arrived */
-        agg->wait_for_ba = 0;
-        IWL_DEBUG_TX_REPLY(priv, "BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
-
-        /* Calculate shift to align block-ack bits with our Tx window bits */
-        sh = agg->start_idx - SEQ_TO_INDEX(seq_ctl >> 4);
-        if (sh < 0) /* tbw something is wrong with indices */
-                sh += 0x100;
-
-        /* don't use 64-bit values for now */
-        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
-
-        if (agg->frame_count > (64 - sh)) {
-                IWL_DEBUG_TX_REPLY(priv, "more frames than bitmap size");
-                return -1;
-        }
-
-        /* check for success or failure according to the
-         * transmitted bitmap and block-ack bitmap */
-        bitmap &= agg->bitmap;
-
-        /* For each frame attempted in aggregation,
-         * update driver's record of tx frame's status. */
-        for (i = 0; i < agg->frame_count ; i++) {
-                ack = bitmap & (1ULL << i);
-                successes += !!ack;
-                IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
-                        ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
-                        agg->start_idx + i);
-        }
-
-        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
-        memset(&info->status, 0, sizeof(info->status));
-        info->flags |= IEEE80211_TX_STAT_ACK;
-        info->flags |= IEEE80211_TX_STAT_AMPDU;
-        info->status.ampdu_ack_map = successes;
-        info->status.ampdu_ack_len = agg->frame_count;
-        iwl_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
-
-        IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
-
-        return 0;
-}
-
-/**
- * iwl_rx_reply_compressed_ba - Handler for REPLY_COMPRESSED_BA
- *
- * Handles block-acknowledge notification from device, which reports success
- * of frames sent via aggregation.
- */
-void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
-                                           struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
-        struct iwl_tx_queue *txq = NULL;
-        struct iwl_ht_agg *agg;
-        int index;
-        int sta_id;
-        int tid;
-
-        /* "flow" corresponds to Tx queue */
-        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
-
-        /* "ssn" is start of block-ack Tx window, corresponds to index
-         * (in Tx queue's circular buffer) of first TFD/frame in window */
-        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
-
-        if (scd_flow >= priv->hw_params.max_txq_num) {
-                IWL_ERR(priv,
-                        "BUG_ON scd_flow is bigger than number of queues\n");
-                return;
-        }
-
-        txq = &priv->txq[scd_flow];
-        sta_id = ba_resp->sta_id;
-        tid = ba_resp->tid;
-        agg = &priv->stations[sta_id].tid[tid].agg;
-
-        /* Find index just before block-ack window */
-        index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
-
-        /* TODO: Need to get this copy more safely - now good for debug */
-
-        IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
-                           "sta_id = %d\n",
-                           agg->wait_for_ba,
-                           (u8 *) &ba_resp->sta_addr_lo32,
-                           ba_resp->sta_id);
-        IWL_DEBUG_TX_REPLY(priv, "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = "
-                           "%d, scd_ssn = %d\n",
-                           ba_resp->tid,
-                           ba_resp->seq_ctl,
-                           (unsigned long long)le64_to_cpu(ba_resp->bitmap),
-                           ba_resp->scd_flow,
-                           ba_resp->scd_ssn);
-        IWL_DEBUG_TX_REPLY(priv, "DAT start_idx = %d, bitmap = 0x%llx \n",
-                           agg->start_idx,
-                           (unsigned long long)agg->bitmap);
-
-        /* Update driver's record of ACK vs. not for each frame in window */
-        iwl_tx_status_reply_compressed_ba(priv, agg, ba_resp);
-
-        /* Release all TFDs before the SSN, i.e. all TFDs in front of
-         * block-ack window (we assume that they've been successfully
-         * transmitted ... if not, it's too late anyway). */
-        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
-                /* calculate mac80211 ampdu sw queue to wake */
-                int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                    priv->mac80211_registered &&
-                    (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
-                        iwl_wake_queue(priv, txq->swq_id);
-
-                iwl_txq_check_empty(priv, sta_id, tid, scd_flow);
-        }
-}
-EXPORT_SYMBOL(iwl_rx_reply_compressed_ba);
-
 #ifdef CONFIG_IWLWIFI_DEBUG
-#define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
+#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
+#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
 
 const char *iwl_get_tx_fail_reason(u32 status)
 {
         switch (status & TX_STATUS_MSK) {
         case TX_STATUS_SUCCESS:
                 return "SUCCESS";
-                TX_STATUS_ENTRY(SHORT_LIMIT);
-                TX_STATUS_ENTRY(LONG_LIMIT);
-                TX_STATUS_ENTRY(FIFO_UNDERRUN);
-                TX_STATUS_ENTRY(MGMNT_ABORT);
-                TX_STATUS_ENTRY(NEXT_FRAG);
-                TX_STATUS_ENTRY(LIFE_EXPIRE);
-                TX_STATUS_ENTRY(DEST_PS);
-                TX_STATUS_ENTRY(ABORTED);
-                TX_STATUS_ENTRY(BT_RETRY);
-                TX_STATUS_ENTRY(STA_INVALID);
-                TX_STATUS_ENTRY(FRAG_DROPPED);
-                TX_STATUS_ENTRY(TID_DISABLE);
-                TX_STATUS_ENTRY(FRAME_FLUSHED);
-                TX_STATUS_ENTRY(INSUFFICIENT_CF_POLL);
-                TX_STATUS_ENTRY(TX_LOCKED);
-                TX_STATUS_ENTRY(NO_BEACON_ON_RADAR);
+                TX_STATUS_POSTPONE(DELAY);
+                TX_STATUS_POSTPONE(FEW_BYTES);
+                TX_STATUS_POSTPONE(BT_PRIO);
+                TX_STATUS_POSTPONE(QUIET_PERIOD);
+                TX_STATUS_POSTPONE(CALC_TTAK);
+                TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
+                TX_STATUS_FAIL(SHORT_LIMIT);
+                TX_STATUS_FAIL(LONG_LIMIT);
+                TX_STATUS_FAIL(FIFO_UNDERRUN);
+                TX_STATUS_FAIL(DRAIN_FLOW);
+                TX_STATUS_FAIL(RFKILL_FLUSH);
+                TX_STATUS_FAIL(LIFE_EXPIRE);
+                TX_STATUS_FAIL(DEST_PS);
+                TX_STATUS_FAIL(HOST_ABORTED);
+                TX_STATUS_FAIL(BT_RETRY);
+                TX_STATUS_FAIL(STA_INVALID);
+                TX_STATUS_FAIL(FRAG_DROPPED);
+                TX_STATUS_FAIL(TID_DISABLE);
+                TX_STATUS_FAIL(FIFO_FLUSHED);
+                TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
+                TX_STATUS_FAIL(FW_DROP);
+                TX_STATUS_FAIL(STA_COLOR_MISMATCH_DROP);
         }
 
         return "UNKNOWN";
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e1..3e5bffb6034f 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -352,11 +352,11 @@ static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
 
 static void iwl3945_unset_hw_params(struct iwl_priv *priv)
 {
-        if (priv->shared_virt)
+        if (priv->_3945.shared_virt)
                 dma_free_coherent(&priv->pci_dev->dev,
                                   sizeof(struct iwl3945_shared),
-                                  priv->shared_virt,
-                                  priv->shared_phys);
+                                  priv->_3945.shared_virt,
+                                  priv->_3945.shared_phys);
 }
 
 static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
@@ -505,24 +505,15 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
 #endif
 
-        /* drop all non-injected data frame if we are not associated */
-        if (ieee80211_is_data(fc) &&
-            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-            (!iwl_is_associated(priv) ||
-             ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id))) {
-                IWL_DEBUG_DROP(priv, "Dropping - !iwl_is_associated\n");
-                goto drop_unlock;
-        }
-
         spin_unlock_irqrestore(&priv->lock, flags);
 
         hdr_len = ieee80211_hdrlen(fc);
 
-        /* Find (or create) index into station table for destination station */
-        if (info->flags & IEEE80211_TX_CTL_INJECTED)
+        /* Find index into station table for destination station */
+        if (!info->control.sta)
                 sta_id = priv->hw_params.bcast_sta_id;
         else
-                sta_id = iwl_get_sta_id(priv, hdr);
+                sta_id = iwl_sta_id(info->control.sta);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -607,9 +598,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 txq->need_update = 0;
         }
 
-        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x\n",
                      le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
         iwl_print_hex_dump(priv, IWL_DL_TX, tx_cmd, sizeof(*tx_cmd));
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr,
                            ieee80211_hdrlen(fc));
@@ -754,7 +745,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         if (iwl_is_associated(priv))
                 add_time =
                     iwl3945_usecs_to_beacons(
-                        le64_to_cpu(params->start_time) - priv->last_tsf,
+                        le64_to_cpu(params->start_time) - priv->_3945.last_tsf,
                         le16_to_cpu(priv->rxon_timing.beacon_interval));
 
         memset(&spectrum, 0, sizeof(spectrum));
@@ -768,7 +759,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
 
         if (iwl_is_associated(priv))
                 spectrum.start_time =
-                    iwl3945_add_beacon_time(priv->last_beacon_time,
+                    iwl3945_add_beacon_time(priv->_3945.last_beacon_time,
                                 add_time,
                                 le16_to_cpu(priv->rxon_timing.beacon_interval));
         else
@@ -857,7 +848,6 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
 #endif
 
         IWL_DEBUG_RX(priv, "Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
-        return;
 }
 
 static void iwl3945_bg_beacon_update(struct work_struct *work)
@@ -966,7 +956,7 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
          * statistics request from the host as well as for the periodic
          * statistics notifications (after received beacons) from the uCode.
          */
-        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
+        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_reply_statistics;
         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
 
         iwl_setup_rx_scan_handlers(priv);
@@ -1613,9 +1603,6 @@ static int iwl3945_print_last_event_logs(struct iwl_priv *priv, u32 capacity,
         return pos;
 }
 
-/* For sanity check only.  Actual size is determined by uCode, typ. 512 */
-#define IWL3945_MAX_EVENT_LOG_SIZE (512)
-
 #define DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES (20)
 
 int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
@@ -1642,16 +1629,16 @@ int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         num_wraps = iwl_read_targ_mem(priv, base + (2 * sizeof(u32)));
         next_entry = iwl_read_targ_mem(priv, base + (3 * sizeof(u32)));
 
-        if (capacity > IWL3945_MAX_EVENT_LOG_SIZE) {
+        if (capacity > priv->cfg->max_event_log_size) {
                 IWL_ERR(priv, "Log capacity %d is bogus, limit to %d entries\n",
-                        capacity, IWL3945_MAX_EVENT_LOG_SIZE);
-                capacity = IWL3945_MAX_EVENT_LOG_SIZE;
+                        capacity, priv->cfg->max_event_log_size);
+                capacity = priv->cfg->max_event_log_size;
         }
 
-        if (next_entry > IWL3945_MAX_EVENT_LOG_SIZE) {
+        if (next_entry > priv->cfg->max_event_log_size) {
                 IWL_ERR(priv, "Log write index %d is bogus, limit to %d\n",
-                        next_entry, IWL3945_MAX_EVENT_LOG_SIZE);
-                next_entry = IWL3945_MAX_EVENT_LOG_SIZE;
+                        next_entry, priv->cfg->max_event_log_size);
+                next_entry = priv->cfg->max_event_log_size;
         }
 
         size = num_wraps ? capacity : next_entry;
@@ -1860,7 +1847,8 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                                          enum ieee80211_band band,
                                      u8 is_active, u8 n_probes,
-                                     struct iwl3945_scan_channel *scan_ch)
+                                     struct iwl3945_scan_channel *scan_ch,
+                                     struct ieee80211_vif *vif)
 {
         struct ieee80211_channel *chan;
         const struct ieee80211_supported_band *sband;
@@ -1874,7 +1862,7 @@ static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                 return 0;
 
         active_dwell = iwl_get_active_dwell_time(priv, band, n_probes);
-        passive_dwell = iwl_get_passive_dwell_time(priv, band);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
 
         if (passive_dwell <= active_dwell)
                 passive_dwell = active_dwell + 1;
@@ -1947,7 +1935,7 @@ static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                 added++;
         }
 
-        IWL_DEBUG_SCAN(priv, "total channels to scan %d \n", added);
+        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
         return added;
 }
 
@@ -2122,6 +2110,28 @@ static void iwl3945_nic_start(struct iwl_priv *priv)
         iwl_write32(priv, CSR_RESET, 0);
 }
 
+#define IWL3945_UCODE_GET(item)                                         \
+static u32 iwl3945_ucode_get_##item(const struct iwl_ucode_header *ucode)\
+{                                                                       \
+        return le32_to_cpu(ucode->u.v1.item);                           \
+}
+
+static u32 iwl3945_ucode_get_header_size(u32 api_ver)
+{
+        return 24;
+}
+
+static u8 *iwl3945_ucode_get_data(const struct iwl_ucode_header *ucode)
+{
+        return (u8 *) ucode->u.v1.data;
+}
+
+IWL3945_UCODE_GET(inst_size);
+IWL3945_UCODE_GET(data_size);
+IWL3945_UCODE_GET(init_size);
+IWL3945_UCODE_GET(init_data_size);
+IWL3945_UCODE_GET(boot_size);
+
 /**
  * iwl3945_read_ucode - Read uCode images from disk file.
  *
@@ -2170,7 +2180,7 @@ static int iwl3945_read_ucode(struct iwl_priv *priv)
                 goto error;
 
         /* Make sure that we got at least our header! */
-        if (ucode_raw->size <  priv->cfg->ops->ucode->get_header_size(1)) {
+        if (ucode_raw->size <  iwl3945_ucode_get_header_size(1)) {
                 IWL_ERR(priv, "File size way too small!\n");
                 ret = -EINVAL;
                 goto err_release;
@@ -2181,13 +2191,12 @@ static int iwl3945_read_ucode(struct iwl_priv *priv)
 
         priv->ucode_ver = le32_to_cpu(ucode->ver);
         api_ver = IWL_UCODE_API(priv->ucode_ver);
-        inst_size = priv->cfg->ops->ucode->get_inst_size(ucode, api_ver);
-        data_size = priv->cfg->ops->ucode->get_data_size(ucode, api_ver);
-        init_size = priv->cfg->ops->ucode->get_init_size(ucode, api_ver);
-        init_data_size =
-                priv->cfg->ops->ucode->get_init_data_size(ucode, api_ver);
-        boot_size = priv->cfg->ops->ucode->get_boot_size(ucode, api_ver);
-        src = priv->cfg->ops->ucode->get_data(ucode, api_ver);
+        inst_size = iwl3945_ucode_get_inst_size(ucode);
+        data_size = iwl3945_ucode_get_data_size(ucode);
+        init_size = iwl3945_ucode_get_init_size(ucode);
+        init_data_size = iwl3945_ucode_get_init_data_size(ucode);
+        boot_size = iwl3945_ucode_get_boot_size(ucode);
+        src = iwl3945_ucode_get_data(ucode);
 
         /* api_ver should match the api version forming part of the
          * firmware filename ... but we don't check for that and only rely
@@ -2236,7 +2245,7 @@ static int iwl3945_read_ucode(struct iwl_priv *priv)
 
 
         /* Verify size of file vs. image size info in file's header */
-        if (ucode_raw->size != priv->cfg->ops->ucode->get_header_size(api_ver) +
+        if (ucode_raw->size != iwl3945_ucode_get_header_size(api_ver) +
                 inst_size + data_size + init_size +
                 init_data_size + boot_size) {
 
@@ -2490,8 +2499,6 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        iwl_clear_stations_table(priv);
-
         rfkill = iwl_read_prph(priv, APMG_RFKILL_REG);
         IWL_DEBUG_INFO(priv, "RFKILL status: 0x%x\n", rfkill);
 
@@ -2513,13 +2520,19 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send commands to 3945 uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                /* Enable timer to monitor the driver queues */
+                mod_timer(&priv->monitor_recover,
+                        jiffies +
+                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+        }
+
         if (iwl_is_rfkill(priv))
                 return;
 
         ieee80211_wake_queues(priv->hw);
 
-        priv->active_rate = priv->rates_mask;
-        priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
+        priv->active_rate = IWL_RATES_MASK;
 
         iwl_power_update_mode(priv, true);
 
@@ -2531,11 +2544,11 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         } else {
                 /* Initialize our rx_config data */
-                iwl_connection_init_rx_config(priv, priv->iw_mode);
+                iwl_connection_init_rx_config(priv, NULL);
         }
 
         /* Configure Bluetooth device coexistence support */
-        iwl_send_bt_config(priv);
+        priv->cfg->ops->hcmd->send_bt_config(priv);
 
         /* Configure the adapter for unassociated operation */
         iwlcore_commit_rxon(priv);
@@ -2548,17 +2561,6 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
-        /* reassociate for ADHOC mode */
-        if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
-                struct sk_buff *beacon = ieee80211_beacon_get(priv->hw,
-                                                                priv->vif);
-                if (beacon)
-                        iwl_mac_beacon_update(priv->hw, beacon);
-        }
-
-        if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
-                iwl_set_mode(priv, priv->iw_mode);
-
         return;
 
  restart:
@@ -2580,7 +2582,10 @@ static void __iwl3945_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl_clear_stations_table(priv);
+        /* Station information will now be cleared in device */
+        iwl_clear_ucode_stations(priv);
+        iwl_dealloc_bcast_station(priv);
+        iwl_clear_driver_stations(priv);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -2661,6 +2666,10 @@ static int __iwl3945_up(struct iwl_priv *priv)
 {
         int rc, i;
 
+        rc = iwl_alloc_bcast_station(priv, false);
+        if (rc)
+                return rc;
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
                 IWL_WARN(priv, "Exit pending; will not bring the NIC up\n");
                 return -EIO;
@@ -2714,12 +2723,10 @@ static int __iwl3945_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                iwl_clear_stations_table(priv);
-
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
                  * prepare to load the "initialize" uCode */
-                priv->cfg->ops->lib->load_ucode(priv);
+                rc = priv->cfg->ops->lib->load_ucode(priv);
 
                 if (rc) {
                         IWL_ERR(priv,
@@ -2787,7 +2794,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
 static void iwl3945_rfkill_poll(struct work_struct *data)
 {
         struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, rfkill_poll.work);
+            container_of(data, struct iwl_priv, _3945.rfkill_poll.work);
         bool old_rfkill = test_bit(STATUS_RF_KILL_HW, &priv->status);
         bool new_rfkill = !(iwl_read32(priv, CSR_GP_CNTRL)
                         & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
@@ -2806,22 +2813,18 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 
         /* Keep this running, even if radio now enabled.  This will be
          * cancelled in mac_start() if system decides to start again */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
 }
 
-#define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
-static void iwl3945_bg_request_scan(struct work_struct *data)
+void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
-        struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, request_scan);
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
                 .len = sizeof(struct iwl3945_scan_cmd),
                 .flags = CMD_SIZE_HUGE,
         };
-        int rc = 0;
         struct iwl3945_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
         u8 n_probes = 0;
@@ -2830,8 +2833,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
-        mutex_lock(&priv->mutex);
-
         cancel_delayed_work(&priv->scan_check);
 
         if (!iwl_is_ready(priv)) {
@@ -2849,7 +2850,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
                 IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests  "
                                 "Ignoring second request.\n");
-                rc = -EIO;
                 goto done;
         }
 
@@ -2875,20 +2875,15 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 goto done;
         }
 
-        if (!priv->scan_bands) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to no requested bands\n");
-                goto done;
-        }
-
-        if (!priv->scan) {
-                priv->scan = kmalloc(sizeof(struct iwl3945_scan_cmd) +
-                                     IWL_MAX_SCAN_SIZE, GFP_KERNEL);
-                if (!priv->scan) {
-                        rc = -ENOMEM;
+        if (!priv->scan_cmd) {
+                priv->scan_cmd = kmalloc(sizeof(struct iwl3945_scan_cmd) +
+                                         IWL_MAX_SCAN_SIZE, GFP_KERNEL);
+                if (!priv->scan_cmd) {
+                        IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
                         goto done;
                 }
         }
-        scan = priv->scan;
+        scan = priv->scan_cmd;
         memset(scan, 0, sizeof(struct iwl3945_scan_cmd) + IWL_MAX_SCAN_SIZE);
 
         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
@@ -2904,7 +2899,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
 
                 spin_lock_irqsave(&priv->lock, flags);
-                interval = priv->beacon_int;
+                interval = vif ? vif->bss_conf.beacon_int : 0;
                 spin_unlock_irqrestore(&priv->lock, flags);
 
                 scan->suspend_time = 0;
@@ -2927,7 +2922,9 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                                scan_suspend_time, interval);
         }
 
-        if (priv->scan_request->n_ssids) {
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
                 int i, p = 0;
                 IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
                 for (i = 0; i < priv->scan_request->n_ssids; i++) {
@@ -2955,41 +2952,49 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         /* flags + rate selection */
 
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
+        switch (priv->scan_band) {
+        case IEEE80211_BAND_2GHZ:
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
                 scan->good_CRC_th = 0;
                 band = IEEE80211_BAND_2GHZ;
-        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
+                break;
+        case IEEE80211_BAND_5GHZ:
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
                 /*
                  * If active scaning is requested but a certain channel
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
-        } else {
-                IWL_WARN(priv, "Invalid scan band count\n");
+                break;
+        default:
+                IWL_WARN(priv, "Invalid scan band\n");
                 goto done;
         }
 
-        scan->tx_cmd.len = cpu_to_le16(
+        if (!priv->is_internal_short_scan) {
+                scan->tx_cmd.len = cpu_to_le16(
                         iwl_fill_probe_req(priv,
                                 (struct ieee80211_mgmt *)scan->data,
                                 priv->scan_request->ie,
                                 priv->scan_request->ie_len,
                                 IWL_MAX_SCAN_SIZE - sizeof(*scan)));
-
+        } else {
+                scan->tx_cmd.len = cpu_to_le16(
+                        iwl_fill_probe_req(priv,
+                                (struct ieee80211_mgmt *)scan->data,
+                                NULL, 0,
+                                IWL_MAX_SCAN_SIZE - sizeof(*scan)));
+        }
         /* select Rx antennas */
         scan->flags |= iwl3945_get_antenna_flags(priv);
 
-        if (iwl_is_monitor_mode(priv))
-                scan->filter_flags = RXON_FILTER_PROMISC_MSK;
-
         scan->channel_count =
                 iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
-                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
+                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
 
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
@@ -3002,14 +3007,12 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         scan->len = cpu_to_le16(cmd.len);
 
         set_bit(STATUS_SCAN_HW, &priv->status);
-        rc = iwl_send_cmd_sync(priv, &cmd);
-        if (rc)
+        if (iwl_send_cmd_sync(priv, &cmd))
                 goto done;
 
         queue_delayed_work(priv->workqueue, &priv->scan_check,
                            IWL_SCAN_CHECK_WATCHDOG);
 
-        mutex_unlock(&priv->mutex);
         return;
 
  done:
@@ -3023,7 +3026,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
-        mutex_unlock(&priv->mutex);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -3065,28 +3067,25 @@ static void iwl3945_bg_rx_replenish(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
-#define IWL_DELAY_NEXT_SCAN (HZ*2)
-
-void iwl3945_post_associate(struct iwl_priv *priv)
+void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         int rc = 0;
         struct ieee80211_conf *conf = NULL;
 
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
+        if (!vif || !priv->is_open)
+                return;
+
+        if (vif->type == NL80211_IFTYPE_AP) {
                 IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
                 return;
         }
 
-
         IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        priv->assoc_id, priv->active_rxon.bssid_addr);
+                        vif->bss_conf.aid, priv->active_rxon.bssid_addr);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if (!priv->vif || !priv->is_open)
-                return;
-
         iwl_scan_cancel_timeout(priv, 200);
 
         conf = ieee80211_get_hw_conf(priv->hw);
@@ -3095,7 +3094,7 @@ void iwl3945_post_associate(struct iwl_priv *priv)
         iwlcore_commit_rxon(priv);
 
         memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
-        iwl_setup_rxon_timing(priv);
+        iwl_setup_rxon_timing(priv, vif);
         rc = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
                               sizeof(priv->rxon_timing), &priv->rxon_timing);
         if (rc)
@@ -3104,57 +3103,40 @@ void iwl3945_post_associate(struct iwl_priv *priv)
 
         priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
 
-        priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
+        priv->staging_rxon.assoc_id = cpu_to_le16(vif->bss_conf.aid);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
-                        priv->assoc_id, priv->beacon_int);
+                        vif->bss_conf.aid, vif->bss_conf.beacon_int);
 
-        if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+        if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                if (vif->bss_conf.assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
 
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
+                if (vif->type == NL80211_IFTYPE_ADHOC)
                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-
         }
 
         iwlcore_commit_rxon(priv);
 
-        switch (priv->iw_mode) {
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 iwl3945_rate_scale_init(priv->hw, IWL_AP_ID);
                 break;
-
         case NL80211_IFTYPE_ADHOC:
-
-                priv->assoc_id = 1;
-                iwl_add_station(priv, priv->bssid, 0, CMD_SYNC, NULL);
-                iwl3945_sync_sta(priv, IWL_STA_ID,
-                                 (priv->band == IEEE80211_BAND_5GHZ) ?
-                                 IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
-                                 CMD_ASYNC);
-                iwl3945_rate_scale_init(priv->hw, IWL_STA_ID);
                 iwl3945_send_beacon_cmd(priv);
-
                 break;
-
         default:
-                 IWL_ERR(priv, "%s Should not be called in %d mode\n",
-                           __func__, priv->iw_mode);
+                IWL_ERR(priv, "%s Should not be called in %d mode\n",
+                        __func__, vif->type);
                 break;
         }
-
-        iwl_activate_qos(priv, 0);
-
-        /* we have just associated, don't start scan too early */
-        priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
 }
 
 /*****************************************************************************
@@ -3213,7 +3195,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
 
         /* ucode is running and will send rfkill notifications,
          * no need to poll the killswitch state anymore */
-        cancel_delayed_work(&priv->rfkill_poll);
+        cancel_delayed_work(&priv->_3945.rfkill_poll);
 
         iwl_led_start(priv);
 
@@ -3254,7 +3236,7 @@ static void iwl3945_mac_stop(struct ieee80211_hw *hw)
         flush_workqueue(priv->workqueue);
 
         /* start polling the killswitch state again */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -3276,7 +3258,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
-void iwl3945_config_ap(struct iwl_priv *priv)
+void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
         int rc = 0;
 
@@ -3292,7 +3274,7 @@ void iwl3945_config_ap(struct iwl_priv *priv)
 
                 /* RXON Timing */
                 memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
-                iwl_setup_rxon_timing(priv);
+                iwl_setup_rxon_timing(priv, vif);
                 rc = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
                                       sizeof(priv->rxon_timing),
                                       &priv->rxon_timing);
@@ -3300,9 +3282,10 @@ void iwl3945_config_ap(struct iwl_priv *priv)
                         IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
                                         "Attempting to continue.\n");
 
-                /* FIXME: what should be the assoc_id for AP? */
-                priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
-                if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+                priv->staging_rxon.assoc_id = 0;
+
+                if (vif->bss_conf.assoc_capability &
+                                        WLAN_CAPABILITY_SHORT_PREAMBLE)
                         priv->staging_rxon.flags |=
                                 RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
@@ -3310,22 +3293,21 @@ void iwl3945_config_ap(struct iwl_priv *priv)
                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
                 if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
-                        if (priv->assoc_capability &
-                                WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                        if (vif->bss_conf.assoc_capability &
+                                        WLAN_CAPABILITY_SHORT_SLOT_TIME)
                                 priv->staging_rxon.flags |=
                                         RXON_FLG_SHORT_SLOT_MSK;
                         else
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
 
-                        if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
+                        if (vif->type == NL80211_IFTYPE_ADHOC)
                                 priv->staging_rxon.flags &=
                                         ~RXON_FLG_SHORT_SLOT_MSK;
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
-                iwl_add_station(priv, iwl_bcast_addr, 0, CMD_SYNC, NULL);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3340,7 +3322,6 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                                struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = hw->priv;
-        const u8 *addr;
         int ret = 0;
         u8 sta_id = IWL_INVALID_STATION;
         u8 static_key;
@@ -3352,21 +3333,24 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
 
-        addr = sta ? sta->addr : iwl_bcast_addr;
         static_key = !iwl_is_associated(priv);
 
         if (!static_key) {
-                sta_id = iwl_find_station(priv, addr);
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
-                                            addr);
-                        return -EINVAL;
+                if (!sta) {
+                        sta_id = priv->hw_params.bcast_sta_id;
+                } else {
+                        sta_id = iwl_sta_id(sta);
+                        if (sta_id == IWL_INVALID_STATION) {
+                                IWL_DEBUG_MAC80211(priv,
+                                                   "leave - %pM not in station map.\n",
+                                                   sta->addr);
+                                return -EINVAL;
+                        }
                 }
         }
 
         mutex_lock(&priv->mutex);
         iwl_scan_cancel_timeout(priv, 100);
-        mutex_unlock(&priv->mutex);
 
         switch (cmd) {
         case SET_KEY:
@@ -3387,11 +3371,45 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = -EINVAL;
         }
 
+        mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
         return ret;
 }
 
+static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl3945_sta_priv *sta_priv = (void *)sta->drv_priv;
+        int ret;
+        bool is_ap = vif->type == NL80211_IFTYPE_STATION;
+        u8 sta_id;
+
+        sta_priv->common.sta_id = IWL_INVALID_STATION;
+
+        IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
+                        sta->addr);
+
+        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
+                                     &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM (%d)\n",
+                        sta->addr, ret);
+                /* Should we return success if return code is EEXIST ? */
+                return ret;
+        }
+
+        sta_priv->common.sta_id = sta_id;
+
+        /* Initialize rate scaling */
+        IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
+                       sta->addr);
+        iwl3945_rs_rate_init(priv, sta, sta_id);
+
+        return 0;
+}
 /*****************************************************************************
  *
  * sysfs attributes
@@ -3591,7 +3609,7 @@ static ssize_t store_measurement(struct device *d,
         struct iwl_priv *priv = dev_get_drvdata(d);
         struct ieee80211_measurement_params params = {
                 .channel = le16_to_cpu(priv->active_rxon.channel),
-                .start_time = cpu_to_le64(priv->last_tsf),
+                .start_time = cpu_to_le64(priv->_3945.last_tsf),
                 .duration = cpu_to_le16(1),
         };
         u8 type = IWL_MEASURE_BASIC;
@@ -3655,44 +3673,6 @@ static ssize_t show_channels(struct device *d,
 
 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
 
-static ssize_t show_statistics(struct device *d,
-                               struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        u32 size = sizeof(struct iwl3945_notif_statistics);
-        u32 len = 0, ofs = 0;
-        u8 *data = (u8 *)&priv->statistics_39;
-        int rc = 0;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-
-        if (rc) {
-                len = sprintf(buf,
-                              "Error sending statistics request: 0x%08X\n", rc);
-                return len;
-        }
-
-        while (size && (PAGE_SIZE - len)) {
-                hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
-                                   PAGE_SIZE - len, 1);
-                len = strlen(buf);
-                if (PAGE_SIZE - len)
-                        buf[len++] = '\n';
-
-                ofs += 16;
-                size -= min(size, 16U);
-        }
-
-        return len;
-}
-
-static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
-
 static ssize_t show_antenna(struct device *d,
                             struct device_attribute *attr, char *buf)
 {
@@ -3774,14 +3754,21 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl3945_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
-        INIT_DELAYED_WORK(&priv->rfkill_poll, iwl3945_rfkill_poll);
+        INIT_DELAYED_WORK(&priv->_3945.rfkill_poll, iwl3945_rfkill_poll);
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
-        INIT_WORK(&priv->request_scan, iwl3945_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 
         iwl3945_hw_setup_deferred_work(priv);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                init_timer(&priv->monitor_recover);
+                priv->monitor_recover.data = (unsigned long)priv;
+                priv->monitor_recover.function =
+                        priv->cfg->ops->lib->recover_from_tx_stall;
+        }
+
         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                      iwl3945_irq_tasklet, (unsigned long)priv);
 }
@@ -3793,7 +3780,10 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv)
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_work_sync(&priv->beacon_update);
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
 }
 
 static struct attribute *iwl3945_sysfs_entries[] = {
@@ -3804,7 +3794,6 @@ static struct attribute *iwl3945_sysfs_entries[] = {
         &dev_attr_filter_flags.attr,
         &dev_attr_measurement.attr,
         &dev_attr_retry_rate.attr,
-        &dev_attr_statistics.attr,
         &dev_attr_status.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
@@ -3831,7 +3820,9 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
-        .hw_scan = iwl_mac_hw_scan
+        .hw_scan = iwl_mac_hw_scan,
+        .sta_add = iwl3945_mac_sta_add,
+        .sta_remove = iwl_mac_sta_remove,
 };
 
 static int iwl3945_init_drv(struct iwl_priv *priv)
@@ -3850,9 +3841,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
         mutex_init(&priv->sync_cmd_mutex);
 
-        /* Clear the driver's (not device's) station table */
-        iwl_clear_stations_table(priv);
-
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -3860,12 +3848,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->iw_mode = NL80211_IFTYPE_STATION;
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
 
-        iwl_reset_qos(priv);
-
-        priv->qos_data.qos_active = 0;
-        priv->qos_data.qos_cap.val = 0;
-
-        priv->rates_mask = IWL_RATES_MASK;
         priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
 
         if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
@@ -3901,6 +3883,8 @@ err:
         return ret;
 }
 
+#define IWL3945_MAX_PROBE_REQUEST       200
+
 static int iwl3945_setup_mac(struct iwl_priv *priv)
 {
         int ret;
@@ -3908,10 +3892,10 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         hw->rate_control_algorithm = "iwl-3945-rs";
         hw->sta_data_size = sizeof(struct iwl3945_sta_priv);
+        hw->vif_data_size = sizeof(struct iwl_vif_priv);
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
         if (!priv->cfg->broken_powersave)
@@ -3927,7 +3911,7 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
         /* we create the 802.11 header and a zero-length SSID element */
-        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
+        hw->wiphy->max_scan_ie_len = IWL3945_MAX_PROBE_REQUEST - 24 - 2;
 
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
@@ -4130,7 +4114,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
         /* Start monitoring the killswitch */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            2 * HZ);
 
         return 0;
@@ -4204,7 +4188,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 
-        cancel_delayed_work_sync(&priv->rfkill_poll);
+        cancel_delayed_work_sync(&priv->_3945.rfkill_poll);
 
         iwl3945_dealloc_ucode_pci(priv);
 
@@ -4213,7 +4197,6 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         iwl3945_hw_txq_ctx_free(priv);
 
         iwl3945_unset_hw_params(priv);
-        iwl_clear_stations_table(priv);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
@@ -4235,7 +4218,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         iwl_free_channel_map(priv);
         iwlcore_free_geos(priv);
-        kfree(priv->scan);
+        kfree(priv->scan_cmd);
         if (priv->ibss_beacon)
                 dev_kfree_skb(priv->ibss_beacon);