29 files changed, 1800 insertions, 1236 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 679a67ff76eb..3a645e485dda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -110,8 +110,7 @@ static struct iwl_lib_ops iwl1000_lib = {
        .send_tx_power = iwl5000_send_tx_power,
        .update_chain_flags = iwl_update_chain_flags,
        .apm_ops = {
-                .init = iwl5000_apm_init,
+                .init = iwl_apm_init,
-                .reset = iwl5000_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl1000_nic_config,
                .set_pwr_src = iwl_set_pwr_src,
@@ -159,15 +158,20 @@ struct iwl_cfg iwl1000_bgn_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_A,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = false,
        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
        .shadow_ram_support = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl1000_bg_cfg = {
@@ -180,15 +184,20 @@ struct iwl_cfg iwl1000_bg_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_A,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = false,
        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
        .shadow_ram_support = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
 };
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 16772780c5b0..6fd10d443ba3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -71,12 +71,6 @@
 #include "iwl-eeprom.h"
-/*
- * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965.
- */
-#define IWL_CMD_QUEUE_NUM       4
 /* Time constants */
 #define SHORT_SLOT_TIME 9
 #define LONG_SLOT_TIME 20
@@ -254,12 +248,6 @@ struct iwl3945_eeprom {
 #define TFD_CTL_PAD_SET(n)         (n << 28)
 #define TFD_CTL_PAD_GET(ctl)       (ctl >> 28)
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
 /* Sizes and addresses for instruction and data memory (SRAM) in
 * 3945's embedded processor.  Driver access is via HBUS_TARG_MEM_* regs. */
 #define IWL39_RTC_INST_LOWER_BOUND              (0x000000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 4115672e2338..09a7bd2c0be4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -293,7 +293,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
 static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
                            struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
        int txq_id = SEQ_TO_QUEUE(sequence);
        int index = SEQ_TO_INDEX(sequence);
@@ -353,16 +353,12 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                     (int)sizeof(struct iwl3945_notif_statistics),
                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
        memcpy(&priv->statistics_39, pkt->u.raw, sizeof(priv->statistics_39));
-        iwl_leds_background(priv);
-        priv->last_statistics_time = jiffies;
 }
 /******************************************************************************
@@ -545,14 +541,18 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                   struct iwl_rx_mem_buffer *rxb,
                                   struct ieee80211_rx_status *stats)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
        struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
        struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        short len = le16_to_cpu(rx_hdr->len);
+        u16 len = le16_to_cpu(rx_hdr->len);
+        struct sk_buff *skb;
+        int ret;
+        __le16 fc = hdr->frame_control;
        /* We received data from the HW, so stop the watchdog */
-        if (unlikely((len + IWL39_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
+        if (unlikely(len + IWL39_RX_FRAME_SIZE >
+                     PAGE_SIZE << priv->hw_params.rx_page_order)) {
                IWL_DEBUG_DROP(priv, "Corruption detected!\n");
                return;
        }
@@ -564,20 +564,49 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                return;
        }
-        skb_reserve(rxb->skb, (void *)rx_hdr->payload - (void *)pkt);
+        skb = alloc_skb(IWL_LINK_HDR_MAX, GFP_ATOMIC);
-        /* Set the size of the skb to the size of the frame */
+        if (!skb) {
-        skb_put(rxb->skb, le16_to_cpu(rx_hdr->len));
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
        if (!iwl3945_mod_params.sw_crypto)
                iwl_set_decrypted_flag(priv,
-                                       (struct ieee80211_hdr *)rxb->skb->data,
+                                       (struct ieee80211_hdr *)rxb_addr(rxb),
                                       le32_to_cpu(rx_end->status), stats);
-        iwl_update_stats(priv, false, hdr->frame_control, len);
+        skb_add_rx_frag(skb, 0, rxb->page,
+                        (void *)rx_hdr->payload - (void *)pkt, len);
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                        0 : -ENOMEM;
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
+        /*
+         * XXX: We cannot touch the page and its virtual memory (pkt) after
+         * here. It might have already been freed by the above skb change.
+         */
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
+        ieee80211_rx(priv->hw, skb);
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
+ out:
-        rxb->skb = NULL;
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
 }
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
@@ -587,7 +616,7 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
 {
        struct ieee80211_hdr *header;
        struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
        struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
        struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
@@ -787,29 +816,31 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
        u8 data_retry_limit;
        __le32 tx_flags;
        __le16 fc = hdr->frame_control;
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
        rate = iwl3945_rates[rate_index].plcp;
-        tx_flags = tx->tx_flags;
+        tx_flags = tx_cmd->tx_flags;
        /* We need to figure out how to get the sta->supp_rates while
         * in this running context */
        rate_mask = IWL_RATES_MASK;
+        /* Set retry limit on DATA packets and Probe Responses*/
+        if (ieee80211_is_probe_resp(fc))
+                data_retry_limit = 3;
+        else
+                data_retry_limit = IWL_DEFAULT_TX_RETRY;
+        tx_cmd->data_retry_limit = data_retry_limit;
        if (tx_id >= IWL_CMD_QUEUE_NUM)
                rts_retry_limit = 3;
        else
                rts_retry_limit = 7;
-        if (ieee80211_is_probe_resp(fc)) {
+        if (data_retry_limit < rts_retry_limit)
-                data_retry_limit = 3;
+                rts_retry_limit = data_retry_limit;
-                if (data_retry_limit < rts_retry_limit)
+        tx_cmd->rts_retry_limit = rts_retry_limit;
-                        rts_retry_limit = data_retry_limit;
-        } else
-                data_retry_limit = IWL_DEFAULT_TX_RETRY;
-        if (priv->data_retry_limit != -1)
-                data_retry_limit = priv->data_retry_limit;
        if (ieee80211_is_mgmt(fc)) {
                switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
@@ -827,22 +858,20 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                }
        }
-        tx->rts_retry_limit = rts_retry_limit;
+        tx_cmd->rate = rate;
-        tx->data_retry_limit = data_retry_limit;
+        tx_cmd->tx_flags = tx_flags;
-        tx->rate = rate;
-        tx->tx_flags = tx_flags;
        /* OFDM */
-        tx->supp_rates[0] =
+        tx_cmd->supp_rates[0] =
           ((rate_mask & IWL_OFDM_RATES_MASK) >> IWL_FIRST_OFDM_RATE) & 0xFF;
        /* CCK */
-        tx->supp_rates[1] = (rate_mask & 0xF);
+        tx_cmd->supp_rates[1] = (rate_mask & 0xF);
        IWL_DEBUG_RATE(priv, "Tx sta id: %d, rate: %d (plcp), flags: 0x%4X "
                       "cck/ofdm mask: 0x%x/0x%x\n", sta_id,
-                       tx->rate, le32_to_cpu(tx->tx_flags),
+                       tx_cmd->rate, le32_to_cpu(tx_cmd->tx_flags),
-                       tx->supp_rates[1], tx->supp_rates[0]);
+                       tx_cmd->supp_rates[1], tx_cmd->supp_rates[0]);
 }
 u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
@@ -958,6 +987,11 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
        iwl3945_hw_txq_ctx_free(priv);
+        /* allocate tx queue structure */
+        rc = iwl_alloc_txq_mem(priv);
+        if (rc)
+                return rc;
        /* Tx CMD queue */
        rc = iwl3945_tx_reset(priv);
        if (rc)
@@ -982,42 +1016,25 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
        return rc;
 }
+/*
+ * Start up 3945's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
 static int iwl3945_apm_init(struct iwl_priv *priv)
 {
-        int ret;
+        int ret = iwl_apm_init(priv);
-        iwl_power_initialize(priv);
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+        /* Clear APMG (NIC's internal power management) interrupts */
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
+        iwl_write_prph(priv, APMG_RTC_INT_STT_REG, 0xFFFFFFFF);
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-        /* set "initialization complete" bit to move adapter
-        * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(20);
-        /* disable L1-Active */
+        /* Reset radio chip */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
+        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+        udelay(5);
+        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
-out:
        return ret;
 }
@@ -1142,12 +1159,16 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
        int txq_id;
        /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+        if (priv->txq)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
-                        iwl_cmd_queue_free(priv);
+                     txq_id++)
-                else
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_tx_queue_free(priv, txq_id);
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
@@ -1156,6 +1177,7 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
        /* stop SCD */
        iwl_write_prph(priv, ALM_SCD_MODE_REG, 0);
+        iwl_write_prph(priv, ALM_SCD_TXFACT_REG, 0);
        /* reset TFD queues */
        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
@@ -1168,47 +1190,6 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
        iwl3945_hw_txq_ctx_free(priv);
 }
-static int iwl3945_apm_reset(struct iwl_priv *priv)
-{
-        iwl_apm_stop_master(priv);
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(10);
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG,
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
-        iwl_write_prph(priv, APMG_RTC_INT_STT_REG,
-                                        0xFFFFFFFF);
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG,
-                                APMG_CLK_VAL_DMA_CLK_RQT |
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(10);
-        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-        udelay(5);
-        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-        /* Clear the 'host command active' bit... */
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
-        return 0;
-}
 /**
 * iwl3945_hw_reg_adjust_power_by_temp
 * return index delta into power gain settings table
@@ -1817,7 +1798,7 @@ int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power)
 static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
 {
        int rc = 0;
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
        struct iwl3945_rxon_assoc_cmd rxon_assoc;
        struct iwl_host_cmd cmd = {
                .id = REPLY_RXON_ASSOC,
@@ -1846,14 +1827,14 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
        if (rc)
                return rc;
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_RXON_ASSOC command\n");
                rc = -EIO;
        }
-        priv->alloc_rxb_skb--;
+        priv->alloc_rxb_page--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
        return rc;
 }
@@ -2001,12 +1982,6 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
        return 0;
 }
-/* will add 3945 channel switch cmd handling later */
-int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel)
-{
-        return 0;
-}
 /**
 * iwl3945_reg_txpower_periodic -  called when time to check our temperature.
 *
@@ -2516,11 +2491,10 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
        }
        /* Assign number of Usable TX queues */
-        priv->hw_params.max_txq_num = IWL39_NUM_QUEUES;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
        priv->hw_params.tfd_size = sizeof(struct iwl3945_tfd);
-        priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_3K;
+        priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_3K);
-        priv->hw_params.max_pkt_size = 2342;
        priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
        priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
        priv->hw_params.max_stations = IWL3945_STATION_COUNT;
@@ -2803,7 +2777,6 @@ static struct iwl_lib_ops iwl3945_lib = {
        .dump_nic_error_log = iwl3945_dump_nic_error_log,
        .apm_ops = {
                .init = iwl3945_apm_init,
-                .reset = iwl3945_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl3945_nic_config,
                .set_pwr_src = iwl3945_set_pwr_src,
@@ -2833,6 +2806,7 @@ static struct iwl_lib_ops iwl3945_lib = {
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
        .get_hcmd_size = iwl3945_get_hcmd_size,
        .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
 };
 static struct iwl_ops iwl3945_ops = {
@@ -2852,7 +2826,11 @@ static struct iwl_cfg iwl3945_bg_cfg = {
        .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
        .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
        .mod_params = &iwl3945_mod_params,
+        .pll_cfg_val = CSR39_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = true,
        .use_isr_legacy = true,
        .ht_greenfield_support = false,
        .led_compensation = 64,
@@ -2867,6 +2845,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
        .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
        .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
        .mod_params = &iwl3945_mod_params,
        .use_isr_legacy = true,
        .ht_greenfield_support = false,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index f3907c1079f5..ebb999a51b58 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -130,12 +130,6 @@ struct iwl3945_frame {
 #define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
 #define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -280,8 +274,6 @@ extern void iwl3945_config_ap(struct iwl_priv *priv);
 */
 extern u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *bssid);
-extern int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel);
 /*
 * Forward declare iwl-3945.c functions for iwl-base.c
 */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index b34322a32458..c606366b582c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -76,12 +76,9 @@
 /*
 * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965; map it to Tx FIFO chnl 4.
 * The first queue used for block-ack aggregation is #7 (4965 only).
 * All block-ack aggregation queues should map to Tx DMA/FIFO channel 7.
 */
-#define IWL_CMD_QUEUE_NUM       4
-#define IWL_CMD_FIFO_NUM        4
 #define IWL49_FIRST_AMPDU_QUEUE 7
 /* Time constants */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index f8eed9a4abc1..1ff465ad40d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -62,8 +62,6 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 /* module parameters */
 static struct iwl_mod_params iwl4965_mod_params = {
-        .num_of_queues = IWL49_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
        .amsdu_size_8K = 1,
        .restart_fw = 1,
        /* the rest are 0 by default */
@@ -319,64 +317,13 @@ static void iwl4965_txq_set_sched(struct iwl_priv *priv, u32 mask)
        iwl_write_prph(priv, IWL49_SCD_TXFACT, mask);
 }
-static int iwl4965_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(20);
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-out:
-        return ret;
-}
 static void iwl4965_nic_config(struct iwl_priv *priv)
 {
        unsigned long flags;
        u16 radio_cfg;
-        u16 lctl;
        spin_lock_irqsave(&priv->lock, flags);
-        lctl = iwl_pcie_link_ctl(priv);
-        /* HW bug W/A - negligible power consumption */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-ASPM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
        /* write radio config values to register */
@@ -397,46 +344,6 @@ static void iwl4965_nic_config(struct iwl_priv *priv)
        spin_unlock_irqrestore(&priv->lock, flags);
 }
-static int iwl4965_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-        iwl_apm_stop_master(priv);
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(10);
-        /* FIXME: put here L1A -L0S w/a */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0)
-                goto out;
-        udelay(10);
-        /* Enable DMA and BSM Clock */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                              APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(10);
-        /* disable L1A */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
-out:
-        return ret;
-}
 /* Reset differential Rx gains in NIC to prepare for chain noise calibration.
 * Called after every association, but this runs only once!
 *  ... once chain noise is calibrated the first time, it's good forever.  */
@@ -526,18 +433,6 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
        data->beacon_count = 0;
 }
-static void iwl4965_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                        __le32 *tx_flags)
-{
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                *tx_flags |= TX_CMD_FLG_RTS_MSK;
-                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                *tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
-}
 static void iwl4965_bg_txpower_work(struct work_struct *work)
 {
        struct iwl_priv *priv = container_of(work, struct iwl_priv,
@@ -718,6 +613,10 @@ static struct iwl_sensitivity_ranges iwl4965_sensitivity = {
        .nrg_th_cck = 100,
        .nrg_th_ofdm = 100,
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
@@ -734,19 +633,16 @@ static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
 */
 static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 {
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL49_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
-        if ((priv->cfg->mod_params->num_of_queues > IWL49_NUM_QUEUES) ||
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL49_NUM_QUEUES);
-                return -EINVAL;
-        }
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
        priv->hw_params.dma_chnl_num = FH49_TCSR_CHNL_NUM;
        priv->hw_params.scd_bc_tbls_size =
-                        IWL49_NUM_QUEUES * sizeof(struct iwl4965_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl4965_scd_bc_tbl);
        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
        priv->hw_params.max_stations = IWL4965_STATION_COUNT;
        priv->hw_params.bcast_sta_id = IWL4965_BROADCAST_ID;
@@ -757,10 +653,10 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
-        priv->hw_params.tx_chains_num = 2;
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
-        priv->hw_params.rx_chains_num = 2;
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
-        priv->hw_params.valid_tx_ant = ANT_A | ANT_B;
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
-        priv->hw_params.valid_rx_ant = ANT_A | ANT_B;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
@@ -1537,14 +1433,13 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
        return ret;
 }
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
 static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
        int rc;
        u8 band = 0;
        bool is_ht40 = false;
        u8 ctrl_chan_high = 0;
-        struct iwl4965_channel_switch_cmd cmd = { 0 };
+        struct iwl4965_channel_switch_cmd cmd;
        const struct iwl_channel_info *ch_info;
        band = priv->band == IEEE80211_BAND_2GHZ;
@@ -1565,8 +1460,11 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
        if (ch_info)
                cmd.expect_beacon = is_channel_radar(ch_info);
-        else
+        else {
-                cmd.expect_beacon = 1;
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
        rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_ht40,
                                      ctrl_chan_high, &cmd.tx_power);
@@ -1578,7 +1476,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
        rc = iwl_send_cmd_pdu(priv, REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
        return rc;
 }
-#endif
 /**
 * iwl4965_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
@@ -1775,11 +1672,13 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                   u16 ssn_idx, u8 tx_fifo)
 {
        if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                IWL_WARN(priv,
                        "queue number out of range: %d, must be %d to %d\n",
                        txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                return -EINVAL;
        }
@@ -1840,11 +1739,13 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
        u16 ra_tid;
        if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                IWL_WARN(priv,
                        "queue number out of range: %d, must be %d to %d\n",
                        txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                return -EINVAL;
        }
@@ -2048,7 +1949,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
        int txq_id = SEQ_TO_QUEUE(sequence);
        int index = SEQ_TO_INDEX(sequence);
@@ -2249,7 +2150,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
        .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
        .chain_noise_reset = iwl4965_chain_noise_reset,
        .gain_computation = iwl4965_gain_computation,
-        .rts_tx_cmd_flag = iwl4965_rts_tx_cmd_flag,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
        .calc_rssi = iwl4965_calc_rssi,
 };
@@ -2271,9 +2172,9 @@ static struct iwl_lib_ops iwl4965_lib = {
        .load_ucode = iwl4965_load_bsm,
        .dump_nic_event_log = iwl_dump_nic_event_log,
        .dump_nic_error_log = iwl_dump_nic_error_log,
+        .set_channel_switch = iwl4965_hw_channel_switch,
        .apm_ops = {
-                .init = iwl4965_apm_init,
+                .init = iwl_apm_init,
-                .reset = iwl4965_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl4965_nic_config,
                .set_pwr_src = iwl_set_pwr_src,
@@ -2323,7 +2224,14 @@ struct iwl_cfg iwl4965_agn_cfg = {
        .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
        .ops = &iwl4965_ops,
+        .num_of_queues = IWL49_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
        .mod_params = &iwl4965_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = true,
        .use_isr_legacy = true,
        .ht_greenfield_support = false,
        .broken_powersave = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 8cc3d50e7f59..d256fecc6cda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -72,115 +72,14 @@ static const u16 iwl5000_default_queue_to_tx_fifo[] = {
        IWL_TX_FIFO_HCCA_2
 };
-int iwl5000_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-        /* Set FH wait threshold to maximum (HW error during stress W/A) */
-        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
-        /* enable HAP INTA to move device L1a -> L0s */
-        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                return ret;
-        }
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-        udelay(20);
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-        return ret;
-}
-int iwl5000_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-        iwl_apm_stop_master(priv);
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(10);
-        /* FIXME: put here L1A -L0S w/a */
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-        udelay(20);
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-out:
-        return ret;
-}
 /* NIC configuration for 5000 series */
 void iwl5000_nic_config(struct iwl_priv *priv)
 {
        unsigned long flags;
        u16 radio_cfg;
-        u16 lctl;
        spin_lock_irqsave(&priv->lock, flags);
-        lctl = iwl_pcie_link_ctl(priv);
-        /* HW bug W/A */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-APSM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
        /* write radio config values to register */
@@ -279,7 +178,7 @@ static void iwl5000_gain_computation(struct iwl_priv *priv,
                        data->delta_gain_code[i] = 0;
                        continue;
                }
-                delta_g = (1000 * ((s32)average_noise[0] -
+                delta_g = (1000 * ((s32)average_noise[default_chain] -
                        (s32)average_noise[i])) / 1500;
                /* bound gain by 2 bits value max, 3rd bit is sign */
                data->delta_gain_code[i] =
@@ -372,6 +271,10 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
        .auto_corr_max_cck_mrc = 400,
        .nrg_th_cck = 95,
        .nrg_th_ofdm = 95,
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
@@ -394,6 +297,10 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
        .auto_corr_max_cck_mrc = 400,
        .nrg_th_cck = 95,
        .nrg_th_ofdm = 95,
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -458,7 +365,7 @@ static int iwl5000_send_calib_cfg(struct iwl_priv *priv)
 static void iwl5000_rx_calib_result(struct iwl_priv *priv,
                             struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
        int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
        int index;
@@ -784,18 +691,16 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
 int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((priv->cfg->mod_params->num_of_queues > IWL50_NUM_QUEUES) ||
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
-                IWL_ERR(priv,
+                priv->cfg->num_of_queues =
-                        "invalid queues_num, should be between %d and %d\n",
+                        priv->cfg->mod_params->num_of_queues;
-                        IWL_MIN_NUM_QUEUES, IWL50_NUM_QUEUES);
-                return -EINVAL;
-        }
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
        priv->hw_params.scd_bc_tbls_size =
-                        IWL50_NUM_QUEUES * sizeof(struct iwl5000_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -947,11 +852,13 @@ int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
        u16 ra_tid;
        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                IWL_WARN(priv,
                        "queue number out of range: %d, must be %d to %d\n",
                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                return -EINVAL;
        }
@@ -1005,11 +912,13 @@ int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                   u16 ssn_idx, u8 tx_fifo)
 {
        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                IWL_ERR(priv,
                        "queue number out of range: %d, must be %d to %d\n",
                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                return -EINVAL;
        }
@@ -1176,7 +1085,7 @@ static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
        int txq_id = SEQ_TO_QUEUE(sequence);
        int index = SEQ_TO_INDEX(sequence);
@@ -1473,6 +1382,36 @@ IWL5000_UCODE_GET(init_size);
 IWL5000_UCODE_GET(init_data_size);
 IWL5000_UCODE_GET(boot_size);
+static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl5000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->active_rxon.flags;
+        cmd.rxon_filter_flags = priv->active_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+        return iwl_send_cmd_sync(priv, &hcmd);
+}
 struct iwl_hcmd_ops iwl5000_hcmd = {
        .rxon_assoc = iwl5000_send_rxon_assoc,
        .commit_rxon = iwl_commit_rxon,
@@ -1520,9 +1459,9 @@ struct iwl_lib_ops iwl5000_lib = {
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
        .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
        .apm_ops = {
-                .init = iwl5000_apm_init,
+                .init = iwl_apm_init,
-                .reset = iwl5000_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl5000_nic_config,
                .set_pwr_src = iwl_set_pwr_src,
@@ -1572,9 +1511,9 @@ static struct iwl_lib_ops iwl5150_lib = {
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
        .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
        .apm_ops = {
-                .init = iwl5000_apm_init,
+                .init = iwl_apm_init,
-                .reset = iwl5000_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl5000_nic_config,
                .set_pwr_src = iwl_set_pwr_src,
@@ -1621,8 +1560,6 @@ static struct iwl_ops iwl5150_ops = {
 };
 struct iwl_mod_params iwl50_mod_params = {
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .amsdu_size_8K = 1,
        .restart_fw = 1,
        /* the rest are 0 by default */
@@ -1639,10 +1576,14 @@ struct iwl_cfg iwl5300_agn_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_ABC,
        .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1658,10 +1599,14 @@ struct iwl_cfg iwl5100_bg_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_B,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1677,10 +1622,14 @@ struct iwl_cfg iwl5100_abg_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_B,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1696,10 +1645,14 @@ struct iwl_cfg iwl5100_agn_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_B,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1715,10 +1668,14 @@ struct iwl_cfg iwl5350_agn_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_ABC,
        .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1734,10 +1691,14 @@ struct iwl_cfg iwl5150_agn_cfg = {
        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
        .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_A,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index d1f0b0b4ad0c..32466d38d1ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -52,8 +52,8 @@
 #define IWL6050_UCODE_API_MAX 4
 /* Lowest firmware API version supported */
-#define IWL6000_UCODE_API_MIN 1
+#define IWL6000_UCODE_API_MIN 4
-#define IWL6050_UCODE_API_MIN 1
+#define IWL6050_UCODE_API_MIN 4
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -121,22 +121,24 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
        .auto_corr_max_cck_mrc = 310,
        .nrg_th_cck = 97,
        .nrg_th_ofdm = 100,
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((priv->cfg->mod_params->num_of_queues > IWL50_NUM_QUEUES) ||
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
-                IWL_ERR(priv,
+                priv->cfg->num_of_queues =
-                        "invalid queues_num, should be between %d and %d\n",
+                        priv->cfg->mod_params->num_of_queues;
-                        IWL_MIN_NUM_QUEUES, IWL50_NUM_QUEUES);
-                return -EINVAL;
-        }
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
        priv->hw_params.scd_bc_tbls_size =
-                        IWL50_NUM_QUEUES * sizeof(struct iwl5000_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -170,6 +172,37 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
        return 0;
 }
+static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl6000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->active_rxon.flags;
+        cmd.rxon_filter_flags = priv->active_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+        return iwl_send_cmd_sync(priv, &hcmd);
+}
 static struct iwl_lib_ops iwl6000_lib = {
        .set_hw_params = iwl6000_hw_set_hw_params,
        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
@@ -190,9 +223,9 @@ static struct iwl_lib_ops iwl6000_lib = {
        .alive_notify = iwl5000_alive_notify,
        .send_tx_power = iwl5000_send_tx_power,
        .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl6000_hw_channel_switch,
        .apm_ops = {
-                .init = iwl5000_apm_init,
+                .init = iwl_apm_init,
-                .reset = iwl5000_apm_reset,
                .stop = iwl_apm_stop,
                .config = iwl6000_nic_config,
                .set_pwr_src = iwl_set_pwr_src,
@@ -231,6 +264,21 @@ static struct iwl_ops iwl6000_ops = {
        .led = &iwlagn_led_ops,
 };
+static struct iwl_hcmd_utils_ops iwl6050_hcmd_utils = {
+        .get_hcmd_size = iwl5000_get_hcmd_size,
+        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
+        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
+        .calc_rssi = iwl5000_calc_rssi,
+};
+static struct iwl_ops iwl6050_ops = {
+        .ucode = &iwl5000_ucode,
+        .lib = &iwl6000_lib,
+        .hcmd = &iwl5000_hcmd,
+        .utils = &iwl6050_hcmd_utils,
+        .led = &iwlagn_led_ops,
+};
 /*
 * "h": Hybrid configuration, use both internal and external Power Amplifier
@@ -245,10 +293,14 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_HYBRID,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -257,6 +309,8 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6000h_2abg_cfg = {
@@ -269,10 +323,14 @@ struct iwl_cfg iwl6000h_2abg_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_HYBRID,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -280,6 +338,8 @@ struct iwl_cfg iwl6000h_2abg_cfg = {
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6000h_2bg_cfg = {
@@ -292,10 +352,14 @@ struct iwl_cfg iwl6000h_2bg_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_HYBRID,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -303,6 +367,8 @@ struct iwl_cfg iwl6000h_2bg_cfg = {
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 /*
@@ -318,10 +384,14 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_BC,
        .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_INTERNAL,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -330,6 +400,8 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -342,10 +414,14 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_BC,
        .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_INTERNAL,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -353,6 +429,8 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -365,10 +443,14 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_BC,
        .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_INTERNAL,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -376,6 +458,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -384,22 +468,28 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .ucode_api_max = IWL6050_UCODE_API_MAX,
        .ucode_api_min = IWL6050_UCODE_API_MIN,
        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -408,21 +498,27 @@ struct iwl_cfg iwl6050_2abg_cfg = {
        .ucode_api_max = IWL6050_UCODE_API_MAX,
        .ucode_api_min = IWL6050_UCODE_API_MIN,
        .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -435,10 +531,14 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_ABC,
        .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_SYSTEM,
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
@@ -447,6 +547,8 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 struct iwl_cfg iwl6050_3agn_cfg = {
@@ -455,22 +557,28 @@ struct iwl_cfg iwl6050_3agn_cfg = {
        .ucode_api_max = IWL6050_UCODE_API_MAX,
        .ucode_api_min = IWL6050_UCODE_API_MIN,
        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
        .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
        .mod_params = &iwl50_mod_params,
        .valid_tx_ant = ANT_ABC,
        .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
        .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
        .led_compensation = 51,
        .use_rts_for_ht = true, /* use rts/cts protection */
        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index a07be29cc5e5..27d4ece4d467 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -75,106 +75,6 @@ static const u8 ant_toggle_lookup[] = {
        /*ANT_ABC  -> */ ANT_ABC,
 };
-/**
- * struct iwl_rate_scale_data -- tx success history for one rate
- */
-struct iwl_rate_scale_data {
-        u64 data;               /* bitmap of successful frames */
-        s32 success_counter;    /* number of frames successful */
-        s32 success_ratio;      /* per-cent * 128  */
-        s32 counter;            /* number of frames attempted */
-        s32 average_tpt;        /* success ratio * expected throughput */
-        unsigned long stamp;
-};
-/**
- * struct iwl_scale_tbl_info -- tx params and success history for all rates
- *
- * There are two of these in struct iwl_lq_sta,
- * one for "active", and one for "search".
- */
-struct iwl_scale_tbl_info {
-        enum iwl_table_type lq_type;
-        u8 ant_type;
-        u8 is_SGI;      /* 1 = short guard interval */
-        u8 is_ht40;     /* 1 = 40 MHz channel width */
-        u8 is_dup;      /* 1 = duplicated data streams */
-        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
-        u8 max_search;  /* maximun number of tables we can search */
-        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
-        u32 current_rate;  /* rate_n_flags, uCode API format */
-        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
-};
-struct iwl_traffic_load {
-        unsigned long time_stamp;       /* age of the oldest statistics */
-        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
-                                                 * slice */
-        u32 total;                      /* total num of packets during the
-                                         * last TID_MAX_TIME_DIFF */
-        u8 queue_count;                 /* number of queues that has
-                                         * been used since the last cleanup */
-        u8 head;                        /* start of the circular buffer */
-};
-/**
- * struct iwl_lq_sta -- driver's rate scaling private structure
- *
- * Pointer to this gets passed back and forth between driver and mac80211.
- */
-struct iwl_lq_sta {
-        u8 active_tbl;          /* index of active table, range 0-1 */
-        u8 enable_counter;      /* indicates HT mode */
-        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
-        u8 search_better_tbl;   /* 1: currently trying alternate mode */
-        s32 last_tpt;
-        /* The following determine when to search for a new mode */
-        u32 table_count_limit;
-        u32 max_failure_limit;  /* # failed frames before new search */
-        u32 max_success_limit;  /* # successful frames before new search */
-        u32 table_count;
-        u32 total_failed;       /* total failed frames, any/all rates */
-        u32 total_success;      /* total successful frames, any/all rates */
-        u64 flush_timer;        /* time staying in mode before new search */
-        u8 action_counter;      /* # mode-switch actions tried */
-        u8 is_green;
-        u8 is_dup;
-        enum ieee80211_band band;
-        u8 ibss_sta_added;
-        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
-        u32 supp_rates;
-        u16 active_legacy_rate;
-        u16 active_siso_rate;
-        u16 active_mimo2_rate;
-        u16 active_mimo3_rate;
-        u16 active_rate_basic;
-        s8 max_rate_idx;     /* Max rate set by user */
-        u8 missed_rate_counter;
-        struct iwl_link_quality_cmd lq;
-        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
-        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
-        u8 tx_agg_tid_en;
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct dentry *rs_sta_dbgfs_scale_table_file;
-        struct dentry *rs_sta_dbgfs_stats_table_file;
-        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
-        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
-        u32 dbg_fixed_rate;
-#endif
-        struct iwl_priv *drv;
-        /* used to be in sta_info */
-        int last_txrate_idx;
-        /* last tx rate_n_flags */
-        u32 last_rate_n_flags;
-        /* packets destined for this STA are aggregated */
-        u8 is_agg;
-};
 static void rs_rate_scale_perform(struct iwl_priv *priv,
                                   struct sk_buff *skb,
                                   struct ieee80211_sta *sta,
@@ -2575,19 +2475,17 @@ static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
                          gfp_t gfp)
 {
        struct iwl_lq_sta *lq_sta;
+        struct iwl_station_priv *sta_priv = (struct iwl_station_priv *) sta->drv_priv;
        struct iwl_priv *priv;
        int i, j;
        priv = (struct iwl_priv *)priv_rate;
        IWL_DEBUG_RATE(priv, "create station rate scale window\n");
-        lq_sta = kzalloc(sizeof(struct iwl_lq_sta), gfp);
+        lq_sta = &sta_priv->lq_sta;
-        if (lq_sta == NULL)
-                return NULL;
        lq_sta->lq.sta_id = 0xff;
        for (j = 0; j < LQ_SIZE; j++)
                for (i = 0; i < IWL_RATE_COUNT; i++)
                        rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
@@ -2819,11 +2717,9 @@ static void rs_free(void *priv_rate)
 static void rs_free_sta(void *priv_r, struct ieee80211_sta *sta,
                        void *priv_sta)
 {
-        struct iwl_lq_sta *lq_sta = priv_sta;
        struct iwl_priv *priv __maybe_unused = priv_r;
        IWL_DEBUG_RATE(priv, "enter\n");
-        kfree(lq_sta);
        IWL_DEBUG_RATE(priv, "leave\n");
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index 9fac530cfb7e..affc0c5a2f2c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -54,6 +54,7 @@ struct iwl3945_rate_info {
        u8 prev_table_rs;       /* prev in rate table cmd */
 };
 /*
 * These serve as indexes into
 * struct iwl_rate_info iwl_rates[IWL_RATE_COUNT];
@@ -335,6 +336,106 @@ struct iwl_rate_mcs_info {
        char    mcs[IWL_MAX_MCS_DISPLAY_SIZE];
 };
+/**
+ * struct iwl_rate_scale_data -- tx success history for one rate
+ */
+struct iwl_rate_scale_data {
+        u64 data;               /* bitmap of successful frames */
+        s32 success_counter;    /* number of frames successful */
+        s32 success_ratio;      /* per-cent * 128  */
+        s32 counter;            /* number of frames attempted */
+        s32 average_tpt;        /* success ratio * expected throughput */
+        unsigned long stamp;
+};
+/**
+ * struct iwl_scale_tbl_info -- tx params and success history for all rates
+ *
+ * There are two of these in struct iwl_lq_sta,
+ * one for "active", and one for "search".
+ */
+struct iwl_scale_tbl_info {
+        enum iwl_table_type lq_type;
+        u8 ant_type;
+        u8 is_SGI;      /* 1 = short guard interval */
+        u8 is_ht40;     /* 1 = 40 MHz channel width */
+        u8 is_dup;      /* 1 = duplicated data streams */
+        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
+        u8 max_search;  /* maximun number of tables we can search */
+        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
+        u32 current_rate;  /* rate_n_flags, uCode API format */
+        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
+};
+struct iwl_traffic_load {
+        unsigned long time_stamp;       /* age of the oldest statistics */
+        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
+                                                 * slice */
+        u32 total;                      /* total num of packets during the
+                                         * last TID_MAX_TIME_DIFF */
+        u8 queue_count;                 /* number of queues that has
+                                         * been used since the last cleanup */
+        u8 head;                        /* start of the circular buffer */
+};
+/**
+ * struct iwl_lq_sta -- driver's rate scaling private structure
+ *
+ * Pointer to this gets passed back and forth between driver and mac80211.
+ */
+struct iwl_lq_sta {
+        u8 active_tbl;          /* index of active table, range 0-1 */
+        u8 enable_counter;      /* indicates HT mode */
+        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
+        u8 search_better_tbl;   /* 1: currently trying alternate mode */
+        s32 last_tpt;
+        /* The following determine when to search for a new mode */
+        u32 table_count_limit;
+        u32 max_failure_limit;  /* # failed frames before new search */
+        u32 max_success_limit;  /* # successful frames before new search */
+        u32 table_count;
+        u32 total_failed;       /* total failed frames, any/all rates */
+        u32 total_success;      /* total successful frames, any/all rates */
+        u64 flush_timer;        /* time staying in mode before new search */
+        u8 action_counter;      /* # mode-switch actions tried */
+        u8 is_green;
+        u8 is_dup;
+        enum ieee80211_band band;
+        u8 ibss_sta_added;
+        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
+        u32 supp_rates;
+        u16 active_legacy_rate;
+        u16 active_siso_rate;
+        u16 active_mimo2_rate;
+        u16 active_mimo3_rate;
+        u16 active_rate_basic;
+        s8 max_rate_idx;     /* Max rate set by user */
+        u8 missed_rate_counter;
+        struct iwl_link_quality_cmd lq;
+        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
+        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
+        u8 tx_agg_tid_en;
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *rs_sta_dbgfs_scale_table_file;
+        struct dentry *rs_sta_dbgfs_stats_table_file;
+        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
+        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
+        u32 dbg_fixed_rate;
+#endif
+        struct iwl_priv *drv;
+        /* used to be in sta_info */
+        int last_txrate_idx;
+        /* last tx rate_n_flags */
+        u32 last_rate_n_flags;
+        /* packets destined for this STA are aggregated */
+        u8 is_agg;
+};
 static inline u8 num_of_ant(u8 mask)
 {
        return  !!((mask) & ANT_A) +
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8d7bc38fe005..fa1672e99e4b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -524,7 +524,7 @@ int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 static void iwl_rx_reply_alive(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_alive_resp *palive;
        struct delayed_work *pwork;
@@ -610,7 +610,7 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl4965_beacon_notif *beacon =
                (struct iwl4965_beacon_notif *)pkt->u.raw;
        u8 rate = iwl_hw_get_rate(beacon->beacon_notify_hdr.rate_n_flags);
@@ -634,7 +634,7 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
        unsigned long status = priv->status;
@@ -769,7 +769,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
        /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
        if (total_empty < 0)
                total_empty += RX_QUEUE_SIZE;
@@ -786,10 +786,10 @@ void iwl_rx_handle(struct iwl_priv *priv)
                rxq->queue[i] = NULL;
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
-                                 priv->hw_params.rx_buf_size + 256,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
-                                 PCI_DMA_FROMDEVICE);
+                               PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pkt = rxb_addr(rxb);
                trace_iwlwifi_dev_rx(priv, pkt,
                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
@@ -814,8 +814,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                if (priv->rx_handlers[pkt->hdr.cmd]) {
                        IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r,
                                i, get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                        priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                } else {
                        /* No handling needed */
                        IWL_DEBUG_RX(priv,
@@ -824,35 +824,45 @@ void iwl_rx_handle(struct iwl_priv *priv)
                                pkt->hdr.cmd);
                }
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
                if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
+                        /* Invoke any callbacks, transfer the buffer to caller,
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                         * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                iwl_tx_cmd_complete(priv, rxb);
                        else
                                IWL_WARN(priv, "Claim null rxb?\n");
                }
-                /* For now we just don't re-use anything.  We can tweak this
+                /* Reuse the page if possible. For notification packets and
-                 * later to try and re-use notification packets and SKBs that
+                 * SKBs that fail to Rx correctly, add them back into the
-                 * fail to Rx correctly */
+                 * rx_free list for reuse later. */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
                spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
                spin_unlock_irqrestore(&rxq->lock, flags);
                i = (i + 1) & RX_QUEUE_MASK;
                /* If there are a lot of unused frames,
                 * restock the Rx queue so ucode wont assert. */
                if (fill_rx) {
                        count++;
                        if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                iwl_rx_replenish_now(priv);
                                count = 0;
                        }
@@ -860,7 +870,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
        }
        /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
        if (fill_rx)
                iwl_rx_replenish_now(priv);
        else
@@ -907,6 +917,8 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
        }
 #endif
+        spin_unlock_irqrestore(&priv->lock, flags);
        /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
         * atomic, make sure that inta covers all the interrupts that
         * we've discovered, even if FH interrupt came in just after
@@ -928,8 +940,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_HW_ERR;
-                spin_unlock_irqrestore(&priv->lock, flags);
                return;
        }
@@ -1019,6 +1029,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
        if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                iwl_rx_handle(priv);
                priv->isr_stats.rx++;
+                iwl_leds_background(priv);
                handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
        }
@@ -1056,7 +1067,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                        "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
        }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 /* tasklet for iwlagn interrupt */
@@ -1086,6 +1096,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                inta, inta_mask);
        }
 #endif
+        spin_unlock_irqrestore(&priv->lock, flags);
        /* saved interrupt in inta variable now we can reset priv->inta */
        priv->inta = 0;
@@ -1101,8 +1114,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_HW_ERR;
-                spin_unlock_irqrestore(&priv->lock, flags);
                return;
        }
@@ -1220,6 +1231,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                    CSR_INT_PERIODIC_ENA);
                priv->isr_stats.rx++;
+                iwl_leds_background(priv);
        }
        if (inta & CSR_INT_BIT_FH_TX) {
@@ -1242,14 +1254,10 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                         inta & ~priv->inta_mask);
        }
        /* Re-enable all interrupts */
        /* only Re-enable if diabled by irq */
        if (test_bit(STATUS_INT_ENABLED, &priv->status))
                iwl_enable_interrupts(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -1899,11 +1907,9 @@ static void __iwl_down(struct iwl_priv *priv)
        udelay(5);
-        /* FIXME: apm_ops.suspend(priv) */
+        /* Stop the device, and put it in low power state */
-        if (exit_pending)
+        priv->cfg->ops->lib->apm_ops.stop(priv);
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
 exit:
        memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
@@ -2290,6 +2296,69 @@ void iwl_post_associate(struct iwl_priv *priv)
 #define UCODE_READY_TIMEOUT     (4 * HZ)
+/*
+ * Not a mac80211 entry point function, but it fits in with all the
+ * other mac80211 functions grouped here.
+ */
+static int iwl_setup_mac(struct iwl_priv *priv)
+{
+        int ret;
+        struct ieee80211_hw *hw = priv->hw;
+        hw->rate_control_algorithm = "iwl-agn-rs";
+        /* Tell mac80211 our characteristics */
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_NOISE_DBM |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_SPECTRUM_MGMT;
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+        hw->sta_data_size = sizeof(struct iwl_station_priv);
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
+        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
+        /*
+         * For now, disable PS by default because it affects
+         * RX performance significantly.
+         */
+        hw->wiphy->ps_default = false;
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        /* we create the 802.11 header and a zero-length SSID element */
+        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
+        /* Default value; 4 EDCA QOS priorities */
+        hw->queues = 4;
+        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &priv->bands[IEEE80211_BAND_2GHZ];
+        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &priv->bands[IEEE80211_BAND_5GHZ];
+        ret = ieee80211_register_hw(priv->hw);
+        if (ret) {
+                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
+                return ret;
+        }
+        priv->mac80211_registered = 1;
+        return 0;
+}
 static int iwl_mac_start(struct ieee80211_hw *hw)
 {
        struct iwl_priv *priv = hw->priv;
@@ -3187,6 +3256,15 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
                iwl_down(priv);
        }
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
        iwl_tt_exit(priv);
        /* make sure we flush any pending irq or
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 69a80d7c2e44..1f801eb9fbff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -447,11 +447,11 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
                                cpu_to_le16((u16)data->nrg_th_ofdm);
        cmd.table[HD_BARKER_CORR_TH_ADD_MIN_INDEX] =
-                                cpu_to_le16(190);
+                                cpu_to_le16(data->barker_corr_th_min);
        cmd.table[HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX] =
-                                cpu_to_le16(390);
+                                cpu_to_le16(data->barker_corr_th_min_mrc);
        cmd.table[HD_OFDM_ENERGY_TH_IN_INDEX] =
-                                cpu_to_le16(62);
+                                cpu_to_le16(data->nrg_th_cca);
        IWL_DEBUG_CALIB(priv, "ofdm: ac %u mrc %u x1 %u mrc_x1 %u thresh %u\n",
                        data->auto_corr_ofdm, data->auto_corr_ofdm_mrc,
@@ -524,6 +524,9 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
        data->auto_corr_cck_mrc = ranges->auto_corr_min_cck_mrc;
        data->nrg_th_cck = ranges->nrg_th_cck;
        data->nrg_th_ofdm = ranges->nrg_th_ofdm;
+        data->barker_corr_th_min = ranges->barker_corr_th_min;
+        data->barker_corr_th_min_mrc = ranges->barker_corr_th_min_mrc;
+        data->nrg_th_cca = ranges->nrg_th_cca;
        data->last_bad_plcp_cnt_ofdm = 0;
        data->last_fa_cnt_ofdm = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index ba3e4c837d87..954bad60355d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -109,11 +109,12 @@ enum {
        REPLY_TX_LINK_QUALITY_CMD = 0x4e, /* 4965 only */
        /* WiMAX coexistence */
-        COEX_PRIORITY_TABLE_CMD = 0x5a, /*5000 only */
+        COEX_PRIORITY_TABLE_CMD = 0x5a, /* for 5000 series and up */
        COEX_MEDIUM_NOTIFICATION = 0x5b,
        COEX_EVENT_CMD = 0x5c,
        /* Calibration */
+        TEMPERATURE_NOTIFICATION = 0x62,
        CALIBRATION_CFG_CMD = 0x65,
        CALIBRATION_RES_NOTIFICATION = 0x66,
        CALIBRATION_COMPLETE_NOTIFICATION = 0x67,
@@ -353,6 +354,9 @@ struct iwl3945_power_per_rate {
 #define POWER_TABLE_NUM_HT_OFDM_ENTRIES         32
 #define POWER_TABLE_CCK_ENTRY                   32
+#define IWL_PWR_NUM_HT_OFDM_ENTRIES             24
+#define IWL_PWR_CCK_ENTRIES                     2
 /**
 * union iwl4965_tx_power_dual_stream
 *
@@ -803,7 +807,7 @@ struct iwl3945_channel_switch_cmd {
        struct iwl3945_power_per_rate power[IWL_MAX_RATES];
 } __attribute__ ((packed));
-struct iwl_channel_switch_cmd {
+struct iwl4965_channel_switch_cmd {
        u8 band;
        u8 expect_beacon;
        __le16 channel;
@@ -813,6 +817,48 @@ struct iwl_channel_switch_cmd {
        struct iwl4965_tx_power_db tx_power;
 } __attribute__ ((packed));
+/**
+ * struct iwl5000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl5000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[2][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
+/**
+ * struct iwl6000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl6000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[3][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
 /*
 * CHANNEL_SWITCH_NOTIFICATION = 0x73 (notification only, not a command)
 */
@@ -2172,6 +2218,19 @@ struct iwl_link_quality_cmd {
        __le32 reserved2;
 } __attribute__ ((packed));
+#define BT_COEX_DISABLE (0x0)
+#define BT_COEX_MODE_2W (0x1)
+#define BT_COEX_MODE_3W (0x2)
+#define BT_COEX_MODE_4W (0x3)
+#define BT_LEAD_TIME_MIN (0x0)
+#define BT_LEAD_TIME_DEF (0x1E)
+#define BT_LEAD_TIME_MAX (0xFF)
+#define BT_MAX_KILL_MIN (0x1)
+#define BT_MAX_KILL_DEF (0x5)
+#define BT_MAX_KILL_MAX (0xFF)
 /*
 * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)
 *
@@ -3247,12 +3306,6 @@ struct iwl_missed_beacon_notif {
 *   Lower values mean higher energy; this means making sure that the value
 *   in HD_MIN_ENERGY_CCK_DET_INDEX is at or *above* "Max cck energy".
 *
- * Driver should set the following entries to fixed values:
- *
- *   HD_MIN_ENERGY_OFDM_DET_INDEX               100
- *   HD_BARKER_CORR_TH_ADD_MIN_INDEX            190
- *   HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX        390
- *   HD_OFDM_ENERGY_TH_IN_INDEX                  62
 */
 /*
@@ -3505,6 +3558,16 @@ struct iwl_wimax_coex_cmd {
 *****************************************************************************/
 struct iwl_rx_packet {
+        /*
+         * The first 4 bytes of the RX frame header contain both the RX frame
+         * size and some flags.
+         * Bit fields:
+         * 31:    flag flush RB request
+         * 30:    flag ignore TC (terminal counter) request
+         * 29:    flag fast IRQ request
+         * 28-14: Reserved
+         * 13-00: RX frame size
+         */
        __le32 len_n_flags;
        struct iwl_cmd_header hdr;
        union {
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index dc7fd87bed98..d2b56baf98fb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -604,6 +604,23 @@ void iwlcore_free_geos(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwlcore_free_geos);
+/*
+ *  iwlcore_rts_tx_cmd_flag: Set rts/cts. 3945 and 4965 only share this
+ *  function.
+ */
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags)
+{
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
+                *tx_flags |= TX_CMD_FLG_RTS_MSK;
+                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
+        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
+                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                *tx_flags |= TX_CMD_FLG_CTS_MSK;
+        }
+}
+EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
 static bool is_single_rx_stream(struct iwl_priv *priv)
 {
        return !priv->current_ht_config.is_ht ||
@@ -1264,13 +1281,18 @@ static void iwl_set_rate(struct iwl_priv *priv)
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_rxon_cmd *rxon = (void *)&priv->active_rxon;
        struct iwl_csa_notification *csa = &(pkt->u.csa_notif);
-        IWL_DEBUG_11H(priv, "CSA notif: channel %d, status %d\n",
-                      le16_to_cpu(csa->channel), le32_to_cpu(csa->status));
+        if (!le32_to_cpu(csa->status)) {
-        rxon->channel = csa->channel;
+                rxon->channel = csa->channel;
-        priv->staging_rxon.channel = csa->channel;
+                priv->staging_rxon.channel = csa->channel;
+                IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+                      le16_to_cpu(csa->channel));
+        } else
+                IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
+                      le16_to_cpu(csa->channel));
 }
 EXPORT_SYMBOL(iwl_rx_csa);
@@ -1352,6 +1374,8 @@ void iwl_apm_stop(struct iwl_priv *priv)
 {
        unsigned long flags;
+        IWL_DEBUG_INFO(priv, "Stop card, put in low power state\n");
        iwl_apm_stop_master(priv);
        spin_lock_irqsave(&priv->lock, flags);
@@ -1365,6 +1389,118 @@ void iwl_apm_stop(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_apm_stop);
+/*
+ * Start up NIC's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
+int iwl_apm_init(struct iwl_priv *priv)
+{
+        int ret = 0;
+        u16 lctl;
+        IWL_DEBUG_INFO(priv, "Init card's basic functions\n");
+        /*
+         * Use "set_bit" below rather than "write", to preserve any hardware
+         * bits already set by default after reset.
+         */
+        /* Disable L0S exit timer (platform NMI Work/Around) */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+        /*
+         * Disable L0s without affecting L1;
+         *  don't wait for ICH L0s (ICH bug W/A)
+         */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
+        /* Set FH wait threshold to maximum (HW error during stress W/A) */
+        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
+        /*
+         * Enable HAP INTA (interrupt from management bus) to
+         * wake device's PCI Express link L1a -> L0s
+         * NOTE:  This is no-op for 3945 (non-existant bit)
+         */
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
+        /*
+         * HW bug W/A - costs negligible power consumption ...
+         * Check if BIOS (or OS) enabled L1-ASPM on this device
+         */
+        if (priv->cfg->set_l0s) {
+                lctl = iwl_pcie_link_ctl(priv);
+                if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) ==
+                                        PCI_CFG_LINK_CTRL_VAL_L1_EN) {
+                        /* L1-ASPM enabled; disable(!) L0S  */
+                        iwl_set_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Enabled; Disabling L0S\n");
+                } else {
+                        /* L1-ASPM disabled; enable(!) L0S */
+                        iwl_clear_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Disabled; Enabling L0S\n");
+                }
+        }
+        /* Configure analog phase-lock-loop before activating to D0A */
+        if (priv->cfg->pll_cfg_val)
+                iwl_set_bit(priv, CSR_ANA_PLL_CFG, priv->cfg->pll_cfg_val);
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is supported, e.g. iwl_write_prph()
+         * and accesses to uCode SRAM.
+         */
+        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
+        if (ret < 0) {
+                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
+                goto out;
+        }
+        /*
+         * Enable DMA and BSM (if used) clocks, wait for them to stabilize.
+         * BSM (Boostrap State Machine) is only in 3945 and 4965;
+         * later devices (i.e. 5000 and later) have non-volatile SRAM,
+         * and don't need BSM to restore data after power-saving sleep.
+         *
+         * Write to "CLK_EN_REG"; "1" bits enable clocks, while "0" bits
+         * do not disable clocks.  This preserves any hardware bits already
+         * set by default in "CLK_CTRL_REG" after reset.
+         */
+        if (priv->cfg->use_bsm)
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT | APMG_CLK_VAL_BSM_CLK_RQT);
+        else
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT);
+        udelay(20);
+        /* Disable L1-Active */
+        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
+                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+out:
+        return ret;
+}
+EXPORT_SYMBOL(iwl_apm_init);
 void iwl_configure_filter(struct ieee80211_hw *hw,
                          unsigned int changed_flags,
                          unsigned int *total_flags,
@@ -1412,73 +1548,14 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(iwl_configure_filter);
-int iwl_setup_mac(struct iwl_priv *priv)
-{
-        int ret;
-        struct ieee80211_hw *hw = priv->hw;
-        hw->rate_control_algorithm = "iwl-agn-rs";
-        /* Tell mac80211 our characteristics */
-        hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_SPECTRUM_MGMT;
-        if (!priv->cfg->broken_powersave)
-                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
-                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
-        hw->wiphy->custom_regulatory = true;
-        /* Firmware does not support this */
-        hw->wiphy->disable_beacon_hints = true;
-        /*
-         * For now, disable PS by default because it affects
-         * RX performance significantly.
-         */
-        hw->wiphy->ps_default = false;
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
-        /* we create the 802.11 header and a zero-length SSID element */
-        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
-        /* Default value; 4 EDCA QOS priorities */
-        hw->queues = 4;
-        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
-        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
-                        &priv->bands[IEEE80211_BAND_2GHZ];
-        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
-                        &priv->bands[IEEE80211_BAND_5GHZ];
-        ret = ieee80211_register_hw(priv->hw);
-        if (ret) {
-                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
-                return ret;
-        }
-        priv->mac80211_registered = 1;
-        return 0;
-}
-EXPORT_SYMBOL(iwl_setup_mac);
 int iwl_set_hw_params(struct iwl_priv *priv)
 {
        priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
        priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
        if (priv->cfg->mod_params->amsdu_size_8K)
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_8K;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
        else
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_4K;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
-        priv->hw_params.max_pkt_size = priv->hw_params.rx_buf_size - 256;
        priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
@@ -1507,7 +1584,6 @@ int iwl_init_drv(struct iwl_priv *priv)
        /* Clear the driver's (not device's) station table */
        iwl_clear_stations_table(priv);
-        priv->data_retry_limit = -1;
        priv->ieee_channels = NULL;
        priv->ieee_rates = NULL;
        priv->band = IEEE80211_BAND_2GHZ;
@@ -1932,9 +2008,9 @@ EXPORT_SYMBOL(iwl_isr_legacy);
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
        struct iwl_bt_cmd bt_cmd = {
-                .flags = 3,
+                .flags = BT_COEX_MODE_4W,
-                .lead_time = 0xAA,
+                .lead_time = BT_LEAD_TIME_DEF,
-                .max_kill = 1,
+                .max_kill = BT_MAX_KILL_DEF,
                .kill_ack_mask = 0,
                .kill_cts_mask = 0,
        };
@@ -2094,10 +2170,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
        spin_unlock_irqrestore(&priv->lock, flags);
        priv->thermal_throttle.ct_kill_toggle = false;
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        if (priv->cfg->support_ct_kill_exit) {
-        case CSR_HW_REV_TYPE_1000:
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
                adv_cmd.critical_temperature_enter =
                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
                adv_cmd.critical_temperature_exit =
@@ -2114,8 +2187,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                        "exit is %d\n",
                                       priv->hw_params.ct_kill_threshold,
                                       priv->hw_params.ct_kill_exit_threshold);
-                break;
+        } else {
-        default:
                cmd.critical_temperature_R =
                        cpu_to_le32(priv->hw_params.ct_kill_threshold);
@@ -2128,7 +2200,6 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                        "succeeded, "
                                        "critical temperature is %d\n",
                                        priv->hw_params.ct_kill_threshold);
-                break;
        }
 }
 EXPORT_SYMBOL(iwl_rf_kill_ct_config);
@@ -2160,7 +2231,7 @@ void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
                           struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
@@ -2171,7 +2242,7 @@ EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
 void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
                                      struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                        "notification for %s:\n", len,
@@ -2183,7 +2254,7 @@ EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
 void iwl_rx_reply_error(struct iwl_priv *priv,
                        struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
                "seq 0x%04X ser 0x%08X\n",
@@ -2648,6 +2719,14 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                        goto set_ch_out;
                }
+                if (iwl_is_associated(priv) &&
+                    (le16_to_cpu(priv->active_rxon.channel) != ch) &&
+                    priv->cfg->ops->lib->set_channel_switch) {
+                        ret = priv->cfg->ops->lib->set_channel_switch(priv,
+                                ch);
+                        goto out;
+                }
                spin_lock_irqsave(&priv->lock, flags);
                /* Configure HT40 channels */
@@ -2826,6 +2905,27 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(iwl_mac_reset_tsf);
+int iwl_alloc_txq_mem(struct iwl_priv *priv)
+{
+        if (!priv->txq)
+                priv->txq = kzalloc(
+                        sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
+                        GFP_KERNEL);
+        if (!priv->txq) {
+                IWL_ERR(priv, "Not enough memory for txq \n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwl_alloc_txq_mem);
+void iwl_free_txq_mem(struct iwl_priv *priv)
+{
+        kfree(priv->txq);
+        priv->txq = NULL;
+}
+EXPORT_SYMBOL(iwl_free_txq_mem);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 #define IWL_TRAFFIC_DUMP_SIZE   (IWL_TRAFFIC_ENTRY_SIZE * IWL_TRAFFIC_ENTRIES)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 6688b6944200..b875dcfca2d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -109,7 +109,6 @@ struct iwl_hcmd_utils_ops {
 struct iwl_apm_ops {
        int (*init)(struct iwl_priv *priv);
-        int (*reset)(struct iwl_priv *priv);
        void (*stop)(struct iwl_priv *priv);
        void (*config)(struct iwl_priv *priv);
        int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
@@ -170,6 +169,7 @@ struct iwl_lib_ops {
        int (*load_ucode)(struct iwl_priv *priv);
        void (*dump_nic_event_log)(struct iwl_priv *priv);
        void (*dump_nic_error_log)(struct iwl_priv *priv);
+        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
        /* power management */
        struct iwl_apm_ops apm_ops;
@@ -205,7 +205,6 @@ struct iwl_mod_params {
        int sw_crypto;          /* def: 0 = using hardware encryption */
        int disable_hw_scan;    /* def: 0 = use h/w scan */
        int num_of_queues;      /* def: HW dependent */
-        int num_of_ampdu_queues;/* def: HW dependent */
        int disable_11n;        /* def: 0 = 11n capabilities enabled */
        int amsdu_size_8K;      /* def: 1 = enable 8K amsdu size */
        int antenna;            /* def: 0 = both antennas (use diversity) */
@@ -227,6 +226,8 @@ struct iwl_mod_params {
 *      The detail algorithm is described in iwl-led.c
 * @use_rts_for_ht: use rts/cts protection for HT traffic
 * @chain_noise_num_beacons: number of beacons used to compute chain noise
+ * @adv_thermal_throttle: support advance thermal throttle
+ * @support_ct_kill_exit: support ct kill exit condition
 *
 * We enable the driver to be backward compatible wrt API version. The
 * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -258,11 +259,18 @@ struct iwl_cfg {
        int eeprom_size;
        u16  eeprom_ver;
        u16  eeprom_calib_ver;
+        int num_of_queues;      /* def: HW dependent */
+        int num_of_ampdu_queues;/* def: HW dependent */
        const struct iwl_ops *ops;
        const struct iwl_mod_params *mod_params;
        u8   valid_tx_ant;
        u8   valid_rx_ant;
-        bool need_pll_cfg;
+        /* for iwl_apm_init() */
+        u32 pll_cfg_val;
+        bool set_l0s;
+        bool use_bsm;
        bool use_isr_legacy;
        enum iwl_pa_type pa_type;
        const u16 max_ll_items;
@@ -273,6 +281,8 @@ struct iwl_cfg {
        bool use_rts_for_ht;
        int chain_noise_num_beacons;
        const bool supports_idle;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
 };
 /***************************
@@ -305,7 +315,6 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                          unsigned int changed_flags,
                          unsigned int *total_flags, u64 multicast);
 int iwl_hw_nic_init(struct iwl_priv *priv);
-int iwl_setup_mac(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
 int iwl_init_drv(struct iwl_priv *priv);
 void iwl_uninit_drv(struct iwl_priv *priv);
@@ -327,6 +336,10 @@ void iwl_config_ap(struct iwl_priv *priv);
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
                         struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
+int iwl_alloc_txq_mem(struct iwl_priv *priv);
+void iwl_free_txq_mem(struct iwl_priv *priv);
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
 void iwl_free_traffic_mem(struct iwl_priv *priv);
@@ -527,7 +540,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv, u8 id, u16 len,
                           const void *data,
                           void (*callback)(struct iwl_priv *priv,
                                            struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb));
+                                            struct iwl_rx_packet *pkt));
 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd);
@@ -660,6 +673,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb);
 void iwl_apm_stop(struct iwl_priv *priv);
 int iwl_apm_stop_master(struct iwl_priv *priv);
+int iwl_apm_init(struct iwl_priv *priv);
 void iwl_setup_rxon_timing(struct iwl_priv *priv);
 static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 8f183e0fa512..b6ed5a3147a1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -109,8 +109,9 @@
 * Bit fields:
 *  3-2:  0 = A, 1 = B, 2 = C, 3 = D step
 */
-#define CSR_HW_REV_WA_REG       (CSR_BASE+0x22C)
+#define CSR_HW_REV_WA_REG               (CSR_BASE+0x22C)
-#define CSR_DBG_HPET_MEM_REG    (CSR_BASE+0x240)
+#define CSR_DBG_HPET_MEM_REG            (CSR_BASE+0x240)
+#define CSR_DBG_LINK_PWR_MGMT_REG       (CSR_BASE+0x250)
 /* Bits for CSR_HW_IF_CONFIG_REG */
 #define CSR49_HW_IF_CONFIG_REG_BIT_4965_R       (0x00000010)
@@ -195,6 +196,7 @@
 #define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
 #define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
 #define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
+#define CSR_RESET_LINK_PWR_MGMT_DISABLED             (0x80000000)
 /* GP (general purpose) CONTROL */
 #define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
@@ -235,6 +237,11 @@
 #define CSR_OTP_GP_REG_OTP_ACCESS_MODE  (0x00020000) /* 0 - absolute, 1 - relative */
 #define CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK          (0x00100000) /* bit 20 */
 #define CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK        (0x00200000) /* bit 21 */
+#define CSR_GP_REG_POWER_SAVE_STATUS_MSK            (0x03000000) /* bit 24/25 */
+#define CSR_GP_REG_NO_POWER_SAVE            (0x00000000)
+#define CSR_GP_REG_MAC_POWER_SAVE           (0x01000000)
+#define CSR_GP_REG_PHY_POWER_SAVE           (0x02000000)
+#define CSR_GP_REG_POWER_SAVE_ERROR         (0x03000000)
 /* EEPROM signature */
 #define CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP    (0x00000000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index b9ca475cc61c..96c92eab692a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -106,6 +106,7 @@ struct iwl_debugfs {
                struct dentry *file_sensitivity;
                struct dentry *file_chain_noise;
                struct dentry *file_tx_power;
+                struct dentry *file_power_save_status;
        } dbgfs_debug_files;
        u32 sram_offset;
        u32 sram_len;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 1794b9c4e6ac..8784911fd56e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -801,15 +801,20 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
         * valid here. However, let's not confuse them and present
         * IWL_POWER_INDEX_1 as "1", not "0".
         */
-        if (value > 0)
+        if (value == 0)
+                return -EINVAL;
+        else if (value > 0)
                value -= 1;
        if (value != -1 && (value < 0 || value >= IWL_POWER_NUM))
                return -EINVAL;
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
        priv->power_data.debug_sleep_level_override = value;
-        iwl_power_update_mode(priv, false);
+        iwl_power_update_mode(priv, true);
        return count;
 }
@@ -882,10 +887,14 @@ static ssize_t iwl_dbgfs_traffic_log_read(struct file *file,
        struct iwl_rx_queue *rxq = &priv->rxq;
        char *buf;
        int bufsz = ((IWL_TRAFFIC_ENTRIES * IWL_TRAFFIC_ENTRY_SIZE * 64) * 2) +
-                (IWL_MAX_NUM_QUEUES * 32 * 8) + 400;
+                (priv->cfg->num_of_queues * 32 * 8) + 400;
        const u8 *ptr;
        ssize_t ret;
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
        buf = kzalloc(bufsz, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate buffer\n");
@@ -977,8 +986,12 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
        int pos = 0;
        int cnt;
        int ret;
-        const size_t bufsz = sizeof(char) * 60 * IWL_MAX_NUM_QUEUES;
+        const size_t bufsz = sizeof(char) * 60 * priv->cfg->num_of_queues;
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
        buf = kzalloc(bufsz, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;
@@ -1069,10 +1082,10 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                sizeof(struct statistics_rx_non_phy) * 20 +
                sizeof(struct statistics_rx_ht_phy) * 20 + 400;
        ssize_t ret;
-        struct statistics_rx_phy *ofdm;
+        struct statistics_rx_phy *ofdm, *accum_ofdm;
-        struct statistics_rx_phy *cck;
+        struct statistics_rx_phy *cck, *accum_cck;
-        struct statistics_rx_non_phy *general;
+        struct statistics_rx_non_phy *general, *accum_general;
-        struct statistics_rx_ht_phy *ht;
+        struct statistics_rx_ht_phy *ht, *accum_ht;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
@@ -1101,155 +1114,268 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
        cck = &priv->statistics.rx.cck;
        general = &priv->statistics.rx.general;
        ht = &priv->statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->accum_statistics.rx.ofdm;
+        accum_cck = &priv->accum_statistics.rx.cck;
+        accum_general = &priv->accum_statistics.rx.general;
+        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->ina_cnt));
+                        "\t\t\tcurrent\t\t\taccumulative\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->fina_cnt));
+                         le32_to_cpu(ofdm->ina_cnt), accum_ofdm->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->plcp_err));
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->crc32_err));
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->overrun_err));
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->early_overrun_err));
+                         "overrun_err:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(ofdm->overrun_err),
-                         le32_to_cpu(ofdm->crc32_good));
+                         accum_ofdm->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->false_alarm_cnt));
+                         "early_overrun_err:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
+                         le32_to_cpu(ofdm->early_overrun_err),
-                         le32_to_cpu(ofdm->fina_sync_err_cnt));
+                         accum_ofdm->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->sfd_timeout));
+                         le32_to_cpu(ofdm->crc32_good),
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
+                         accum_ofdm->crc32_good);
-                         le32_to_cpu(ofdm->fina_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
+                         "false_alarm_cnt:\t%u\t\t\t%u\n",
-                         le32_to_cpu(ofdm->unresponded_rts));
+                         le32_to_cpu(ofdm->false_alarm_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         accum_ofdm->false_alarm_cnt);
-                        "rxe_frame_limit_overrun: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        le32_to_cpu(ofdm->rxe_frame_limit_overrun));
+                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
-                         le32_to_cpu(ofdm->sent_ack_cnt));
+                         accum_ofdm->fina_sync_err_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->sent_cts_cnt));
+                         "sfd_timeout:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
+                         le32_to_cpu(ofdm->sfd_timeout),
-                         le32_to_cpu(ofdm->sent_ba_rsp_cnt));
+                         accum_ofdm->sfd_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->dsp_self_kill));
+                         "fina_timeout:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         le32_to_cpu(ofdm->fina_timeout),
-                         le32_to_cpu(ofdm->mh_format_err));
+                         accum_ofdm->fina_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ofdm->re_acq_main_rssi_sum));
+                         "unresponded_rts:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
+                         accum_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->dsp_self_kill),
+                         accum_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->mh_format_err),
+                         accum_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
+                         accum_ofdm->re_acq_main_rssi_sum);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - CCK:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(cck->ina_cnt));
+                        "\t\t\tcurrent\t\t\taccumulative\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->fina_cnt));
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->plcp_err));
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->crc32_err));
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->overrun_err));
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(cck->early_overrun_err));
+                         "overrun_err:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(cck->overrun_err),
-                         le32_to_cpu(cck->crc32_good));
+                         accum_cck->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(cck->false_alarm_cnt));
+                         "early_overrun_err:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
+                         le32_to_cpu(cck->early_overrun_err),
-                         le32_to_cpu(cck->fina_sync_err_cnt));
+                         accum_cck->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->sfd_timeout));
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(cck->fina_timeout));
+                         "false_alarm_cnt:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
+                         le32_to_cpu(cck->false_alarm_cnt),
-                         le32_to_cpu(cck->unresponded_rts));
+                         accum_cck->false_alarm_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        "rxe_frame_limit_overrun: %u\n",
+                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
-                        le32_to_cpu(cck->rxe_frame_limit_overrun));
+                         le32_to_cpu(cck->fina_sync_err_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
+                         accum_cck->fina_sync_err_cnt);
-                         le32_to_cpu(cck->sent_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
+                         "sfd_timeout:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->sent_cts_cnt));
+                         le32_to_cpu(cck->sfd_timeout),
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
+                         accum_cck->sfd_timeout);
-                         le32_to_cpu(cck->sent_ba_rsp_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
+                         "fina_timeout:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->dsp_self_kill));
+                         le32_to_cpu(cck->fina_timeout),
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         accum_cck->fina_timeout);
-                         le32_to_cpu(cck->mh_format_err));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
+                         "unresponded_rts:\t%u\t\t\t%u\n",
-                         le32_to_cpu(cck->re_acq_main_rssi_sum));
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt),
+                         accum_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->dsp_self_kill),
+                         accum_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->mh_format_err),
+                         accum_cck->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum),
+                         accum_cck->re_acq_main_rssi_sum);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - GENERAL:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->bogus_cts));
+                        "\t\t\tcurrent\t\t\taccumulative\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->bogus_ack));
+                         le32_to_cpu(general->bogus_cts),
-        pos += scnprintf(buf + pos, bufsz - pos, "non_bssid_frames: %u\n",
+                         accum_general->bogus_cts);
-                         le32_to_cpu(general->non_bssid_frames));
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "filtered_frames: %u\n",
+                         le32_to_cpu(general->bogus_ack),
-                         le32_to_cpu(general->filtered_frames));
+                         accum_general->bogus_ack);
-        pos += scnprintf(buf + pos, bufsz - pos, "non_channel_beacons: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->non_channel_beacons));
+                         "non_bssid_frames:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_beacons: %u\n",
+                         le32_to_cpu(general->non_bssid_frames),
-                         le32_to_cpu(general->channel_beacons));
+                         accum_general->non_bssid_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, "num_missed_bcon: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->num_missed_bcon));
+                         "filtered_frames:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(general->filtered_frames),
-                        "adc_rx_saturation_time: %u\n",
+                         accum_general->filtered_frames);
-                        le32_to_cpu(general->adc_rx_saturation_time));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         "non_channel_beacons:\t%u\t\t\t%u\n",
-                        "ina_detection_search_time: %u\n",
+                         le32_to_cpu(general->non_channel_beacons),
-                        le32_to_cpu(general->ina_detection_search_time));
+                         accum_general->non_channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_a: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->beacon_silence_rssi_a));
+                         "channel_beacons:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_b: %u\n",
+                         le32_to_cpu(general->channel_beacons),
-                         le32_to_cpu(general->beacon_silence_rssi_b));
+                         accum_general->channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_c: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->beacon_silence_rssi_c));
+                         "num_missed_bcon:\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(general->num_missed_bcon),
-                        "interference_data_flag: %u\n",
+                         accum_general->num_missed_bcon);
-                        le32_to_cpu(general->interference_data_flag));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_load: %u\n",
+                        "adc_rx_saturation_time:\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->channel_load));
+                         le32_to_cpu(general->adc_rx_saturation_time),
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_false_alarms: %u\n",
+                         accum_general->adc_rx_saturation_time);
-                         le32_to_cpu(general->dsp_false_alarms));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_a: %u\n",
+                        "ina_detect_search_tm:\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->beacon_rssi_a));
+                         le32_to_cpu(general->ina_detection_search_time),
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_b: %u\n",
+                         accum_general->ina_detection_search_time);
-                         le32_to_cpu(general->beacon_rssi_b));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_c: %u\n",
+                         "beacon_silence_rssi_a:\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->beacon_rssi_c));
+                         le32_to_cpu(general->beacon_silence_rssi_a),
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_a: %u\n",
+                         accum_general->beacon_silence_rssi_a);
-                         le32_to_cpu(general->beacon_energy_a));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_b: %u\n",
+                         "beacon_silence_rssi_b:\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->beacon_energy_b));
+                         le32_to_cpu(general->beacon_silence_rssi_b),
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_c: %u\n",
+                         accum_general->beacon_silence_rssi_b);
-                         le32_to_cpu(general->beacon_energy_c));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_silence_rssi_c:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_c),
+                         accum_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "interference_data_flag:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->interference_data_flag),
+                         accum_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "channel_load:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->channel_load),
+                         accum_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_false_alarms:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->dsp_false_alarms),
+                         accum_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_a:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_a),
+                         accum_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_b:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_b),
+                         accum_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_c:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_c),
+                         accum_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_a:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_a),
+                         accum_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_b:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_b),
+                         accum_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_c:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_c),
+                         accum_general->beacon_energy_c);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ht->plcp_err));
+                        "\t\t\tcurrent\t\t\taccumulative\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ht->overrun_err));
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(ht->early_overrun_err));
+                         "overrun_err:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err);
-                         le32_to_cpu(ht->crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+                         "early_overrun_err:\t%u\t\t\t%u\n",
-                         le32_to_cpu(ht->crc32_err));
+                         le32_to_cpu(ht->early_overrun_err),
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         accum_ht->early_overrun_err);
-                         le32_to_cpu(ht->mh_format_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_crc32_good: %u\n",
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good);
-                         le32_to_cpu(ht->agg_crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_mpdu_cnt: %u\n",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err);
-                         le32_to_cpu(ht->agg_mpdu_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt: %u\n",
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(ht->agg_cnt));
+                         le32_to_cpu(ht->mh_format_err),
+                         accum_ht->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg_crc32_good:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_crc32_good),
+                         accum_ht->agg_crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg_mpdu_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_mpdu_cnt),
+                         accum_ht->agg_mpdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
@@ -1265,7 +1391,7 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
        char *buf;
        int bufsz = (sizeof(struct statistics_tx) * 24) + 250;
        ssize_t ret;
-        struct statistics_tx *tx;
+        struct statistics_tx *tx, *accum_tx;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
@@ -1291,62 +1417,107 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
         * might not reflect the current uCode activity
         */
        tx = &priv->statistics.tx;
+        accum_tx = &priv->accum_statistics.tx;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Tx:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "preamble: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(tx->preamble_cnt));
+                        "\t\t\tcurrent\t\t\taccumulative\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_detected_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "preamble:\t\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(tx->rx_detected_cnt));
+                         le32_to_cpu(tx->preamble_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_defer_cnt: %u\n",
+                         accum_tx->preamble_cnt);
-                         le32_to_cpu(tx->bt_prio_defer_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_kill_cnt: %u\n",
+                         "rx_detected_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(tx->bt_prio_kill_cnt));
+                         le32_to_cpu(tx->rx_detected_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "few_bytes_cnt: %u\n",
+                         accum_tx->rx_detected_cnt);
-                         le32_to_cpu(tx->few_bytes_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout: %u\n",
+                         "bt_prio_defer_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(tx->cts_timeout));
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "ack_timeout: %u\n",
+                         accum_tx->bt_prio_defer_cnt);
-                         le32_to_cpu(tx->ack_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "expected_ack_cnt: %u\n",
+                         "bt_prio_kill_cnt:\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(tx->expected_ack_cnt));
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "actual_ack_cnt: %u\n",
+                         accum_tx->bt_prio_kill_cnt);
-                         le32_to_cpu(tx->actual_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "dump_msdu_cnt: %u\n",
+                         "few_bytes_cnt:\t\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(tx->dump_msdu_cnt));
+                         le32_to_cpu(tx->few_bytes_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         accum_tx->few_bytes_cnt);
-                        "burst_abort_next_frame_mismatch_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt));
+                         "cts_timeout:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout);
-                        "burst_abort_missing_next_frame_cnt: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        le32_to_cpu(tx->burst_abort_missing_next_frame_cnt));
+                         "ack_timeout:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout_collision: %u\n",
+                         le32_to_cpu(tx->ack_timeout),
-                         le32_to_cpu(tx->cts_timeout_collision));
+                         accum_tx->ack_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        "ack_or_ba_timeout_collision: %u\n",
+                         "expected_ack_cnt:\t\t%u\t\t\t%u\n",
-                        le32_to_cpu(tx->ack_or_ba_timeout_collision));
+                         le32_to_cpu(tx->expected_ack_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "agg ba_timeout: %u\n",
+                         accum_tx->expected_ack_cnt);
-                         le32_to_cpu(tx->agg.ba_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         "actual_ack_cnt:\t\t\t%u\t\t\t%u\n",
-                        "agg ba_reschedule_frames: %u\n",
+                         le32_to_cpu(tx->actual_ack_cnt),
-                        le32_to_cpu(tx->agg.ba_reschedule_frames));
+                         accum_tx->actual_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos,
+        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg scd_query_agg_frame_cnt: %u\n",
+                         "dump_msdu_cnt:\t\t\t%u\t\t\t%u\n",
-                        le32_to_cpu(tx->agg.scd_query_agg_frame_cnt));
+                         le32_to_cpu(tx->dump_msdu_cnt),
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_no_agg: %u\n",
+                         accum_tx->dump_msdu_cnt);
-                         le32_to_cpu(tx->agg.scd_query_no_agg));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_agg: %u\n",
+                         "abort_nxt_frame_mismatch:"
-                         le32_to_cpu(tx->agg.scd_query_agg));
+                         "\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos,
+                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
-                        "agg scd_query_mismatch: %u\n",
+                         accum_tx->burst_abort_next_frame_mismatch_cnt);
-                        le32_to_cpu(tx->agg.scd_query_mismatch));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "agg frame_not_ready: %u\n",
+                         "abort_missing_nxt_frame:"
-                         le32_to_cpu(tx->agg.frame_not_ready));
+                         "\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "agg underrun: %u\n",
+                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
-                         le32_to_cpu(tx->agg.underrun));
+                         accum_tx->burst_abort_missing_next_frame_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "agg bt_prio_kill: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(tx->agg.bt_prio_kill));
+                         "cts_timeout_collision:\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "agg rx_ba_rsp_cnt: %u\n",
+                         le32_to_cpu(tx->cts_timeout_collision),
-                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt));
+                         accum_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "ack_ba_timeout_collision:\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
+                         accum_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg ba_timeout:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.ba_timeout),
+                         accum_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg ba_resched_frames:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.ba_reschedule_frames),
+                         accum_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_agg_frame:\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
+                         accum_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg scd_query_no_agg:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_no_agg),
+                         accum_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg scd_query_agg:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_agg),
+                         accum_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_mismatch:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_mismatch),
+                         accum_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg frame_not_ready:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.frame_not_ready),
+                         accum_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg underrun:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.underrun),
+                         accum_tx->agg.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg bt_prio_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.bt_prio_kill),
+                         accum_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg rx_ba_rsp_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
+                         accum_tx->agg.rx_ba_rsp_cnt);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
@@ -1362,9 +1533,9 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
        char *buf;
        int bufsz = sizeof(struct statistics_general) * 4 + 250;
        ssize_t ret;
-        struct statistics_general *general;
+        struct statistics_general *general, *accum_general;
-        struct statistics_dbg *dbg;
+        struct statistics_dbg *dbg, *accum_dbg;
-        struct statistics_div *div;
+        struct statistics_div *div, *accum_div;
        if (!iwl_is_alive(priv))
                return -EAGAIN;
@@ -1392,34 +1563,53 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
        general = &priv->statistics.general;
        dbg = &priv->statistics.general.dbg;
        div = &priv->statistics.general.div;
+        accum_general = &priv->accum_statistics.general;
+        accum_dbg = &priv->accum_statistics.general.dbg;
+        accum_div = &priv->accum_statistics.general.div;
        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_General:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature:\t\t\t%u\n",
                         le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m:\t\t\t%u\n",
                         le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_check: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(dbg->burst_check));
+                         "burst_check:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_count: %u\n",
+                         le32_to_cpu(dbg->burst_check),
-                         le32_to_cpu(dbg->burst_count));
+                         accum_dbg->burst_check);
-        pos += scnprintf(buf + pos, bufsz - pos, "sleep_time: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->sleep_time));
+                         "burst_count:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_out: %u\n",
+                         le32_to_cpu(dbg->burst_count),
-                         le32_to_cpu(general->slots_out));
+                         accum_dbg->burst_count);
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_idle: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(general->slots_idle));
+                         "sleep_time:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp: %u\n",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "slots_out:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "slots_idle:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
                         le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a:\t\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(div->tx_on_a));
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a);
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b:\t\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(div->tx_on_b));
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b);
-        pos += scnprintf(buf + pos, bufsz - pos, "exec_time: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
-                         le32_to_cpu(div->exec_time));
+                         "exec_time:\t\t\t%u\t\t\t%u\n",
-        pos += scnprintf(buf + pos, bufsz - pos, "probe_time: %u\n",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time);
-                         le32_to_cpu(div->probe_time));
+        pos += scnprintf(buf + pos, bufsz - pos,
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_enable_counter: %u\n",
+                         "probe_time:\t\t\t%u\t\t\t%u\n",
-                         le32_to_cpu(general->rx_enable_counter));
+                         le32_to_cpu(div->probe_time), accum_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "rx_enable_counter:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->rx_enable_counter),
+                         accum_general->rx_enable_counter);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
        kfree(buf);
        return ret;
@@ -1615,6 +1805,29 @@ static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
+static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,
+                                                    char __user *user_buf,
+                                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char buf[60];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+        u32 pwrsave_status;
+        pwrsave_status = iwl_read32(priv, CSR_GP_CNTRL) &
+                        CSR_GP_REG_POWER_SAVE_STATUS_MSK;
+        pos += scnprintf(buf + pos, bufsz - pos, "Power Save Status: ");
+        pos += scnprintf(buf + pos, bufsz - pos, "%s\n",
+                (pwrsave_status == CSR_GP_REG_NO_POWER_SAVE) ? "none" :
+                (pwrsave_status == CSR_GP_REG_MAC_POWER_SAVE) ? "MAC" :
+                (pwrsave_status == CSR_GP_REG_PHY_POWER_SAVE) ? "PHY" :
+                "error");
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
 DEBUGFS_READ_WRITE_FILE_OPS(rx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1626,6 +1839,7 @@ DEBUGFS_READ_FILE_OPS(ucode_general_stats);
 DEBUGFS_READ_FILE_OPS(sensitivity);
 DEBUGFS_READ_FILE_OPS(chain_noise);
 DEBUGFS_READ_FILE_OPS(tx_power);
+DEBUGFS_READ_FILE_OPS(power_save_status);
 /*
 * Create the debugfs files and directories
@@ -1673,6 +1887,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
        DEBUGFS_ADD_FILE(rx_queue, debug);
        DEBUGFS_ADD_FILE(tx_queue, debug);
        DEBUGFS_ADD_FILE(tx_power, debug);
+        DEBUGFS_ADD_FILE(power_save_status, debug);
        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
                DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
@@ -1725,6 +1940,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_power_save_status);
        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
                        file_ucode_rx_stats);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 72946c144be7..e7ce67387662 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -85,8 +85,6 @@ extern void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                                    __le32 *tx_flags);
 extern int iwl5000_calc_rssi(struct iwl_priv *priv,
                             struct iwl_rx_phy_res *rx_resp);
-extern int iwl5000_apm_init(struct iwl_priv *priv);
-extern int iwl5000_apm_reset(struct iwl_priv *priv);
 extern void iwl5000_nic_config(struct iwl_priv *priv);
 extern u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv);
 extern const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -147,12 +145,13 @@ extern void iwl5000_temperature(struct iwl_priv *priv);
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 struct iwl_rx_mem_buffer {
-        dma_addr_t real_dma_addr;
+        dma_addr_t page_dma;
-        dma_addr_t aligned_dma_addr;
+        struct page *page;
-        struct sk_buff *skb;
        struct list_head list;
 };
+#define rxb_addr(r) page_address(r->page)
 /* defined below */
 struct iwl_device_cmd;
@@ -168,7 +167,7 @@ struct iwl_cmd_meta {
         */
        void (*callback)(struct iwl_priv *priv,
                         struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
        /* The CMD_SIZE_HUGE flag bit indicates that the command
         * structure is stored at the end of the shared queue memory. */
@@ -324,6 +323,12 @@ struct iwl_channel_info {
 * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
 #define IWL_MIN_NUM_QUEUES      10
+/*
+ * uCode queue management definitions ...
+ * Queue #4 is the command queue for 3945/4965/5x00/1000/6x00.
+ */
+#define IWL_CMD_QUEUE_NUM       4
 /* Power management (not Tx power) structures */
 enum iwl_pwr_src {
@@ -359,7 +364,14 @@ enum {
        CMD_WANT_SKB = (1 << 2),
 };
-#define IWL_CMD_MAX_PAYLOAD 320
+#define DEF_CMD_PAYLOAD_SIZE 320
+/*
+ * IWL_LINK_HDR_MAX should include ieee80211_hdr, radiotap header,
+ * SNAP header and alignment. It should also be big enough for 802.11
+ * control frames.
+ */
+#define IWL_LINK_HDR_MAX 64
 /**
 * struct iwl_device_cmd
@@ -376,7 +388,8 @@ struct iwl_device_cmd {
                u16 val16;
                u32 val32;
                struct iwl_tx_cmd tx;
-                u8 payload[IWL_CMD_MAX_PAYLOAD];
+                struct iwl6000_channel_switch_cmd chswitch;
+                u8 payload[DEF_CMD_PAYLOAD_SIZE];
        } __attribute__ ((packed)) cmd;
 } __attribute__ ((packed));
@@ -385,21 +398,15 @@ struct iwl_device_cmd {
 struct iwl_host_cmd {
        const void *data;
-        struct sk_buff *reply_skb;
+        unsigned long reply_page;
        void (*callback)(struct iwl_priv *priv,
                         struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
        u32 flags;
        u16 len;
        u8 id;
 };
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -563,6 +570,19 @@ struct iwl_station_entry {
        struct iwl_hw_key keyinfo;
 };
+/*
+ * iwl_station_priv: Driver's private station information
+ *
+ * When mac80211 creates a station it reserves some space (hw->sta_data_size)
+ * in the structure for use by driver. This structure is places in that
+ * space.
+ *
+ * At the moment use it for the station's rate scaling information.
+ */
+struct iwl_station_priv {
+        struct iwl_lq_sta lq_sta;
+};
 /* one for each uCode image (inst/data, boot/init/runtime) */
 struct fw_desc {
        void *v_addr;           /* access by driver */
@@ -624,6 +644,10 @@ struct iwl_sensitivity_ranges {
        u16 auto_corr_max_cck_mrc;
        u16 auto_corr_min_cck;
        u16 auto_corr_min_cck_mrc;
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
@@ -641,7 +665,7 @@ struct iwl_sensitivity_ranges {
 * @valid_tx/rx_ant: usable antennas
 * @max_rxq_size: Max # Rx frames in Rx queue (must be power-of-2)
 * @max_rxq_log: Log-base-2 of max_rxq_size
- * @rx_buf_size: Rx buffer size
+ * @rx_page_order: Rx buffer page order
 * @rx_wrt_ptr_reg: FH{39}_RSCSR_CHNL0_WPTR
 * @max_stations:
 * @bcast_sta_id:
@@ -664,9 +688,8 @@ struct iwl_hw_params {
        u8  valid_rx_ant;
        u16 max_rxq_size;
        u16 max_rxq_log;
-        u32 rx_buf_size;
+        u32 rx_page_order;
        u32 rx_wrt_ptr_reg;
-        u32 max_pkt_size;
        u8  max_stations;
        u8  bcast_sta_id;
        u8  ht40_channel;
@@ -713,7 +736,11 @@ static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 static inline u8 get_cmd_index(struct iwl_queue *q, u32 index, int is_huge)
 {
-        /* This is for scan command, the big buffer at end of command array */
+        /*
+         * This is for init calibration result and scan command which
+         * required buffer > TFD_MAX_PAYLOAD_SIZE,
+         * the big buffer at end of command array
+         */
        if (is_huge)
                return q->n_window;     /* must be power of 2 */
@@ -845,6 +872,10 @@ struct iwl_sensitivity_data {
        s32 nrg_auto_corr_silence_diff;
        u32 num_in_cck_no_fa;
        u32 nrg_th_ofdm;
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
 /* Chain noise (differential Rx gain) calib data */
@@ -961,8 +992,6 @@ struct traffic_stats {
 };
 #endif
-#define IWL_MAX_NUM_QUEUES      20 /* FIXME: do dynamic allocation */
 struct iwl_priv {
        /* ieee device used by generic ieee processing code */
@@ -976,7 +1005,7 @@ struct iwl_priv {
        int frames_count;
        enum ieee80211_band band;
-        int alloc_rxb_skb;
+        int alloc_rxb_page;
        void (*rx_handlers[REPLY_MAX])(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb);
@@ -1081,7 +1110,6 @@ struct iwl_priv {
        u8 last_phy_res[100];
        /* Rate scaling data */
-        s8 data_retry_limit;
        u8 retry_rate;
        wait_queue_head_t wait_command_queue;
@@ -1090,7 +1118,7 @@ struct iwl_priv {
        /* Rx and Tx DMA processing queues */
        struct iwl_rx_queue rxq;
-        struct iwl_tx_queue txq[IWL_MAX_NUM_QUEUES];
+        struct iwl_tx_queue *txq;
        unsigned long txq_ctx_active_msk;
        struct iwl_dma_ptr  kw; /* keep warm address */
        struct iwl_dma_ptr  scd_bc_tbls;
@@ -1113,7 +1141,9 @@ struct iwl_priv {
        struct iwl_tt_mgmt thermal_throttle;
        struct iwl_notif_statistics statistics;
-        unsigned long last_statistics_time;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        struct iwl_notif_statistics accum_statistics;
+#endif
        /* context information */
        u16 rates_mask;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 2e8c40576d22..9429cb1c69bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -358,6 +358,14 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
                udelay(5);
                iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
                                    APMG_PS_CTRL_VAL_RESET_REQ);
+                /*
+                 * CSR auto clock gate disable bit -
+                 * this is only applicable for HW with OTP shadow RAM
+                 */
+                if (priv->cfg->shadow_ram_support)
+                        iwl_set_bit(priv, CSR_DBG_LINK_PWR_MGMT_REG,
+                                CSR_RESET_LINK_PWR_MGMT_DISABLED);
        }
        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index b363c96fd6c6..5ba5a4e9e49a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -261,9 +261,12 @@ struct iwl_eeprom_enhanced_txpwr {
 /* 1000 Specific */
 #define EEPROM_1000_EEPROM_VERSION      (0x15C)
-/* 60x0 Specific */
+/* 6x00 Specific */
 #define EEPROM_6000_EEPROM_VERSION      (0x434)
+/* 6x50 Specific */
+#define EEPROM_6050_EEPROM_VERSION      (0x532)
 /* OTP */
 /* lower blocks contain EEPROM image and calibration data */
 #define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 532c8d6cd8da..f2a60dc4109f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -92,6 +92,8 @@ const char *get_cmd_string(u8 cmd)
                IWL_CMD(CALIBRATION_RES_NOTIFICATION);
                IWL_CMD(CALIBRATION_COMPLETE_NOTIFICATION);
                IWL_CMD(REPLY_TX_POWER_DBM_CMD);
+                IWL_CMD(TEMPERATURE_NOTIFICATION);
+                IWL_CMD(TX_ANT_CONFIGURATION_CMD);
        default:
                return "UNKNOWN";
@@ -103,17 +105,8 @@ EXPORT_SYMBOL(get_cmd_string);
 static void iwl_generic_cmd_callback(struct iwl_priv *priv,
                                     struct iwl_device_cmd *cmd,
-                                     struct sk_buff *skb)
+                                     struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *pkt = NULL;
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in %s.\n",
-                                get_cmd_string(cmd->hdr.cmd));
-                return;
-        }
-        pkt = (struct iwl_rx_packet *)skb->data;
        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from %s (0x%08X)\n",
                        get_cmd_string(cmd->hdr.cmd), pkt->hdr.flags);
@@ -215,7 +208,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                ret = -EIO;
                goto fail;
        }
-        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_skb) {
+        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_page) {
                IWL_ERR(priv, "Error: Response NULL in '%s'\n",
                          get_cmd_string(cmd->id));
                ret = -EIO;
@@ -237,9 +230,9 @@ cancel:
                                                        ~CMD_WANT_SKB;
        }
 fail:
-        if (cmd->reply_skb) {
+        if (cmd->reply_page) {
-                dev_kfree_skb_any(cmd->reply_skb);
+                free_pages(cmd->reply_page, priv->hw_params.rx_page_order);
-                cmd->reply_skb = NULL;
+                cmd->reply_page = 0;
        }
 out:
        clear_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status);
@@ -272,7 +265,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv,
                           u8 id, u16 len, const void *data,
                           void (*callback)(struct iwl_priv *priv,
                                            struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb))
+                                            struct iwl_rx_packet *pkt))
 {
        struct iwl_host_cmd cmd = {
                .id = id,
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 9c6b14952061..9bce2c1625e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -66,7 +66,7 @@ MODULE_PARM_DESC(no_sleep_autoadjust,
 struct iwl_power_vec_entry {
        struct iwl_powertable_cmd cmd;
-        u8 no_dtim;
+        u8 no_dtim;     /* number of skip dtim */
 };
 #define IWL_DTIM_RANGE_0_MAX    2
@@ -83,8 +83,9 @@ struct iwl_power_vec_entry {
                                     cpu_to_le32(X4)}
 /* default power management (not Tx power) table values */
 /* for DTIM period 0 through IWL_DTIM_RANGE_0_MAX */
+/* DTIM 0 - 2 */
 static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
-        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
+        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 1, 2, 2, 0xFF)}, 0},
        {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
        {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 2, 2, 2, 0xFF)}, 0},
        {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 2, 4, 4, 0xFF)}, 1},
@@ -93,15 +94,17 @@ static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
 /* for DTIM period IWL_DTIM_RANGE_0_MAX + 1 through IWL_DTIM_RANGE_1_MAX */
+/* DTIM 3 - 10 */
 static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
        {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 3, 4, 7)}, 0},
        {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 4, 6, 7, 9)}, 0},
        {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 4, 6, 9, 10)}, 1},
-        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 7, 10, 10)}, 2}
+        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 6, 10, 10)}, 2}
 };
 /* for DTIM period > IWL_DTIM_RANGE_1_MAX */
+/* DTIM 11 - */
 static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
        {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
@@ -115,13 +118,15 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
                                 enum iwl_power_level lvl, int period)
 {
        const struct iwl_power_vec_entry *table;
-        int max_sleep, i;
+        int max_sleep[IWL_POWER_VEC_SIZE] = { 0 };
-        bool skip;
+        int i;
+        u8 skip;
+        u32 slp_itrvl;
        table = range_2;
-        if (period < IWL_DTIM_RANGE_1_MAX)
+        if (period <= IWL_DTIM_RANGE_1_MAX)
                table = range_1;
-        if (period < IWL_DTIM_RANGE_0_MAX)
+        if (period <= IWL_DTIM_RANGE_0_MAX)
                table = range_0;
        BUG_ON(lvl < 0 || lvl >= IWL_POWER_NUM);
@@ -129,34 +134,60 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
        *cmd = table[lvl].cmd;
        if (period == 0) {
-                skip = false;
+                skip = 0;
                period = 1;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] =  1;
        } else {
-                skip = !!table[lvl].no_dtim;
+                skip = table[lvl].no_dtim;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] = le32_to_cpu(cmd->sleep_interval[i]);
+                max_sleep[IWL_POWER_VEC_SIZE - 1] = skip + 1;
        }
-        if (skip) {
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
-                __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
+        /* figure out the listen interval based on dtim period and skip */
-                max_sleep = le32_to_cpu(slp_itrvl);
+        if (slp_itrvl == 0xFF)
-                if (max_sleep == 0xFF)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
-                        max_sleep = period * (skip + 1);
+                        cpu_to_le32(period * (skip + 1));
-                else if (max_sleep > period)
-                        max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        if (slp_itrvl > period)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32((slp_itrvl / period) * period);
+        if (skip)
                cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        } else {
+        else
-                max_sleep = period;
                cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        }
-        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
-                if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
+        if (slp_itrvl > IWL_CONN_MAX_LISTEN_INTERVAL)
-                        cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32(IWL_CONN_MAX_LISTEN_INTERVAL);
+        /* enforce max sleep interval */
+        for (i = IWL_POWER_VEC_SIZE - 1; i >= 0 ; i--) {
+                if (le32_to_cpu(cmd->sleep_interval[i]) >
+                    (max_sleep[i] * period))
+                        cmd->sleep_interval[i] =
+                                cpu_to_le32(max_sleep[i] * period);
+                if (i != (IWL_POWER_VEC_SIZE - 1)) {
+                        if (le32_to_cpu(cmd->sleep_interval[i]) >
+                            le32_to_cpu(cmd->sleep_interval[i+1]))
+                                cmd->sleep_interval[i] =
+                                        cmd->sleep_interval[i+1];
+                }
+        }
        if (priv->power_data.pci_pm)
                cmd->flags |= IWL_POWER_PCI_PM_MSK;
        else
                cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
+        IWL_DEBUG_POWER(priv, "numSkipDtim = %u, dtimPeriod = %d\n",
+                        skip, period);
        IWL_DEBUG_POWER(priv, "Sleep command for index %d\n", lvl + 1);
 }
@@ -862,9 +893,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
        INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
        INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        if (priv->cfg->adv_thermal_throttle) {
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
                IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
                tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
                                         IWL_TI_STATE_MAX, GFP_KERNEL);
@@ -897,11 +926,9 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                                &restriction_range[0], size);
                        priv->thermal_throttle.advanced_tt = true;
                }
-                break;
+        } else {
-        default:
                IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
                priv->thermal_throttle.advanced_tt = false;
-                break;
        }
 }
 EXPORT_SYMBOL(iwl_tt_initialize);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 493626bcd3ec..e5339c9ad13e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -200,7 +200,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                list_del(element);
                /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->page_dma);
                rxq->queue[rxq->write] = rxb;
                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                rxq->free_count--;
@@ -239,8 +239,9 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
        struct iwl_rx_queue *rxq = &priv->rxq;
        struct list_head *element;
        struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
        unsigned long flags;
+        gfp_t gfp_mask = priority;
        while (1) {
                spin_lock_irqsave(&rxq->lock, flags);
@@ -251,30 +252,35 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                spin_unlock_irqrestore(&rxq->lock, flags);
                if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
+                        gfp_mask |= __GFP_NOWARN;
-                /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
+                if (priv->hw_params.rx_page_order > 0)
-                                                priority);
+                        gfp_mask |= __GFP_COMP;
-                if (!skb) {
+                /* Alloc a new receive buffer */
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
                        if (net_ratelimit())
-                                IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
+                                               "order: %d\n",
+                                               priv->hw_params.rx_page_order);
                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
                            net_ratelimit())
-                                IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
                                         priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
                                         rxq->free_count);
                        /* We don't reschedule replenish work here -- we will
                         * call the restock method and if it still needs
                         * more buffers it will schedule replenish */
-                        break;
+                        return;
                }
                spin_lock_irqsave(&rxq->lock, flags);
                if (list_empty(&rxq->rx_used)) {
                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                        return;
                }
                element = rxq->rx_used.next;
@@ -283,24 +289,21 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                spin_unlock_irqrestore(&rxq->lock, flags);
-                rxb->skb = skb;
+                rxb->page = page;
-                /* Get physical address of RB/SKB */
+                /* Get physical address of the RB */
-                rxb->real_dma_addr = pci_map_single(
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
-                                        priv->pci_dev,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                        rxb->skb->data,
+                                PCI_DMA_FROMDEVICE);
-                                        priv->hw_params.rx_buf_size + 256,
-                                        PCI_DMA_FROMDEVICE);
                /* dma address must be no more than 36 bits */
-                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                /* and also 256 byte aligned! */
-                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
+                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
-                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
                spin_lock_irqsave(&rxq->lock, flags);
                list_add_tail(&rxb->list, &rxq->rx_free);
                rxq->free_count++;
-                priv->alloc_rxb_skb++;
+                priv->alloc_rxb_page++;
                spin_unlock_irqrestore(&rxq->lock, flags);
        }
@@ -336,12 +339,14 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
        int i;
        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
+                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_single(priv->pci_dev,
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                         rxq->pool[i].real_dma_addr,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                         priv->hw_params.rx_buf_size + 256,
+                                PCI_DMA_FROMDEVICE);
-                                         PCI_DMA_FROMDEVICE);
+                        __free_pages(rxq->pool[i].page,
-                        dev_kfree_skb(rxq->pool[i].skb);
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
+                        priv->alloc_rxb_page--;
                }
        }
@@ -405,14 +410,14 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                /* In the reset function, these buffers may have been allocated
                 * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
+                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_single(priv->pci_dev,
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                         rxq->pool[i].real_dma_addr,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                         priv->hw_params.rx_buf_size + 256,
+                                PCI_DMA_FROMDEVICE);
-                                         PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_page--;
-                        priv->alloc_rxb_skb--;
+                        __free_pages(rxq->pool[i].page,
-                        dev_kfree_skb(rxq->pool[i].skb);
+                                     priv->hw_params.rx_page_order);
-                        rxq->pool[i].skb = NULL;
+                        rxq->pool[i].page = NULL;
                }
                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
        }
@@ -491,7 +496,7 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_missed_beacon_notif *missed_beacon;
        missed_beacon = &pkt->u.missed_beacon;
@@ -548,13 +553,51 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
                        priv->last_rx_noise);
 }
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl_accumulative_statistics(struct iwl_priv *priv,
+                                        __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+        prev_stats = (__le32 *)&priv->statistics;
+        accum_stats = (u32 *)&priv->accum_statistics;
+        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, accum_stats++)
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats))
+                        *accum_stats += (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->accum_statistics.general.temperature =
+                priv->statistics.general.temperature;
+        priv->accum_statistics.general.temperature_m =
+                priv->statistics.general.temperature_m;
+        priv->accum_statistics.general.ttl_timestamp =
+                priv->statistics.general.ttl_timestamp;
+        priv->accum_statistics.tx.tx_power.ant_a =
+                priv->statistics.tx.tx_power.ant_a;
+        priv->accum_statistics.tx.tx_power.ant_b =
+                priv->statistics.tx.tx_power.ant_b;
+        priv->accum_statistics.tx.tx_power.ant_c =
+                priv->statistics.tx.tx_power.ant_c;
+}
+#endif
 #define REG_RECALIB_PERIOD (60)
 void iwl_rx_statistics(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb)
 {
        int change;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                     (int)sizeof(priv->statistics),
@@ -566,6 +609,9 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
        memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
        set_bit(STATUS_STATISTICS, &priv->status);
@@ -582,9 +628,6 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                iwl_rx_calc_noise(priv);
                queue_work(priv->workqueue, &priv->run_time_calib_work);
        }
-        iwl_leds_background(priv);
        if (priv->cfg->ops->lib->temp_ops.temperature && change)
                priv->cfg->ops->lib->temp_ops.temperature(priv);
 }
@@ -878,6 +921,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb,
                                        struct ieee80211_rx_status *stats)
 {
+        struct sk_buff *skb;
+        int ret = 0;
+        __le16 fc = hdr->frame_control;
        /* We only process data packets if the interface is open */
        if (unlikely(!priv->is_open)) {
                IWL_DEBUG_DROP_LIMIT(priv,
@@ -890,15 +937,43 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
            iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
                return;
-        /* Resize SKB from mac header to end of packet */
+        skb = alloc_skb(IWL_LINK_HDR_MAX, GFP_ATOMIC);
-        skb_reserve(rxb->skb, (void *)hdr - (void *)rxb->skb->data);
+        if (!skb) {
-        skb_put(rxb->skb, len);
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                         0 : -ENOMEM;
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
+        /*
+         * XXX: We cannot touch the page and its virtual memory (hdr) after
+         * here. It might have already been freed by the above skb change.
+         */
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
-        iwl_update_stats(priv, false, hdr->frame_control, len);
+        ieee80211_rx(priv->hw, skb);
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
+ out:
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
+        priv->alloc_rxb_page--;
-        priv->alloc_rxb_skb--;
+        rxb->page = NULL;
-        rxb->skb = NULL;
 }
 /* This is necessary only for a number of statistics, see the caller. */
@@ -926,7 +1001,7 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
 {
        struct ieee80211_hdr *header;
        struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_rx_phy_res *phy_res;
        __le32 rx_pkt_status;
        struct iwl4965_rx_mpdu_res_start *amsdu;
@@ -1087,7 +1162,7 @@ EXPORT_SYMBOL(iwl_rx_reply_rx);
 void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        priv->last_phy_res[0] = 1;
        memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
               sizeof(struct iwl_rx_phy_res));
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 41f9a0621250..4fca65a2fe9c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -111,7 +111,7 @@ EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 static int iwl_send_scan_abort(struct iwl_priv *priv)
 {
        int ret = 0;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
        struct iwl_host_cmd cmd = {
                .id = REPLY_SCAN_ABORT_CMD,
                .flags = CMD_WANT_SKB,
@@ -131,21 +131,21 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
                return ret;
        }
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (res->u.status != CAN_ABORT_STATUS) {
+        if (pkt->u.status != CAN_ABORT_STATUS) {
                /* The scan abort will return 1 for success or
                 * 2 for "failure".  A failure condition can be
                 * due to simply not being in an active scan which
                 * can occur if we send the scan abort before we
                 * the microcode has notified us that a scan is
                 * completed. */
-                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", res->u.status);
+                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", pkt->u.status);
                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
                clear_bit(STATUS_SCAN_HW, &priv->status);
        }
-        priv->alloc_rxb_skb--;
+        priv->alloc_rxb_page--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
        return ret;
 }
@@ -155,7 +155,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_scanreq_notification *notif =
            (struct iwl_scanreq_notification *)pkt->u.raw;
@@ -167,7 +167,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
 static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_scanstart_notification *notif =
            (struct iwl_scanstart_notification *)pkt->u.raw;
        priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
@@ -186,7 +186,7 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
                                      struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_scanresults_notification *notif =
            (struct iwl_scanresults_notification *)pkt->u.raw;
@@ -213,7 +213,7 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
        IWL_DEBUG_SCAN(priv, "Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.c b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
index 022bcf115731..1ea5cd345fe8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.c
+++ b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
@@ -177,7 +177,7 @@ static int iwl_get_measurement(struct iwl_priv *priv,
 static void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                          struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
        if (!report->state) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index c6633fec8216..dc74c16d36a8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -99,32 +99,25 @@ static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 static void iwl_add_sta_callback(struct iwl_priv *priv,
                                 struct iwl_device_cmd *cmd,
-                                 struct sk_buff *skb)
+                                 struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *res = NULL;
        struct iwl_addsta_cmd *addsta =
                (struct iwl_addsta_cmd *)cmd->cmd.payload;
        u8 sta_id = addsta->sta.sta_id;
-        if (!skb) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_ADD_STA.\n");
-                return;
-        }
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                return;
        }
-        switch (res->u.add_sta.status) {
+        switch (pkt->u.add_sta.status) {
        case ADD_STA_SUCCESS_MSK:
                iwl_sta_ucode_activate(priv, sta_id);
                 /* fall through */
        default:
                IWL_DEBUG_HC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
-                             res->u.add_sta.status);
+                             pkt->u.add_sta.status);
                break;
        }
 }
@@ -132,7 +125,7 @@ static void iwl_add_sta_callback(struct iwl_priv *priv,
 int iwl_send_add_sta(struct iwl_priv *priv,
                     struct iwl_addsta_cmd *sta, u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt = NULL;
        int ret = 0;
        u8 data[sizeof(*sta)];
        struct iwl_host_cmd cmd = {
@@ -152,15 +145,15 @@ int iwl_send_add_sta(struct iwl_priv *priv,
        if (ret || (flags & CMD_ASYNC))
                return ret;
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                ret = -EIO;
        }
        if (ret == 0) {
-                switch (res->u.add_sta.status) {
+                switch (pkt->u.add_sta.status) {
                case ADD_STA_SUCCESS_MSK:
                        iwl_sta_ucode_activate(priv, sta->sta.sta_id);
                        IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
@@ -172,8 +165,8 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                }
        }
-        priv->alloc_rxb_skb--;
+        priv->alloc_rxb_page--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
        return ret;
 }
@@ -324,26 +317,19 @@ static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
 static void iwl_remove_sta_callback(struct iwl_priv *priv,
                                    struct iwl_device_cmd *cmd,
-                                    struct sk_buff *skb)
+                                    struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *res = NULL;
        struct iwl_rem_sta_cmd *rm_sta =
-                 (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
+                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
        const char *addr = rm_sta->addr;
-        if (!skb) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_REMOVE_STA.\n");
-                return;
-        }
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                res->hdr.flags);
+                pkt->hdr.flags);
                return;
        }
-        switch (res->u.rem_sta.status) {
+        switch (pkt->u.rem_sta.status) {
        case REM_STA_SUCCESS_MSK:
                iwl_sta_ucode_deactivate(priv, addr);
                break;
@@ -356,7 +342,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                                   u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
        int ret;
        struct iwl_rem_sta_cmd rm_sta_cmd;
@@ -381,15 +367,15 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
        if (ret || (flags & CMD_ASYNC))
                return ret;
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                ret = -EIO;
        }
        if (!ret) {
-                switch (res->u.rem_sta.status) {
+                switch (pkt->u.rem_sta.status) {
                case REM_STA_SUCCESS_MSK:
                        iwl_sta_ucode_deactivate(priv, addr);
                        IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
@@ -401,8 +387,8 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                }
        }
-        priv->alloc_rxb_skb--;
+        priv->alloc_rxb_page--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index c832ba085dba..8ae4c9b614e7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -131,7 +131,7 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
        struct iwl_tx_queue *txq = &priv->txq[txq_id];
        struct iwl_queue *q = &txq->q;
        struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        int i;
        if (q->n_bd == 0)
                return;
@@ -141,8 +141,6 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
        /* De-alloc array of command/tx buffers */
        for (i = 0; i < TFD_TX_CMD_SLOTS; i++)
                kfree(txq->cmd[i]);
@@ -180,14 +178,11 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
        struct iwl_queue *q = &txq->q;
        struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        int i;
        if (q->n_bd == 0)
                return;
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
-        len += IWL_MAX_SCAN_SIZE;
        /* De-alloc array of command/tx buffers */
        for (i = 0; i <= TFD_CMD_SLOTS; i++)
                kfree(txq->cmd[i]);
@@ -405,15 +400,19 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
        int txq_id;
        /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+        if (priv->txq)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
-                        iwl_cmd_queue_free(priv);
+                     txq_id++)
-                else
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_tx_queue_free(priv, txq_id);
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
        iwl_free_dma_ptr(priv, &priv->kw);
        iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
@@ -445,6 +444,12 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
                IWL_ERR(priv, "Keep Warm allocation failed\n");
                goto error_kw;
        }
+        /* allocate tx queue structure */
+        ret = iwl_alloc_txq_mem(priv);
+        if (ret)
+                goto error;
        spin_lock_irqsave(&priv->lock, flags);
        /* Turn off all Tx DMA fifos */
@@ -581,9 +586,7 @@ static void iwl_tx_cmd_build_rate(struct iwl_priv *priv,
        u8 rate_plcp;
        /* Set retry limit on DATA packets and Probe Responses*/
-        if (priv->data_retry_limit != -1)
+        if (ieee80211_is_probe_resp(fc))
-                data_retry_limit = priv->data_retry_limit;
-        else if (ieee80211_is_probe_resp(fc))
                data_retry_limit = 3;
        else
                data_retry_limit = IWL_DEFAULT_TX_RETRY;
@@ -1145,7 +1148,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
 */
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
        int txq_id = SEQ_TO_QUEUE(sequence);
        int index = SEQ_TO_INDEX(sequence);
@@ -1172,10 +1175,10 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        /* Input error checking is done when commands are added to queue. */
        if (meta->flags & CMD_WANT_SKB) {
-                meta->source->reply_skb = rxb->skb;
+                meta->source->reply_page = (unsigned long)rxb_addr(rxb);
-                rxb->skb = NULL;
+                rxb->page = NULL;
        } else if (meta->callback)
-                meta->callback(priv, cmd, rxb->skb);
+                meta->callback(priv, cmd, pkt);
        iwl_hcmd_queue_reclaim(priv, txq_id, index, cmd_index);
@@ -1434,7 +1437,7 @@ static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
 void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
        struct iwl_tx_queue *txq = NULL;
        struct iwl_ht_agg *agg;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c347d6631d85..bfd7f497157f 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -88,7 +88,6 @@ MODULE_LICENSE("GPL");
 /* module parameters */
 struct iwl_mod_params iwl3945_mod_params = {
-        .num_of_queues = IWL39_NUM_QUEUES, /* Not used */
        .sw_crypto = 1,
        .restart_fw = 1,
        /* the rest are 0 by default */
@@ -366,13 +365,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                      struct sk_buff *skb_frag,
                                      int sta_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
        struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
        switch (keyinfo->alg) {
        case ALG_CCMP:
-                tx->sec_ctl = TX_CMD_SEC_CCM;
+                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
-                memcpy(tx->key, keyinfo->key, keyinfo->keylen);
+                memcpy(tx_cmd->key, keyinfo->key, keyinfo->keylen);
                IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
                break;
@@ -380,13 +379,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                break;
        case ALG_WEP:
-                tx->sec_ctl = TX_CMD_SEC_WEP |
+                tx_cmd->sec_ctl = TX_CMD_SEC_WEP |
                    (info->control.hw_key->hw_key_idx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT;
                if (keyinfo->keylen == 13)
-                        tx->sec_ctl |= TX_CMD_SEC_KEY128;
+                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
-                memcpy(&tx->key[3], keyinfo->key, keyinfo->keylen);
+                memcpy(&tx_cmd->key[3], keyinfo->key, keyinfo->keylen);
                IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
                             "with key %d\n", info->control.hw_key->hw_key_idx);
@@ -406,12 +405,11 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                                  struct ieee80211_tx_info *info,
                                  struct ieee80211_hdr *hdr, u8 std_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
-        __le32 tx_flags = tx->tx_flags;
+        __le32 tx_flags = tx_cmd->tx_flags;
        __le16 fc = hdr->frame_control;
-        u8 rc_flags = info->control.rates[0].flags;
-        tx->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
                tx_flags |= TX_CMD_FLG_ACK_MSK;
                if (ieee80211_is_mgmt(fc))
@@ -424,25 +422,19 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
        }
-        tx->sta_id = std_id;
+        tx_cmd->sta_id = std_id;
        if (ieee80211_has_morefrags(fc))
                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
        if (ieee80211_is_data_qos(fc)) {
                u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tx->tid_tspec = qc[0] & 0xf;
+                tx_cmd->tid_tspec = qc[0] & 0xf;
                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
        } else {
                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
        }
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
+        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
-                tx_flags |= TX_CMD_FLG_RTS_MSK;
-                tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
        if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
                tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
@@ -450,16 +442,16 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
        if (ieee80211_is_mgmt(fc)) {
                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(3);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
                else
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(2);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
        } else {
-                tx->timeout.pm_frame_timeout = 0;
+                tx_cmd->timeout.pm_frame_timeout = 0;
        }
-        tx->driver_txop = 0;
+        tx_cmd->driver_txop = 0;
-        tx->tx_flags = tx_flags;
+        tx_cmd->tx_flags = tx_flags;
-        tx->next_frame_len = 0;
+        tx_cmd->next_frame_len = 0;
 }
 /*
@@ -469,7 +461,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 {
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl3945_tx_cmd *tx;
+        struct iwl3945_tx_cmd *tx_cmd;
        struct iwl_tx_queue *txq = NULL;
        struct iwl_queue *q = NULL;
        struct iwl_device_cmd *out_cmd;
@@ -568,9 +560,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        /* Init first empty entry in queue's array of Tx/cmd buffers */
        out_cmd = txq->cmd[idx];
        out_meta = &txq->meta[idx];
-        tx = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
+        tx_cmd = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
-        memset(tx, 0, sizeof(*tx));
+        memset(tx_cmd, 0, sizeof(*tx_cmd));
        /*
         * Set up the Tx-command (not MAC!) header.
@@ -583,7 +575,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                INDEX_TO_SEQ(q->write_ptr)));
        /* Copy MAC header from skb into command buffer */
-        memcpy(tx->hdr, hdr, hdr_len);
+        memcpy(tx_cmd->hdr, hdr, hdr_len);
        if (info->control.hw_key)
@@ -597,12 +589,12 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        /* Total # bytes to be transmitted */
        len = (u16)skb->len;
-        tx->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16(len);
        iwl_dbg_log_tx_data_frame(priv, len, hdr);
        iwl_update_stats(priv, true, fc, len);
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
        if (!ieee80211_has_morefrags(hdr->frame_control)) {
                txq->need_update = 1;
@@ -615,9 +607,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                     le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx_cmd, sizeof(*tx_cmd));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr,
                           ieee80211_hdrlen(fc));
        /*
@@ -753,7 +745,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                               u8 type)
 {
        struct iwl_spectrum_cmd spectrum;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
        struct iwl_host_cmd cmd = {
                .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
                .data = (void *)&spectrum,
@@ -798,18 +790,18 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
        if (rc)
                return rc;
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_RX_ON_ASSOC command\n");
                rc = -EIO;
        }
-        spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
+        spectrum_resp_status = le16_to_cpu(pkt->u.spectrum.status);
        switch (spectrum_resp_status) {
        case 0:         /* Command will be handled */
-                if (res->u.spectrum.id != 0xff) {
+                if (pkt->u.spectrum.id != 0xff) {
                        IWL_DEBUG_INFO(priv, "Replaced existing measurement: %d\n",
-                                                res->u.spectrum.id);
+                                                pkt->u.spectrum.id);
                        priv->measurement_status &= ~MEASUREMENT_READY;
                }
                priv->measurement_status |= MEASUREMENT_ACTIVE;
@@ -821,7 +813,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                break;
        }
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
        return rc;
 }
@@ -830,7 +822,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
 static void iwl3945_rx_reply_alive(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_alive_resp *palive;
        struct delayed_work *pwork;
@@ -867,7 +859,7 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 #endif
        IWL_DEBUG_RX(priv, "Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
@@ -903,7 +895,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl3945_beacon_notif *beacon = &(pkt->u.beacon_status);
        u8 rate = beacon->beacon_notify_hdr.rate;
@@ -926,7 +918,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
        unsigned long status = priv->status;
@@ -1090,7 +1082,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
                list_del(element);
                /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->real_dma_addr);
+                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->page_dma);
                rxq->queue[rxq->write] = rxb;
                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                rxq->free_count--;
@@ -1130,8 +1122,9 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
        struct iwl_rx_queue *rxq = &priv->rxq;
        struct list_head *element;
        struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
        unsigned long flags;
+        gfp_t gfp_mask = priority;
        while (1) {
                spin_lock_irqsave(&rxq->lock, flags);
@@ -1143,10 +1136,14 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                spin_unlock_irqrestore(&rxq->lock, flags);
                if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
+                        gfp_mask |= __GFP_NOWARN;
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
                /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
-                if (!skb) {
+                if (!page) {
                        if (net_ratelimit())
                                IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
@@ -1163,7 +1160,7 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                spin_lock_irqsave(&rxq->lock, flags);
                if (list_empty(&rxq->rx_used)) {
                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                        return;
                }
                element = rxq->rx_used.next;
@@ -1171,26 +1168,18 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                list_del(element);
                spin_unlock_irqrestore(&rxq->lock, flags);
-                rxb->skb = skb;
+                rxb->page = page;
-                /* If radiotap head is required, reserve some headroom here.
-                 * The physical head count is a variable rx_stats->phy_count.
-                 * We reserve 4 bytes here. Plus these extra bytes, the
-                 * headroom of the physical head should be enough for the
-                 * radiotap head that iwl3945 supported. See iwl3945_rt.
-                 */
-                skb_reserve(rxb->skb, 4);
                /* Get physical address of RB/SKB */
-                rxb->real_dma_addr = pci_map_single(priv->pci_dev,
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
-                                                rxb->skb->data,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                                priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
-                                                PCI_DMA_FROMDEVICE);
                spin_lock_irqsave(&rxq->lock, flags);
                list_add_tail(&rxb->list, &rxq->rx_free);
-                priv->alloc_rxb_skb++;
                rxq->free_count++;
+                priv->alloc_rxb_page++;
                spin_unlock_irqrestore(&rxq->lock, flags);
        }
 }
@@ -1206,14 +1195,14 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                /* In the reset function, these buffers may have been allocated
                 * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
+                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_single(priv->pci_dev,
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                         rxq->pool[i].real_dma_addr,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                         priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
-                                         PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_page--;
-                        priv->alloc_rxb_skb--;
+                        __free_pages(rxq->pool[i].page,
-                        dev_kfree_skb(rxq->pool[i].skb);
+                                     priv->hw_params.rx_page_order);
-                        rxq->pool[i].skb = NULL;
+                        rxq->pool[i].page = NULL;
                }
                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
        }
@@ -1221,8 +1210,8 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
        /* Set us so that we have processed and used all buffers, but have
         * not restocked the Rx queue with fresh buffers */
        rxq->read = rxq->write = 0;
-        rxq->free_count = 0;
        rxq->write_actual = 0;
+        rxq->free_count = 0;
        spin_unlock_irqrestore(&rxq->lock, flags);
 }
@@ -1255,12 +1244,14 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
 {
        int i;
        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
+                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_single(priv->pci_dev,
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                         rxq->pool[i].real_dma_addr,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                         priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
-                                         PCI_DMA_FROMDEVICE);
+                        __free_pages(rxq->pool[i].page,
-                        dev_kfree_skb(rxq->pool[i].skb);
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
+                        priv->alloc_rxb_page--;
                }
        }
@@ -1376,7 +1367,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
        i = rxq->read;
        /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
        if (total_empty < 0)
                total_empty += RX_QUEUE_SIZE;
@@ -1396,10 +1387,10 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                rxq->queue[i] = NULL;
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
-                                priv->hw_params.rx_buf_size,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
+                               PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pkt = rxb_addr(rxb);
                trace_iwlwifi_dev_rx(priv, pkt,
                        le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
@@ -1420,44 +1411,55 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                if (priv->rx_handlers[pkt->hdr.cmd]) {
                        IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r, i,
                                get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                        priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                } else {
                        /* No handling needed */
-                        IWL_DEBUG_RX(priv, "r %d i %d No handler needed for %s, 0x%02x\n",
+                        IWL_DEBUG_RX(priv,
+                                "r %d i %d No handler needed for %s, 0x%02x\n",
                                r, i, get_cmd_string(pkt->hdr.cmd),
                                pkt->hdr.cmd);
                }
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
                if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
+                        /* Invoke any callbacks, transfer the buffer to caller,
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                         * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                iwl_tx_cmd_complete(priv, rxb);
                        else
                                IWL_WARN(priv, "Claim null rxb?\n");
                }
-                /* For now we just don't re-use anything.  We can tweak this
+                /* Reuse the page if possible. For notification packets and
-                 * later to try and re-use notification packets and SKBs that
+                 * SKBs that fail to Rx correctly, add them back into the
-                 * fail to Rx correctly */
+                 * rx_free list for reuse later. */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
                spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
                spin_unlock_irqrestore(&rxq->lock, flags);
                i = (i + 1) & RX_QUEUE_MASK;
                /* If there are a lot of unused frames,
                 * restock the Rx queue so ucode won't assert. */
                if (fill_rx) {
                        count++;
                        if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                iwl3945_rx_replenish_now(priv);
                                count = 0;
                        }
@@ -1465,7 +1467,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
        }
        /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
        if (fill_rx)
                iwl3945_rx_replenish_now(priv);
        else
@@ -1686,6 +1688,8 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
        }
 #endif
+        spin_unlock_irqrestore(&priv->lock, flags);
        /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
         * atomic, make sure that inta covers all the interrupts that
         * we've discovered, even if FH interrupt came in just after
@@ -1707,8 +1711,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_HW_ERR;
-                spin_unlock_irqrestore(&priv->lock, flags);
                return;
        }
@@ -1800,7 +1802,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                        "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
        }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
@@ -2563,11 +2564,6 @@ static void __iwl3945_down(struct iwl_priv *priv)
                        test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                STATUS_EXIT_PENDING;
-        priv->cfg->ops->lib->apm_ops.reset(priv);
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-        spin_unlock_irqrestore(&priv->lock, flags);
        iwl3945_hw_txq_ctx_stop(priv);
        iwl3945_hw_rxq_stop(priv);
@@ -2576,10 +2572,8 @@ static void __iwl3945_down(struct iwl_priv *priv)
        udelay(5);
-        if (exit_pending)
+        /* Stop the device, and put it in low power state */
-                priv->cfg->ops->lib->apm_ops.stop(priv);
+        priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
 exit:
        memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
@@ -2724,19 +2718,34 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
        mutex_unlock(&priv->mutex);
 }
+/*
+ * 3945 cannot interrupt driver when hardware rf kill switch toggles;
+ * driver must poll CSR_GP_CNTRL_REG register for change.  This register
+ * *is* readable even when device has been SW_RESET into low power mode
+ * (e.g. during RF KILL).
+ */
 static void iwl3945_rfkill_poll(struct work_struct *data)
 {
        struct iwl_priv *priv =
            container_of(data, struct iwl_priv, rfkill_poll.work);
+        bool old_rfkill = test_bit(STATUS_RF_KILL_HW, &priv->status);
+        bool new_rfkill = !(iwl_read32(priv, CSR_GP_CNTRL)
+                        & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
-        if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
+        if (new_rfkill != old_rfkill) {
-                clear_bit(STATUS_RF_KILL_HW, &priv->status);
+                if (new_rfkill)
-        else
+                        set_bit(STATUS_RF_KILL_HW, &priv->status);
-                set_bit(STATUS_RF_KILL_HW, &priv->status);
+                else
+                        clear_bit(STATUS_RF_KILL_HW, &priv->status);
-        wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, new_rfkill);
-                        test_bit(STATUS_RF_KILL_HW, &priv->status));
+                IWL_DEBUG_RF_KILL(priv, "RF_KILL bit toggled to %s.\n",
+                                new_rfkill ? "disable radio" : "enable radio");
+        }
+        /* Keep this running, even if radio now enabled.  This will be
+         * cancelled in mac_start() if system decides to start again */
        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
                           round_jiffies_relative(2 * HZ));
@@ -3797,7 +3806,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
        /* Clear the driver's (not device's) station table */
        iwl_clear_stations_table(priv);
-        priv->data_retry_limit = -1;
        priv->ieee_channels = NULL;
        priv->ieee_rates = NULL;
        priv->band = IEEE80211_BAND_2GHZ;
@@ -4056,6 +4064,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                             &priv->bands[IEEE80211_BAND_2GHZ].channels[5]);
        iwl3945_setup_deferred_work(priv);
        iwl3945_setup_rx_handlers(priv);
+        iwl_power_initialize(priv);
        /*********************************
         * 8. Setup and Register mac80211
@@ -4126,6 +4135,15 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
                iwl3945_down(priv);
        }
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
        /* make sure we flush any pending irq or
         * tasklet for the driver
         */