34 files changed, 3301 insertions, 3704 deletions

diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 736162324ba4..e092af09d6bf 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -5,16 +5,11 @@ config IWLWIFI
         select FW_LOADER
         select MAC80211_LEDS if IWLWIFI_LEDS
         select LEDS_CLASS if IWLWIFI_LEDS
-        select RFKILL if IWLWIFI_RFKILL
 
 config IWLWIFI_LEDS
         bool "Enable LED support in iwlagn and iwl3945 drivers"
         depends on IWLWIFI
 
-config IWLWIFI_RFKILL
-        bool "Enable RF kill support in iwlagn and iwl3945 drivers"
-        depends on IWLWIFI
-
 config IWLWIFI_SPECTRUM_MEASUREMENT
         bool "Enable Spectrum Measurement in iwlagn driver"
         depends on IWLWIFI
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index d79d97ad61a5..1d4e0a226fd4 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -4,7 +4,6 @@ iwlcore-objs 		+= iwl-rx.o iwl-tx.o iwl-sta.o iwl-calib.o
 iwlcore-objs            += iwl-scan.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlcore-$(CONFIG_IWLWIFI_LEDS) += iwl-led.o
-iwlcore-$(CONFIG_IWLWIFI_RFKILL) += iwl-rfkill.o
 iwlcore-$(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) += iwl-spectrum.o
 
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index ac22f59be9ef..225e5f889346 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -44,6 +44,15 @@
 #include "iwl-core.h"
 #include "iwl-dev.h"
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+static const char *led_type_str[] = {
+        __stringify(IWL_LED_TRG_TX),
+        __stringify(IWL_LED_TRG_RX),
+        __stringify(IWL_LED_TRG_ASSOC),
+        __stringify(IWL_LED_TRG_RADIO),
+        NULL
+};
+#endif /* CONFIG_IWLWIFI_DEBUG */
 
 static const struct {
         u16 brightness;
@@ -61,7 +70,7 @@ static const struct {
         {10, 110, 110},
         {5, 130, 130},
         {0, 167, 167},
-        /*SOLID_ON*/
+        /* SOLID_ON */
         {-1, IWL_LED_SOLID, 0}
 };
 
@@ -143,6 +152,26 @@ static int iwl3945_led_off(struct iwl_priv *priv, int led_id)
 }
 
 /*
+ *  Set led on in case of association
+ *  */
+static int iwl3945_led_associate(struct iwl_priv *priv, int led_id)
+{
+        IWL_DEBUG_LED(priv, "Associated\n");
+
+        priv->allow_blinking = 1;
+        return iwl3945_led_on(priv, led_id);
+}
+/* Set Led off in case of disassociation */
+static int iwl3945_led_disassociate(struct iwl_priv *priv, int led_id)
+{
+        IWL_DEBUG_LED(priv, "Disassociated\n");
+
+        priv->allow_blinking = 0;
+
+        return 0;
+}
+
+/*
  * brightness call back function for Tx/Rx LED
  */
 static int iwl3945_led_associated(struct iwl_priv *priv, int led_id)
@@ -165,26 +194,21 @@ static void iwl3945_led_brightness_set(struct led_classdev *led_cdev,
                                 enum led_brightness brightness)
 {
         struct iwl_led *led = container_of(led_cdev,
-                                               struct iwl_led, led_dev);
+                                           struct iwl_led, led_dev);
         struct iwl_priv *priv = led->priv;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        IWL_DEBUG_LED(priv, "Led type = %s brightness = %d\n",
+                        led_type_str[led->type], brightness);
+
         switch (brightness) {
         case LED_FULL:
-                if (led->type == IWL_LED_TRG_ASSOC) {
-                        priv->allow_blinking = 1;
-                        IWL_DEBUG_LED(priv, "MAC is  associated\n");
-                }
                 if (led->led_on)
                         led->led_on(priv, IWL_LED_LINK);
                 break;
         case LED_OFF:
-                if (led->type == IWL_LED_TRG_ASSOC) {
-                        priv->allow_blinking = 0;
-                        IWL_DEBUG_LED(priv, "MAC is disassociated\n");
-                }
                 if (led->led_off)
                         led->led_off(priv, IWL_LED_LINK);
                 break;
@@ -197,8 +221,6 @@ static void iwl3945_led_brightness_set(struct led_classdev *led_cdev,
         }
 }
 
-
-
 /*
  * Register led class with the system
  */
@@ -237,12 +259,12 @@ static int iwl3945_led_register_led(struct iwl_priv *priv,
 static inline u8 get_blink_rate(struct iwl_priv *priv)
 {
         int index;
-        u64 current_tpt = priv->rxtxpackets;
-        s64 tpt = current_tpt - priv->led_tpt;
+        s64 tpt = priv->rxtxpackets;
 
         if (tpt < 0)
                 tpt = -tpt;
-        priv->led_tpt = current_tpt;
+
+        IWL_DEBUG_LED(priv, "tpt %lld \n", (long long)tpt);
 
         if (!priv->allow_blinking)
                 index = IWL_MAX_BLINK_TBL;
@@ -250,13 +272,9 @@ static inline u8 get_blink_rate(struct iwl_priv *priv)
                 for (index = 0; index < IWL_MAX_BLINK_TBL; index++)
                         if (tpt > (blink_tbl[index].brightness * IWL_1MB_RATE))
                                 break;
-        return index;
-}
 
-static inline int is_rf_kill(struct iwl_priv *priv)
-{
-        return test_bit(STATUS_RF_KILL_HW, &priv->status) ||
-                test_bit(STATUS_RF_KILL_SW, &priv->status);
+        IWL_DEBUG_LED(priv, "LED BLINK IDX=%d\n", index);
+        return index;
 }
 
 /*
@@ -272,7 +290,7 @@ void iwl3945_led_background(struct iwl_priv *priv)
                 priv->last_blink_time = 0;
                 return;
         }
-        if (is_rf_kill(priv)) {
+        if (iwl_is_rfkill(priv)) {
                 priv->last_blink_time = 0;
                 return;
         }
@@ -341,8 +359,8 @@ int iwl3945_led_register(struct iwl_priv *priv)
                                    IWL_LED_TRG_ASSOC, 0, trigger);
 
         /* for assoc always turn led on */
-        priv->led[IWL_LED_TRG_ASSOC].led_on = iwl3945_led_on;
-        priv->led[IWL_LED_TRG_ASSOC].led_off = iwl3945_led_on;
+        priv->led[IWL_LED_TRG_ASSOC].led_on = iwl3945_led_associate;
+        priv->led[IWL_LED_TRG_ASSOC].led_off = iwl3945_led_disassociate;
         priv->led[IWL_LED_TRG_ASSOC].led_pattern = NULL;
 
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index af6b9d444778..5eb538d18a80 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -38,6 +38,7 @@
 
 #include "iwl-commands.h"
 #include "iwl-3945.h"
+#include "iwl-sta.h"
 
 #define RS_NAME "iwl-3945-rs"
 
@@ -683,11 +684,10 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         if (sta)
                 rate_mask = sta->supp_rates[sband->band];
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            is_multicast_ether_addr(hdr->addr1) ||
+            info->flags & IEEE80211_TX_CTL_NO_ACK ||
             !sta || !priv_sta) {
                 IWL_DEBUG_RATE(priv, "leave: No STA priv data to update!\n");
                 if (!rate_mask)
@@ -696,6 +696,8 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
                 else
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
                 return;
         }
 
@@ -713,13 +715,13 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 
         if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
             !rs_sta->ibss_sta_added) {
-                u8 sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
+                u8 sta_id = iwl_find_station(priv, hdr->addr1);
 
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pm\n",
                                        hdr->addr1);
-                        sta_id = iwl3945_add_station(priv,
-                                    hdr->addr1, 0, CMD_ASYNC);
+                        sta_id = iwl_add_station(priv, hdr->addr1, false,
+                                CMD_ASYNC, NULL);
                 }
                 if (sta_id != IWL_INVALID_STATION)
                         rs_sta->ibss_sta_added = 1;
@@ -974,7 +976,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta(hw, priv->stations_39[sta_id].sta.sta.addr);
+        sta = ieee80211_find_sta(hw, priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
                 rcu_read_unlock();
                 return;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 527525cc0919..46288e724889 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -98,7 +98,6 @@ const struct iwl3945_rate_info iwl3945_rates[IWL_RATE_COUNT_3945] = {
  *   ... and set IWL_EVT_DISABLE to 1. */
 void iwl3945_disable_events(struct iwl_priv *priv)
 {
-        int ret;
         int i;
         u32 base;               /* SRAM address of event log header */
         u32 disable_ptr;        /* SRAM address of event-disable bitmap array */
@@ -159,26 +158,17 @@ void iwl3945_disable_events(struct iwl_priv *priv)
                 return;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                IWL_WARN(priv, "Can not read from adapter at this time.\n");
-                return;
-        }
-
         disable_ptr = iwl_read_targ_mem(priv, base + (4 * sizeof(u32)));
         array_size = iwl_read_targ_mem(priv, base + (5 * sizeof(u32)));
-        iwl_release_nic_access(priv);
 
         if (IWL_EVT_DISABLE && (array_size == IWL_EVT_DISABLE_SIZE)) {
                 IWL_DEBUG_INFO(priv, "Disabling selected uCode log events at 0x%x\n",
                                disable_ptr);
-                ret = iwl_grab_nic_access(priv);
                 for (i = 0; i < IWL_EVT_DISABLE_SIZE; i++)
                         iwl_write_targ_mem(priv,
                                            disable_ptr + (i * sizeof(u32)),
                                            evt_disable[i]);
 
-                iwl_release_nic_access(priv);
         } else {
                 IWL_DEBUG_INFO(priv, "Selected uCode log events may be disabled\n");
                 IWL_DEBUG_INFO(priv, "  by writing \"1\"s into disable bitmap\n");
@@ -779,35 +769,6 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         return ;
 }
 
-u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *addr)
-{
-        int i, start = IWL_AP_ID;
-        int ret = IWL_INVALID_STATION;
-        unsigned long flags;
-
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) ||
-            (priv->iw_mode == NL80211_IFTYPE_AP))
-                start = IWL_STA_ID;
-
-        if (is_broadcast_ether_addr(addr))
-                return priv->hw_params.bcast_sta_id;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        for (i = start; i < priv->hw_params.max_stations; i++)
-                if ((priv->stations_39[i].used) &&
-                    (!compare_ether_addr
-                     (priv->stations_39[i].sta.sta.addr, addr))) {
-                        ret = i;
-                        goto out;
-                }
-
-        IWL_DEBUG_INFO(priv, "can not find STA %pM (total %d)\n",
-                       addr, priv->num_stations);
- out:
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return ret;
-}
-
 /**
  * iwl3945_hw_build_tx_cmd_rate - Add rate portion to TX_CMD:
  *
@@ -885,13 +846,13 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv, struct iwl_cmd *cmd,
 u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
 {
         unsigned long flags_spin;
-        struct iwl3945_station_entry *station;
+        struct iwl_station_entry *station;
 
         if (sta_id == IWL_INVALID_STATION)
                 return IWL_INVALID_STATION;
 
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
-        station = &priv->stations_39[sta_id];
+        station = &priv->stations[sta_id];
 
         station->sta.sta.modify_mask = STA_MODIFY_TX_RATE_MSK;
         station->sta.rate_n_flags = cpu_to_le16(tx_rate);
@@ -899,8 +860,7 @@ u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
 
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
-        iwl_send_add_sta(priv,
-                         (struct iwl_addsta_cmd *)&station->sta, flags);
+        iwl_send_add_sta(priv, &station->sta, flags);
         IWL_DEBUG_RATE(priv, "SCALE sync station %d to rate %d\n",
                         sta_id, tx_rate);
         return sta_id;
@@ -908,55 +868,30 @@ u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
 
 static int iwl3945_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
 {
-        int ret;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         if (src == IWL_PWR_SRC_VAUX) {
                 if (pci_pme_capable(priv->pci_dev, PCI_D3cold)) {
                         iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
                                         APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
                                         ~APMG_PS_CTRL_MSK_PWR_SRC);
-                        iwl_release_nic_access(priv);
 
                         iwl_poll_bit(priv, CSR_GPIO_IN,
                                      CSR_GPIO_IN_VAL_VAUX_PWR_SRC,
                                      CSR_GPIO_IN_BIT_AUX_POWER, 5000);
-                } else {
-                        iwl_release_nic_access(priv);
                 }
         } else {
                 iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
                                 APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
                                 ~APMG_PS_CTRL_MSK_PWR_SRC);
 
-                iwl_release_nic_access(priv);
                 iwl_poll_bit(priv, CSR_GPIO_IN, CSR_GPIO_IN_VAL_VMAIN_PWR_SRC,
                              CSR_GPIO_IN_BIT_AUX_POWER, 5000);  /* uS */
         }
-        spin_unlock_irqrestore(&priv->lock, flags);
 
-        return ret;
+        return 0;
 }
 
 static int iwl3945_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
-        int rc;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
-
         iwl_write_direct32(priv, FH39_RCSR_RBD_BASE(0), rxq->dma_addr);
         iwl_write_direct32(priv, FH39_RCSR_RPTR_ADDR(0), rxq->rb_stts_dma);
         iwl_write_direct32(priv, FH39_RCSR_WPTR(0), 0);
@@ -973,23 +908,11 @@ static int iwl3945_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         /* fake read to flush all prev I/O */
         iwl_read_direct32(priv, FH39_RSSR_CTRL);
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return 0;
 }
 
 static int iwl3945_tx_reset(struct iwl_priv *priv)
 {
-        int rc;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
 
         /* bypass mode */
         iwl_write_prph(priv, ALM_SCD_MODE_REG, 0x2);
@@ -1017,8 +940,6 @@ static int iwl3945_tx_reset(struct iwl_priv *priv)
                 FH39_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RSP_WAIT_TH |
                 FH39_TSSR_TX_MSG_CONFIG_REG_VAL_RSP_WAIT_TH);
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
 }
@@ -1061,7 +982,7 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
 
 static int iwl3945_apm_init(struct iwl_priv *priv)
 {
-        int ret = 0;
+        int ret;
 
         iwl_power_initialize(priv);
 
@@ -1083,10 +1004,6 @@ static int iwl3945_apm_init(struct iwl_priv *priv)
                 goto out;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                goto out;
-
         /* enable DMA */
         iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
                                                 APMG_CLK_VAL_BSM_CLK_RQT);
@@ -1097,7 +1014,6 @@ static int iwl3945_apm_init(struct iwl_priv *priv)
         iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
                           APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
 
-        iwl_release_nic_access(priv);
 out:
         return ret;
 }
@@ -1110,6 +1026,11 @@ static void iwl3945_nic_config(struct iwl_priv *priv)
 
         spin_lock_irqsave(&priv->lock, flags);
 
+        /* Determine HW type */
+        pci_read_config_byte(priv->pci_dev, PCI_REVISION_ID, &rev_id);
+
+        IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
+
         if (rev_id & PCI_CFG_REV_ID_BIT_RTP)
                 IWL_DEBUG_INFO(priv, "RTP type \n");
         else if (rev_id & PCI_CFG_REV_ID_BIT_BASIC_SKU) {
@@ -1163,7 +1084,6 @@ static void iwl3945_nic_config(struct iwl_priv *priv)
 
 int iwl3945_hw_nic_init(struct iwl_priv *priv)
 {
-        u8 rev_id;
         int rc;
         unsigned long flags;
         struct iwl_rx_queue *rxq = &priv->rxq;
@@ -1172,12 +1092,6 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
         priv->cfg->ops->lib->apm_ops.init(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Determine HW type */
-        rc = pci_read_config_byte(priv->pci_dev, PCI_REVISION_ID, &rev_id);
-        if (rc)
-                return rc;
-        IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
-
         rc = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
         if (rc)
                 return rc;
@@ -1198,22 +1112,13 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
 
         iwl3945_rx_init(priv, rxq);
 
-        spin_lock_irqsave(&priv->lock, flags);
 
         /* Look at using this instead:
         rxq->need_update = 1;
         iwl_rx_queue_update_write_ptr(priv, rxq);
         */
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
         iwl_write_direct32(priv, FH39_RCSR_WPTR(0), rxq->write & ~7);
-        iwl_release_nic_access(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         rc = iwl3945_txq_ctx_reset(priv);
         if (rc)
@@ -1245,14 +1150,6 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
 void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
 {
         int txq_id;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        if (iwl_grab_nic_access(priv)) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                iwl3945_hw_txq_ctx_free(priv);
-                return;
-        }
 
         /* stop SCD */
         iwl_write_prph(priv, ALM_SCD_MODE_REG, 0);
@@ -1265,9 +1162,6 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
                                 1000);
         }
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         iwl3945_hw_txq_ctx_free(priv);
 }
 
@@ -1312,12 +1206,8 @@ static void iwl3945_apm_stop(struct iwl_priv *priv)
 
 static int iwl3945_apm_reset(struct iwl_priv *priv)
 {
-        int rc;
-        unsigned long flags;
-
         iwl3945_apm_stop_master(priv);
 
-        spin_lock_irqsave(&priv->lock, flags);
 
         iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
         udelay(10);
@@ -1327,36 +1217,31 @@ static int iwl3945_apm_reset(struct iwl_priv *priv)
         iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
                          CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
 
-        rc = iwl_grab_nic_access(priv);
-        if (!rc) {
-                iwl_write_prph(priv, APMG_CLK_CTRL_REG,
-                                         APMG_CLK_VAL_BSM_CLK_RQT);
+        iwl_write_prph(priv, APMG_CLK_CTRL_REG,
+                                APMG_CLK_VAL_BSM_CLK_RQT);
 
-                iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
-                iwl_write_prph(priv, APMG_RTC_INT_STT_REG,
+        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
+        iwl_write_prph(priv, APMG_RTC_INT_STT_REG,
                                         0xFFFFFFFF);
 
-                /* enable DMA */
-                iwl_write_prph(priv, APMG_CLK_EN_REG,
-                                         APMG_CLK_VAL_DMA_CLK_RQT |
-                                         APMG_CLK_VAL_BSM_CLK_RQT);
-                udelay(10);
+        /* enable DMA */
+        iwl_write_prph(priv, APMG_CLK_EN_REG,
+                                APMG_CLK_VAL_DMA_CLK_RQT |
+                                APMG_CLK_VAL_BSM_CLK_RQT);
+        udelay(10);
 
-                iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
+        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
                                 APMG_PS_CTRL_VAL_RESET_REQ);
-                udelay(5);
-                iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
+        udelay(5);
+        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
                                 APMG_PS_CTRL_VAL_RESET_REQ);
-                iwl_release_nic_access(priv);
-        }
 
         /* Clear the 'host command active' bit... */
         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
 
         wake_up_interruptible(&priv->wait_command_queue);
-        spin_unlock_irqrestore(&priv->lock, flags);
 
-        return rc;
+        return 0;
 }
 
 /**
@@ -1964,6 +1849,193 @@ int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power)
         return 0;
 }
 
+static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
+{
+        int rc = 0;
+        struct iwl_rx_packet *res = NULL;
+        struct iwl3945_rxon_assoc_cmd rxon_assoc;
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_RXON_ASSOC,
+                .len = sizeof(rxon_assoc),
+                .meta.flags = CMD_WANT_SKB,
+                .data = &rxon_assoc,
+        };
+        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
+        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+
+        if ((rxon1->flags == rxon2->flags) &&
+            (rxon1->filter_flags == rxon2->filter_flags) &&
+            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
+            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
+                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
+                return 0;
+        }
+
+        rxon_assoc.flags = priv->staging_rxon.flags;
+        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
+        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.reserved = 0;
+
+        rc = iwl_send_cmd_sync(priv, &cmd);
+        if (rc)
+                return rc;
+
+        res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
+        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+                IWL_ERR(priv, "Bad return from REPLY_RXON_ASSOC command\n");
+                rc = -EIO;
+        }
+
+        priv->alloc_rxb_skb--;
+        dev_kfree_skb_any(cmd.meta.u.skb);
+
+        return rc;
+}
+
+/**
+ * iwl3945_commit_rxon - commit staging_rxon to hardware
+ *
+ * The RXON command in staging_rxon is committed to the hardware and
+ * the active_rxon structure is updated with the new data.  This
+ * function correctly transitions out of the RXON_ASSOC_MSK state if
+ * a HW tune is required based on the RXON structure changes.
+ */
+static int iwl3945_commit_rxon(struct iwl_priv *priv)
+{
+        /* cast away the const for active_rxon in this function */
+        struct iwl3945_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
+        struct iwl3945_rxon_cmd *staging_rxon = (void *)&priv->staging_rxon;
+        int rc = 0;
+        bool new_assoc =
+                !!(priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK);
+
+        if (!iwl_is_alive(priv))
+                return -1;
+
+        /* always get timestamp with Rx frame */
+        staging_rxon->flags |= RXON_FLG_TSF2HOST_MSK;
+
+        /* select antenna */
+        staging_rxon->flags &=
+            ~(RXON_FLG_DIS_DIV_MSK | RXON_FLG_ANT_SEL_MSK);
+        staging_rxon->flags |= iwl3945_get_antenna_flags(priv);
+
+        rc = iwl_check_rxon_cmd(priv);
+        if (rc) {
+                IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
+                return -EINVAL;
+        }
+
+        /* If we don't need to send a full RXON, we can use
+         * iwl3945_rxon_assoc_cmd which is used to reconfigure filter
+         * and other flags for the current radio configuration. */
+        if (!iwl_full_rxon_required(priv)) {
+                rc = iwl_send_rxon_assoc(priv);
+                if (rc) {
+                        IWL_ERR(priv, "Error setting RXON_ASSOC "
+                                  "configuration (%d).\n", rc);
+                        return rc;
+                }
+
+                memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
+
+                return 0;
+        }
+
+        /* If we are currently associated and the new config requires
+         * an RXON_ASSOC and the new config wants the associated mask enabled,
+         * we must clear the associated from the active configuration
+         * before we apply the new config */
+        if (iwl_is_associated(priv) && new_assoc) {
+                IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
+                active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+
+                /*
+                 * reserved4 and 5 could have been filled by the iwlcore code.
+                 * Let's clear them before pushing to the 3945.
+                 */
+                active_rxon->reserved4 = 0;
+                active_rxon->reserved5 = 0;
+                rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
+                                      sizeof(struct iwl3945_rxon_cmd),
+                                      &priv->active_rxon);
+
+                /* If the mask clearing failed then we set
+                 * active_rxon back to what it was previously */
+                if (rc) {
+                        active_rxon->filter_flags |= RXON_FILTER_ASSOC_MSK;
+                        IWL_ERR(priv, "Error clearing ASSOC_MSK on current "
+                                  "configuration (%d).\n", rc);
+                        return rc;
+                }
+        }
+
+        IWL_DEBUG_INFO(priv, "Sending RXON\n"
+                       "* with%s RXON_FILTER_ASSOC_MSK\n"
+                       "* channel = %d\n"
+                       "* bssid = %pM\n",
+                       (new_assoc ? "" : "out"),
+                       le16_to_cpu(staging_rxon->channel),
+                       staging_rxon->bssid_addr);
+
+        /*
+         * reserved4 and 5 could have been filled by the iwlcore code.
+         * Let's clear them before pushing to the 3945.
+         */
+        staging_rxon->reserved4 = 0;
+        staging_rxon->reserved5 = 0;
+
+        iwl_set_rxon_hwcrypto(priv, !priv->hw_params.sw_crypto);
+
+        /* Apply the new configuration */
+        rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
+                              sizeof(struct iwl3945_rxon_cmd),
+                              staging_rxon);
+        if (rc) {
+                IWL_ERR(priv, "Error setting new configuration (%d).\n", rc);
+                return rc;
+        }
+
+        memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
+
+        iwl_clear_stations_table(priv);
+
+        /* If we issue a new RXON command which required a tune then we must
+         * send a new TXPOWER command or we won't be able to Tx any frames */
+        rc = priv->cfg->ops->lib->send_tx_power(priv);
+        if (rc) {
+                IWL_ERR(priv, "Error setting Tx power (%d).\n", rc);
+                return rc;
+        }
+
+        /* Add the broadcast address so we can send broadcast frames */
+        if (iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL) ==
+            IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
+                return -EIO;
+        }
+
+        /* If we have set the ASSOC_MSK and we are in BSS mode then
+         * add the IWL_AP_ID to the station rate table */
+        if (iwl_is_associated(priv) &&
+            (priv->iw_mode == NL80211_IFTYPE_STATION))
+                if (iwl_add_station(priv, priv->active_rxon.bssid_addr,
+                                true, CMD_SYNC, NULL) == IWL_INVALID_STATION) {
+                        IWL_ERR(priv, "Error adding AP address for transmit\n");
+                        return -EIO;
+                }
+
+        /* Init the hardware's rate fallback order based on the band */
+        rc = iwl3945_init_hw_rate_table(priv);
+        if (rc) {
+                IWL_ERR(priv, "Error setting HW rate table: %02X\n", rc);
+                return -EIO;
+        }
+
+        return 0;
+}
+
 /* will add 3945 channel switch cmd handling later */
 int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
@@ -2314,14 +2386,6 @@ int iwl3945_txpower_set_from_eeprom(struct iwl_priv *priv)
 int iwl3945_hw_rxq_stop(struct iwl_priv *priv)
 {
         int rc;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
 
         iwl_write_direct32(priv, FH39_RCSR_CONFIG(0), 0);
         rc = iwl_poll_direct_bit(priv, FH39_RSSR_STATUS,
@@ -2329,28 +2393,17 @@ int iwl3945_hw_rxq_stop(struct iwl_priv *priv)
         if (rc < 0)
                 IWL_ERR(priv, "Can't stop Rx DMA.\n");
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return 0;
 }
 
 int iwl3945_hw_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 {
-        int rc;
-        unsigned long flags;
         int txq_id = txq->q.id;
 
         struct iwl3945_shared *shared_data = priv->shared_virt;
 
         shared_data->tx_base_ptr[txq_id] = cpu_to_le32((u32)txq->q.dma_addr);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
         iwl_write_direct32(priv, FH39_CBCC_CTRL(txq_id), 0);
         iwl_write_direct32(priv, FH39_CBCC_BASE(txq_id), 0);
 
@@ -2360,11 +2413,9 @@ int iwl3945_hw_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                 FH39_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_IFTFD |
                 FH39_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE_VAL |
                 FH39_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE);
-        iwl_release_nic_access(priv);
 
         /* fake read to flush all prev. writes */
         iwl_read32(priv, FH39_TSSR_CBB_BASE);
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
 }
@@ -2384,13 +2435,25 @@ static u16 iwl3945_get_hcmd_size(u8 cmd_id, u16 len)
         }
 }
 
+
 static u16 iwl3945_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
 {
-        u16 size = (u16)sizeof(struct iwl3945_addsta_cmd);
-        memcpy(data, cmd, size);
-        return size;
+        struct iwl3945_addsta_cmd *addsta = (struct iwl3945_addsta_cmd *)data;
+        addsta->mode = cmd->mode;
+        memcpy(&addsta->sta, &cmd->sta, sizeof(struct sta_id_modify));
+        memcpy(&addsta->key, &cmd->key, sizeof(struct iwl4965_keyinfo));
+        addsta->station_flags = cmd->station_flags;
+        addsta->station_flags_msk = cmd->station_flags_msk;
+        addsta->tid_disable_tx = cpu_to_le16(0);
+        addsta->rate_n_flags = cmd->rate_n_flags;
+        addsta->add_immediate_ba_tid = cmd->add_immediate_ba_tid;
+        addsta->remove_immediate_ba_tid = cmd->remove_immediate_ba_tid;
+        addsta->add_immediate_ba_ssn = cmd->add_immediate_ba_ssn;
+
+        return (u16)sizeof(struct iwl3945_addsta_cmd);
 }
 
+
 /**
  * iwl3945_init_hw_rate_table - Initialize the hardware rate fallback table
  */
@@ -2672,10 +2735,6 @@ static int iwl3945_load_bsm(struct iwl_priv *priv)
         inst_len = priv->ucode_init.len;
         data_len = priv->ucode_init_data.len;
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc)
-                return rc;
-
         iwl_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
         iwl_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
         iwl_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG, inst_len);
@@ -2689,10 +2748,8 @@ static int iwl3945_load_bsm(struct iwl_priv *priv)
                                           le32_to_cpu(*image));
 
         rc = iwl3945_verify_bsm(priv);
-        if (rc) {
-                iwl_release_nic_access(priv);
+        if (rc)
                 return rc;
-        }
 
         /* Tell BSM to copy from BSM SRAM into instruction SRAM, when asked */
         iwl_write_prph(priv, BSM_WR_MEM_SRC_REG, 0x0);
@@ -2724,11 +2781,14 @@ static int iwl3945_load_bsm(struct iwl_priv *priv)
         iwl_write_prph(priv, BSM_WR_CTRL_REG,
                 BSM_WR_CTRL_REG_BIT_START_EN);
 
-        iwl_release_nic_access(priv);
-
         return 0;
 }
 
+static struct iwl_hcmd_ops iwl3945_hcmd = {
+        .rxon_assoc = iwl3945_send_rxon_assoc,
+        .commit_rxon = iwl3945_commit_rxon,
+};
+
 static struct iwl_lib_ops iwl3945_lib = {
         .txq_attach_buf_to_tfd = iwl3945_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl3945_hw_txq_free_tfd,
@@ -2758,6 +2818,9 @@ static struct iwl_lib_ops iwl3945_lib = {
         },
         .send_tx_power  = iwl3945_send_tx_power,
         .is_valid_rtc_data_addr = iwl3945_hw_valid_rtc_data_addr,
+        .post_associate = iwl3945_post_associate,
+        .isr = iwl_isr_legacy,
+        .config_ap = iwl3945_config_ap,
 };
 
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
@@ -2767,6 +2830,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
 
 static struct iwl_ops iwl3945_ops = {
         .lib = &iwl3945_lib,
+        .hcmd = &iwl3945_hcmd,
         .utils = &iwl3945_hcmd_utils,
 };
 
@@ -2779,7 +2843,8 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
-        .mod_params = &iwl3945_mod_params
+        .mod_params = &iwl3945_mod_params,
+        .use_isr_legacy = true
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2791,7 +2856,8 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
-        .mod_params = &iwl3945_mod_params
+        .mod_params = &iwl3945_mod_params,
+        .use_isr_legacy = true
 };
 
 struct pci_device_id iwl3945_hw_card_ids[] = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 55188844657b..fbb3a573463e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -36,10 +36,6 @@
 #include <linux/kernel.h>
 #include <net/ieee80211_radiotap.h>
 
-/*used for rfkill*/
-#include <linux/rfkill.h>
-#include <linux/input.h>
-
 /* Hardware specific file defines the PCI IDs table for that hardware module */
 extern struct pci_device_id iwl3945_hw_card_ids[];
 
@@ -155,14 +151,12 @@ struct iwl3945_frame {
 #define STATUS_HCMD_SYNC_ACTIVE 1       /* sync host command in progress */
 #define STATUS_INT_ENABLED      2
 #define STATUS_RF_KILL_HW       3
-#define STATUS_RF_KILL_SW       4
 #define STATUS_INIT             5
 #define STATUS_ALIVE            6
 #define STATUS_READY            7
 #define STATUS_TEMPERATURE      8
 #define STATUS_GEO_CONFIGURED   9
 #define STATUS_EXIT_PENDING     10
-#define STATUS_IN_SUSPEND       11
 #define STATUS_STATISTICS       12
 #define STATUS_SCANNING         13
 #define STATUS_SCAN_ABORTING    14
@@ -203,11 +197,6 @@ struct iwl3945_ibss_seq {
  * for use by iwl-*.c
  *
  *****************************************************************************/
-struct iwl3945_addsta_cmd;
-extern int iwl3945_send_add_station(struct iwl_priv *priv,
-                                struct iwl3945_addsta_cmd *sta, u8 flags);
-extern u8 iwl3945_add_station(struct iwl_priv *priv, const u8 *bssid,
-                          int is_ap, u8 flags);
 extern int iwl3945_power_init_handle(struct iwl_priv *priv);
 extern int iwl3945_eeprom_init(struct iwl_priv *priv);
 extern int iwl3945_calc_db_from_ratio(int sig_ratio);
@@ -278,6 +267,8 @@ extern void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                                  struct iwl_rx_mem_buffer *rxb);
 extern void iwl3945_disable_events(struct iwl_priv *priv);
 extern int iwl4965_get_temperature(const struct iwl_priv *priv);
+extern void iwl3945_post_associate(struct iwl_priv *priv);
+extern void iwl3945_config_ap(struct iwl_priv *priv);
 
 /**
  * iwl3945_hw_find_station - Find station id for a given BSSID
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 847a6220c5e6..8f3d4bc6a03f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -163,10 +163,6 @@ static int iwl4965_load_bsm(struct iwl_priv *priv)
         inst_len = priv->ucode_init.len;
         data_len = priv->ucode_init_data.len;
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         iwl_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
         iwl_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
         iwl_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG, inst_len);
@@ -179,10 +175,8 @@ static int iwl4965_load_bsm(struct iwl_priv *priv)
                 _iwl_write_prph(priv, reg_offset, le32_to_cpu(*image));
 
         ret = iwl4965_verify_bsm(priv);
-        if (ret) {
-                iwl_release_nic_access(priv);
+        if (ret)
                 return ret;
-        }
 
         /* Tell BSM to copy from BSM SRAM into instruction SRAM, when asked */
         iwl_write_prph(priv, BSM_WR_MEM_SRC_REG, 0x0);
@@ -211,7 +205,6 @@ static int iwl4965_load_bsm(struct iwl_priv *priv)
          *   (e.g. when powering back up after power-save shutdown) */
         iwl_write_prph(priv, BSM_WR_CTRL_REG, BSM_WR_CTRL_REG_BIT_START_EN);
 
-        iwl_release_nic_access(priv);
 
         return 0;
 }
@@ -229,20 +222,12 @@ static int iwl4965_set_ucode_ptrs(struct iwl_priv *priv)
 {
         dma_addr_t pinst;
         dma_addr_t pdata;
-        unsigned long flags;
         int ret = 0;
 
         /* bits 35:4 for 4965 */
         pinst = priv->ucode_code.p_addr >> 4;
         pdata = priv->ucode_data_backup.p_addr >> 4;
 
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         /* Tell bootstrap uCode where to find image to load */
         iwl_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
         iwl_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
@@ -253,10 +238,6 @@ static int iwl4965_set_ucode_ptrs(struct iwl_priv *priv)
          *   that all new ptr/size info is in place */
         iwl_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG,
                                  priv->ucode_code.len | BSM_DRAM_INST_LOAD);
-        iwl_release_nic_access(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         IWL_DEBUG_INFO(priv, "Runtime uCode pointers are set.\n");
 
         return ret;
@@ -312,10 +293,12 @@ restart:
         queue_work(priv->workqueue, &priv->restart);
 }
 
-static int is_fat_channel(__le32 rxon_flags)
+static bool is_fat_channel(__le32 rxon_flags)
 {
-        return (rxon_flags & RXON_FLG_CHANNEL_MODE_PURE_40_MSK) ||
-                (rxon_flags & RXON_FLG_CHANNEL_MODE_MIXED_MSK);
+        int chan_mod = le32_to_cpu(rxon_flags & RXON_FLG_CHANNEL_MODE_MSK)
+                                    >> RXON_FLG_CHANNEL_MODE_POS;
+        return ((chan_mod == CHANNEL_MODE_PURE_40) ||
+                  (chan_mod == CHANNEL_MODE_MIXED));
 }
 
 /*
@@ -358,10 +341,6 @@ static int iwl4965_apm_init(struct iwl_priv *priv)
                 goto out;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                goto out;
-
         /* enable DMA */
         iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
                                                 APMG_CLK_VAL_BSM_CLK_RQT);
@@ -372,7 +351,6 @@ static int iwl4965_apm_init(struct iwl_priv *priv)
         iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
                           APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
 
-        iwl_release_nic_access(priv);
 out:
         return ret;
 }
@@ -454,11 +432,9 @@ static void iwl4965_apm_stop(struct iwl_priv *priv)
 static int iwl4965_apm_reset(struct iwl_priv *priv)
 {
         int ret = 0;
-        unsigned long flags;
 
         iwl4965_apm_stop_master(priv);
 
-        spin_lock_irqsave(&priv->lock, flags);
 
         iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
 
@@ -475,9 +451,6 @@ static int iwl4965_apm_reset(struct iwl_priv *priv)
 
         udelay(10);
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                goto out;
         /* Enable DMA and BSM Clock */
         iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT |
                                               APMG_CLK_VAL_BSM_CLK_RQT);
@@ -488,14 +461,10 @@ static int iwl4965_apm_reset(struct iwl_priv *priv)
         iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
                           APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
 
-        iwl_release_nic_access(priv);
-
         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
 out:
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return ret;
 }
 
@@ -681,18 +650,11 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
 {
         u32 a;
         unsigned long flags;
-        int ret;
         int i, chan;
         u32 reg_val;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         /* Clear 4965's internal Tx Scheduler data base */
         priv->scd_base_addr = iwl_read_prph(priv, IWL49_SCD_SRAM_BASE_ADDR);
         a = priv->scd_base_addr + IWL49_SCD_CONTEXT_DATA_OFFSET;
@@ -759,10 +721,9 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
                 iwl4965_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
         }
 
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        return ret;
+        return 0;
 }
 
 static struct iwl_sensitivity_ranges iwl4965_sensitivity = {
@@ -788,6 +749,12 @@ static struct iwl_sensitivity_ranges iwl4965_sensitivity = {
         .nrg_th_ofdm = 100,
 };
 
+static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Kelvin */
+        priv->hw_params.ct_kill_threshold = CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD);
+}
+
 /**
  * iwl4965_hw_set_hw_params
  *
@@ -822,7 +789,8 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.rx_chains_num = 2;
         priv->hw_params.valid_tx_ant = ANT_A | ANT_B;
         priv->hw_params.valid_rx_ant = ANT_A | ANT_B;
-        priv->hw_params.ct_kill_threshold = CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD);
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
         priv->hw_params.sens = &iwl4965_sensitivity;
 
@@ -1524,7 +1492,7 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
         struct iwl4965_txpowertable_cmd cmd = { 0 };
         int ret;
         u8 band = 0;
-        u8 is_fat = 0;
+        bool is_fat = false;
         u8 ctrl_chan_high = 0;
 
         if (test_bit(STATUS_SCANNING, &priv->status)) {
@@ -1602,7 +1570,7 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         int rc;
         u8 band = 0;
-        u8 is_fat = 0;
+        bool is_fat = false;
         u8 ctrl_chan_high = 0;
         struct iwl4965_channel_switch_cmd cmd = { 0 };
         const struct iwl_channel_info *ch_info;
@@ -1833,8 +1801,6 @@ static void iwl4965_tx_queue_stop_scheduler(struct iwl_priv *priv,
 static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
-        int ret = 0;
-
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
             (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
                 IWL_WARN(priv,
@@ -1844,10 +1810,6 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                 return -EINVAL;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         iwl4965_tx_queue_stop_scheduler(priv, txq_id);
 
         iwl_clear_bits_prph(priv, IWL49_SCD_QUEUECHAIN_SEL, (1 << txq_id));
@@ -1861,8 +1823,6 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
         iwl_txq_ctx_deactivate(priv, txq_id);
         iwl4965_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
 
-        iwl_release_nic_access(priv);
-
         return 0;
 }
 
@@ -1904,7 +1864,6 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
                                   int tx_fifo, int sta_id, int tid, u16 ssn_idx)
 {
         unsigned long flags;
-        int ret;
         u16 ra_tid;
 
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
@@ -1922,11 +1881,6 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
 
         spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
 
         /* Stop this Tx queue before configuring it */
         iwl4965_tx_queue_stop_scheduler(priv, txq_id);
@@ -1959,7 +1913,6 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
         iwl4965_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
 
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
@@ -2268,9 +2221,10 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv)
         cancel_work_sync(&priv->txpower_work);
 }
 
-
 static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
 };
 
 static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
@@ -2323,7 +2277,13 @@ static struct iwl_lib_ops iwl4965_lib = {
         },
         .send_tx_power  = iwl4965_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
-        .temperature = iwl4965_temperature_calib,
+        .post_associate = iwl_post_associate,
+        .config_ap = iwl_config_ap,
+        .isr = iwl_isr_legacy,
+        .temp_ops = {
+                .temperature = iwl4965_temperature_calib,
+                .set_ct_kill = iwl4965_set_ct_threshold,
+        },
 };
 
 static struct iwl_ops iwl4965_ops = {
@@ -2343,6 +2303,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
         .ops = &iwl4965_ops,
         .mod_params = &iwl4965_mod_params,
+        .use_isr_legacy = true
 };
 
 /* Module firmware */
@@ -2350,8 +2311,6 @@ MODULE_FIRMWARE(IWL4965_MODULE_FIRMWARE(IWL4965_UCODE_API_MAX));
 
 module_param_named(antenna, iwl4965_mod_params.antenna, int, 0444);
 MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(disable, iwl4965_mod_params.disable, int, 0444);
-MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
 module_param_named(swcrypto, iwl4965_mod_params.sw_crypto, int, 0444);
 MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 module_param_named(debug, iwl4965_mod_params.debug, uint, 0444);
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 15cac70e36e2..4ef6804a455a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -87,6 +87,18 @@
 #define IWL50_NUM_AMPDU_QUEUES            10
 #define IWL50_FIRST_AMPDU_QUEUE           10
 
+/* 5150 only */
+#define IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF   (-5)
+
+static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
+{
+        u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
+                                                       EEPROM_5000_TEMPERATURE);
+        /* offset =  temperature -  voltage / coef */
+        s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
+        return offset;
+}
+
 /* Fixed (non-configurable) rx data from phy */
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 9452461ce864..b3c648ce8c7b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -124,10 +124,6 @@ static int iwl5000_apm_init(struct iwl_priv *priv)
                 return ret;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         /* enable DMA */
         iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
 
@@ -137,8 +133,6 @@ static int iwl5000_apm_init(struct iwl_priv *priv)
         iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
                           APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
 
-        iwl_release_nic_access(priv);
-
         return ret;
 }
 
@@ -165,12 +159,9 @@ static void iwl5000_apm_stop(struct iwl_priv *priv)
 static int iwl5000_apm_reset(struct iwl_priv *priv)
 {
         int ret = 0;
-        unsigned long flags;
 
         iwl5000_apm_stop_master(priv);
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
 
         udelay(10);
@@ -193,10 +184,6 @@ static int iwl5000_apm_reset(struct iwl_priv *priv)
                 goto out;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                goto out;
-
         /* enable DMA */
         iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
 
@@ -205,11 +192,7 @@ static int iwl5000_apm_reset(struct iwl_priv *priv)
         /* disable L1-Active */
         iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
                           APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-        iwl_release_nic_access(priv);
-
 out:
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         return ret;
 }
@@ -252,11 +235,9 @@ static void iwl5000_nic_config(struct iwl_priv *priv)
          * (PCIe power is lost before PERST# is asserted),
          * causing ME FW to lose ownership and not being able to obtain it back.
          */
-        iwl_grab_nic_access(priv);
         iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
                                 APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
                                 ~APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
-        iwl_release_nic_access(priv);
 
         spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -434,15 +415,19 @@ static const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
         return &priv->eeprom[address];
 }
 
-static s32 iwl5150_get_ct_threshold(struct iwl_priv *priv)
+static void iwl5150_set_ct_threshold(struct iwl_priv *priv)
 {
-        const s32 volt2temp_coef = -5;
-        u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
-                                                EEPROM_5000_TEMPERATURE);
-        /* offset =  temperate -  voltage / coef */
-        s32 offset = temp_calib[0] - temp_calib[1] / volt2temp_coef;
-        s32 threshold = (s32)CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD) - offset;
-        return threshold * volt2temp_coef;
+        const s32 volt2temp_coef = IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF;
+        s32 threshold = (s32)CELSIUS_TO_KELVIN(CT_KILL_THRESHOLD) -
+                        iwl_temp_calib_to_offset(priv);
+
+        priv->hw_params.ct_kill_threshold = threshold * volt2temp_coef;
+}
+
+static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
+{
+        /* want Celsius */
+        priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD;
 }
 
 /*
@@ -533,19 +518,9 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                                 struct fw_desc *image,
                                 u32 dst_addr)
 {
-        int ret = 0;
-        unsigned long flags;
-
         dma_addr_t phy_addr = image->p_addr;
         u32 byte_cnt = image->len;
 
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         iwl_write_direct32(priv,
                 FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
                 FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
@@ -574,8 +549,6 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                 FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
                 FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
         return 0;
 }
 
@@ -736,18 +709,11 @@ static int iwl5000_alive_notify(struct iwl_priv *priv)
 {
         u32 a;
         unsigned long flags;
-        int ret;
         int i, chan;
         u32 reg_val;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         priv->scd_base_addr = iwl_read_prph(priv, IWL50_SCD_SRAM_BASE_ADDR);
         a = priv->scd_base_addr + IWL50_SCD_CONTEXT_DATA_OFFSET;
         for (; a < priv->scd_base_addr + IWL50_SCD_TX_STTS_BITMAP_OFFSET;
@@ -815,7 +781,6 @@ static int iwl5000_alive_notify(struct iwl_priv *priv)
         iwl_txq_ctx_activate(priv, 8);
         iwl_txq_ctx_activate(priv, 9);
 
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
 
@@ -868,17 +833,8 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
         priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_5150:
-                /* 5150 wants in Kelvin */
-                priv->hw_params.ct_kill_threshold =
-                                iwl5150_get_ct_threshold(priv);
-                break;
-        default:
-                /* all others want Celsius */
-                priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD;
-                break;
-        }
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
         /* Set initial calibration set */
         switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
@@ -900,7 +856,6 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
                 break;
         }
 
-
         return 0;
 }
 
@@ -1006,7 +961,6 @@ static int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
                                   int tx_fifo, int sta_id, int tid, u16 ssn_idx)
 {
         unsigned long flags;
-        int ret;
         u16 ra_tid;
 
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
@@ -1024,11 +978,6 @@ static int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
 
         spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
 
         /* Stop this Tx queue before configuring it */
         iwl5000_tx_queue_stop_scheduler(priv, txq_id);
@@ -1064,7 +1013,6 @@ static int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
         iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
 
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
@@ -1073,8 +1021,6 @@ static int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
 static int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
-        int ret;
-
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
             (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
                 IWL_ERR(priv,
@@ -1084,10 +1030,6 @@ static int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                 return -EINVAL;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         iwl5000_tx_queue_stop_scheduler(priv, txq_id);
 
         iwl_clear_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1 << txq_id));
@@ -1101,15 +1043,16 @@ static int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
         iwl_txq_ctx_deactivate(priv, txq_id);
         iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
 
-        iwl_release_nic_access(priv);
-
         return 0;
 }
 
 u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
 {
         u16 size = (u16)sizeof(struct iwl_addsta_cmd);
-        memcpy(data, cmd, size);
+        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
+        memcpy(addsta, cmd, size);
+        /* resrved in 5000 */
+        addsta->rate_n_flags = cpu_to_le16(0);
         return size;
 }
 
@@ -1434,6 +1377,17 @@ static void iwl5000_temperature(struct iwl_priv *priv)
         priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
 }
 
+static void iwl5150_temperature(struct iwl_priv *priv)
+{
+        u32 vt = 0;
+        s32 offset =  iwl_temp_calib_to_offset(priv);
+
+        vt = le32_to_cpu(priv->statistics.general.temperature);
+        vt = vt / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF + offset;
+        /* now vt hold the temperature in Kelvin */
+        priv->temperature = KELVIN_TO_CELSIUS(vt);
+}
+
 /* Calc max signal level (dBm) among 3 possible receivers */
 int iwl5000_calc_rssi(struct iwl_priv *priv,
                              struct iwl_rx_phy_res *rx_resp)
@@ -1474,6 +1428,8 @@ int iwl5000_calc_rssi(struct iwl_priv *priv,
 
 struct iwl_hcmd_ops iwl5000_hcmd = {
         .rxon_assoc = iwl5000_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
 };
 
 struct iwl_hcmd_utils_ops iwl5000_hcmd_utils = {
@@ -1502,7 +1458,6 @@ struct iwl_lib_ops iwl5000_lib = {
         .init_alive_start = iwl5000_init_alive_start,
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
-        .temperature = iwl5000_temperature,
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
                 .init = iwl5000_apm_init,
@@ -1527,6 +1482,63 @@ struct iwl_lib_ops iwl5000_lib = {
                 .calib_version  = iwl5000_eeprom_calib_version,
                 .query_addr = iwl5000_eeprom_query_addr,
         },
+        .post_associate = iwl_post_associate,
+        .isr = iwl_isr_ict,
+        .config_ap = iwl_config_ap,
+        .temp_ops = {
+                .temperature = iwl5000_temperature,
+                .set_ct_kill = iwl5000_set_ct_threshold,
+         },
+};
+
+static struct iwl_lib_ops iwl5150_lib = {
+        .set_hw_params = iwl5000_hw_set_hw_params,
+        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwl5000_txq_set_sched,
+        .txq_agg_enable = iwl5000_txq_agg_enable,
+        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
+        .txq_free_tfd = iwl_hw_txq_free_tfd,
+        .txq_init = iwl_hw_tx_queue_init,
+        .rx_handler_setup = iwl5000_rx_handler_setup,
+        .setup_deferred_work = iwl5000_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .load_ucode = iwl5000_load_ucode,
+        .init_alive_start = iwl5000_init_alive_start,
+        .alive_notify = iwl5000_alive_notify,
+        .send_tx_power = iwl5000_send_tx_power,
+        .update_chain_flags = iwl_update_chain_flags,
+        .apm_ops = {
+                .init = iwl5000_apm_init,
+                .reset = iwl5000_apm_reset,
+                .stop = iwl5000_apm_stop,
+                .config = iwl5000_nic_config,
+                .set_pwr_src = iwl_set_pwr_src,
+        },
+        .eeprom_ops = {
+                .regulatory_bands = {
+                        EEPROM_5000_REG_BAND_1_CHANNELS,
+                        EEPROM_5000_REG_BAND_2_CHANNELS,
+                        EEPROM_5000_REG_BAND_3_CHANNELS,
+                        EEPROM_5000_REG_BAND_4_CHANNELS,
+                        EEPROM_5000_REG_BAND_5_CHANNELS,
+                        EEPROM_5000_REG_BAND_24_FAT_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_FAT_CHANNELS
+                },
+                .verify_signature  = iwlcore_eeprom_verify_signature,
+                .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
+                .release_semaphore = iwlcore_eeprom_release_semaphore,
+                .calib_version  = iwl5000_eeprom_calib_version,
+                .query_addr = iwl5000_eeprom_query_addr,
+        },
+        .post_associate = iwl_post_associate,
+        .isr = iwl_isr_ict,
+        .config_ap = iwl_config_ap,
+        .temp_ops = {
+                .temperature = iwl5150_temperature,
+                .set_ct_kill = iwl5150_set_ct_threshold,
+         },
 };
 
 struct iwl_ops iwl5000_ops = {
@@ -1535,6 +1547,12 @@ struct iwl_ops iwl5000_ops = {
         .utils = &iwl5000_hcmd_utils,
 };
 
+static struct iwl_ops iwl5150_ops = {
+        .lib = &iwl5150_lib,
+        .hcmd = &iwl5000_hcmd,
+        .utils = &iwl5000_hcmd_utils,
+};
+
 struct iwl_mod_params iwl50_mod_params = {
         .num_of_queues = IWL50_NUM_QUEUES,
         .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
@@ -1630,7 +1648,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl5000_ops,
+        .ops = &iwl5150_ops,
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
@@ -1643,9 +1661,6 @@ struct iwl_cfg iwl5150_agn_cfg = {
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
 
-module_param_named(disable50, iwl50_mod_params.disable, int, 0444);
-MODULE_PARM_DESC(disable50,
-                  "manually disable the 50XX radio (default 0 [radio on])");
 module_param_named(swcrypto50, iwl50_mod_params.sw_crypto, bool, 0444);
 MODULE_PARM_DESC(swcrypto50,
                   "using software crypto engine (default 0 [hardware])\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index cab7842a73aa..ff20e5048a55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -52,7 +52,7 @@
 /* max allowed rate miss before sync LQ cmd */
 #define IWL_MISSED_RATE_MAX             15
 /* max time to accum history 2 seconds */
-#define IWL_RATE_SCALE_FLUSH_INTVL   (2*HZ)
+#define IWL_RATE_SCALE_FLUSH_INTVL   (3*HZ)
 
 static u8 rs_ht_to_legacy[] = {
         IWL_RATE_6M_INDEX, IWL_RATE_6M_INDEX,
@@ -100,6 +100,7 @@ struct iwl_scale_tbl_info {
         u8 is_fat;      /* 1 = 40 MHz channel width */
         u8 is_dup;      /* 1 = duplicated data streams */
         u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
+        u8 max_search;  /* maximun number of tables we can search */
         s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
         u32 current_rate;  /* rate_n_flags, uCode API format */
         struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
@@ -135,7 +136,7 @@ struct iwl_lq_sta {
         u32 table_count;
         u32 total_failed;       /* total failed frames, any/all rates */
         u32 total_success;      /* total successful frames, any/all rates */
-        u32 flush_timer;        /* time staying in mode before new search */
+        u64 flush_timer;        /* time staying in mode before new search */
 
         u8 action_counter;      /* # mode-switch actions tried */
         u8 is_green;
@@ -160,6 +161,7 @@ struct iwl_lq_sta {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *rs_sta_dbgfs_scale_table_file;
         struct dentry *rs_sta_dbgfs_stats_table_file;
+        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
         struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
         u32 dbg_fixed_rate;
 #endif
@@ -167,10 +169,12 @@ struct iwl_lq_sta {
 
         /* used to be in sta_info */
         int last_txrate_idx;
+        /* last tx rate_n_flags */
+        u32 last_rate_n_flags;
 };
 
 static void rs_rate_scale_perform(struct iwl_priv *priv,
-                                   struct ieee80211_hdr *hdr,
+                                   struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
                                    struct iwl_lq_sta *lq_sta);
 static void rs_fill_link_cmd(const struct iwl_priv *priv,
@@ -191,7 +195,7 @@ static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
  * 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 60 MBits
  * "G" is the only table that supports CCK (the first 4 rates).
  */
-/*FIXME:RS:need to separate tables for MIMO2/MIMO3*/
+
 static s32 expected_tpt_A[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 40, 57, 72, 98, 121, 154, 177, 186, 186
 };
@@ -208,11 +212,11 @@ static s32 expected_tpt_siso20MHzSGI[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 46, 46, 82, 110, 132, 168, 192, 202, 211
 };
 
-static s32 expected_tpt_mimo20MHz[IWL_RATE_COUNT] = {
+static s32 expected_tpt_mimo2_20MHz[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 74, 74, 123, 155, 179, 214, 236, 244, 251
 };
 
-static s32 expected_tpt_mimo20MHzSGI[IWL_RATE_COUNT] = {
+static s32 expected_tpt_mimo2_20MHzSGI[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 81, 81, 131, 164, 188, 222, 243, 251, 257
 };
 
@@ -224,14 +228,50 @@ static s32 expected_tpt_siso40MHzSGI[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 83, 83, 135, 169, 193, 229, 250, 257, 264
 };
 
-static s32 expected_tpt_mimo40MHz[IWL_RATE_COUNT] = {
+static s32 expected_tpt_mimo2_40MHz[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 123, 123, 182, 214, 235, 264, 279, 285, 289
 };
 
-static s32 expected_tpt_mimo40MHzSGI[IWL_RATE_COUNT] = {
+static s32 expected_tpt_mimo2_40MHzSGI[IWL_RATE_COUNT] = {
         0, 0, 0, 0, 131, 131, 191, 222, 242, 270, 284, 289, 293
 };
 
+/* Expected throughput metric MIMO3 */
+static s32 expected_tpt_mimo3_20MHz[IWL_RATE_COUNT] = {
+        0, 0, 0, 0, 99, 99, 153, 186, 208, 239, 256, 263, 268
+};
+
+static s32 expected_tpt_mimo3_20MHzSGI[IWL_RATE_COUNT] = {
+        0, 0, 0, 0, 106, 106, 162, 194, 215, 246, 262, 268, 273
+};
+
+static s32 expected_tpt_mimo3_40MHz[IWL_RATE_COUNT] = {
+        0, 0, 0, 0, 152, 152, 211, 239, 255, 279, 290, 294, 297
+};
+
+static s32 expected_tpt_mimo3_40MHzSGI[IWL_RATE_COUNT] = {
+        0, 0, 0, 0, 160, 160, 219, 245, 261, 284, 294, 297, 300
+};
+
+/* mbps, mcs */
+const static struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
+  {"1", ""},
+  {"2", ""},
+  {"5.5", ""},
+  {"11", ""},
+  {"6", "BPSK 1/2"},
+  {"9", "BPSK 1/2"},
+  {"12", "QPSK 1/2"},
+  {"18", "QPSK 3/4"},
+  {"24", "16QAM 1/2"},
+  {"36", "16QAM 3/4"},
+  {"48", "64QAM 2/3"},
+  {"54", "64QAM 3/4"},
+  {"60", "64QAM 5/6"}
+};
+
+#define MCS_INDEX_PER_STREAM    (8)
+
 static inline u8 rs_extract_rate(u32 rate_n_flags)
 {
         return (u8)(rate_n_flags & 0xFF);
@@ -543,6 +583,7 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
         tbl->is_dup = 0;
         tbl->ant_type = (ant_msk >> RATE_MCS_ANT_POS);
         tbl->lq_type = LQ_NONE;
+        tbl->max_search = IWL_MAX_SEARCH;
 
         /* legacy rate format */
         if (!(rate_n_flags & RATE_MCS_HT_MSK)) {
@@ -576,8 +617,10 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
                                 tbl->lq_type = LQ_MIMO2;
                 /* MIMO3 */
                 } else {
-                        if (num_of_ant == 3)
+                        if (num_of_ant == 3) {
+                                tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
                                 tbl->lq_type = LQ_MIMO3;
+                        }
                 }
         }
         return 0;
@@ -611,19 +654,19 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
         return 1;
 }
 
-/* FIXME:RS: in 4965 we don't use greenfield at all */
-/* FIXME:RS: don't use greenfield for now in TX */
-#if 0
-static inline u8 rs_use_green(struct iwl_priv *priv, struct ieee80211_conf *conf)
+/* in 4965 we don't use greenfield at all */
+static inline u8 rs_use_green(struct iwl_priv *priv,
+                              struct ieee80211_conf *conf)
 {
-        return (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) &&
-                priv->current_ht_config.is_green_field &&
-                !priv->current_ht_config.non_GF_STA_present;
-}
-#endif
-static inline u8 rs_use_green(struct iwl_priv *priv, struct ieee80211_conf *conf)
-{
-        return 0;
+        u8 is_green;
+
+        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+                is_green = 0;
+        else
+                is_green = (conf_is_ht(conf) &&
+                           priv->current_ht_config.is_green_field &&
+                           !priv->current_ht_config.non_GF_STA_present);
+        return is_green;
 }
 
 /**
@@ -735,6 +778,7 @@ static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
 
                 tbl->is_fat = 0;
                 tbl->is_SGI = 0;
+                tbl->max_search = IWL_MAX_SEARCH;
         }
 
         rate_mask = rs_get_supported_rates(lq_sta, NULL, tbl->lq_type);
@@ -793,7 +837,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1))
+            info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
         /* This packet was aggregated but doesn't carry rate scale info */
@@ -902,6 +946,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
          * else look up the rate that was, finally, successful.
          */
         tx_rate = le32_to_cpu(table->rs_table[index].rate_n_flags);
+        lq_sta->last_rate_n_flags = tx_rate;
         rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type, &rs_index);
 
         /* Update frame history window with "success" if Tx got ACKed ... */
@@ -958,7 +1003,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
 
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
-                rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+                rs_rate_scale_perform(priv, skb, sta, lq_sta);
 out:
         return;
 }
@@ -988,6 +1033,8 @@ static void rs_set_stay_in_table(struct iwl_priv *priv, u8 is_legacy,
         lq_sta->table_count = 0;
         lq_sta->total_failed = 0;
         lq_sta->total_success = 0;
+        lq_sta->flush_timer = jiffies;
+        lq_sta->action_counter = 0;
 }
 
 /*
@@ -1011,17 +1058,26 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                         tbl->expected_tpt = expected_tpt_siso20MHzSGI;
                 else
                         tbl->expected_tpt = expected_tpt_siso20MHz;
-
-        } else if (is_mimo(tbl->lq_type)) { /* FIXME:need to separate mimo2/3 */
+        } else if (is_mimo2(tbl->lq_type)) {
                 if (tbl->is_fat && !lq_sta->is_dup)
                         if (tbl->is_SGI)
-                                tbl->expected_tpt = expected_tpt_mimo40MHzSGI;
+                                tbl->expected_tpt = expected_tpt_mimo2_40MHzSGI;
                         else
-                                tbl->expected_tpt = expected_tpt_mimo40MHz;
+                                tbl->expected_tpt = expected_tpt_mimo2_40MHz;
                 else if (tbl->is_SGI)
-                        tbl->expected_tpt = expected_tpt_mimo20MHzSGI;
+                        tbl->expected_tpt = expected_tpt_mimo2_20MHzSGI;
                 else
-                        tbl->expected_tpt = expected_tpt_mimo20MHz;
+                        tbl->expected_tpt = expected_tpt_mimo2_20MHz;
+        } else if (is_mimo3(tbl->lq_type)) {
+                if (tbl->is_fat && !lq_sta->is_dup)
+                        if (tbl->is_SGI)
+                                tbl->expected_tpt = expected_tpt_mimo3_40MHzSGI;
+                        else
+                                tbl->expected_tpt = expected_tpt_mimo3_40MHz;
+                else if (tbl->is_SGI)
+                        tbl->expected_tpt = expected_tpt_mimo3_20MHzSGI;
+                else
+                        tbl->expected_tpt = expected_tpt_mimo3_20MHz;
         } else
                 tbl->expected_tpt = expected_tpt_G;
 }
@@ -1130,7 +1186,7 @@ static s32 rs_get_best_rate(struct iwl_priv *priv,
 }
 
 /*
- * Set up search table for MIMO
+ * Set up search table for MIMO2
  */
 static int rs_switch_to_mimo2(struct iwl_priv *priv,
                              struct iwl_lq_sta *lq_sta,
@@ -1158,10 +1214,10 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->lq_type = LQ_MIMO2;
         tbl->is_dup = lq_sta->is_dup;
         tbl->action = 0;
+        tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (priv->current_ht_config.supported_chan_width
-                                        == IWL_CHANNEL_WIDTH_40MHZ)
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
                 tbl->is_fat = 1;
         else
                 tbl->is_fat = 0;
@@ -1183,7 +1239,73 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         rate = rs_get_best_rate(priv, lq_sta, tbl, rate_mask, index);
 
         IWL_DEBUG_RATE(priv, "LQ: MIMO2 best rate %d mask %X\n", rate, rate_mask);
+        if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
+                IWL_DEBUG_RATE(priv, "Can't switch with index %d rate mask %x\n",
+                                                rate, rate_mask);
+                return -1;
+        }
+        tbl->current_rate = rate_n_flags_from_tbl(priv, tbl, rate, is_green);
+
+        IWL_DEBUG_RATE(priv, "LQ: Switch to new mcs %X index is green %X\n",
+                     tbl->current_rate, is_green);
+        return 0;
+}
+
+/*
+ * Set up search table for MIMO3
+ */
+static int rs_switch_to_mimo3(struct iwl_priv *priv,
+                             struct iwl_lq_sta *lq_sta,
+                             struct ieee80211_conf *conf,
+                             struct ieee80211_sta *sta,
+                             struct iwl_scale_tbl_info *tbl, int index)
+{
+        u16 rate_mask;
+        s32 rate;
+        s8 is_green = lq_sta->is_green;
+
+        if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
+                return -1;
+
+        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
+                                                == WLAN_HT_CAP_SM_PS_STATIC)
+                return -1;
+
+        /* Need both Tx chains/antennas to support MIMO */
+        if (priv->hw_params.tx_chains_num < 3)
+                return -1;
+
+        IWL_DEBUG_RATE(priv, "LQ: try to switch to MIMO3\n");
+
+        tbl->lq_type = LQ_MIMO3;
+        tbl->is_dup = lq_sta->is_dup;
+        tbl->action = 0;
+        tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
+        rate_mask = lq_sta->active_mimo3_rate;
+
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
+                tbl->is_fat = 1;
+        else
+                tbl->is_fat = 0;
 
+        /* FIXME: - don't toggle SGI here
+        if (tbl->is_fat) {
+                if (priv->current_ht_config.sgf & HT_SHORT_GI_40MHZ_ONLY)
+                        tbl->is_SGI = 1;
+                else
+                        tbl->is_SGI = 0;
+        } else if (priv->current_ht_config.sgf & HT_SHORT_GI_20MHZ_ONLY)
+                tbl->is_SGI = 1;
+        else
+                tbl->is_SGI = 0;
+        */
+
+        rs_set_expected_tpt_table(lq_sta, tbl);
+
+        rate = rs_get_best_rate(priv, lq_sta, tbl, rate_mask, index);
+
+        IWL_DEBUG_RATE(priv, "LQ: MIMO3 best rate %d mask %X\n",
+                rate, rate_mask);
         if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
                 IWL_DEBUG_RATE(priv, "Can't switch with index %d rate mask %x\n",
                                                 rate, rate_mask);
@@ -1217,10 +1339,10 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->is_dup = lq_sta->is_dup;
         tbl->lq_type = LQ_SISO;
         tbl->action = 0;
+        tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (priv->current_ht_config.supported_chan_width
-            == IWL_CHANNEL_WIDTH_40MHZ)
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
                 tbl->is_fat = 1;
         else
                 tbl->is_fat = 0;
@@ -1274,15 +1396,15 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret = 0;
+        u8 update_search_tbl_counter = 0;
 
         for (; ;) {
+                lq_sta->action_counter++;
                 switch (tbl->action) {
                 case IWL_LEGACY_SWITCH_ANTENNA1:
                 case IWL_LEGACY_SWITCH_ANTENNA2:
                         IWL_DEBUG_RATE(priv, "LQ: Legacy toggle Antenna\n");
 
-                        lq_sta->action_counter++;
-
                         if ((tbl->action == IWL_LEGACY_SWITCH_ANTENNA1 &&
                                                         tx_chains_num <= 1) ||
                             (tbl->action == IWL_LEGACY_SWITCH_ANTENNA2 &&
@@ -1298,6 +1420,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
 
                         if (rs_toggle_antenna(valid_tx_ant,
                                 &search_tbl->current_rate, search_tbl)) {
+                                update_search_tbl_counter = 1;
                                 rs_set_expected_tpt_table(lq_sta, search_tbl);
                                 goto out;
                         }
@@ -1342,9 +1465,29 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                                 goto out;
                         }
                         break;
+
+                case IWL_LEGACY_SWITCH_MIMO3_ABC:
+                        IWL_DEBUG_RATE(priv, "LQ: Legacy switch to MIMO3\n");
+
+                        /* Set up search table to try MIMO3 */
+                        memcpy(search_tbl, tbl, sz);
+                        search_tbl->is_SGI = 0;
+
+                        search_tbl->ant_type = ANT_ABC;
+
+                        if (!rs_is_valid_ant(valid_tx_ant, search_tbl->ant_type))
+                                break;
+
+                        ret = rs_switch_to_mimo3(priv, lq_sta, conf, sta,
+                                                 search_tbl, index);
+                        if (!ret) {
+                                lq_sta->action_counter = 0;
+                                goto out;
+                        }
+                        break;
                 }
                 tbl->action++;
-                if (tbl->action > IWL_LEGACY_SWITCH_MIMO2_BC)
+                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
                         tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1357,8 +1500,10 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
 out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_LEGACY_SWITCH_MIMO2_BC)
+        if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
                 tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
+        if (update_search_tbl_counter)
+                search_tbl->action = tbl->action;
         return 0;
 
 }
@@ -1381,6 +1526,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         u8 start_action = tbl->action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
+        u8 update_search_tbl_counter = 0;
         int ret;
 
         for (;;) {
@@ -1401,8 +1547,10 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
 
                         memcpy(search_tbl, tbl, sz);
                         if (rs_toggle_antenna(valid_tx_ant,
-                                       &search_tbl->current_rate, search_tbl))
+                                       &search_tbl->current_rate, search_tbl)) {
+                                update_search_tbl_counter = 1;
                                 goto out;
+                        }
                         break;
                 case IWL_SISO_SWITCH_MIMO2_AB:
                 case IWL_SISO_SWITCH_MIMO2_AC:
@@ -1456,10 +1604,25 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
                         search_tbl->current_rate =
                                 rate_n_flags_from_tbl(priv, search_tbl,
                                                       index, is_green);
+                        update_search_tbl_counter = 1;
                         goto out;
+                case IWL_SISO_SWITCH_MIMO3_ABC:
+                        IWL_DEBUG_RATE(priv, "LQ: SISO switch to MIMO3\n");
+                        memcpy(search_tbl, tbl, sz);
+                        search_tbl->is_SGI = 0;
+                        search_tbl->ant_type = ANT_ABC;
+
+                        if (!rs_is_valid_ant(valid_tx_ant, search_tbl->ant_type))
+                                break;
+
+                        ret = rs_switch_to_mimo3(priv, lq_sta, conf, sta,
+                                                 search_tbl, index);
+                        if (!ret)
+                                goto out;
+                        break;
                 }
                 tbl->action++;
-                if (tbl->action > IWL_SISO_SWITCH_GI)
+                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1471,15 +1634,18 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_SISO_SWITCH_GI)
+        if (tbl->action > IWL_SISO_SWITCH_MIMO3_ABC)
                 tbl->action = IWL_SISO_SWITCH_ANTENNA1;
+        if (update_search_tbl_counter)
+                search_tbl->action = tbl->action;
+
         return 0;
 }
 
 /*
- * Try to switch to new modulation mode from MIMO
+ * Try to switch to new modulation mode from MIMO2
  */
-static int rs_move_mimo_to_other(struct iwl_priv *priv,
+static int rs_move_mimo2_to_other(struct iwl_priv *priv,
                                  struct iwl_lq_sta *lq_sta,
                                  struct ieee80211_conf *conf,
                                  struct ieee80211_sta *sta, int index)
@@ -1494,6 +1660,7 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
         u8 start_action = tbl->action;
         u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
+        u8 update_search_tbl_counter = 0;
         int ret;
 
         for (;;) {
@@ -1501,7 +1668,7 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
                 switch (tbl->action) {
                 case IWL_MIMO2_SWITCH_ANTENNA1:
                 case IWL_MIMO2_SWITCH_ANTENNA2:
-                        IWL_DEBUG_RATE(priv, "LQ: MIMO toggle Antennas\n");
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO2 toggle Antennas\n");
 
                         if (tx_chains_num <= 2)
                                 break;
@@ -1511,8 +1678,10 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
 
                         memcpy(search_tbl, tbl, sz);
                         if (rs_toggle_antenna(valid_tx_ant,
-                                       &search_tbl->current_rate, search_tbl))
+                                       &search_tbl->current_rate, search_tbl)) {
+                                update_search_tbl_counter = 1;
                                 goto out;
+                        }
                         break;
                 case IWL_MIMO2_SWITCH_SISO_A:
                 case IWL_MIMO2_SWITCH_SISO_B:
@@ -1549,9 +1718,9 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
                                                 HT_SHORT_GI_40MHZ))
                                 break;
 
-                        IWL_DEBUG_RATE(priv, "LQ: MIMO toggle SGI/NGI\n");
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO2 toggle SGI/NGI\n");
 
-                        /* Set up new search table for MIMO */
+                        /* Set up new search table for MIMO2 */
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->is_SGI = !tbl->is_SGI;
                         rs_set_expected_tpt_table(lq_sta, search_tbl);
@@ -1569,11 +1738,27 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
                         search_tbl->current_rate =
                                 rate_n_flags_from_tbl(priv, search_tbl,
                                                       index, is_green);
+                        update_search_tbl_counter = 1;
                         goto out;
 
+                case IWL_MIMO2_SWITCH_MIMO3_ABC:
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO2 switch to MIMO3\n");
+                        memcpy(search_tbl, tbl, sz);
+                        search_tbl->is_SGI = 0;
+                        search_tbl->ant_type = ANT_ABC;
+
+                        if (!rs_is_valid_ant(valid_tx_ant, search_tbl->ant_type))
+                                break;
+
+                        ret = rs_switch_to_mimo3(priv, lq_sta, conf, sta,
+                                                 search_tbl, index);
+                        if (!ret)
+                                goto out;
+
+                        break;
                 }
                 tbl->action++;
-                if (tbl->action > IWL_MIMO2_SWITCH_GI)
+                if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
                         tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1584,8 +1769,153 @@ static int rs_move_mimo_to_other(struct iwl_priv *priv,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_MIMO2_SWITCH_GI)
+        if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
                 tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
+        if (update_search_tbl_counter)
+                search_tbl->action = tbl->action;
+
+        return 0;
+
+}
+
+/*
+ * Try to switch to new modulation mode from MIMO3
+ */
+static int rs_move_mimo3_to_other(struct iwl_priv *priv,
+                                 struct iwl_lq_sta *lq_sta,
+                                 struct ieee80211_conf *conf,
+                                 struct ieee80211_sta *sta, int index)
+{
+        s8 is_green = lq_sta->is_green;
+        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+        struct iwl_scale_tbl_info *search_tbl =
+                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
+        struct iwl_rate_scale_data *window = &(tbl->win[index]);
+        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
+                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
+        u8 start_action = tbl->action;
+        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 tx_chains_num = priv->hw_params.tx_chains_num;
+        int ret;
+        u8 update_search_tbl_counter = 0;
+
+        for (;;) {
+                lq_sta->action_counter++;
+                switch (tbl->action) {
+                case IWL_MIMO3_SWITCH_ANTENNA1:
+                case IWL_MIMO3_SWITCH_ANTENNA2:
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO3 toggle Antennas\n");
+
+                        if (tx_chains_num <= 3)
+                                break;
+
+                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
+                                break;
+
+                        memcpy(search_tbl, tbl, sz);
+                        if (rs_toggle_antenna(valid_tx_ant,
+                                       &search_tbl->current_rate, search_tbl))
+                                goto out;
+                        break;
+                case IWL_MIMO3_SWITCH_SISO_A:
+                case IWL_MIMO3_SWITCH_SISO_B:
+                case IWL_MIMO3_SWITCH_SISO_C:
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO3 switch to SISO\n");
+
+                        /* Set up new search table for SISO */
+                        memcpy(search_tbl, tbl, sz);
+
+                        if (tbl->action == IWL_MIMO3_SWITCH_SISO_A)
+                                search_tbl->ant_type = ANT_A;
+                        else if (tbl->action == IWL_MIMO3_SWITCH_SISO_B)
+                                search_tbl->ant_type = ANT_B;
+                        else
+                                search_tbl->ant_type = ANT_C;
+
+                        if (!rs_is_valid_ant(valid_tx_ant, search_tbl->ant_type))
+                                break;
+
+                        ret = rs_switch_to_siso(priv, lq_sta, conf, sta,
+                                                 search_tbl, index);
+                        if (!ret)
+                                goto out;
+
+                        break;
+
+                case IWL_MIMO3_SWITCH_MIMO2_AB:
+                case IWL_MIMO3_SWITCH_MIMO2_AC:
+                case IWL_MIMO3_SWITCH_MIMO2_BC:
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO3 switch to MIMO2\n");
+
+                        memcpy(search_tbl, tbl, sz);
+                        search_tbl->is_SGI = 0;
+                        if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AB)
+                                search_tbl->ant_type = ANT_AB;
+                        else if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AC)
+                                search_tbl->ant_type = ANT_AC;
+                        else
+                                search_tbl->ant_type = ANT_BC;
+
+                        if (!rs_is_valid_ant(valid_tx_ant, search_tbl->ant_type))
+                                break;
+
+                        ret = rs_switch_to_mimo2(priv, lq_sta, conf, sta,
+                                                 search_tbl, index);
+                        if (!ret)
+                                goto out;
+
+                        break;
+
+                case IWL_MIMO3_SWITCH_GI:
+                        if (!tbl->is_fat &&
+                                !(priv->current_ht_config.sgf &
+                                                HT_SHORT_GI_20MHZ))
+                                break;
+                        if (tbl->is_fat &&
+                                !(priv->current_ht_config.sgf &
+                                                HT_SHORT_GI_40MHZ))
+                                break;
+
+                        IWL_DEBUG_RATE(priv, "LQ: MIMO3 toggle SGI/NGI\n");
+
+                        /* Set up new search table for MIMO */
+                        memcpy(search_tbl, tbl, sz);
+                        search_tbl->is_SGI = !tbl->is_SGI;
+                        rs_set_expected_tpt_table(lq_sta, search_tbl);
+                        /*
+                         * If active table already uses the fastest possible
+                         * modulation (dual stream with short guard interval),
+                         * and it's working well, there's no need to look
+                         * for a better type of modulation!
+                         */
+                        if (tbl->is_SGI) {
+                                s32 tpt = lq_sta->last_tpt / 100;
+                                if (tpt >= search_tbl->expected_tpt[index])
+                                        break;
+                        }
+                        search_tbl->current_rate =
+                                rate_n_flags_from_tbl(priv, search_tbl,
+                                                      index, is_green);
+                        update_search_tbl_counter = 1;
+                        goto out;
+                }
+                tbl->action++;
+                if (tbl->action > IWL_MIMO3_SWITCH_GI)
+                        tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
+
+                if (tbl->action == start_action)
+                        break;
+        }
+        search_tbl->lq_type = LQ_NONE;
+        return 0;
+ out:
+        lq_sta->search_better_tbl = 1;
+        tbl->action++;
+        if (tbl->action > IWL_MIMO3_SWITCH_GI)
+                tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
+        if (update_search_tbl_counter)
+                search_tbl->action = tbl->action;
+
         return 0;
 
 }
@@ -1616,8 +1946,8 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
                 /* Elapsed time using current modulation mode */
                 if (lq_sta->flush_timer)
                         flush_interval_passed =
-                            time_after(jiffies,
-                                       (unsigned long)(lq_sta->flush_timer +
+                        time_after(jiffies,
+                                        (unsigned long)(lq_sta->flush_timer +
                                         IWL_RATE_SCALE_FLUSH_INTVL));
 
                 /*
@@ -1676,12 +2006,14 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
  * Do rate scaling and search for new modulation mode.
  */
 static void rs_rate_scale_perform(struct iwl_priv *priv,
-                                  struct ieee80211_hdr *hdr,
+                                  struct sk_buff *skb,
                                   struct ieee80211_sta *sta,
                                   struct iwl_lq_sta *lq_sta)
 {
         struct ieee80211_hw *hw = priv->hw;
         struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int low = IWL_RATE_INVALID;
         int high = IWL_RATE_INVALID;
         int index;
@@ -1707,11 +2039,10 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 
         IWL_DEBUG_RATE(priv, "rate scale calculate new rate for skb\n");
 
-        /* Send management frames and broadcast/multicast data using
-         * lowest rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         /* TODO: this could probably be improved.. */
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1))
+            info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
         if (!sta || !lq_sta)
@@ -1732,6 +2063,10 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
                 active_tbl = 1 - lq_sta->active_tbl;
 
         tbl = &(lq_sta->lq_info[active_tbl]);
+        if (is_legacy(tbl->lq_type))
+                lq_sta->is_green = 0;
+        else
+                lq_sta->is_green = rs_use_green(priv, conf);
         is_green = lq_sta->is_green;
 
         /* current tx rate */
@@ -1951,6 +2286,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
                         update_lq = 1;
                         index = low;
                 }
+
                 break;
         case 1:
                 /* Increase starting rate, update uCode's rate table */
@@ -1997,8 +2333,10 @@ lq_update:
                         rs_move_legacy_other(priv, lq_sta, conf, sta, index);
                 else if (is_siso(tbl->lq_type))
                         rs_move_siso_to_other(priv, lq_sta, conf, sta, index);
+                else if (is_mimo2(tbl->lq_type))
+                        rs_move_mimo2_to_other(priv, lq_sta, conf, sta, index);
                 else
-                        rs_move_mimo_to_other(priv, lq_sta, conf, sta, index);
+                        rs_move_mimo3_to_other(priv, lq_sta, conf, sta, index);
 
                 /* If new "search" mode was selected, set up in uCode table */
                 if (lq_sta->search_better_tbl) {
@@ -2014,8 +2352,11 @@ lq_update:
                                      tbl->current_rate, index);
                         rs_fill_link_cmd(priv, lq_sta, tbl->current_rate);
                         iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
-                }
+                } else
+                        done_search = 1;
+        }
 
+        if (done_search && !lq_sta->stay_in_tbl) {
                 /* If the "active" (non-search) mode was legacy,
                  * and we've tried switching antennas,
                  * but we haven't been able to try HT modes (not available),
@@ -2023,8 +2364,7 @@ lq_update:
                  * before next round of mode comparisons. */
                 tbl1 = &(lq_sta->lq_info[lq_sta->active_tbl]);
                 if (is_legacy(tbl1->lq_type) && !conf_is_ht(conf) &&
-                    lq_sta->action_counter >= 1) {
-                        lq_sta->action_counter = 0;
+                    lq_sta->action_counter > tbl1->max_search) {
                         IWL_DEBUG_RATE(priv, "LQ: STAY in legacy table\n");
                         rs_set_stay_in_table(priv, 1, lq_sta);
                 }
@@ -2033,7 +2373,7 @@ lq_update:
                  * have been tried and compared, stay in this best modulation
                  * mode for a while before next round of mode comparisons. */
                 if (lq_sta->enable_counter &&
-                    (lq_sta->action_counter >= IWL_ACTION_LIMIT)) {
+                    (lq_sta->action_counter >= tbl1->max_search)) {
                         if ((lq_sta->last_tpt > IWL_AGG_TPT_THREHOLD) &&
                             (lq_sta->tx_agg_tid_en & (1 << tid)) &&
                             (tid != MAX_TID_COUNT)) {
@@ -2047,20 +2387,8 @@ lq_update:
                                                           lq_sta, sta);
                                 }
                         }
-                        lq_sta->action_counter = 0;
                         rs_set_stay_in_table(priv, 0, lq_sta);
                 }
-
-        /*
-         * Else, don't search for a new modulation mode.
-         * Put new timestamp in stay-in-modulation-mode flush timer if:
-         * 1)  Not changing rates right now
-         * 2)  Not just finishing up a search
-         * 3)  flush timer is empty
-         */
-        } else {
-                if ((!update_lq) && (!done_search) && (!lq_sta->flush_timer))
-                        lq_sta->flush_timer = jiffies;
         }
 
 out:
@@ -2156,16 +2484,17 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
         if (sta)
                 mask_bit = sta->supp_rates[sband->band];
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1) || !sta || !lq_sta) {
+            info->flags & IEEE80211_TX_CTL_NO_ACK || !sta || !lq_sta) {
                 if (!mask_bit)
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, NULL);
                 else
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
                 return;
         }
 
@@ -2178,8 +2507,8 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
                                        hdr->addr1);
-                        sta_id = iwl_add_station_flags(priv, hdr->addr1,
-                                                        0, CMD_ASYNC, NULL);
+                        sta_id = iwl_add_station(priv, hdr->addr1,
+                                                false, CMD_ASYNC, NULL);
                 }
                 if ((sta_id != IWL_INVALID_STATION)) {
                         lq_sta->lq.sta_id = sta_id;
@@ -2189,12 +2518,33 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
                 }
         }
 
-        if (rate_idx < 0 || rate_idx > IWL_RATE_COUNT)
-                rate_idx = rate_lowest_index(sband, sta);
-        else if (sband->band == IEEE80211_BAND_5GHZ)
+        if (lq_sta->last_rate_n_flags & RATE_MCS_HT_MSK) {
                 rate_idx -= IWL_FIRST_OFDM_RATE;
-
+                /* 6M and 9M shared same MCS index */
+                rate_idx = (rate_idx > 0) ? (rate_idx - 1) : 0;
+                if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
+                    IWL_RATE_MIMO3_6M_PLCP)
+                        rate_idx = rate_idx + (2 * MCS_INDEX_PER_STREAM);
+                else if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
+                         IWL_RATE_MIMO2_6M_PLCP)
+                        rate_idx = rate_idx + MCS_INDEX_PER_STREAM;
+                info->control.rates[0].flags = IEEE80211_TX_RC_MCS;
+                if (lq_sta->last_rate_n_flags & RATE_MCS_SGI_MSK)
+                        info->control.rates[0].flags |= IEEE80211_TX_RC_SHORT_GI;
+                if (lq_sta->last_rate_n_flags & RATE_MCS_DUP_MSK)
+                        info->control.rates[0].flags |= IEEE80211_TX_RC_DUP_DATA;
+                if (lq_sta->last_rate_n_flags & RATE_MCS_FAT_MSK)
+                        info->control.rates[0].flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+                if (lq_sta->last_rate_n_flags & RATE_MCS_GF_MSK)
+                        info->control.rates[0].flags |= IEEE80211_TX_RC_GREEN_FIELD;
+        } else {
+                if (rate_idx < 0 || rate_idx > IWL_RATE_COUNT)
+                        rate_idx = rate_lowest_index(sband, sta);
+                else if (sband->band == IEEE80211_BAND_5GHZ)
+                        rate_idx -= IWL_FIRST_OFDM_RATE;
+        }
         info->control.rates[0].idx = rate_idx;
+
 }
 
 static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
@@ -2246,15 +2596,16 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
 
         lq_sta->ibss_sta_added = 0;
         if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                u8 sta_id = iwl_find_station(priv, sta->addr);
+                u8 sta_id = iwl_find_station(priv,
+                                                                sta->addr);
 
                 /* for IBSS the call are from tasklet */
                 IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
 
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-                        sta_id = iwl_add_station_flags(priv, sta->addr,
-                                                        0, CMD_ASYNC, NULL);
+                        sta_id = iwl_add_station(priv, sta->addr, false,
+                                                CMD_ASYNC, NULL);
                 }
                 if ((sta_id != IWL_INVALID_STATION)) {
                         lq_sta->lq.sta_id = sta_id;
@@ -2436,9 +2787,10 @@ static void rs_fill_link_cmd(const struct iwl_priv *priv,
                 repeat_rate--;
         }
 
-        lq_cmd->agg_params.agg_frame_cnt_limit = 64;
-        lq_cmd->agg_params.agg_dis_start_th = 3;
-        lq_cmd->agg_params.agg_time_limit = cpu_to_le16(4000);
+        lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_MAX;
+        lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        lq_cmd->agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
@@ -2539,6 +2891,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         char *buff;
         int desc = 0;
         int i = 0;
+        int index = 0;
         ssize_t ret;
 
         struct iwl_lq_sta *lq_sta = file->private_data;
@@ -2568,8 +2921,11 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                    ((is_mimo2(tbl->lq_type)) ? "MIMO2" : "MIMO3"));
                    desc += sprintf(buff+desc, " %s",
                    (tbl->is_fat) ? "40MHz" : "20MHz");
-                desc += sprintf(buff+desc, " %s\n", (tbl->is_SGI) ? "SGI" : "");
+                   desc += sprintf(buff+desc, " %s %s\n", (tbl->is_SGI) ? "SGI" : "",
+                   (lq_sta->is_green) ? "GF enabled" : "");
         }
+        desc += sprintf(buff+desc, "last tx rate=0x%X\n",
+                lq_sta->last_rate_n_flags);
         desc += sprintf(buff+desc, "general:"
                 "flags=0x%X mimo-d=%d s-ant0x%x d-ant=0x%x\n",
                 lq_sta->lq.general_params.flags,
@@ -2590,10 +2946,19 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                         lq_sta->lq.general_params.start_rate_index[2],
                         lq_sta->lq.general_params.start_rate_index[3]);
 
-
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
-                desc += sprintf(buff+desc, " rate[%d] 0x%X\n",
-                        i, le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags));
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
+                index = iwl_hwrate_to_plcp_idx(
+                        le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags));
+                if (is_legacy(tbl->lq_type)) {
+                        desc += sprintf(buff+desc, " rate[%d] 0x%X %smbps\n",
+                                i, le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags),
+                                iwl_rate_mcs[index].mbps);
+                } else {
+                        desc += sprintf(buff+desc, " rate[%d] 0x%X %smbps (%s)\n",
+                                i, le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags),
+                                iwl_rate_mcs[index].mbps, iwl_rate_mcs[index].mcs);
+                }
+        }
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
         kfree(buff);
@@ -2620,13 +2985,14 @@ static ssize_t rs_sta_dbgfs_stats_table_read(struct file *file,
                 return -ENOMEM;
 
         for (i = 0; i < LQ_SIZE; i++) {
-                desc += sprintf(buff+desc, "%s type=%d SGI=%d FAT=%d DUP=%d\n"
+                desc += sprintf(buff+desc, "%s type=%d SGI=%d FAT=%d DUP=%d GF=%d\n"
                                 "rate=0x%X\n",
                                 lq_sta->active_tbl == i ? "*" : "x",
                                 lq_sta->lq_info[i].lq_type,
                                 lq_sta->lq_info[i].is_SGI,
                                 lq_sta->lq_info[i].is_fat,
                                 lq_sta->lq_info[i].is_dup,
+                                lq_sta->is_green,
                                 lq_sta->lq_info[i].current_rate);
                 for (j = 0; j < IWL_RATE_COUNT; j++) {
                         desc += sprintf(buff+desc,
@@ -2646,6 +3012,43 @@ static const struct file_operations rs_sta_dbgfs_stats_table_ops = {
         .open = open_file_generic,
 };
 
+static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,
+                        char __user *user_buf, size_t count, loff_t *ppos)
+{
+        char buff[120];
+        int desc = 0;
+        ssize_t ret;
+
+        struct iwl_lq_sta *lq_sta = file->private_data;
+        struct iwl_priv *priv;
+        struct iwl_scale_tbl_info *tbl = &lq_sta->lq_info[lq_sta->active_tbl];
+
+        priv = lq_sta->drv;
+
+        if (is_Ht(tbl->lq_type))
+                desc += sprintf(buff+desc,
+                                "Bit Rate= %d Mb/s\n",
+                                tbl->expected_tpt[lq_sta->last_txrate_idx]);
+        else
+                desc += sprintf(buff+desc,
+                                "Bit Rate= %d Mb/s\n",
+                                iwl_rates[lq_sta->last_txrate_idx].ieee >> 1);
+        desc += sprintf(buff+desc,
+                        "Signal Level= %d dBm\tNoise Level= %d dBm\n",
+                        priv->last_rx_rssi, priv->last_rx_noise);
+        desc += sprintf(buff+desc,
+                        "Tsf= 0x%llx\tBeacon time= 0x%08X\n",
+                        priv->last_tsf, priv->last_beacon_time);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
+        return ret;
+}
+
+static const struct file_operations rs_sta_dbgfs_rate_scale_data_ops = {
+        .read = rs_sta_dbgfs_rate_scale_data_read,
+        .open = open_file_generic,
+};
+
 static void rs_add_debugfs(void *priv, void *priv_sta,
                                         struct dentry *dir)
 {
@@ -2656,6 +3059,9 @@ static void rs_add_debugfs(void *priv, void *priv_sta,
         lq_sta->rs_sta_dbgfs_stats_table_file =
                 debugfs_create_file("rate_stats_table", 0600, dir,
                         lq_sta, &rs_sta_dbgfs_stats_table_ops);
+        lq_sta->rs_sta_dbgfs_rate_scale_data_file =
+                debugfs_create_file("rate_scale_data", 0600, dir,
+                        lq_sta, &rs_sta_dbgfs_rate_scale_data_ops);
         lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
                 debugfs_create_u8("tx_agg_tid_enable", 0600, dir,
                 &lq_sta->tx_agg_tid_en);
@@ -2667,6 +3073,7 @@ static void rs_remove_debugfs(void *priv, void *priv_sta)
         struct iwl_lq_sta *lq_sta = priv_sta;
         debugfs_remove(lq_sta->rs_sta_dbgfs_scale_table_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_stats_table_file);
+        debugfs_remove(lq_sta->rs_sta_dbgfs_rate_scale_data_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file);
 }
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index ab59acc405d9..25050bf315a2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -241,6 +241,7 @@ enum {
 #define IWL_LEGACY_SWITCH_MIMO2_AB      3
 #define IWL_LEGACY_SWITCH_MIMO2_AC      4
 #define IWL_LEGACY_SWITCH_MIMO2_BC      5
+#define IWL_LEGACY_SWITCH_MIMO3_ABC     6
 
 /* possible actions when in siso mode */
 #define IWL_SISO_SWITCH_ANTENNA1        0
@@ -249,6 +250,8 @@ enum {
 #define IWL_SISO_SWITCH_MIMO2_AC        3
 #define IWL_SISO_SWITCH_MIMO2_BC        4
 #define IWL_SISO_SWITCH_GI              5
+#define IWL_SISO_SWITCH_MIMO3_ABC       6
+
 
 /* possible actions when in mimo mode */
 #define IWL_MIMO2_SWITCH_ANTENNA1       0
@@ -257,6 +260,23 @@ enum {
 #define IWL_MIMO2_SWITCH_SISO_B         3
 #define IWL_MIMO2_SWITCH_SISO_C         4
 #define IWL_MIMO2_SWITCH_GI             5
+#define IWL_MIMO2_SWITCH_MIMO3_ABC      6
+
+
+/* possible actions when in mimo3 mode */
+#define IWL_MIMO3_SWITCH_ANTENNA1       0
+#define IWL_MIMO3_SWITCH_ANTENNA2       1
+#define IWL_MIMO3_SWITCH_SISO_A         2
+#define IWL_MIMO3_SWITCH_SISO_B         3
+#define IWL_MIMO3_SWITCH_SISO_C         4
+#define IWL_MIMO3_SWITCH_MIMO2_AB       5
+#define IWL_MIMO3_SWITCH_MIMO2_AC       6
+#define IWL_MIMO3_SWITCH_MIMO2_BC       7
+#define IWL_MIMO3_SWITCH_GI             8
+
+
+#define IWL_MAX_11N_MIMO3_SEARCH IWL_MIMO3_SWITCH_GI
+#define IWL_MAX_SEARCH IWL_MIMO2_SWITCH_MIMO3_ABC
 
 /*FIXME:RS:add possible actions for MIMO3*/
 
@@ -307,6 +327,13 @@ enum iwl_table_type {
 #define ANT_BC          (ANT_B | ANT_C)
 #define ANT_ABC         (ANT_AB | ANT_C)
 
+#define IWL_MAX_MCS_DISPLAY_SIZE        12
+
+struct iwl_rate_mcs_info {
+        char    mbps[IWL_MAX_MCS_DISPLAY_SIZE];
+        char    mcs[IWL_MAX_MCS_DISPLAY_SIZE];
+};
+
 static inline u8 num_of_ant(u8 mask)
 {
         return  !!((mask) & ANT_A) +
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index f46ba2475776..a5637c4aa85d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -102,7 +102,7 @@ MODULE_ALIAS("iwl4965");
  * function correctly transitions out of the RXON_ASSOC_MSK state if
  * a HW tune is required based on the RXON structure changes.
  */
-static int iwl_commit_rxon(struct iwl_priv *priv)
+int iwl_commit_rxon(struct iwl_priv *priv)
 {
         /* cast away the const for active_rxon in this function */
         struct iwl_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
@@ -190,8 +190,7 @@ static int iwl_commit_rxon(struct iwl_priv *priv)
 
         iwl_clear_stations_table(priv);
 
-        if (!priv->error_recovering)
-                priv->start_calib = 0;
+        priv->start_calib = 0;
 
         /* Add the broadcast address so we can send broadcast frames */
         if (iwl_rxon_add_station(priv, iwl_bcast_addr, 0) ==
@@ -246,8 +245,9 @@ static int iwl_commit_rxon(struct iwl_priv *priv)
 void iwl_update_chain_flags(struct iwl_priv *priv)
 {
 
-        iwl_set_rxon_chain(priv);
-        iwl_commit_rxon(priv);
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+        iwlcore_commit_rxon(priv);
 }
 
 static void iwl_clear_free_frames(struct iwl_priv *priv)
@@ -503,24 +503,12 @@ int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq)
 {
-        int ret;
-        unsigned long flags;
         int txq_id = txq->q.id;
 
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
-
         /* Circular buffer (TFD queue in DRAM) physical base address */
         iwl_write_direct32(priv, FH_MEM_CBBC_QUEUE(txq_id),
                              txq->q.dma_addr >> 8);
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return 0;
 }
 
@@ -531,76 +519,6 @@ int iwl_hw_tx_queue_init(struct iwl_priv *priv,
  *
  ******************************************************************************/
 
-static void iwl_ht_conf(struct iwl_priv *priv,
-                            struct ieee80211_bss_conf *bss_conf)
-{
-        struct ieee80211_sta_ht_cap *ht_conf;
-        struct iwl_ht_info *iwl_conf = &priv->current_ht_config;
-        struct ieee80211_sta *sta;
-
-        IWL_DEBUG_MAC80211(priv, "enter: \n");
-
-        if (!iwl_conf->is_ht)
-                return;
-
-
-        /*
-         * It is totally wrong to base global information on something
-         * that is valid only when associated, alas, this driver works
-         * that way and I don't know how to fix it.
-         */
-
-        rcu_read_lock();
-        sta = ieee80211_find_sta(priv->hw, priv->bssid);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-        ht_conf = &sta->ht_cap;
-
-        if (ht_conf->cap & IEEE80211_HT_CAP_SGI_20)
-                iwl_conf->sgf |= HT_SHORT_GI_20MHZ;
-        if (ht_conf->cap & IEEE80211_HT_CAP_SGI_40)
-                iwl_conf->sgf |= HT_SHORT_GI_40MHZ;
-
-        iwl_conf->is_green_field = !!(ht_conf->cap & IEEE80211_HT_CAP_GRN_FLD);
-        iwl_conf->max_amsdu_size =
-                !!(ht_conf->cap & IEEE80211_HT_CAP_MAX_AMSDU);
-
-        iwl_conf->supported_chan_width =
-                !!(ht_conf->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40);
-
-        /*
-         * XXX: The HT configuration needs to be moved into iwl_mac_config()
-         *      to be done there correctly.
-         */
-
-        iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-        if (conf_is_ht40_minus(&priv->hw->conf))
-                iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-        else if (conf_is_ht40_plus(&priv->hw->conf))
-                iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-
-        /* If no above or below channel supplied disable FAT channel */
-        if (iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_ABOVE &&
-            iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_BELOW)
-                iwl_conf->supported_chan_width = 0;
-
-        iwl_conf->sm_ps = (u8)((ht_conf->cap & IEEE80211_HT_CAP_SM_PS) >> 2);
-
-        memcpy(&iwl_conf->mcs, &ht_conf->mcs, 16);
-
-        iwl_conf->tx_chan_width = iwl_conf->supported_chan_width != 0;
-        iwl_conf->ht_protection =
-                bss_conf->ht.operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
-        iwl_conf->non_GF_STA_present =
-                !!(bss_conf->ht.operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
-
-        rcu_read_unlock();
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-}
-
 #define MAX_UCODE_BEACON_INTERVAL       4096
 
 static u16 iwl_adjust_beacon_interval(u16 beacon_val)
@@ -636,7 +554,8 @@ static void iwl_setup_rxon_timing(struct iwl_priv *priv)
                 beacon_int = iwl_adjust_beacon_interval(priv->beacon_int);
                 priv->rxon_timing.atim_window = 0;
         } else {
-                beacon_int = iwl_adjust_beacon_interval(conf->beacon_int);
+                beacon_int = iwl_adjust_beacon_interval(
+                        priv->vif->bss_conf.beacon_int);
 
                 /* TODO: we need to get atim_window from upper stack
                  * for now we set to 0 */
@@ -657,23 +576,6 @@ static void iwl_setup_rxon_timing(struct iwl_priv *priv)
                         le16_to_cpu(priv->rxon_timing.atim_window));
 }
 
-static int iwl_set_mode(struct iwl_priv *priv, int mode)
-{
-        iwl_connection_init_rx_config(priv, mode);
-        iwl_set_rxon_chain(priv);
-        memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
-
-        iwl_clear_stations_table(priv);
-
-        /* dont commit rxon if rf-kill is on*/
-        if (!iwl_is_ready_rf(priv))
-                return -EAGAIN;
-
-        iwl_commit_rxon(priv);
-
-        return 0;
-}
-
 /******************************************************************************
  *
  * Generic RX handler implementations
@@ -795,6 +697,7 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
         unsigned long status = priv->status;
+        unsigned long reg_flags;
 
         IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s\n",
                           (flags & HW_CARD_DISABLED) ? "Kill" : "On",
@@ -806,32 +709,25 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                 iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                             CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
 
-                if (!iwl_grab_nic_access(priv)) {
-                        iwl_write_direct32(
-                                priv, HBUS_TARG_MBX_C,
-                                HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
-
-                        iwl_release_nic_access(priv);
-                }
+                iwl_write_direct32(priv, HBUS_TARG_MBX_C,
+                                        HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
 
                 if (!(flags & RXON_CARD_DISABLED)) {
                         iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
                                     CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
-                        if (!iwl_grab_nic_access(priv)) {
-                                iwl_write_direct32(
-                                        priv, HBUS_TARG_MBX_C,
+                        iwl_write_direct32(priv, HBUS_TARG_MBX_C,
                                         HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
 
-                                iwl_release_nic_access(priv);
-                        }
                 }
 
                 if (flags & RF_CARD_DISABLED) {
                         iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                                     CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
                         iwl_read32(priv, CSR_UCODE_DRV_GP1);
+                        spin_lock_irqsave(&priv->reg_lock, reg_flags);
                         if (!iwl_grab_nic_access(priv))
                                 iwl_release_nic_access(priv);
+                        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
                 }
         }
 
@@ -841,33 +737,19 @@ static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
 
 
-        if (flags & SW_CARD_DISABLED)
-                set_bit(STATUS_RF_KILL_SW, &priv->status);
-        else
-                clear_bit(STATUS_RF_KILL_SW, &priv->status);
-
         if (!(flags & RXON_CARD_DISABLED))
                 iwl_scan_cancel(priv);
 
         if ((test_bit(STATUS_RF_KILL_HW, &status) !=
-             test_bit(STATUS_RF_KILL_HW, &priv->status)) ||
-            (test_bit(STATUS_RF_KILL_SW, &status) !=
-             test_bit(STATUS_RF_KILL_SW, &priv->status)))
-                queue_work(priv->workqueue, &priv->rf_kill);
+             test_bit(STATUS_RF_KILL_HW, &priv->status)))
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+                        test_bit(STATUS_RF_KILL_HW, &priv->status));
         else
                 wake_up_interruptible(&priv->wait_command_queue);
 }
 
 int iwl_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
 {
-        int ret;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                goto err;
-
         if (src == IWL_PWR_SRC_VAUX) {
                 if (pci_pme_capable(priv->pci_dev, PCI_D3cold))
                         iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
@@ -879,10 +761,7 @@ int iwl_set_pwr_src(struct iwl_priv *priv, enum iwl_pwr_src src)
                                        ~APMG_PS_CTRL_MSK_PWR_SRC);
         }
 
-        iwl_release_nic_access(priv);
-err:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return ret;
+        return 0;
 }
 
 /**
@@ -946,6 +825,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
         unsigned long flags;
         u8 fill_rx = 0;
         u32 count = 8;
+        int total_empty;
 
         /* uCode's read index (stored in shared DRAM) indicates the last Rx
          * buffer that the driver may process (last buffer filled by ucode). */
@@ -956,7 +836,12 @@ void iwl_rx_handle(struct iwl_priv *priv)
         if (i == r)
                 IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
 
-        if (iwl_rx_queue_space(rxq) > (RX_QUEUE_SIZE / 2))
+        /* calculate total frames need to be restock after handling RX */
+        total_empty = r - priv->rxq.write_actual;
+        if (total_empty < 0)
+                total_empty += RX_QUEUE_SIZE;
+
+        if (total_empty > (RX_QUEUE_SIZE / 2))
                 fill_rx = 1;
 
         while (i != r) {
@@ -995,6 +880,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r,
                                 i, get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
                         priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
+                        priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
                 } else {
                         /* No handling needed */
                         IWL_DEBUG_RX(priv,
@@ -1032,7 +918,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 priv->rxq.read = i;
-                                iwl_rx_queue_restock(priv);
+                                iwl_rx_replenish_now(priv);
                                 count = 0;
                         }
                 }
@@ -1040,7 +926,10 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
         /* Backtrack one entry */
         priv->rxq.read = i;
-        iwl_rx_queue_restock(priv);
+        if (fill_rx)
+                iwl_rx_replenish_now(priv);
+        else
+                iwl_rx_queue_restock(priv);
 }
 
 /* call this function to flush any scheduled tasklet */
@@ -1051,24 +940,7 @@ static inline void iwl_synchronize_irq(struct iwl_priv *priv)
         tasklet_kill(&priv->irq_tasklet);
 }
 
-static void iwl_error_recovery(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        memcpy(&priv->staging_rxon, &priv->recovery_rxon,
-               sizeof(priv->staging_rxon));
-        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwl_commit_rxon(priv);
-
-        iwl_rxon_add_station(priv, priv->bssid, 1);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->assoc_id = le16_to_cpu(priv->staging_rxon.assoc_id);
-        priv->error_recovering = 0;
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-static void iwl_irq_tasklet(struct iwl_priv *priv)
+static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
 {
         u32 inta, handled = 0;
         u32 inta_fh;
@@ -1116,6 +988,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 /* Tell the device to stop sending interrupts */
                 iwl_disable_interrupts(priv);
 
+                priv->isr_stats.hw++;
                 iwl_irq_handle_error(priv);
 
                 handled |= CSR_INT_BIT_HW_ERR;
@@ -1128,13 +1001,17 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (priv->debug_level & (IWL_DL_ISR)) {
                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
-                if (inta & CSR_INT_BIT_SCD)
+                if (inta & CSR_INT_BIT_SCD) {
                         IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
                                       "the frame/frames.\n");
+                        priv->isr_stats.sch++;
+                }
 
                 /* Alive notification via Rx interrupt will do the real work */
-                if (inta & CSR_INT_BIT_ALIVE)
+                if (inta & CSR_INT_BIT_ALIVE) {
                         IWL_DEBUG_ISR(priv, "Alive interrupt\n");
+                        priv->isr_stats.alive++;
+                }
         }
 #endif
         /* Safely ignore these bits for debug checks below */
@@ -1150,6 +1027,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 IWL_DEBUG_RF_KILL(priv, "RF_KILL bit toggled to %s.\n",
                                 hw_rf_kill ? "disable radio" : "enable radio");
 
+                priv->isr_stats.rfkill++;
+
                 /* driver only loads ucode once setting the interface up.
                  * the driver allows loading the ucode even if the radio
                  * is killed. Hence update the killswitch state here. The
@@ -1160,7 +1039,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                 set_bit(STATUS_RF_KILL_HW, &priv->status);
                         else
                                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
-                        queue_work(priv->workqueue, &priv->rf_kill);
+                        wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill);
                 }
 
                 handled |= CSR_INT_BIT_RF_KILL;
@@ -1169,6 +1048,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* Chip got too hot and stopped itself */
         if (inta & CSR_INT_BIT_CT_KILL) {
                 IWL_ERR(priv, "Microcode CT kill error detected.\n");
+                priv->isr_stats.ctkill++;
                 handled |= CSR_INT_BIT_CT_KILL;
         }
 
@@ -1176,6 +1056,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         if (inta & CSR_INT_BIT_SW_ERR) {
                 IWL_ERR(priv, "Microcode SW error detected. "
                         " Restarting 0x%X.\n", inta);
+                priv->isr_stats.sw++;
+                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -1191,6 +1073,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 iwl_txq_update_write_ptr(priv, &priv->txq[4]);
                 iwl_txq_update_write_ptr(priv, &priv->txq[5]);
 
+                priv->isr_stats.wakeup++;
+
                 handled |= CSR_INT_BIT_WAKEUP;
         }
 
@@ -1199,23 +1083,27 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
          * notifications from uCode come through here*/
         if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                 iwl_rx_handle(priv);
+                priv->isr_stats.rx++;
                 handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
         }
 
         if (inta & CSR_INT_BIT_FH_TX) {
                 IWL_DEBUG_ISR(priv, "Tx interrupt\n");
+                priv->isr_stats.tx++;
                 handled |= CSR_INT_BIT_FH_TX;
                 /* FH finished to write, send event */
                 priv->ucode_write_complete = 1;
                 wake_up_interruptible(&priv->wait_command_queue);
         }
 
-        if (inta & ~handled)
+        if (inta & ~handled) {
                 IWL_ERR(priv, "Unhandled INTA bits 0x%08x\n", inta & ~handled);
+                priv->isr_stats.unhandled++;
+        }
 
-        if (inta & ~CSR_INI_SET_MASK) {
+        if (inta & ~(priv->inta_mask)) {
                 IWL_WARN(priv, "Disabled INTA bits 0x%08x were pending\n",
-                         inta & ~CSR_INI_SET_MASK);
+                         inta & ~priv->inta_mask);
                 IWL_WARN(priv, "   with FH_INT = 0x%08x\n", inta_fh);
         }
 
@@ -1236,6 +1124,200 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
+/* tasklet for iwlagn interrupt */
+static void iwl_irq_tasklet(struct iwl_priv *priv)
+{
+        u32 inta = 0;
+        u32 handled = 0;
+        unsigned long flags;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        u32 inta_mask;
+#endif
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Ack/clear/reset pending uCode interrupts.
+         * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
+         */
+        iwl_write32(priv, CSR_INT, priv->inta);
+
+        inta = priv->inta;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (priv->debug_level & IWL_DL_ISR) {
+                /* just for debug */
+                inta_mask = iwl_read32(priv, CSR_INT_MASK);
+                IWL_DEBUG_ISR(priv, "inta 0x%08x, enabled 0x%08x\n ",
+                                inta, inta_mask);
+        }
+#endif
+        /* saved interrupt in inta variable now we can reset priv->inta */
+        priv->inta = 0;
+
+        /* Now service all interrupt bits discovered above. */
+        if (inta & CSR_INT_BIT_HW_ERR) {
+                IWL_ERR(priv, "Microcode HW error detected.  Restarting.\n");
+
+                /* Tell the device to stop sending interrupts */
+                iwl_disable_interrupts(priv);
+
+                priv->isr_stats.hw++;
+                iwl_irq_handle_error(priv);
+
+                handled |= CSR_INT_BIT_HW_ERR;
+
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                return;
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (priv->debug_level & (IWL_DL_ISR)) {
+                /* NIC fires this, but we don't use it, redundant with WAKEUP */
+                if (inta & CSR_INT_BIT_SCD) {
+                        IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
+                                      "the frame/frames.\n");
+                        priv->isr_stats.sch++;
+                }
+
+                /* Alive notification via Rx interrupt will do the real work */
+                if (inta & CSR_INT_BIT_ALIVE) {
+                        IWL_DEBUG_ISR(priv, "Alive interrupt\n");
+                        priv->isr_stats.alive++;
+                }
+        }
+#endif
+        /* Safely ignore these bits for debug checks below */
+        inta &= ~(CSR_INT_BIT_SCD | CSR_INT_BIT_ALIVE);
+
+        /* HW RF KILL switch toggled */
+        if (inta & CSR_INT_BIT_RF_KILL) {
+                int hw_rf_kill = 0;
+                if (!(iwl_read32(priv, CSR_GP_CNTRL) &
+                                CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW))
+                        hw_rf_kill = 1;
+
+                IWL_DEBUG_RF_KILL(priv, "RF_KILL bit toggled to %s.\n",
+                                hw_rf_kill ? "disable radio" : "enable radio");
+
+                priv->isr_stats.rfkill++;
+
+                /* driver only loads ucode once setting the interface up.
+                 * the driver allows loading the ucode even if the radio
+                 * is killed. Hence update the killswitch state here. The
+                 * rfkill handler will care about restarting if needed.
+                 */
+                if (!test_bit(STATUS_ALIVE, &priv->status)) {
+                        if (hw_rf_kill)
+                                set_bit(STATUS_RF_KILL_HW, &priv->status);
+                        else
+                                clear_bit(STATUS_RF_KILL_HW, &priv->status);
+                        wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill);
+                }
+
+                handled |= CSR_INT_BIT_RF_KILL;
+        }
+
+        /* Chip got too hot and stopped itself */
+        if (inta & CSR_INT_BIT_CT_KILL) {
+                IWL_ERR(priv, "Microcode CT kill error detected.\n");
+                priv->isr_stats.ctkill++;
+                handled |= CSR_INT_BIT_CT_KILL;
+        }
+
+        /* Error detected by uCode */
+        if (inta & CSR_INT_BIT_SW_ERR) {
+                IWL_ERR(priv, "Microcode SW error detected. "
+                        " Restarting 0x%X.\n", inta);
+                priv->isr_stats.sw++;
+                priv->isr_stats.sw_err = inta;
+                iwl_irq_handle_error(priv);
+                handled |= CSR_INT_BIT_SW_ERR;
+        }
+
+        /* uCode wakes up after power-down sleep */
+        if (inta & CSR_INT_BIT_WAKEUP) {
+                IWL_DEBUG_ISR(priv, "Wakeup interrupt\n");
+                iwl_rx_queue_update_write_ptr(priv, &priv->rxq);
+                iwl_txq_update_write_ptr(priv, &priv->txq[0]);
+                iwl_txq_update_write_ptr(priv, &priv->txq[1]);
+                iwl_txq_update_write_ptr(priv, &priv->txq[2]);
+                iwl_txq_update_write_ptr(priv, &priv->txq[3]);
+                iwl_txq_update_write_ptr(priv, &priv->txq[4]);
+                iwl_txq_update_write_ptr(priv, &priv->txq[5]);
+
+                priv->isr_stats.wakeup++;
+
+                handled |= CSR_INT_BIT_WAKEUP;
+        }
+
+        /* All uCode command responses, including Tx command responses,
+         * Rx "responses" (frame-received notification), and other
+         * notifications from uCode come through here*/
+        if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX |
+                        CSR_INT_BIT_RX_PERIODIC)) {
+                IWL_DEBUG_ISR(priv, "Rx interrupt\n");
+                if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
+                        handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
+                        iwl_write32(priv, CSR_FH_INT_STATUS,
+                                        CSR49_FH_INT_RX_MASK);
+                }
+                if (inta & CSR_INT_BIT_RX_PERIODIC) {
+                        handled |= CSR_INT_BIT_RX_PERIODIC;
+                        iwl_write32(priv, CSR_INT, CSR_INT_BIT_RX_PERIODIC);
+                }
+                /* Sending RX interrupt require many steps to be done in the
+                 * the device:
+                 * 1- write interrupt to current index in ICT table.
+                 * 2- dma RX frame.
+                 * 3- update RX shared data to indicate last write index.
+                 * 4- send interrupt.
+                 * This could lead to RX race, driver could receive RX interrupt
+                 * but the shared data changes does not reflect this.
+                 * this could lead to RX race, RX periodic will solve this race
+                 */
+                iwl_write32(priv, CSR_INT_PERIODIC_REG,
+                            CSR_INT_PERIODIC_DIS);
+                iwl_rx_handle(priv);
+                /* Only set RX periodic if real RX is received. */
+                if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX))
+                        iwl_write32(priv, CSR_INT_PERIODIC_REG,
+                                    CSR_INT_PERIODIC_ENA);
+
+                priv->isr_stats.rx++;
+        }
+
+        if (inta & CSR_INT_BIT_FH_TX) {
+                iwl_write32(priv, CSR_FH_INT_STATUS, CSR49_FH_INT_TX_MASK);
+                IWL_DEBUG_ISR(priv, "Tx interrupt\n");
+                priv->isr_stats.tx++;
+                handled |= CSR_INT_BIT_FH_TX;
+                /* FH finished to write, send event */
+                priv->ucode_write_complete = 1;
+                wake_up_interruptible(&priv->wait_command_queue);
+        }
+
+        if (inta & ~handled) {
+                IWL_ERR(priv, "Unhandled INTA bits 0x%08x\n", inta & ~handled);
+                priv->isr_stats.unhandled++;
+        }
+
+        if (inta & ~(priv->inta_mask)) {
+                IWL_WARN(priv, "Disabled INTA bits 0x%08x were pending\n",
+                         inta & ~priv->inta_mask);
+        }
+
+
+        /* Re-enable all interrupts */
+        /* only Re-enable if diabled by irq */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status))
+                iwl_enable_interrupts(priv);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+}
+
+
 /******************************************************************************
  *
  * uCode download functions
@@ -1501,10 +1583,6 @@ static int iwl_read_ucode(struct iwl_priv *priv)
         return ret;
 }
 
-/* temporary */
-static int iwl_mac_beacon_update(struct ieee80211_hw *hw,
-                                 struct sk_buff *skb);
-
 /**
  * iwl_alive_start - called after REPLY_ALIVE notification received
  *                   from protocol/runtime uCode (initialization uCode's
@@ -1561,7 +1639,10 @@ static void iwl_alive_start(struct iwl_priv *priv)
         } else {
                 /* Initialize our rx_config data */
                 iwl_connection_init_rx_config(priv, priv->iw_mode);
-                iwl_set_rxon_chain(priv);
+
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
                 memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
         }
 
@@ -1571,7 +1652,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
         iwl_reset_run_time_calib(priv);
 
         /* Configure the adapter for unassociated operation */
-        iwl_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         /* At this point, the NIC is initialized and operational */
         iwl_rf_kill_ct_config(priv);
@@ -1582,9 +1663,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
         set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
-        if (priv->error_recovering)
-                iwl_error_recovery(priv);
-
         iwl_power_update_mode(priv, 1);
 
         /* reassociate for ADHOC mode */
@@ -1642,36 +1720,30 @@ static void __iwl_down(struct iwl_priv *priv)
                 ieee80211_stop_queues(priv->hw);
 
         /* If we have not previously called iwl_init() then
-         * clear all bits but the RF Kill and SUSPEND bits and return */
+         * clear all bits but the RF Kill bit and return */
         if (!iwl_is_init(priv)) {
                 priv->status = test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                         STATUS_RF_KILL_HW |
-                               test_bit(STATUS_RF_KILL_SW, &priv->status) <<
-                                        STATUS_RF_KILL_SW |
                                test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
                                         STATUS_GEO_CONFIGURED |
-                               test_bit(STATUS_IN_SUSPEND, &priv->status) <<
-                                        STATUS_IN_SUSPEND |
                                test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                         STATUS_EXIT_PENDING;
                 goto exit;
         }
 
-        /* ...otherwise clear out all the status bits but the RF Kill and
-         * SUSPEND bits and continue taking the NIC down. */
+        /* ...otherwise clear out all the status bits but the RF Kill
+         * bit and continue taking the NIC down. */
         priv->status &= test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                 STATUS_RF_KILL_HW |
-                        test_bit(STATUS_RF_KILL_SW, &priv->status) <<
-                                STATUS_RF_KILL_SW |
                         test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
                                 STATUS_GEO_CONFIGURED |
-                        test_bit(STATUS_IN_SUSPEND, &priv->status) <<
-                                STATUS_IN_SUSPEND |
                         test_bit(STATUS_FW_ERROR, &priv->status) <<
                                 STATUS_FW_ERROR |
                        test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                 STATUS_EXIT_PENDING;
 
+        /* device going down, Stop using ICT table */
+        iwl_disable_ict(priv);
         spin_lock_irqsave(&priv->lock, flags);
         iwl_clear_bit(priv, CSR_GP_CNTRL,
                          CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -1680,18 +1752,13 @@ static void __iwl_down(struct iwl_priv *priv)
         iwl_txq_ctx_stop(priv);
         iwl_rxq_stop(priv);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!iwl_grab_nic_access(priv)) {
-                iwl_write_prph(priv, APMG_CLK_DIS_REG,
-                                         APMG_CLK_VAL_DMA_CLK_RQT);
-                iwl_release_nic_access(priv);
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
+        iwl_write_prph(priv, APMG_CLK_DIS_REG,
+                                APMG_CLK_VAL_DMA_CLK_RQT);
 
         udelay(5);
 
         /* FIXME: apm_ops.suspend(priv) */
-        if (exit_pending || test_bit(STATUS_IN_SUSPEND, &priv->status))
+        if (exit_pending)
                 priv->cfg->ops->lib->apm_ops.stop(priv);
         else
                 priv->cfg->ops->lib->apm_ops.reset(priv);
@@ -1715,6 +1782,49 @@ static void iwl_down(struct iwl_priv *priv)
         iwl_cancel_deferred_work(priv);
 }
 
+#define HW_READY_TIMEOUT (50)
+
+static int iwl_set_hw_ready(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
+
+        /* See if we got it */
+        ret = iwl_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
+                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
+                                HW_READY_TIMEOUT);
+        if (ret != -ETIMEDOUT)
+                priv->hw_ready = true;
+        else
+                priv->hw_ready = false;
+
+        IWL_DEBUG_INFO(priv, "hardware %s\n",
+                      (priv->hw_ready == 1) ? "ready" : "not ready");
+        return ret;
+}
+
+static int iwl_prepare_card_hw(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter \n");
+
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                        CSR_HW_IF_CONFIG_REG_PREPARE);
+
+        ret = iwl_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
+                        ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
+                        CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
+
+        if (ret != -ETIMEDOUT)
+                iwl_set_hw_ready(priv);
+
+        return ret;
+}
+
 #define MAX_HW_RESTARTS 5
 
 static int __iwl_up(struct iwl_priv *priv)
@@ -1732,6 +1842,13 @@ static int __iwl_up(struct iwl_priv *priv)
                 return -EIO;
         }
 
+        iwl_prepare_card_hw(priv);
+
+        if (!priv->hw_ready) {
+                IWL_WARN(priv, "Exit HW not ready\n");
+                return -EIO;
+        }
+
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
@@ -1739,9 +1856,10 @@ static int __iwl_up(struct iwl_priv *priv)
                 set_bit(STATUS_RF_KILL_HW, &priv->status);
 
         if (iwl_is_rfkill(priv)) {
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, true);
+
                 iwl_enable_interrupts(priv);
-                IWL_WARN(priv, "Radio disabled by %s RF Kill switch\n",
-                    test_bit(STATUS_RF_KILL_HW, &priv->status) ? "HW" : "SW");
+                IWL_WARN(priv, "Radio disabled by HW RF Kill switch\n");
                 return 0;
         }
 
@@ -1787,9 +1905,6 @@ static int __iwl_up(struct iwl_priv *priv)
                         continue;
                 }
 
-                /* Clear out the uCode error bit if it is set */
-                clear_bit(STATUS_FW_ERROR, &priv->status);
-
                 /* start card; "initialize" will load runtime ucode */
                 iwl_nic_start(priv);
 
@@ -1836,6 +1951,9 @@ static void iwl_bg_alive_start(struct work_struct *data)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        /* enable dram interrupt */
+        iwl_reset_ict(priv);
+
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
         mutex_unlock(&priv->mutex);
@@ -1874,7 +1992,6 @@ static void iwl_bg_up(struct work_struct *data)
         mutex_lock(&priv->mutex);
         __iwl_up(priv);
         mutex_unlock(&priv->mutex);
-        iwl_rfkill_set_hw_state(priv);
 }
 
 static void iwl_bg_restart(struct work_struct *data)
@@ -1884,8 +2001,17 @@ static void iwl_bg_restart(struct work_struct *data)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        iwl_down(priv);
-        queue_work(priv->workqueue, &priv->up);
+        if (test_and_clear_bit(STATUS_FW_ERROR, &priv->status)) {
+                mutex_lock(&priv->mutex);
+                priv->vif = NULL;
+                priv->is_open = 0;
+                mutex_unlock(&priv->mutex);
+                iwl_down(priv);
+                ieee80211_restart_hw(priv->hw);
+        } else {
+                iwl_down(priv);
+                queue_work(priv->workqueue, &priv->up);
+        }
 }
 
 static void iwl_bg_rx_replenish(struct work_struct *data)
@@ -1903,7 +2029,7 @@ static void iwl_bg_rx_replenish(struct work_struct *data)
 
 #define IWL_DELAY_NEXT_SCAN (HZ*2)
 
-static void iwl_post_associate(struct iwl_priv *priv)
+void iwl_post_associate(struct iwl_priv *priv)
 {
         struct ieee80211_conf *conf = NULL;
         int ret = 0;
@@ -1925,13 +2051,12 @@ static void iwl_post_associate(struct iwl_priv *priv)
         if (!priv->vif || !priv->is_open)
                 return;
 
-        iwl_power_cancel_timeout(priv);
         iwl_scan_cancel_timeout(priv, 200);
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
         priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwl_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         iwl_setup_rxon_timing(priv);
         ret = iwl_send_cmd_pdu(priv, REPLY_RXON_TIMING,
@@ -1944,7 +2069,9 @@ static void iwl_post_associate(struct iwl_priv *priv)
 
         iwl_set_rxon_ht(priv, &priv->current_ht_config);
 
-        iwl_set_rxon_chain(priv);
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
         priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
@@ -1966,7 +2093,7 @@ static void iwl_post_associate(struct iwl_priv *priv)
 
         }
 
-        iwl_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         switch (priv->iw_mode) {
         case NL80211_IFTYPE_STATION:
@@ -1999,7 +2126,7 @@ static void iwl_post_associate(struct iwl_priv *priv)
          * If chain noise has already been run, then we need to enable
          * power management here */
         if (priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE)
-                iwl_power_enable_management(priv);
+                iwl_power_update_mode(priv, 0);
 
         /* Enable Rx differential gain and sensitivity calibrations */
         iwl_chain_noise_reset(priv);
@@ -2042,8 +2169,6 @@ static int iwl_mac_start(struct ieee80211_hw *hw)
 
         mutex_unlock(&priv->mutex);
 
-        iwl_rfkill_set_hw_state(priv);
-
         if (ret)
                 return ret;
 
@@ -2052,9 +2177,6 @@ static int iwl_mac_start(struct ieee80211_hw *hw)
 
         IWL_DEBUG_INFO(priv, "Start UP work done.\n");
 
-        if (test_bit(STATUS_IN_SUSPEND, &priv->status))
-                return 0;
-
         /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
          * mac80211 will not be run successfully. */
         ret = wait_event_interruptible_timeout(priv->wait_command_queue,
@@ -2080,10 +2202,8 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
-        if (!priv->is_open) {
-                IWL_DEBUG_MAC80211(priv, "leave - skip\n");
+        if (!priv->is_open)
                 return;
-        }
 
         priv->is_open = 0;
 
@@ -2123,175 +2243,7 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
-static int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
-
-        if (priv->vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
-                return -EOPNOTSUPP;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->vif = conf->vif;
-        priv->iw_mode = conf->type;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->mac_addr) {
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", conf->mac_addr);
-                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
-        }
-
-        if (iwl_set_mode(priv, conf->type) == -EAGAIN)
-                /* we are not ready, will run again when ready */
-                set_bit(STATUS_MODE_PENDING, &priv->status);
-
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
-}
-
-/**
- * iwl_mac_config - mac80211 config callback
- *
- * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
- * be set inappropriately and the driver currently sets the hardware up to
- * use it whenever needed.
- */
-static int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
-{
-        struct iwl_priv *priv = hw->priv;
-        const struct iwl_channel_info *ch_info;
-        struct ieee80211_conf *conf = &hw->conf;
-        unsigned long flags = 0;
-        int ret = 0;
-        u16 ch;
-        int scan_active = 0;
-
-        mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
-                                        conf->channel->hw_value, changed);
-
-        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
-                        test_bit(STATUS_SCANNING, &priv->status))) {
-                scan_active = 1;
-                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
-        }
-
-
-        /* during scanning mac80211 will delay channel setting until
-         * scan finish with changed = 0
-         */
-        if (!changed || (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
-                if (scan_active)
-                        goto set_ch_out;
-
-                ch = ieee80211_frequency_to_channel(conf->channel->center_freq);
-                ch_info = iwl_get_channel_info(priv, conf->channel->band, ch);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
-                        ret = -EINVAL;
-                        goto set_ch_out;
-                }
-
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-                        !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d in band %d not "
-                                "IBSS channel\n",
-                                conf->channel->hw_value, conf->channel->band);
-                        ret = -EINVAL;
-                        goto set_ch_out;
-                }
-
-                priv->current_ht_config.is_ht = conf_is_ht(conf);
-
-                spin_lock_irqsave(&priv->lock, flags);
-
-
-                /* if we are switching from ht to 2.4 clear flags
-                 * from any ht related info since 2.4 does not
-                 * support ht */
-                if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
-                        priv->staging_rxon.flags = 0;
-
-                iwl_set_rxon_channel(priv, conf->channel);
-
-                iwl_set_flags_for_band(priv, conf->channel->band);
-                spin_unlock_irqrestore(&priv->lock, flags);
- set_ch_out:
-                /* The list of supported rates and rate mask can be different
-                 * for each band; since the band may have changed, reset
-                 * the rate mask to what mac80211 lists */
-                iwl_set_rate(priv);
-        }
-
-        if (changed & IEEE80211_CONF_CHANGE_PS) {
-                if (conf->flags & IEEE80211_CONF_PS)
-                        ret = iwl_power_set_user_mode(priv, IWL_POWER_INDEX_3);
-                else
-                        ret = iwl_power_set_user_mode(priv, IWL_POWER_MODE_CAM);
-                if (ret)
-                        IWL_DEBUG_MAC80211(priv, "Error setting power level\n");
-
-        }
-
-        if (changed & IEEE80211_CONF_CHANGE_POWER) {
-                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
-                        priv->tx_power_user_lmt, conf->power_level);
-
-                iwl_set_tx_power(priv, conf->power_level, false);
-        }
-
-        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
-        iwl_set_rxon_chain(priv);
-
-        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
-                if (conf->radio_enabled &&
-                        iwl_radio_kill_sw_enable_radio(priv)) {
-                        IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - "
-                                                "waiting for uCode\n");
-                        goto out;
-                }
-
-                if (!conf->radio_enabled)
-                        iwl_radio_kill_sw_disable_radio(priv);
-        }
-
-        if (!conf->radio_enabled) {
-                IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
-                goto out;
-        }
-
-        if (!iwl_is_ready(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                goto out;
-        }
-
-        if (scan_active)
-                goto out;
-
-        if (memcmp(&priv->active_rxon,
-                   &priv->staging_rxon, sizeof(priv->staging_rxon)))
-                iwl_commit_rxon(priv);
-        else
-                IWL_DEBUG_INFO(priv, "No re-sending same RXON configuration.\n");
-
-
-out:
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        mutex_unlock(&priv->mutex);
-        return ret;
-}
-
-static void iwl_config_ap(struct iwl_priv *priv)
+void iwl_config_ap(struct iwl_priv *priv)
 {
         int ret = 0;
         unsigned long flags;
@@ -2304,7 +2256,7 @@ static void iwl_config_ap(struct iwl_priv *priv)
 
                 /* RXON - unassoc (to set timing command) */
                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl_commit_rxon(priv);
+                iwlcore_commit_rxon(priv);
 
                 /* RXON Timing */
                 iwl_setup_rxon_timing(priv);
@@ -2314,7 +2266,8 @@ static void iwl_config_ap(struct iwl_priv *priv)
                         IWL_WARN(priv, "REPLY_RXON_TIMING failed - "
                                         "Attempting to continue.\n");
 
-                iwl_set_rxon_chain(priv);
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
                 /* FIXME: what should be the assoc_id for AP? */
                 priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
@@ -2340,7 +2293,7 @@ static void iwl_config_ap(struct iwl_priv *priv)
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwl_commit_rxon(priv);
+                iwlcore_commit_rxon(priv);
                 spin_lock_irqsave(&priv->lock, flags);
                 iwl_activate_qos(priv, 1);
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -2353,194 +2306,6 @@ static void iwl_config_ap(struct iwl_priv *priv)
          * clear sta table, add BCAST sta... */
 }
 
-
-static int iwl_mac_config_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif,
-                                    struct ieee80211_if_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-        int rc;
-
-        if (conf == NULL)
-                return -EIO;
-
-        if (priv->vif != vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - priv->vif != vif\n");
-                return 0;
-        }
-
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            conf->changed & IEEE80211_IFCC_BEACON) {
-                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-                if (!beacon)
-                        return -ENOMEM;
-                mutex_lock(&priv->mutex);
-                rc = iwl_mac_beacon_update(hw, beacon);
-                mutex_unlock(&priv->mutex);
-                if (rc)
-                        return rc;
-        }
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->bssid)
-                IWL_DEBUG_MAC80211(priv, "bssid: %pM\n", conf->bssid);
-
-/*
- * very dubious code was here; the probe filtering flag is never set:
- *
-        if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
-            !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
- */
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                if (!conf->bssid) {
-                        conf->bssid = priv->mac_addr;
-                        memcpy(priv->bssid, priv->mac_addr, ETH_ALEN);
-                        IWL_DEBUG_MAC80211(priv, "bssid was set to: %pM\n",
-                                           conf->bssid);
-                }
-                if (priv->ibss_beacon)
-                        dev_kfree_skb(priv->ibss_beacon);
-
-                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
-        }
-
-        if (iwl_is_rfkill(priv))
-                goto done;
-
-        if (conf->bssid && !is_zero_ether_addr(conf->bssid) &&
-            !is_multicast_ether_addr(conf->bssid)) {
-                /* If there is currently a HW scan going on in the background
-                 * then we need to cancel it else the RXON below will fail. */
-                if (iwl_scan_cancel_timeout(priv, 100)) {
-                        IWL_WARN(priv, "Aborted scan still in progress "
-                                    "after 100ms\n");
-                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                        mutex_unlock(&priv->mutex);
-                        return -EAGAIN;
-                }
-                memcpy(priv->staging_rxon.bssid_addr, conf->bssid, ETH_ALEN);
-
-                /* TODO: Audit driver for usage of these members and see
-                 * if mac80211 deprecates them (priv->bssid looks like it
-                 * shouldn't be there, but I haven't scanned the IBSS code
-                 * to verify) - jpk */
-                memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-
-                if (priv->iw_mode == NL80211_IFTYPE_AP)
-                        iwl_config_ap(priv);
-                else {
-                        rc = iwl_commit_rxon(priv);
-                        if ((priv->iw_mode == NL80211_IFTYPE_STATION) && rc)
-                                iwl_rxon_add_station(
-                                        priv, priv->active_rxon.bssid_addr, 1);
-                }
-
-        } else {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl_commit_rxon(priv);
-        }
-
- done:
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        mutex_unlock(&priv->mutex);
-
-        return 0;
-}
-
-static void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_if_init_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        mutex_lock(&priv->mutex);
-
-        if (iwl_is_ready_rf(priv)) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl_commit_rxon(priv);
-        }
-        if (priv->vif == conf->vif) {
-                priv->vif = NULL;
-                memset(priv->bssid, 0, ETH_ALEN);
-        }
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-}
-
-#define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
-static void iwl_bss_info_changed(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_bss_conf *bss_conf,
-                                     u32 changes)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
-
-        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
-                IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
-                                   bss_conf->use_short_preamble);
-                if (bss_conf->use_short_preamble)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
-                else
-                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
-        }
-
-        if (changes & BSS_CHANGED_ERP_CTS_PROT) {
-                IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n", bss_conf->use_cts_prot);
-                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
-                        priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
-                else
-                        priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
-        }
-
-        if (changes & BSS_CHANGED_HT) {
-                iwl_ht_conf(priv, bss_conf);
-                iwl_set_rxon_chain(priv);
-        }
-
-        if (changes & BSS_CHANGED_ASSOC) {
-                IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
-                /* This should never happen as this function should
-                 * never be called from interrupt context. */
-                if (WARN_ON_ONCE(in_interrupt()))
-                        return;
-                if (bss_conf->assoc) {
-                        priv->assoc_id = bss_conf->aid;
-                        priv->beacon_int = bss_conf->beacon_int;
-                        priv->power_data.dtim_period = bss_conf->dtim_period;
-                        priv->timestamp = bss_conf->timestamp;
-                        priv->assoc_capability = bss_conf->assoc_capability;
-
-                        /* we have just associated, don't start scan too early
-                         * leave time for EAPOL exchange to complete
-                         */
-                        priv->next_scan_jiffies = jiffies +
-                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
-                        mutex_lock(&priv->mutex);
-                        iwl_post_associate(priv);
-                        mutex_unlock(&priv->mutex);
-                } else {
-                        priv->assoc_id = 0;
-                        IWL_DEBUG_MAC80211(priv, "DISASSOC %d\n", bss_conf->assoc);
-                }
-        } else if (changes && iwl_is_associated(priv) && priv->assoc_id) {
-                        IWL_DEBUG_MAC80211(priv, "Associated Changes %d\n", changes);
-                        iwl_send_rxon_assoc(priv);
-        }
-
-}
-
 static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
                         struct ieee80211_key_conf *keyconf, const u8 *addr,
                         u32 iv32, u16 *phase1key)
@@ -2623,49 +2388,6 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
-static int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
-                           const struct ieee80211_tx_queue_params *params)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        int q;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        if (queue >= AC_NUM) {
-                IWL_DEBUG_MAC80211(priv, "leave - queue >= AC_NUM %d\n", queue);
-                return 0;
-        }
-
-        q = AC_NUM - 1 - queue;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->qos_data.def_qos_parm.ac[q].cw_min = cpu_to_le16(params->cw_min);
-        priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
-        priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
-        priv->qos_data.def_qos_parm.ac[q].edca_txop =
-                        cpu_to_le16((params->txop * 32));
-
-        priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
-        priv->qos_data.qos_active = 1;
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP)
-                iwl_activate_qos(priv, 1);
-        else if (priv->assoc_id && iwl_is_associated(priv))
-                iwl_activate_qos(priv, 0);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
-}
-
 static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                              enum ieee80211_ampdu_mlme_action action,
                              struct ieee80211_sta *sta, u16 tid, u16 *ssn)
@@ -2708,41 +2430,6 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-        int i, avail;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        for (i = 0; i < AC_NUM; i++) {
-                txq = &priv->txq[i];
-                q = &txq->q;
-                avail = iwl_queue_space(q);
-
-                stats[i].len = q->n_window - avail;
-                stats[i].limit = q->n_window - q->high_mark;
-                stats[i].count = q->n_window;
-
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-
 static int iwl_mac_get_stats(struct ieee80211_hw *hw,
                              struct ieee80211_low_level_stats *stats)
 {
@@ -2755,120 +2442,6 @@ static int iwl_mac_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-
-        mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        spin_lock_irqsave(&priv->lock, flags);
-        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_info));
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        iwl_reset_qos(priv);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->assoc_id = 0;
-        priv->assoc_capability = 0;
-        priv->assoc_station_added = 0;
-
-        /* new association get rid of ibss beacon skb */
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-
-        priv->ibss_beacon = NULL;
-
-        priv->beacon_int = priv->hw->conf.beacon_int;
-        priv->timestamp = 0;
-        if ((priv->iw_mode == NL80211_IFTYPE_STATION))
-                priv->beacon_int = 0;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
-
-        /* we are restarting association process
-         * clear RXON_FILTER_ASSOC_MSK bit
-         */
-        if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl_commit_rxon(priv);
-        }
-
-        iwl_power_update_mode(priv, 0);
-
-        /* Per mac80211.h: This is only used in IBSS mode... */
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-
-                /* switch to CAM during association period.
-                 * the ucode will block any association/authentication
-                 * frome during assiciation period if it can not hear
-                 * the AP because of PM. the timer enable PM back is
-                 * association do not complete
-                 */
-                if (priv->hw->conf.channel->flags & (IEEE80211_CHAN_PASSIVE_SCAN |
-                                                     IEEE80211_CHAN_RADAR))
-                                iwl_power_disable_management(priv, 3000);
-
-                IWL_DEBUG_MAC80211(priv, "leave - not in IBSS\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
-
-        iwl_set_rate(priv);
-
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-}
-
-static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        __le64 timestamp;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not IBSS\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-
-        priv->ibss_beacon = skb;
-
-        priv->assoc_id = 0;
-        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        iwl_reset_qos(priv);
-
-        iwl_post_associate(priv);
-
-
-        return 0;
-}
-
 /*****************************************************************************
  *
  * sysfs attributes
@@ -2888,7 +2461,7 @@ static int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%08X\n", priv->debug_level);
 }
@@ -2896,7 +2469,7 @@ static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -2919,7 +2492,7 @@ static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
 static ssize_t show_version(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         struct iwl_alive_resp *palive = &priv->card_alive;
         ssize_t pos = 0;
         u16 eeprom_ver;
@@ -2936,8 +2509,10 @@ static ssize_t show_version(struct device *d,
 
         if (priv->eeprom) {
                 eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
-                pos += sprintf(buf + pos, "EEPROM version: 0x%x\n",
-                                 eeprom_ver);
+                pos += sprintf(buf + pos, "NVM Type: %s, version: 0x%x\n",
+                               (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                               ? "OTP" : "EEPROM", eeprom_ver);
+
         } else {
                 pos += sprintf(buf + pos, "EEPROM not initialzed\n");
         }
@@ -2950,7 +2525,7 @@ static DEVICE_ATTR(version, S_IWUSR | S_IRUGO, show_version, NULL);
 static ssize_t show_temperature(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -2963,7 +2538,7 @@ static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
 static ssize_t show_tx_power(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_ready_rf(priv))
                 return sprintf(buf, "off\n");
@@ -2975,7 +2550,7 @@ static ssize_t store_tx_power(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -2993,7 +2568,7 @@ static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 static ssize_t show_flags(struct device *d,
                           struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
 }
@@ -3002,7 +2577,7 @@ static ssize_t store_flags(struct device *d,
                            struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         u32 flags;
         int ret = strict_strtoul(buf, 0, &val);
@@ -3018,7 +2593,7 @@ static ssize_t store_flags(struct device *d,
                 else {
                         IWL_DEBUG_INFO(priv, "Commit rxon.flags = 0x%04X\n", flags);
                         priv->staging_rxon.flags = cpu_to_le32(flags);
-                        iwl_commit_rxon(priv);
+                        iwlcore_commit_rxon(priv);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3031,7 +2606,7 @@ static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
 static ssize_t show_filter_flags(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n",
                 le32_to_cpu(priv->active_rxon.filter_flags));
@@ -3041,7 +2616,7 @@ static ssize_t store_filter_flags(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         u32 filter_flags;
         int ret = strict_strtoul(buf, 0, &val);
@@ -3059,7 +2634,7 @@ static ssize_t store_filter_flags(struct device *d,
                                        "0x%04X\n", filter_flags);
                         priv->staging_rxon.filter_flags =
                                 cpu_to_le32(filter_flags);
-                        iwl_commit_rxon(priv);
+                        iwlcore_commit_rxon(priv);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -3102,32 +2677,37 @@ static ssize_t show_power_level(struct device *d,
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
         int mode = priv->power_data.user_power_setting;
-        int system = priv->power_data.system_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        switch (system) {
-        case IWL_POWER_SYS_AUTO:
-                p += sprintf(p, "SYSTEM:auto");
-                break;
-        case IWL_POWER_SYS_AC:
-                p += sprintf(p, "SYSTEM:ac");
-                break;
-        case IWL_POWER_SYS_BATTERY:
-                p += sprintf(p, "SYSTEM:battery");
-                break;
-        }
-
-        p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ?
-                        "fixed" : "auto");
-        p += sprintf(p, "\tINDEX:%d", level);
-        p += sprintf(p, "\n");
+        p += sprintf(p, "INDEX:%d\t", level);
+        p += sprintf(p, "USER:%d\n", mode);
         return p - buf + 1;
 }
 
 static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR, show_power_level,
                    store_power_level);
 
+static ssize_t show_qos(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        char *p = buf;
+        int   q;
+
+        for (q = 0; q < AC_NUM; q++) {
+                p += sprintf(p, "\tcw_min\tcw_max\taifsn\ttxop\n");
+                p += sprintf(p, "AC[%d]\t%u\t%u\t%u\t%u\n", q,
+                             priv->qos_data.def_qos_parm.ac[q].cw_min,
+                             priv->qos_data.def_qos_parm.ac[q].cw_max,
+                             priv->qos_data.def_qos_parm.ac[q].aifsn,
+                             priv->qos_data.def_qos_parm.ac[q].edca_txop);
+        }
+
+        return p - buf + 1;
+}
+
+static DEVICE_ATTR(qos, S_IRUGO, show_qos, NULL);
 
 static ssize_t show_statistics(struct device *d,
                                struct device_attribute *attr, char *buf)
@@ -3183,14 +2763,12 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->up, iwl_bg_up);
         INIT_WORK(&priv->restart, iwl_bg_restart);
         INIT_WORK(&priv->rx_replenish, iwl_bg_rx_replenish);
-        INIT_WORK(&priv->rf_kill, iwl_bg_rf_kill);
         INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update);
         INIT_WORK(&priv->run_time_calib_work, iwl_bg_run_time_calib_work);
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl_bg_alive_start);
 
         iwl_setup_scan_deferred_work(priv);
-        iwl_setup_power_deferred_work(priv);
 
         if (priv->cfg->ops->lib->setup_deferred_work)
                 priv->cfg->ops->lib->setup_deferred_work(priv);
@@ -3199,8 +2777,12 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         priv->statistics_periodic.data = (unsigned long)priv;
         priv->statistics_periodic.function = iwl_bg_statistics_periodic;
 
-        tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
-                     iwl_irq_tasklet, (unsigned long)priv);
+        if (!priv->cfg->use_isr_legacy)
+                tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+                        iwl_irq_tasklet, (unsigned long)priv);
+        else
+                tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
+                        iwl_irq_tasklet_legacy, (unsigned long)priv);
 }
 
 static void iwl_cancel_deferred_work(struct iwl_priv *priv)
@@ -3210,7 +2792,6 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
-        cancel_delayed_work_sync(&priv->set_power_save);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
@@ -3227,7 +2808,7 @@ static struct attribute *iwl_sysfs_entries[] = {
         &dev_attr_debug_level.attr,
 #endif
         &dev_attr_version.attr,
-
+        &dev_attr_qos.attr,
         NULL
 };
 
@@ -3243,7 +2824,6 @@ static struct ieee80211_ops iwl_hw_ops = {
         .add_interface = iwl_mac_add_interface,
         .remove_interface = iwl_mac_remove_interface,
         .config = iwl_mac_config,
-        .config_interface = iwl_mac_config_interface,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
@@ -3291,6 +2871,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
         priv->cfg = cfg;
         priv->pci_dev = pdev;
+        priv->inta_mask = CSR_INI_SET_MASK;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         priv->debug_level = priv->cfg->mod_params->debug;
@@ -3341,6 +2922,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 (unsigned long long) pci_resource_len(pdev, 0));
         IWL_DEBUG_INFO(priv, "pci_resource_base = %p\n", priv->hw_base);
 
+        /* this spin lock will be used in apm_ops.init and EEPROM access
+         * we should init now
+         */
+        spin_lock_init(&priv->reg_lock);
         iwl_hw_detect(priv);
         IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
@@ -3349,6 +2934,12 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
+        iwl_prepare_card_hw(priv);
+        if (!priv->hw_ready) {
+                IWL_WARN(priv, "Failed, HW not ready\n");
+                goto out_iounmap;
+        }
+
         /* amp init */
         err = priv->cfg->ops->lib->apm_ops.init(priv);
         if (err < 0) {
@@ -3390,18 +2981,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_free_eeprom;
         /* At this point both hw and priv are initialized. */
 
-        /**********************************
-         * 7. Initialize module parameters
-         **********************************/
-
-        /* Disable radio (SW RF KILL) via parameter when loading driver */
-        if (priv->cfg->mod_params->disable) {
-                set_bit(STATUS_RF_KILL_SW, &priv->status);
-                IWL_DEBUG_INFO(priv, "Radio disabled.\n");
-        }
-
         /********************
-         * 8. Setup services
+         * 7. Setup services
          ********************/
         spin_lock_irqsave(&priv->lock, flags);
         iwl_disable_interrupts(priv);
@@ -3409,8 +2990,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_enable_msi(priv->pci_dev);
 
-        err = request_irq(priv->pci_dev->irq, iwl_isr, IRQF_SHARED,
-                          DRV_NAME, priv);
+        iwl_alloc_isr_ict(priv);
+        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr,
+                          IRQF_SHARED, DRV_NAME, priv);
         if (err) {
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
                 goto out_disable_msi;
@@ -3425,7 +3007,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         iwl_setup_rx_handlers(priv);
 
         /**********************************
-         * 9. Setup and register mac80211
+         * 8. Setup and register mac80211
          **********************************/
 
         /* enable interrupts if needed: hw bug w/a */
@@ -3443,7 +3025,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         err = iwl_dbgfs_register(priv, DRV_NAME);
         if (err)
-                IWL_ERR(priv, "failed to create debugfs files\n");
+                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
@@ -3451,12 +3033,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         else
                 set_bit(STATUS_RF_KILL_HW, &priv->status);
 
-        err = iwl_rfkill_init(priv);
-        if (err)
-                IWL_ERR(priv, "Unable to initialize RFKILL system. "
-                                  "Ignoring error: %d\n", err);
-        else
-                iwl_rfkill_set_hw_state(priv);
+        wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+                test_bit(STATUS_RF_KILL_HW, &priv->status));
 
         iwl_power_initialize(priv);
         return 0;
@@ -3467,6 +3045,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
  out_free_irq:
         free_irq(priv->pci_dev->irq, priv);
+        iwl_free_isr_ict(priv);
  out_disable_msi:
         pci_disable_msi(priv->pci_dev);
         iwl_uninit_drv(priv);
@@ -3519,7 +3098,6 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 
         iwl_synchronize_irq(priv);
 
-        iwl_rfkill_unregister(priv);
         iwl_dealloc_ucode_pci(priv);
 
         if (priv->rxq.bd)
@@ -3548,51 +3126,14 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 
         iwl_uninit_drv(priv);
 
+        iwl_free_isr_ict(priv);
+
         if (priv->ibss_beacon)
                 dev_kfree_skb(priv->ibss_beacon);
 
         ieee80211_free_hw(priv->hw);
 }
 
-#ifdef CONFIG_PM
-
-static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct iwl_priv *priv = pci_get_drvdata(pdev);
-
-        if (priv->is_open) {
-                set_bit(STATUS_IN_SUSPEND, &priv->status);
-                iwl_mac_stop(priv->hw);
-                priv->is_open = 1;
-        }
-
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
-        return 0;
-}
-
-static int iwl_pci_resume(struct pci_dev *pdev)
-{
-        struct iwl_priv *priv = pci_get_drvdata(pdev);
-        int ret;
-
-        pci_set_power_state(pdev, PCI_D0);
-        ret = pci_enable_device(pdev);
-        if (ret)
-                return ret;
-        pci_restore_state(pdev);
-        iwl_enable_interrupts(priv);
-
-        if (priv->is_open)
-                iwl_mac_start(priv->hw);
-
-        clear_bit(STATUS_IN_SUSPEND, &priv->status);
-        return 0;
-}
-
-#endif /* CONFIG_PM */
 
 /*****************************************************************************
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 735f3f19928c..a5d63672ad39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -857,7 +857,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 priv->cfg->ops->lib->update_chain_flags(priv);
 
         data->state = IWL_CHAIN_NOISE_DONE;
-        iwl_power_enable_management(priv);
+        iwl_power_update_mode(priv, 0);
 }
 EXPORT_SYMBOL(iwl_chain_noise_calibration);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 29d40746da6a..c87033bf3ad2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -614,8 +614,18 @@ enum {
 
 #define RXON_FLG_CHANNEL_MODE_POS               (25)
 #define RXON_FLG_CHANNEL_MODE_MSK               cpu_to_le32(0x3 << 25)
-#define RXON_FLG_CHANNEL_MODE_PURE_40_MSK       cpu_to_le32(0x1 << 25)
-#define RXON_FLG_CHANNEL_MODE_MIXED_MSK         cpu_to_le32(0x2 << 25)
+
+/* channel mode */
+enum {
+        CHANNEL_MODE_LEGACY = 0,
+        CHANNEL_MODE_PURE_40 = 1,
+        CHANNEL_MODE_MIXED = 2,
+        CHANNEL_MODE_RESERVED = 3,
+};
+#define RXON_FLG_CHANNEL_MODE_LEGACY    cpu_to_le32(CHANNEL_MODE_LEGACY << RXON_FLG_CHANNEL_MODE_POS)
+#define RXON_FLG_CHANNEL_MODE_PURE_40   cpu_to_le32(CHANNEL_MODE_PURE_40 << RXON_FLG_CHANNEL_MODE_POS)
+#define RXON_FLG_CHANNEL_MODE_MIXED     cpu_to_le32(CHANNEL_MODE_MIXED << RXON_FLG_CHANNEL_MODE_POS)
+
 /* CTS to self (if spec allows) flag */
 #define RXON_FLG_SELF_CTS_EN                    cpu_to_le32(0x1<<30)
 
@@ -1057,7 +1067,7 @@ struct iwl_addsta_cmd {
          * Set modify_mask bit STA_MODIFY_TID_DISABLE_TX to use this field. */
         __le16 tid_disable_tx;
 
-        __le16  reserved1;
+        __le16  rate_n_flags;           /* 3945 only */
 
         /* TID for which to add block-ack support.
          * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
@@ -1903,6 +1913,18 @@ struct iwl_link_qual_general_params {
         u8 start_rate_index[LINK_QUAL_AC_NUM];
 } __attribute__ ((packed));
 
+#define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
+#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (65535)
+#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (0)
+
+#define LINK_QUAL_AGG_DISABLE_START_DEF (3)
+#define LINK_QUAL_AGG_DISABLE_START_MAX (255)
+#define LINK_QUAL_AGG_DISABLE_START_MIN (0)
+
+#define LINK_QUAL_AGG_FRAME_LIMIT_DEF   (31)
+#define LINK_QUAL_AGG_FRAME_LIMIT_MAX   (64)
+#define LINK_QUAL_AGG_FRAME_LIMIT_MIN   (0)
+
 /**
  * struct iwl_link_qual_agg_params
  *
@@ -2469,11 +2491,12 @@ struct iwl_ssid_ie {
         u8 ssid[32];
 } __attribute__ ((packed));
 
-#define PROBE_OPTION_MAX_API1           0x4
-#define PROBE_OPTION_MAX                0x14
+#define PROBE_OPTION_MAX_3945           4
+#define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
 #define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
 #define IWL_MAX_SCAN_SIZE 1024
+#define IWL_MAX_PROBE_REQUEST           200
 
 /*
  * REPLY_SCAN_CMD = 0x80 (command)
@@ -2552,7 +2575,7 @@ struct iwl3945_scan_cmd {
         struct iwl3945_tx_cmd tx_cmd;
 
         /* For directed active scans (set to all-0s otherwise) */
-        struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX_API1];
+        struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX_3945];
 
         /*
          * Probe request frame, followed by channel list.
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index c54fb93e9d72..f9d16ca5b3d9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -36,9 +36,9 @@
 #include "iwl-debug.h"
 #include "iwl-core.h"
 #include "iwl-io.h"
-#include "iwl-rfkill.h"
 #include "iwl-power.h"
 #include "iwl-sta.h"
+#include "iwl-helpers.h"
 
 
 MODULE_DESCRIPTION("iwl core");
@@ -59,6 +59,8 @@ MODULE_LICENSE("GPL");
                                     IWL_RATE_##pp##M_INDEX,    \
                                     IWL_RATE_##np##M_INDEX }
 
+static irqreturn_t iwl_isr(int irq, void *data);
+
 /*
  * Parameter order:
  *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
@@ -273,6 +275,14 @@ void iwl_activate_qos(struct iwl_priv *priv, u8 force)
 }
 EXPORT_SYMBOL(iwl_activate_qos);
 
+/*
+ * AC        CWmin         CW max      AIFSN      TXOP Limit    TXOP Limit
+ *                                              (802.11b)      (802.11a/g)
+ * AC_BK      15            1023        7           0               0
+ * AC_BE      15            1023        3           0               0
+ * AC_VI       7              15        2          6.016ms       3.008ms
+ * AC_VO       3               7        2          3.264ms       1.504ms
+ */
 void iwl_reset_qos(struct iwl_priv *priv)
 {
         u16 cw_min = 15;
@@ -304,6 +314,7 @@ void iwl_reset_qos(struct iwl_priv *priv)
         if (priv->qos_data.qos_active)
                 aifs = 3;
 
+        /* AC_BE */
         priv->qos_data.def_qos_parm.ac[0].cw_min = cpu_to_le16(cw_min);
         priv->qos_data.def_qos_parm.ac[0].cw_max = cpu_to_le16(cw_max);
         priv->qos_data.def_qos_parm.ac[0].aifsn = aifs;
@@ -311,6 +322,7 @@ void iwl_reset_qos(struct iwl_priv *priv)
         priv->qos_data.def_qos_parm.ac[0].reserved1 = 0;
 
         if (priv->qos_data.qos_active) {
+                /* AC_BK */
                 i = 1;
                 priv->qos_data.def_qos_parm.ac[i].cw_min = cpu_to_le16(cw_min);
                 priv->qos_data.def_qos_parm.ac[i].cw_max = cpu_to_le16(cw_max);
@@ -318,11 +330,12 @@ void iwl_reset_qos(struct iwl_priv *priv)
                 priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
 
+                /* AC_VI */
                 i = 2;
                 priv->qos_data.def_qos_parm.ac[i].cw_min =
                         cpu_to_le16((cw_min + 1) / 2 - 1);
                 priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16(cw_max);
+                        cpu_to_le16(cw_min);
                 priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
                 if (is_legacy)
                         priv->qos_data.def_qos_parm.ac[i].edca_txop =
@@ -332,11 +345,12 @@ void iwl_reset_qos(struct iwl_priv *priv)
                                 cpu_to_le16(3008);
                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
 
+                /* AC_VO */
                 i = 3;
                 priv->qos_data.def_qos_parm.ac[i].cw_min =
                         cpu_to_le16((cw_min + 1) / 4 - 1);
                 priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16((cw_max + 1) / 2 - 1);
+                        cpu_to_le16((cw_min + 1) / 2 - 1);
                 priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
                 if (is_legacy)
@@ -591,10 +605,10 @@ static u8 iwl_is_channel_extension(struct iwl_priv *priv,
 
         if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
                 return !(ch_info->fat_extension_channel &
-                                        IEEE80211_CHAN_NO_FAT_ABOVE);
+                                        IEEE80211_CHAN_NO_HT40PLUS);
         else if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_BELOW)
                 return !(ch_info->fat_extension_channel &
-                                        IEEE80211_CHAN_NO_FAT_BELOW);
+                                        IEEE80211_CHAN_NO_HT40MINUS);
 
         return 0;
 }
@@ -605,19 +619,23 @@ u8 iwl_is_fat_tx_allowed(struct iwl_priv *priv,
         struct iwl_ht_info *iwl_ht_conf = &priv->current_ht_config;
 
         if ((!iwl_ht_conf->is_ht) ||
-           (iwl_ht_conf->supported_chan_width != IWL_CHANNEL_WIDTH_40MHZ) ||
-           (iwl_ht_conf->extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_NONE))
+            (iwl_ht_conf->supported_chan_width != IWL_CHANNEL_WIDTH_40MHZ))
                 return 0;
 
+        /* We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
+         * the bit will not set if it is pure 40MHz case
+         */
         if (sta_ht_inf) {
-                if ((!sta_ht_inf->ht_supported) ||
-                   (!(sta_ht_inf->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)))
+                if (!sta_ht_inf->ht_supported)
                         return 0;
         }
 
-        return iwl_is_channel_extension(priv, priv->band,
-                                        le16_to_cpu(priv->staging_rxon.channel),
-                                        iwl_ht_conf->extension_chan_offset);
+        if (iwl_ht_conf->ht_protection & IEEE80211_HT_OP_MODE_PROTECTION_20MHZ)
+                return 1;
+        else
+                return iwl_is_channel_extension(priv, priv->band,
+                                le16_to_cpu(priv->staging_rxon.channel),
+                                iwl_ht_conf->extension_chan_offset);
 }
 EXPORT_SYMBOL(iwl_is_fat_tx_allowed);
 
@@ -735,6 +753,8 @@ int iwl_full_rxon_required(struct iwl_priv *priv)
              priv->active_rxon.ofdm_ht_single_stream_basic_rates) ||
             (priv->staging_rxon.ofdm_ht_dual_stream_basic_rates !=
              priv->active_rxon.ofdm_ht_dual_stream_basic_rates) ||
+            (priv->staging_rxon.ofdm_ht_triple_stream_basic_rates !=
+             priv->active_rxon.ofdm_ht_triple_stream_basic_rates) ||
             (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
                 return 1;
 
@@ -785,43 +805,53 @@ EXPORT_SYMBOL(iwl_rate_get_lowest_plcp);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
 {
         struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
-        u32 val;
 
         if (!ht_info->is_ht) {
-                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED_MSK |
-                        RXON_FLG_CHANNEL_MODE_PURE_40_MSK |
+                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
                         RXON_FLG_FAT_PROT_MSK |
                         RXON_FLG_HT_PROT_MSK);
                 return;
         }
 
-        /* Set up channel bandwidth:  20 MHz only, or 20/40 mixed if fat ok */
-        if (iwl_is_fat_tx_allowed(priv, NULL))
-                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED_MSK;
-        else
-                rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED_MSK |
-                                 RXON_FLG_CHANNEL_MODE_PURE_40_MSK);
-
-        /* Note: control channel is opposite of extension channel */
-        switch (ht_info->extension_chan_offset) {
-        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                rxon->flags &= ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-        default:
-                rxon->flags &= ~RXON_FLG_CHANNEL_MODE_MIXED_MSK;
-                break;
+        /* FIXME: if the definition of ht_protection changed, the "translation"
+         * will be needed for rxon->flags
+         */
+        rxon->flags |= cpu_to_le32(ht_info->ht_protection << RXON_FLG_HT_OPERATING_MODE_POS);
+
+        /* Set up channel bandwidth:
+         * 20 MHz only, 20/40 mixed or pure 40 if fat ok */
+        /* clear the HT channel mode before set the mode */
+        rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
+                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
+        if (iwl_is_fat_tx_allowed(priv, NULL)) {
+                /* pure 40 fat */
+                if (rxon->flags & RXON_FLG_FAT_PROT_MSK)
+                        rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
+                else {
+                        /* Note: control channel is opposite of extension channel */
+                        switch (ht_info->extension_chan_offset) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                rxon->flags &= ~(RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
+                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
+                                rxon->flags |= RXON_FLG_CHANNEL_MODE_MIXED;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
+                        default:
+                                /* channel location only valid if in Mixed mode */
+                                IWL_ERR(priv, "invalid extension channel offset\n");
+                                break;
+                        }
+                }
+        } else {
+                rxon->flags |= RXON_FLG_CHANNEL_MODE_LEGACY;
         }
 
-        val = ht_info->ht_protection;
-
-        rxon->flags |= cpu_to_le32(val << RXON_FLG_HT_OPERATING_MODE_POS);
-
-        iwl_set_rxon_chain(priv);
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
         IWL_DEBUG_ASSOC(priv, "supported HT rate 0x%X 0x%X 0x%X "
                         "rxon flags 0x%X operation mode :0x%X "
@@ -901,10 +931,11 @@ static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
  * never called for monitor mode. The only way mac80211 informs us about
  * monitor mode is through configuring filters (call to configure_filter).
  */
-static bool iwl_is_monitor_mode(struct iwl_priv *priv)
+bool iwl_is_monitor_mode(struct iwl_priv *priv)
 {
         return !!(priv->staging_rxon.filter_flags & RXON_FILTER_PROMISC_MSK);
 }
+EXPORT_SYMBOL(iwl_is_monitor_mode);
 
 /**
  * iwl_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
@@ -956,10 +987,10 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
         if (iwl_is_monitor_mode(priv) &&
             !(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) &&
             ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)) {
-                rx_chain = 0x07 << RXON_RX_CHAIN_VALID_POS;
-                rx_chain |= 0x06 << RXON_RX_CHAIN_FORCE_SEL_POS;
-                rx_chain |= 0x07 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
-                rx_chain |= 0x01 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
+                rx_chain = ANT_ABC << RXON_RX_CHAIN_VALID_POS;
+                rx_chain |= ANT_BC << RXON_RX_CHAIN_FORCE_SEL_POS;
+                rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
+                rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
         }
 
         priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
@@ -1068,11 +1099,6 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
                                                   RXON_FILTER_ACCEPT_GRP_MSK;
                 break;
 
-        case NL80211_IFTYPE_MONITOR:
-                priv->staging_rxon.dev_type = RXON_DEV_TYPE_SNIFFER;
-                priv->staging_rxon.filter_flags = RXON_FILTER_PROMISC_MSK |
-                    RXON_FILTER_CTL2HOST_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
-                break;
         default:
                 IWL_ERR(priv, "Unsupported interface type %d\n", mode);
                 break;
@@ -1111,16 +1137,18 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
         priv->staging_rxon.cck_basic_rates =
             (IWL_CCK_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
 
-        priv->staging_rxon.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED_MSK |
-                                        RXON_FLG_CHANNEL_MODE_PURE_40_MSK);
+        /* clear both MIX and PURE40 mode flag */
+        priv->staging_rxon.flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED |
+                                        RXON_FLG_CHANNEL_MODE_PURE_40);
         memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
         memcpy(priv->staging_rxon.wlap_bssid_addr, priv->mac_addr, ETH_ALEN);
         priv->staging_rxon.ofdm_ht_single_stream_basic_rates = 0xff;
         priv->staging_rxon.ofdm_ht_dual_stream_basic_rates = 0xff;
+        priv->staging_rxon.ofdm_ht_triple_stream_basic_rates = 0xff;
 }
 EXPORT_SYMBOL(iwl_connection_init_rx_config);
 
-void iwl_set_rate(struct iwl_priv *priv)
+static void iwl_set_rate(struct iwl_priv *priv)
 {
         const struct ieee80211_supported_band *hw = NULL;
         struct ieee80211_rate *rate;
@@ -1166,7 +1194,6 @@ void iwl_set_rate(struct iwl_priv *priv)
                 priv->staging_rxon.ofdm_basic_rates =
                    (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
 }
-EXPORT_SYMBOL(iwl_set_rate);
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
@@ -1230,11 +1257,6 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
                 IWL_DEBUG(priv, IWL_DL_FW_ERRORS,
                           "Restarting adapter due to uCode error.\n");
 
-                if (iwl_is_associated(priv)) {
-                        memcpy(&priv->recovery_rxon, &priv->active_rxon,
-                               sizeof(priv->recovery_rxon));
-                        priv->error_recovering = 1;
-                }
                 if (priv->cfg->mod_params->restart_fw)
                         queue_work(priv->workqueue, &priv->restart);
         }
@@ -1298,19 +1320,20 @@ int iwl_setup_mac(struct iwl_priv *priv)
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS;
+                    IEEE80211_HW_SPECTRUM_MGMT;
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
 
         hw->wiphy->custom_regulatory = true;
-        hw->wiphy->max_scan_ssids = 1;
+
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        /* we create the 802.11 header and a zero-length SSID element */
+        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
 
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 
-        hw->conf.beacon_int = 100;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 
         if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
@@ -1357,7 +1380,6 @@ int iwl_init_drv(struct iwl_priv *priv)
         priv->ibss_beacon = NULL;
 
         spin_lock_init(&priv->lock);
-        spin_lock_init(&priv->power_data.lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -1378,7 +1400,9 @@ int iwl_init_drv(struct iwl_priv *priv)
         priv->current_ht_config.sm_ps = WLAN_HT_CAP_SM_PS_DISABLED;
 
         /* Choose which receivers/antennas to use */
-        iwl_set_rxon_chain(priv);
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
         iwl_init_scan_params(priv);
 
         iwl_reset_qos(priv);
@@ -1475,11 +1499,273 @@ void iwl_enable_interrupts(struct iwl_priv *priv)
 {
         IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
         set_bit(STATUS_INT_ENABLED, &priv->status);
-        iwl_write32(priv, CSR_INT_MASK, CSR_INI_SET_MASK);
+        iwl_write32(priv, CSR_INT_MASK, priv->inta_mask);
 }
 EXPORT_SYMBOL(iwl_enable_interrupts);
 
-irqreturn_t iwl_isr(int irq, void *data)
+
+#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
+
+/* Free dram table */
+void iwl_free_isr_ict(struct iwl_priv *priv)
+{
+        if (priv->ict_tbl_vir) {
+                pci_free_consistent(priv->pci_dev, (sizeof(u32) * ICT_COUNT) +
+                                        PAGE_SIZE, priv->ict_tbl_vir,
+                                        priv->ict_tbl_dma);
+                priv->ict_tbl_vir = NULL;
+        }
+}
+EXPORT_SYMBOL(iwl_free_isr_ict);
+
+
+/* allocate dram shared table it is a PAGE_SIZE aligned
+ * also reset all data related to ICT table interrupt.
+ */
+int iwl_alloc_isr_ict(struct iwl_priv *priv)
+{
+
+        if (priv->cfg->use_isr_legacy)
+                return 0;
+        /* allocate shrared data table */
+        priv->ict_tbl_vir = pci_alloc_consistent(priv->pci_dev, (sizeof(u32) *
+                                                  ICT_COUNT) + PAGE_SIZE,
+                                                  &priv->ict_tbl_dma);
+        if (!priv->ict_tbl_vir)
+                return -ENOMEM;
+
+        /* align table to PAGE_SIZE boundry */
+        priv->aligned_ict_tbl_dma = ALIGN(priv->ict_tbl_dma, PAGE_SIZE);
+
+        IWL_DEBUG_ISR(priv, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+                             (unsigned long long)priv->ict_tbl_dma,
+                             (unsigned long long)priv->aligned_ict_tbl_dma,
+                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
+
+        priv->ict_tbl =  priv->ict_tbl_vir +
+                          (priv->aligned_ict_tbl_dma - priv->ict_tbl_dma);
+
+        IWL_DEBUG_ISR(priv, "ict vir addr %p vir aligned %p diff %d\n",
+                             priv->ict_tbl, priv->ict_tbl_vir,
+                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
+
+        /* reset table and index to all 0 */
+        memset(priv->ict_tbl_vir,0, (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
+        priv->ict_index = 0;
+
+        /* add periodic RX interrupt */
+        priv->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
+        return 0;
+}
+EXPORT_SYMBOL(iwl_alloc_isr_ict);
+
+/* Device is going up inform it about using ICT interrupt table,
+ * also we need to tell the driver to start using ICT interrupt.
+ */
+int iwl_reset_ict(struct iwl_priv *priv)
+{
+        u32 val;
+        unsigned long flags;
+
+        if (!priv->ict_tbl_vir)
+                return 0;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwl_disable_interrupts(priv);
+
+        memset(&priv->ict_tbl[0],0, sizeof(u32) * ICT_COUNT);
+
+        val = priv->aligned_ict_tbl_dma >> PAGE_SHIFT;
+
+        val |= CSR_DRAM_INT_TBL_ENABLE;
+        val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+
+        IWL_DEBUG_ISR(priv, "CSR_DRAM_INT_TBL_REG =0x%X "
+                        "aligned dma address %Lx\n",
+                        val, (unsigned long long)priv->aligned_ict_tbl_dma);
+
+        iwl_write32(priv, CSR_DRAM_INT_TBL_REG, val);
+        priv->use_ict = true;
+        priv->ict_index = 0;
+        iwl_write32(priv, CSR_INT, priv->inta_mask);
+        iwl_enable_interrupts(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+EXPORT_SYMBOL(iwl_reset_ict);
+
+/* Device is going down disable ict interrupt usage */
+void iwl_disable_ict(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->use_ict = false;
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+EXPORT_SYMBOL(iwl_disable_ict);
+
+/* interrupt handler using ict table, with this interrupt driver will
+ * stop using INTA register to get device's interrupt, reading this register
+ * is expensive, device will write interrupts in ICT dram table, increment
+ * index then will fire interrupt to driver, driver will OR all ICT table
+ * entries from current index up to table entry with 0 value. the result is
+ * the interrupt we need to service, driver will set the entries back to 0 and
+ * set index.
+ */
+irqreturn_t iwl_isr_ict(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        u32 val = 0;
+
+        if (!priv)
+                return IRQ_NONE;
+
+        /* dram interrupt table not set yet,
+         * use legacy interrupt.
+         */
+        if (!priv->use_ict)
+                return iwl_isr(irq, data);
+
+        spin_lock(&priv->lock);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         * back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here.
+         */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!priv->ict_tbl[priv->ict_index]) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        /* read all entries that not 0 start with ict_index */
+        while (priv->ict_tbl[priv->ict_index]) {
+
+                val |= priv->ict_tbl[priv->ict_index];
+                IWL_DEBUG_ISR(priv, "ICT index %d value 0x%08X\n",
+                                        priv->ict_index,
+                                        priv->ict_tbl[priv->ict_index]);
+                priv->ict_tbl[priv->ict_index] = 0;
+                priv->ict_index = iwl_queue_inc_wrap(priv->ict_index,
+                                                                ICT_COUNT);
+
+        }
+
+        /* We should not get this value, just ignore it. */
+        if (val == 0xffffffff)
+                val = 0;
+
+        inta = (0xff & val) | ((0xff00 & val) << 16);
+        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
+                        inta, inta_mask, val);
+
+        inta &= priv->inta_mask;
+        priv->inta |= inta;
+
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta) {
+                /* Allow interrupt if was disabled by this handler and
+                 * no tasklet was schedules, We should not enable interrupt,
+                 * tasklet will enable it.
+                 */
+                iwl_enable_interrupts(priv);
+        }
+
+        spin_unlock(&priv->lock);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service.
+         * only Re-enable if disabled by irq.
+         */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock(&priv->lock);
+        return IRQ_NONE;
+}
+EXPORT_SYMBOL(iwl_isr_ict);
+
+
+static irqreturn_t iwl_isr(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        u32 inta_fh;
+#endif
+        if (!priv)
+                return IRQ_NONE;
+
+        spin_lock(&priv->lock);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         *    back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here. */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(priv, CSR_INT);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!inta) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /* Hardware disappeared. It might have already raised
+                 * an interrupt */
+                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                goto unplugged;
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (priv->debug_level & (IWL_DL_ISR)) {
+                inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
+                IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
+                              "fh 0x%08x\n", inta, inta_mask, inta_fh);
+        }
+#endif
+
+        priv->inta |= inta;
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
+                iwl_enable_interrupts(priv);
+
+ unplugged:
+        spin_unlock(&priv->lock);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service. */
+        /* only Re-enable if diabled by irq  and no schedules tasklet. */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock(&priv->lock);
+        return IRQ_NONE;
+}
+
+irqreturn_t iwl_isr_legacy(int irq, void *data)
 {
         struct iwl_priv *priv = data;
         u32 inta, inta_mask;
@@ -1536,7 +1822,7 @@ irqreturn_t iwl_isr(int irq, void *data)
         spin_unlock(&priv->lock);
         return IRQ_NONE;
 }
-EXPORT_SYMBOL(iwl_isr);
+EXPORT_SYMBOL(iwl_isr_legacy);
 
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
@@ -1580,10 +1866,6 @@ static int iwlcore_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32
 
         IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         for (i = 0; i < len; i += 100, image += 100/sizeof(u32)) {
                 /* read data comes through single port, auto-incr addr */
                 /* NOTE: Use the debugless read so we don't flood kernel log
@@ -1599,8 +1881,6 @@ static int iwlcore_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32
                 }
         }
 
-        iwl_release_nic_access(priv);
-
         return ret;
 }
 
@@ -1618,10 +1898,6 @@ static int iwl_verify_inst_full(struct iwl_priv *priv, __le32 *image,
 
         IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret)
-                return ret;
-
         iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
                            IWL49_RTC_INST_LOWER_BOUND);
 
@@ -1642,8 +1918,6 @@ static int iwl_verify_inst_full(struct iwl_priv *priv, __le32 *image,
                 }
         }
 
-        iwl_release_nic_access(priv);
-
         if (!errcnt)
                 IWL_DEBUG_INFO(priv,
                     "ucode image in INSTRUCTION memory is good\n");
@@ -1752,7 +2026,6 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         u32 data2, line;
         u32 desc, time, count, base, data1;
         u32 blink1, blink2, ilink1, ilink2;
-        int ret;
 
         if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
@@ -1764,12 +2037,6 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
                 return;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                IWL_WARN(priv, "Can not read from adapter at this time.\n");
-                return;
-        }
-
         count = iwl_read_targ_mem(priv, base);
 
         if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
@@ -1796,7 +2063,6 @@ void iwl_dump_nic_error_log(struct iwl_priv *priv)
         IWL_ERR(priv, "0x%05X 0x%05X 0x%05X 0x%05X\n", blink1, blink2,
                 ilink1, ilink2);
 
-        iwl_release_nic_access(priv);
 }
 EXPORT_SYMBOL(iwl_dump_nic_error_log);
 
@@ -1805,7 +2071,6 @@ EXPORT_SYMBOL(iwl_dump_nic_error_log);
 /**
  * iwl_print_event_log - Dump error event log to syslog
  *
- * NOTE: Must be called with iwl_grab_nic_access() already obtained!
  */
 static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
                                 u32 num_events, u32 mode)
@@ -1851,7 +2116,6 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
 void iwl_dump_nic_event_log(struct iwl_priv *priv)
 {
-        int ret;
         u32 base;       /* SRAM byte address of event log header */
         u32 capacity;   /* event log capacity in # entries */
         u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
@@ -1869,12 +2133,6 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
                 return;
         }
 
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                IWL_WARN(priv, "Can not read from adapter at this time.\n");
-                return;
-        }
-
         /* event log header */
         capacity = iwl_read_targ_mem(priv, base);
         mode = iwl_read_targ_mem(priv, base + (1 * sizeof(u32)));
@@ -1886,7 +2144,6 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
         /* bail out if nothing in log */
         if (size == 0) {
                 IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                iwl_release_nic_access(priv);
                 return;
         }
 
@@ -1901,7 +2158,6 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
         /* (then/else) start at top of log */
         iwl_print_event_log(priv, 0, next_entry, mode);
 
-        iwl_release_nic_access(priv);
 }
 EXPORT_SYMBOL(iwl_dump_nic_event_log);
 
@@ -1954,161 +2210,680 @@ int iwl_send_card_state(struct iwl_priv *priv, u32 flags, u8 meta_flag)
 }
 EXPORT_SYMBOL(iwl_send_card_state);
 
-void iwl_radio_kill_sw_disable_radio(struct iwl_priv *priv)
+void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
+                           struct iwl_rx_mem_buffer *rxb)
 {
-        unsigned long flags;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
+        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
+                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
+#endif
+}
+EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
 
-        if (test_bit(STATUS_RF_KILL_SW, &priv->status))
-                return;
+void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
+                                      struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
+                        "notification for %s:\n",
+                        le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
+        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
+}
+EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
 
-        IWL_DEBUG_RF_KILL(priv, "Manual SW RF KILL set to: RADIO OFF\n");
+void iwl_rx_reply_error(struct iwl_priv *priv,
+                        struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 
-        iwl_scan_cancel(priv);
-        /* FIXME: This is a workaround for AP */
-        if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                spin_lock_irqsave(&priv->lock, flags);
-                iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
-                            CSR_UCODE_SW_BIT_RFKILL);
-                spin_unlock_irqrestore(&priv->lock, flags);
-                /* call the host command only if no hw rf-kill set */
-                if (!test_bit(STATUS_RF_KILL_HW, &priv->status) &&
-                    iwl_is_ready(priv))
-                        iwl_send_card_state(priv,
-                                CARD_STATE_CMD_DISABLE, 0);
-                set_bit(STATUS_RF_KILL_SW, &priv->status);
-                        /* make sure mac80211 stop sending Tx frame */
-                if (priv->mac80211_registered)
-                        ieee80211_stop_queues(priv->hw);
-        }
+        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
+                "seq 0x%04X ser 0x%08X\n",
+                le32_to_cpu(pkt->u.err_resp.error_type),
+                get_cmd_string(pkt->u.err_resp.cmd_id),
+                pkt->u.err_resp.cmd_id,
+                le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
+                le32_to_cpu(pkt->u.err_resp.error_info));
 }
-EXPORT_SYMBOL(iwl_radio_kill_sw_disable_radio);
+EXPORT_SYMBOL(iwl_rx_reply_error);
+
+void iwl_clear_isr_stats(struct iwl_priv *priv)
+{
+        memset(&priv->isr_stats, 0, sizeof(priv->isr_stats));
+}
+EXPORT_SYMBOL(iwl_clear_isr_stats);
 
-int iwl_radio_kill_sw_enable_radio(struct iwl_priv *priv)
+int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                           const struct ieee80211_tx_queue_params *params)
 {
+        struct iwl_priv *priv = hw->priv;
         unsigned long flags;
+        int q;
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
+                return -EIO;
+        }
 
-        if (!test_bit(STATUS_RF_KILL_SW, &priv->status))
+        if (queue >= AC_NUM) {
+                IWL_DEBUG_MAC80211(priv, "leave - queue >= AC_NUM %d\n", queue);
                 return 0;
+        }
 
-        IWL_DEBUG_RF_KILL(priv, "Manual SW RF KILL set to: RADIO ON\n");
+        q = AC_NUM - 1 - queue;
 
         spin_lock_irqsave(&priv->lock, flags);
-        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
 
-        /* If the driver is up it will receive CARD_STATE_NOTIFICATION
-         * notification where it will clear SW rfkill status.
-         * Setting it here would break the handler. Only if the
-         * interface is down we can set here since we don't
-         * receive any further notification.
-         */
-        if (!priv->is_open)
-                clear_bit(STATUS_RF_KILL_SW, &priv->status);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->qos_data.def_qos_parm.ac[q].cw_min = cpu_to_le16(params->cw_min);
+        priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
+        priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
+        priv->qos_data.def_qos_parm.ac[q].edca_txop =
+                        cpu_to_le16((params->txop * 32));
 
-        /* wake up ucode */
-        msleep(10);
+        priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
+        priv->qos_data.qos_active = 1;
+
+        if (priv->iw_mode == NL80211_IFTYPE_AP)
+                iwl_activate_qos(priv, 1);
+        else if (priv->assoc_id && iwl_is_associated(priv))
+                iwl_activate_qos(priv, 0);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_read32(priv, CSR_UCODE_DRV_GP1);
-        if (!iwl_grab_nic_access(priv))
-                iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (test_bit(STATUS_RF_KILL_HW, &priv->status)) {
-                IWL_DEBUG_RF_KILL(priv, "Can not turn radio back on - "
-                                  "disabled by HW switch\n");
-                return 0;
-        }
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        return 0;
+}
+EXPORT_SYMBOL(iwl_mac_conf_tx);
+
+static void iwl_ht_conf(struct iwl_priv *priv,
+                            struct ieee80211_bss_conf *bss_conf)
+{
+        struct ieee80211_sta_ht_cap *ht_conf;
+        struct iwl_ht_info *iwl_conf = &priv->current_ht_config;
+        struct ieee80211_sta *sta;
+
+        IWL_DEBUG_MAC80211(priv, "enter: \n");
+
+        if (!iwl_conf->is_ht)
+                return;
+
 
-        /* when driver is up while rfkill is on, it wont receive
-         * any CARD_STATE_NOTIFICATION notifications so we have to
-         * restart it in here
+        /*
+         * It is totally wrong to base global information on something
+         * that is valid only when associated, alas, this driver works
+         * that way and I don't know how to fix it.
          */
-        if (priv->is_open && !test_bit(STATUS_ALIVE, &priv->status)) {
-                clear_bit(STATUS_RF_KILL_SW, &priv->status);
-                if (!iwl_is_rfkill(priv))
-                        queue_work(priv->workqueue, &priv->up);
+
+        rcu_read_lock();
+        sta = ieee80211_find_sta(priv->hw, priv->bssid);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
         }
+        ht_conf = &sta->ht_cap;
+
+        if (ht_conf->cap & IEEE80211_HT_CAP_SGI_20)
+                iwl_conf->sgf |= HT_SHORT_GI_20MHZ;
+        if (ht_conf->cap & IEEE80211_HT_CAP_SGI_40)
+                iwl_conf->sgf |= HT_SHORT_GI_40MHZ;
 
-        /* If the driver is already loaded, it will receive
-         * CARD_STATE_NOTIFICATION notifications and the handler will
-         * call restart to reload the driver.
+        iwl_conf->is_green_field = !!(ht_conf->cap & IEEE80211_HT_CAP_GRN_FLD);
+        iwl_conf->max_amsdu_size =
+                !!(ht_conf->cap & IEEE80211_HT_CAP_MAX_AMSDU);
+
+        iwl_conf->supported_chan_width =
+                !!(ht_conf->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+
+        /*
+         * XXX: The HT configuration needs to be moved into iwl_mac_config()
+         *      to be done there correctly.
          */
-        return 1;
+
+        iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+        if (conf_is_ht40_minus(&priv->hw->conf))
+                iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        else if (conf_is_ht40_plus(&priv->hw->conf))
+                iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+
+        /* If no above or below channel supplied disable FAT channel */
+        if (iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_ABOVE &&
+            iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_BELOW)
+                iwl_conf->supported_chan_width = 0;
+
+        iwl_conf->sm_ps = (u8)((ht_conf->cap & IEEE80211_HT_CAP_SM_PS) >> 2);
+
+        memcpy(&iwl_conf->mcs, &ht_conf->mcs, 16);
+
+        iwl_conf->tx_chan_width = iwl_conf->supported_chan_width != 0;
+        iwl_conf->ht_protection =
+                bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
+        iwl_conf->non_GF_STA_present =
+                !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+
+        rcu_read_unlock();
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
 }
-EXPORT_SYMBOL(iwl_radio_kill_sw_enable_radio);
 
-void iwl_bg_rf_kill(struct work_struct *work)
+#define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
+void iwl_bss_info_changed(struct ieee80211_hw *hw,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_bss_conf *bss_conf,
+                          u32 changes)
 {
-        struct iwl_priv *priv = container_of(work, struct iwl_priv, rf_kill);
+        struct iwl_priv *priv = hw->priv;
+        int ret;
 
-        wake_up_interruptible(&priv->wait_command_queue);
+        IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
 
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+        if (!iwl_is_alive(priv))
                 return;
 
         mutex_lock(&priv->mutex);
 
-        if (!iwl_is_rfkill(priv)) {
-                IWL_DEBUG_RF_KILL(priv,
-                          "HW and/or SW RF Kill no longer active, restarting "
-                          "device\n");
-                if (!test_bit(STATUS_EXIT_PENDING, &priv->status) &&
-                    test_bit(STATUS_ALIVE, &priv->status))
-                        queue_work(priv->workqueue, &priv->restart);
-        } else {
-                /* make sure mac80211 stop sending Tx frame */
-                if (priv->mac80211_registered)
-                        ieee80211_stop_queues(priv->hw);
+        if (changes & BSS_CHANGED_BEACON &&
+            priv->iw_mode == NL80211_IFTYPE_AP) {
+                dev_kfree_skb(priv->ibss_beacon);
+                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
+        }
+
+        if ((changes & BSS_CHANGED_BSSID) && !iwl_is_rfkill(priv)) {
+                /* If there is currently a HW scan going on in the background
+                 * then we need to cancel it else the RXON below will fail. */
+                if (iwl_scan_cancel_timeout(priv, 100)) {
+                        IWL_WARN(priv, "Aborted scan still in progress "
+                                    "after 100ms\n");
+                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
+                        mutex_unlock(&priv->mutex);
+                        return;
+                }
+                memcpy(priv->staging_rxon.bssid_addr,
+                       bss_conf->bssid, ETH_ALEN);
+
+                /* TODO: Audit driver for usage of these members and see
+                 * if mac80211 deprecates them (priv->bssid looks like it
+                 * shouldn't be there, but I haven't scanned the IBSS code
+                 * to verify) - jpk */
+                memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+
+                if (priv->iw_mode == NL80211_IFTYPE_AP)
+                        iwlcore_config_ap(priv);
+                else {
+                        int rc = iwlcore_commit_rxon(priv);
+                        if ((priv->iw_mode == NL80211_IFTYPE_STATION) && rc)
+                                iwl_rxon_add_station(
+                                        priv, priv->active_rxon.bssid_addr, 1);
+                }
+        } else if (!iwl_is_rfkill(priv)) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv);
+        }
+
+        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+            changes & BSS_CHANGED_BEACON) {
+                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+
+                if (beacon)
+                        iwl_mac_beacon_update(hw, beacon);
+        }
 
-                if (!test_bit(STATUS_RF_KILL_HW, &priv->status))
-                        IWL_DEBUG_RF_KILL(priv, "Can not turn radio back on - "
-                                          "disabled by SW switch\n");
+        mutex_unlock(&priv->mutex);
+
+        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
+                IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
+                                   bss_conf->use_short_preamble);
+                if (bss_conf->use_short_preamble)
+                        priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
                 else
-                        IWL_WARN(priv, "Radio Frequency Kill Switch is On:\n"
-                                    "Kill switch must be turned off for "
-                                    "wireless networking to work.\n");
+                        priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+        }
+
+        if (changes & BSS_CHANGED_ERP_CTS_PROT) {
+                IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n", bss_conf->use_cts_prot);
+                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
+                        priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
+                else
+                        priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+        }
+
+        if (changes & BSS_CHANGED_HT) {
+                iwl_ht_conf(priv, bss_conf);
+
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv);
+        }
+
+        if (changes & BSS_CHANGED_ASSOC) {
+                IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
+                /* This should never happen as this function should
+                 * never be called from interrupt context. */
+                if (WARN_ON_ONCE(in_interrupt()))
+                        return;
+                if (bss_conf->assoc) {
+                        priv->assoc_id = bss_conf->aid;
+                        priv->beacon_int = bss_conf->beacon_int;
+                        priv->power_data.dtim_period = bss_conf->dtim_period;
+                        priv->timestamp = bss_conf->timestamp;
+                        priv->assoc_capability = bss_conf->assoc_capability;
+
+                        /* we have just associated, don't start scan too early
+                         * leave time for EAPOL exchange to complete
+                         */
+                        priv->next_scan_jiffies = jiffies +
+                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
+                        mutex_lock(&priv->mutex);
+                        priv->cfg->ops->lib->post_associate(priv);
+                        mutex_unlock(&priv->mutex);
+                } else {
+                        priv->assoc_id = 0;
+                        IWL_DEBUG_MAC80211(priv, "DISASSOC %d\n", bss_conf->assoc);
+                }
+        } else if (changes && iwl_is_associated(priv) && priv->assoc_id) {
+                        IWL_DEBUG_MAC80211(priv, "Associated Changes %d\n", changes);
+                        ret = iwl_send_rxon_assoc(priv);
+                        if (!ret)
+                                /* Sync active_rxon with latest change. */
+                                memcpy((void *)&priv->active_rxon,
+                                        &priv->staging_rxon,
+                                        sizeof(struct iwl_rxon_cmd));
+        }
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+}
+EXPORT_SYMBOL(iwl_bss_info_changed);
+
+int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct iwl_priv *priv = hw->priv;
+        unsigned long flags;
+        __le64 timestamp;
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
+                return -EIO;
+        }
+
+        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
+                IWL_DEBUG_MAC80211(priv, "leave - not IBSS\n");
+                return -EIO;
+        }
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        if (priv->ibss_beacon)
+                dev_kfree_skb(priv->ibss_beacon);
+
+        priv->ibss_beacon = skb;
+
+        priv->assoc_id = 0;
+        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
+        priv->timestamp = le64_to_cpu(timestamp);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        iwl_reset_qos(priv);
+
+        priv->cfg->ops->lib->post_associate(priv);
+
+
+        return 0;
+}
+EXPORT_SYMBOL(iwl_mac_beacon_update);
+
+int iwl_set_mode(struct iwl_priv *priv, int mode)
+{
+        if (mode == NL80211_IFTYPE_ADHOC) {
+                const struct iwl_channel_info *ch_info;
+
+                ch_info = iwl_get_channel_info(priv,
+                        priv->band,
+                        le16_to_cpu(priv->staging_rxon.channel));
+
+                if (!ch_info || !is_channel_ibss(ch_info)) {
+                        IWL_ERR(priv, "channel %d not IBSS channel\n",
+                                  le16_to_cpu(priv->staging_rxon.channel));
+                        return -EINVAL;
+                }
+        }
+
+        iwl_connection_init_rx_config(priv, mode);
+
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
+        memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
+
+        iwl_clear_stations_table(priv);
+
+        /* dont commit rxon if rf-kill is on*/
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
+
+        iwlcore_commit_rxon(priv);
+
+        return 0;
+}
+EXPORT_SYMBOL(iwl_set_mode);
+
+int iwl_mac_add_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_if_init_conf *conf)
+{
+        struct iwl_priv *priv = hw->priv;
+        unsigned long flags;
+
+        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
+
+        if (priv->vif) {
+                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
+                return -EOPNOTSUPP;
         }
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->vif = conf->vif;
+        priv->iw_mode = conf->type;
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        mutex_lock(&priv->mutex);
+
+        if (conf->mac_addr) {
+                IWL_DEBUG_MAC80211(priv, "Set %pM\n", conf->mac_addr);
+                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        }
+
+        if (iwl_set_mode(priv, conf->type) == -EAGAIN)
+                /* we are not ready, will run again when ready */
+                set_bit(STATUS_MODE_PENDING, &priv->status);
+
         mutex_unlock(&priv->mutex);
-        iwl_rfkill_set_hw_state(priv);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        return 0;
 }
-EXPORT_SYMBOL(iwl_bg_rf_kill);
+EXPORT_SYMBOL(iwl_mac_add_interface);
 
-void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
-                           struct iwl_rx_mem_buffer *rxb)
+void iwl_mac_remove_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_if_init_conf *conf)
 {
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
-        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
-                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
-#endif
+        struct iwl_priv *priv = hw->priv;
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        mutex_lock(&priv->mutex);
+
+        if (iwl_is_ready_rf(priv)) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv);
+        }
+        if (priv->vif == conf->vif) {
+                priv->vif = NULL;
+                memset(priv->bssid, 0, ETH_ALEN);
+        }
+        mutex_unlock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+
 }
-EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
+EXPORT_SYMBOL(iwl_mac_remove_interface);
 
-void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
-                                      struct iwl_rx_mem_buffer *rxb)
+/**
+ * iwl_mac_config - mac80211 config callback
+ *
+ * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
+ * be set inappropriately and the driver currently sets the hardware up to
+ * use it whenever needed.
+ */
+int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
-                        "notification for %s:\n",
-                        le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
-        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
+        struct iwl_priv *priv = hw->priv;
+        const struct iwl_channel_info *ch_info;
+        struct ieee80211_conf *conf = &hw->conf;
+        unsigned long flags = 0;
+        int ret = 0;
+        u16 ch;
+        int scan_active = 0;
+
+        mutex_lock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
+                                        conf->channel->hw_value, changed);
+
+        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
+                        test_bit(STATUS_SCANNING, &priv->status))) {
+                scan_active = 1;
+                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+        }
+
+
+        /* during scanning mac80211 will delay channel setting until
+         * scan finish with changed = 0
+         */
+        if (!changed || (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
+                if (scan_active)
+                        goto set_ch_out;
+
+                ch = ieee80211_frequency_to_channel(conf->channel->center_freq);
+                ch_info = iwl_get_channel_info(priv, conf->channel->band, ch);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
+
+                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+                        !is_channel_ibss(ch_info)) {
+                        IWL_ERR(priv, "channel %d in band %d not "
+                                "IBSS channel\n",
+                                conf->channel->hw_value, conf->channel->band);
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
+
+                priv->current_ht_config.is_ht = conf_is_ht(conf);
+
+                spin_lock_irqsave(&priv->lock, flags);
+
+
+                /* if we are switching from ht to 2.4 clear flags
+                 * from any ht related info since 2.4 does not
+                 * support ht */
+                if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
+                        priv->staging_rxon.flags = 0;
+
+                iwl_set_rxon_channel(priv, conf->channel);
+
+                iwl_set_flags_for_band(priv, conf->channel->band);
+                spin_unlock_irqrestore(&priv->lock, flags);
+ set_ch_out:
+                /* The list of supported rates and rate mask can be different
+                 * for each band; since the band may have changed, reset
+                 * the rate mask to what mac80211 lists */
+                iwl_set_rate(priv);
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_PS &&
+            priv->iw_mode == NL80211_IFTYPE_STATION) {
+                priv->power_data.power_disabled =
+                        !(conf->flags & IEEE80211_CONF_PS);
+                ret = iwl_power_update_mode(priv, 0);
+                if (ret)
+                        IWL_DEBUG_MAC80211(priv, "Error setting power level\n");
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
+                        priv->tx_power_user_lmt, conf->power_level);
+
+                iwl_set_tx_power(priv, conf->power_level, false);
+        }
+
+        /* call to ensure that 4965 rx_chain is set properly in monitor mode */
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv);
+
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
+                goto out;
+        }
+
+        if (scan_active)
+                goto out;
+
+        if (memcmp(&priv->active_rxon,
+                   &priv->staging_rxon, sizeof(priv->staging_rxon)))
+                iwlcore_commit_rxon(priv);
+        else
+                IWL_DEBUG_INFO(priv, "Not re-sending same RXON configuration.\n");
+
+
+out:
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        mutex_unlock(&priv->mutex);
+        return ret;
 }
-EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
+EXPORT_SYMBOL(iwl_mac_config);
 
-void iwl_rx_reply_error(struct iwl_priv *priv,
-                        struct iwl_rx_mem_buffer *rxb)
+int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_queue_stats *stats)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_priv *priv = hw->priv;
+        int i, avail;
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+        unsigned long flags;
 
-        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
-                "seq 0x%04X ser 0x%08X\n",
-                le32_to_cpu(pkt->u.err_resp.error_type),
-                get_cmd_string(pkt->u.err_resp.cmd_id),
-                pkt->u.err_resp.cmd_id,
-                le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
-                le32_to_cpu(pkt->u.err_resp.error_info));
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
+                return -EIO;
+        }
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        for (i = 0; i < AC_NUM; i++) {
+                txq = &priv->txq[i];
+                q = &txq->q;
+                avail = iwl_queue_space(q);
+
+                stats[i].len = q->n_window - avail;
+                stats[i].limit = q->n_window - q->high_mark;
+                stats[i].count = q->n_window;
+
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+
+        return 0;
 }
-EXPORT_SYMBOL(iwl_rx_reply_error);
+EXPORT_SYMBOL(iwl_mac_get_tx_stats);
+
+void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
+{
+        struct iwl_priv *priv = hw->priv;
+        unsigned long flags;
+
+        mutex_lock(&priv->mutex);
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        spin_lock_irqsave(&priv->lock, flags);
+        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_info));
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        iwl_reset_qos(priv);
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->assoc_id = 0;
+        priv->assoc_capability = 0;
+        priv->assoc_station_added = 0;
+
+        /* new association get rid of ibss beacon skb */
+        if (priv->ibss_beacon)
+                dev_kfree_skb(priv->ibss_beacon);
+
+        priv->ibss_beacon = NULL;
+
+        priv->beacon_int = priv->vif->bss_conf.beacon_int;
+        priv->timestamp = 0;
+        if ((priv->iw_mode == NL80211_IFTYPE_STATION))
+                priv->beacon_int = 0;
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
+        /* we are restarting association process
+         * clear RXON_FILTER_ASSOC_MSK bit
+         */
+        if (priv->iw_mode != NL80211_IFTYPE_AP) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv);
+        }
+
+        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
+                IWL_DEBUG_MAC80211(priv, "leave - not in IBSS\n");
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
+        iwl_set_rate(priv);
+
+        mutex_unlock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+}
+EXPORT_SYMBOL(iwl_mac_reset_tsf);
+
+#ifdef CONFIG_PM
+
+int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct iwl_priv *priv = pci_get_drvdata(pdev);
+
+        /*
+         * This function is called when system goes into suspend state
+         * mac80211 will call iwl_mac_stop() from the mac80211 suspend function
+         * first but since iwl_mac_stop() has no knowledge of who the caller is,
+         * it will not call apm_ops.stop() to stop the DMA operation.
+         * Calling apm_ops.stop here to make sure we stop the DMA.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
+        pci_save_state(pdev);
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+
+        return 0;
+}
+EXPORT_SYMBOL(iwl_pci_suspend);
+
+int iwl_pci_resume(struct pci_dev *pdev)
+{
+        struct iwl_priv *priv = pci_get_drvdata(pdev);
+        int ret;
+
+        pci_set_power_state(pdev, PCI_D0);
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+        pci_restore_state(pdev);
+        iwl_enable_interrupts(priv);
+
+        return 0;
+}
+EXPORT_SYMBOL(iwl_pci_resume);
 
+#endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index a8eac8c3c1fa..dabf663e36e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -85,7 +85,10 @@ struct iwl_cmd;
 
 struct iwl_hcmd_ops {
         int (*rxon_assoc)(struct iwl_priv *priv);
+        int (*commit_rxon)(struct iwl_priv *priv);
+        void (*set_rxon_chain)(struct iwl_priv *priv);
 };
+
 struct iwl_hcmd_utils_ops {
         u16 (*get_hcmd_size)(u8 cmd_id, u16 len);
         u16 (*build_addsta_hcmd)(const struct iwl_addsta_cmd *cmd, u8 *data);
@@ -100,6 +103,19 @@ struct iwl_hcmd_utils_ops {
                           struct iwl_rx_phy_res *rx_resp);
 };
 
+struct iwl_apm_ops {
+        int (*init)(struct iwl_priv *priv);
+        int (*reset)(struct iwl_priv *priv);
+        void (*stop)(struct iwl_priv *priv);
+        void (*config)(struct iwl_priv *priv);
+        int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
+};
+
+struct iwl_temp_ops {
+        void (*temperature)(struct iwl_priv *priv);
+        void (*set_ct_kill)(struct iwl_priv *priv);
+};
+
 struct iwl_lib_ops {
         /* set hw dependent parameters */
         int (*set_hw_params)(struct iwl_priv *priv);
@@ -137,20 +153,21 @@ struct iwl_lib_ops {
         int (*is_valid_rtc_data_addr)(u32 addr);
         /* 1st ucode load */
         int (*load_ucode)(struct iwl_priv *priv);
-         /* power management */
-        struct {
-                int (*init)(struct iwl_priv *priv);
-                int (*reset)(struct iwl_priv *priv);
-                void (*stop)(struct iwl_priv *priv);
-                void (*config)(struct iwl_priv *priv);
-                int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
-        } apm_ops;
+        /* power management */
+        struct iwl_apm_ops apm_ops;
+
         /* power */
         int (*send_tx_power) (struct iwl_priv *priv);
         void (*update_chain_flags)(struct iwl_priv *priv);
-        void (*temperature) (struct iwl_priv *priv);
+        void (*post_associate) (struct iwl_priv *priv);
+        void (*config_ap) (struct iwl_priv *priv);
+        irqreturn_t (*isr) (int irq, void *data);
+
         /* eeprom operations (as defined in iwl-eeprom.h) */
         struct iwl_eeprom_ops eeprom_ops;
+
+        /* temperature */
+        struct iwl_temp_ops temp_ops;
 };
 
 struct iwl_ops {
@@ -160,13 +177,12 @@ struct iwl_ops {
 };
 
 struct iwl_mod_params {
-        int disable;            /* def: 0 = enable radio */
         int sw_crypto;          /* def: 0 = using hardware encryption */
         u32 debug;              /* def: 0 = minimal debug log messages */
         int disable_hw_scan;    /* def: 0 = use h/w scan */
         int num_of_queues;      /* def: HW dependent */
         int num_of_ampdu_queues;/* def: HW dependent */
-        int disable_11n;        /* def: 0 = disable 11n capabilities */
+        int disable_11n;        /* def: 0 = 11n capabilities enabled */
         int amsdu_size_8K;      /* def: 1 = enable 8K amsdu size */
         int antenna;            /* def: 0 = both antennas (use diversity) */
         int restart_fw;         /* def: 1 = restart firmware */
@@ -214,6 +230,7 @@ struct iwl_cfg {
         u8   valid_tx_ant;
         u8   valid_rx_ant;
         bool need_pll_cfg;
+        bool use_isr_legacy;
 };
 
 /***************************
@@ -225,6 +242,8 @@ struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
 void iwl_hw_detect(struct iwl_priv *priv);
 void iwl_reset_qos(struct iwl_priv *priv);
 void iwl_activate_qos(struct iwl_priv *priv, u8 force);
+int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                    const struct ieee80211_tx_queue_params *params);
 void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, int hw_decrypt);
 int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
@@ -249,6 +268,24 @@ int iwl_setup_mac(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
 int iwl_init_drv(struct iwl_priv *priv);
 void iwl_uninit_drv(struct iwl_priv *priv);
+bool iwl_is_monitor_mode(struct iwl_priv *priv);
+void iwl_post_associate(struct iwl_priv *priv);
+void iwl_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changes);
+int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
+int iwl_commit_rxon(struct iwl_priv *priv);
+int iwl_set_mode(struct iwl_priv *priv, int mode);
+int iwl_mac_add_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_if_init_conf *conf);
+void iwl_mac_remove_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_if_init_conf *conf);
+int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
+void iwl_config_ap(struct iwl_priv *priv);
+int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_queue_stats *stats);
+void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
 
 /*****************************************************
  * RX handlers.
@@ -271,10 +308,11 @@ int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
                                   struct iwl_rx_queue *q);
 void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 void iwl_rx_replenish(struct iwl_priv *priv);
+void iwl_rx_replenish_now(struct iwl_priv *priv);
 int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 int iwl_rx_queue_restock(struct iwl_priv *priv);
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
-void iwl_rx_allocate(struct iwl_priv *priv);
+void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority);
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
 /* Handlers */
@@ -310,14 +348,6 @@ int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id);
  ****************************************************/
 int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
 
-/*****************************************************
- * RF -Kill - here and not in iwl-rfkill.h to be available when
- * RF-kill subsystem is not compiled.
- ****************************************************/
-void iwl_bg_rf_kill(struct work_struct *work);
-void iwl_radio_kill_sw_disable_radio(struct iwl_priv *priv);
-int iwl_radio_kill_sw_enable_radio(struct iwl_priv *priv);
-
 /*******************************************************************************
  * Rate
  ******************************************************************************/
@@ -328,8 +358,6 @@ int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv);
 
-void iwl_set_rate(struct iwl_priv *priv);
-
 u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant_idx);
 
 static inline u32 iwl_ant_idx_to_flags(u8 ant_idx)
@@ -358,8 +386,8 @@ int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_scan_initiate(struct iwl_priv *priv);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-u16 iwl_fill_probe_req(struct iwl_priv *priv, enum ieee80211_band band,
-                       struct ieee80211_mgmt *frame, int left);
+u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
+                       const u8 *ie, int ie_len, int left);
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
 u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
                               enum ieee80211_band band,
@@ -423,7 +451,13 @@ int iwl_send_card_state(struct iwl_priv *priv, u32 flags,
  *****************************************************/
 void iwl_disable_interrupts(struct iwl_priv *priv);
 void iwl_enable_interrupts(struct iwl_priv *priv);
-irqreturn_t iwl_isr(int irq, void *data);
+irqreturn_t iwl_isr_legacy(int irq, void *data);
+int iwl_reset_ict(struct iwl_priv *priv);
+void iwl_disable_ict(struct iwl_priv *priv);
+int iwl_alloc_isr_ict(struct iwl_priv *priv);
+void iwl_free_isr_ict(struct iwl_priv *priv);
+irqreturn_t iwl_isr_ict(int irq, void *data);
+
 static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 {
         int pos;
@@ -432,12 +466,17 @@ static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
         pci_read_config_word(priv->pci_dev, pos + PCI_EXP_LNKCTL, &pci_lnk_ctl);
         return pci_lnk_ctl;
 }
+#ifdef CONFIG_PM
+int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
+int iwl_pci_resume(struct pci_dev *pdev);
+#endif /* CONFIG_PM */
 
 /*****************************************************
 *  Error Handling Debugging
 ******************************************************/
 void iwl_dump_nic_error_log(struct iwl_priv *priv);
 void iwl_dump_nic_event_log(struct iwl_priv *priv);
+void iwl_clear_isr_stats(struct iwl_priv *priv);
 
 /*****************************************************
 *  GEOS
@@ -451,14 +490,12 @@ void iwlcore_free_geos(struct iwl_priv *priv);
 #define STATUS_HCMD_SYNC_ACTIVE 1       /* sync host command in progress */
 #define STATUS_INT_ENABLED      2
 #define STATUS_RF_KILL_HW       3
-#define STATUS_RF_KILL_SW       4
 #define STATUS_INIT             5
 #define STATUS_ALIVE            6
 #define STATUS_READY            7
 #define STATUS_TEMPERATURE      8
 #define STATUS_GEO_CONFIGURED   9
 #define STATUS_EXIT_PENDING     10
-#define STATUS_IN_SUSPEND       11
 #define STATUS_STATISTICS       12
 #define STATUS_SCANNING         13
 #define STATUS_SCAN_ABORTING    14
@@ -487,11 +524,6 @@ static inline int iwl_is_init(struct iwl_priv *priv)
         return test_bit(STATUS_INIT, &priv->status);
 }
 
-static inline int iwl_is_rfkill_sw(struct iwl_priv *priv)
-{
-        return test_bit(STATUS_RF_KILL_SW, &priv->status);
-}
-
 static inline int iwl_is_rfkill_hw(struct iwl_priv *priv)
 {
         return test_bit(STATUS_RF_KILL_HW, &priv->status);
@@ -499,7 +531,7 @@ static inline int iwl_is_rfkill_hw(struct iwl_priv *priv)
 
 static inline int iwl_is_rfkill(struct iwl_priv *priv)
 {
-        return iwl_is_rfkill_hw(priv) || iwl_is_rfkill_sw(priv);
+        return iwl_is_rfkill_hw(priv);
 }
 
 static inline int iwl_is_ready_rf(struct iwl_priv *priv)
@@ -528,7 +560,14 @@ static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
 {
         return priv->cfg->ops->hcmd->rxon_assoc(priv);
 }
-
+static inline int iwlcore_commit_rxon(struct iwl_priv *priv)
+{
+        return priv->cfg->ops->hcmd->commit_rxon(priv);
+}
+static inline void iwlcore_config_ap(struct iwl_priv *priv)
+{
+        priv->cfg->ops->lib->config_ap(priv);
+}
 static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
                         struct iwl_priv *priv, enum ieee80211_band band)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 6e983149b83b..f03dae1b2f36 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -89,6 +89,7 @@
 /* EEPROM reads */
 #define CSR_EEPROM_REG          (CSR_BASE+0x02c)
 #define CSR_EEPROM_GP           (CSR_BASE+0x030)
+#define CSR_OTP_GP_REG          (CSR_BASE+0x034)
 #define CSR_GIO_REG             (CSR_BASE+0x03C)
 #define CSR_GP_UCODE            (CSR_BASE+0x044)
 #define CSR_UCODE_DRV_GP1       (CSR_BASE+0x054)
@@ -96,8 +97,10 @@
 #define CSR_UCODE_DRV_GP1_CLR   (CSR_BASE+0x05c)
 #define CSR_UCODE_DRV_GP2       (CSR_BASE+0x060)
 #define CSR_LED_REG             (CSR_BASE+0x094)
+#define CSR_DRAM_INT_TBL_REG    (CSR_BASE+0x0A0)
 #define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
 
+#define CSR_INT_PERIODIC_REG    (CSR_BASE+0x005)
 /* Analog phase-lock-loop configuration  */
 #define CSR_ANA_PLL_CFG         (CSR_BASE+0x20c)
 /*
@@ -123,16 +126,18 @@
 
 #define CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A           (0x00080000)
 #define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM         (0x00200000)
-#define CSR_HW_IF_CONFIG_REG_BIT_PCI_OWN_SEM            (0x00400000)
-#define CSR_HW_IF_CONFIG_REG_BIT_ME_OWN                 (0x02000000)
-#define CSR_HW_IF_CONFIG_REG_BIT_WAKE_ME                (0x08000000)
+#define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY              (0x00400000)
+#define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE       (0x02000000)
+#define CSR_HW_IF_CONFIG_REG_PREPARE                    (0x08000000)
 
+#define CSR_INT_PERIODIC_DIS                    (0x00)
+#define CSR_INT_PERIODIC_ENA                    (0xFF)
 
 /* interrupt flags in INTA, set by uCode or hardware (e.g. dma),
  * acknowledged (reset) by host writing "1" to flagged bits. */
 #define CSR_INT_BIT_FH_RX        (1 << 31) /* Rx DMA, cmd responses, FH_INT[17:16] */
 #define CSR_INT_BIT_HW_ERR       (1 << 29) /* DMA hardware error FH_INT[31] */
-#define CSR_INT_BIT_DNLD         (1 << 28) /* uCode Download */
+#define CSR_INT_BIT_RX_PERIODIC  (1 << 28) /* Rx periodic */
 #define CSR_INT_BIT_FH_TX        (1 << 27) /* Tx DMA FH_INT[1:0] */
 #define CSR_INT_BIT_SCD          (1 << 26) /* TXQ pointer advanced */
 #define CSR_INT_BIT_SW_ERR       (1 << 25) /* uCode error */
@@ -226,6 +231,10 @@
 #define CSR_EEPROM_GP_VALID_MSK         (0x00000007)
 #define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
 #define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
+#define CSR_OTP_GP_REG_DEVICE_SELECT    (0x00010000) /* 0 - EEPROM, 1 - OTP */
+#define CSR_OTP_GP_REG_OTP_ACCESS_MODE  (0x00020000) /* 0 - absolute, 1 - relative */
+#define CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK          (0x00100000) /* bit 20 */
+#define CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK        (0x00200000) /* bit 21 */
 
 /* CSR GIO */
 #define CSR_GIO_REG_VAL_L0S_ENABLED     (0x00000002)
@@ -251,6 +260,11 @@
 
 /* HPET MEM debug */
 #define CSR_DBG_HPET_MEM_REG_VAL        (0xFFFF0000)
+
+/* DRAM INT TABLE */
+#define CSR_DRAM_INT_TBL_ENABLE         (1 << 31)
+#define CSR_DRAM_INIT_TBL_WRAP_CHECK    (1 << 27)
+
 /*=== HBUS (Host-side Bus) ===*/
 #define HBUS_BASE       (0x400)
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 65d1a7f2db9e..2cf014f523be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -68,13 +68,14 @@ struct iwl_debugfs {
         struct dentry *dir_rf;
         struct dir_data_files {
                 struct dentry *file_sram;
-                struct dentry *file_eeprom;
+                struct dentry *file_nvm;
                 struct dentry *file_stations;
                 struct dentry *file_rx_statistics;
                 struct dentry *file_tx_statistics;
                 struct dentry *file_log_event;
                 struct dentry *file_channels;
                 struct dentry *file_status;
+                struct dentry *file_interrupt;
         } dbgfs_data_files;
         struct dir_rf_files {
                 struct dentry *file_disable_sensitivity;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 64eb585f1578..11e08c068917 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -172,7 +172,6 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
         struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
         const size_t bufsz = sizeof(buf);
 
-        iwl_grab_nic_access(priv);
         for (i = priv->dbgfs->sram_len; i > 0; i -= 4) {
                 val = iwl_read_targ_mem(priv, priv->dbgfs->sram_offset + \
                                         priv->dbgfs->sram_len - i);
@@ -192,7 +191,6 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
                 pos += scnprintf(buf + pos, bufsz - pos, "0x%08x ", val);
         }
         pos += scnprintf(buf + pos, bufsz - pos, "\n");
-        iwl_release_nic_access(priv);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         return ret;
@@ -292,7 +290,7 @@ static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_eeprom_read(struct file *file,
+static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                                        char __user *user_buf,
                                        size_t count,
                                        loff_t *ppos)
@@ -306,7 +304,7 @@ static ssize_t iwl_dbgfs_eeprom_read(struct file *file,
         buf_size = 4 * eeprom_len + 256;
 
         if (eeprom_len % 16) {
-                IWL_ERR(priv, "EEPROM size is not multiple of 16.\n");
+                IWL_ERR(priv, "NVM size is not multiple of 16.\n");
                 return -ENODATA;
         }
 
@@ -318,6 +316,13 @@ static ssize_t iwl_dbgfs_eeprom_read(struct file *file,
         }
 
         ptr = priv->eeprom;
+        if (!ptr) {
+                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+                return -ENOMEM;
+        }
+        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
+                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                        ? "OTP" : "EEPROM");
         for (ofs = 0 ; ofs < eeprom_len ; ofs += 16) {
                 pos += scnprintf(buf + pos, buf_size - pos, "0x%.4x ", ofs);
                 hex_dump_to_buffer(ptr + ofs, 16 , 16, 2, buf + pos,
@@ -375,51 +380,53 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
         }
 
         supp_band = iwl_get_hw_mode(priv, IEEE80211_BAND_2GHZ);
-        channels = supp_band->channels;
-
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "Displaying %d channels in 2.4GHz band 802.11bg):\n",
-                         supp_band->n_channels);
+        if (supp_band) {
+                channels = supp_band->channels;
 
-        for (i = 0; i < supp_band->n_channels; i++)
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                "%d: %ddBm: BSS%s%s, %s.\n",
-                                ieee80211_frequency_to_channel(
-                                channels[i].center_freq),
-                                channels[i].max_power,
-                                channels[i].flags & IEEE80211_CHAN_RADAR ?
-                                " (IEEE 802.11h required)" : "",
-                                (!(channels[i].flags & IEEE80211_CHAN_NO_IBSS)
-                                || (channels[i].flags &
-                                IEEE80211_CHAN_RADAR)) ? "" :
-                                ", IBSS",
-                                channels[i].flags &
-                                IEEE80211_CHAN_PASSIVE_SCAN ?
-                                "passive only" : "active/passive");
+                                "Displaying %d channels in 2.4GHz band 802.11bg):\n",
+                                supp_band->n_channels);
 
+                for (i = 0; i < supp_band->n_channels; i++)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                        "%d: %ddBm: BSS%s%s, %s.\n",
+                                        ieee80211_frequency_to_channel(
+                                        channels[i].center_freq),
+                                        channels[i].max_power,
+                                        channels[i].flags & IEEE80211_CHAN_RADAR ?
+                                        " (IEEE 802.11h required)" : "",
+                                        ((channels[i].flags & IEEE80211_CHAN_NO_IBSS)
+                                        || (channels[i].flags &
+                                        IEEE80211_CHAN_RADAR)) ? "" :
+                                        ", IBSS",
+                                        channels[i].flags &
+                                        IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        "passive only" : "active/passive");
+        }
         supp_band = iwl_get_hw_mode(priv, IEEE80211_BAND_5GHZ);
-        channels = supp_band->channels;
-
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "Displaying %d channels in 5.2GHz band (802.11a)\n",
-                        supp_band->n_channels);
+        if (supp_band) {
+                channels = supp_band->channels;
 
-        for (i = 0; i < supp_band->n_channels; i++)
                 pos += scnprintf(buf + pos, bufsz - pos,
-                                "%d: %ddBm: BSS%s%s, %s.\n",
-                                ieee80211_frequency_to_channel(
-                                channels[i].center_freq),
-                                channels[i].max_power,
-                                channels[i].flags & IEEE80211_CHAN_RADAR ?
-                                " (IEEE 802.11h required)" : "",
-                                ((channels[i].flags & IEEE80211_CHAN_NO_IBSS)
-                                || (channels[i].flags &
-                                IEEE80211_CHAN_RADAR)) ? "" :
-                                ", IBSS",
-                                channels[i].flags &
-                                IEEE80211_CHAN_PASSIVE_SCAN ?
-                                "passive only" : "active/passive");
+                                "Displaying %d channels in 5.2GHz band (802.11a)\n",
+                                supp_band->n_channels);
 
+                for (i = 0; i < supp_band->n_channels; i++)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                        "%d: %ddBm: BSS%s%s, %s.\n",
+                                        ieee80211_frequency_to_channel(
+                                        channels[i].center_freq),
+                                        channels[i].max_power,
+                                        channels[i].flags & IEEE80211_CHAN_RADAR ?
+                                        " (IEEE 802.11h required)" : "",
+                                        ((channels[i].flags & IEEE80211_CHAN_NO_IBSS)
+                                        || (channels[i].flags &
+                                        IEEE80211_CHAN_RADAR)) ? "" :
+                                        ", IBSS",
+                                        channels[i].flags &
+                                        IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        "passive only" : "active/passive");
+        }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
         return ret;
@@ -442,8 +449,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                 test_bit(STATUS_INT_ENABLED, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_HW:\t %d\n",
                 test_bit(STATUS_RF_KILL_HW, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_RF_KILL_SW:\t %d\n",
-                test_bit(STATUS_RF_KILL_SW, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INIT:\t\t %d\n",
                 test_bit(STATUS_INIT, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_ALIVE:\t\t %d\n",
@@ -456,8 +461,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                 test_bit(STATUS_GEO_CONFIGURED, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_EXIT_PENDING:\t %d\n",
                 test_bit(STATUS_EXIT_PENDING, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_IN_SUSPEND:\t %d\n",
-                test_bit(STATUS_IN_SUSPEND, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_STATISTICS:\t %d\n",
                 test_bit(STATUS_STATISTICS, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_SCANNING:\t %d\n",
@@ -475,14 +478,104 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
+static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        int cnt = 0;
+        char *buf;
+        int bufsz = 24 * 64; /* 24 items * 64 char per item */
+        ssize_t ret;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "Interrupt Statistics Report:\n");
+
+        pos += scnprintf(buf + pos, bufsz - pos, "HW Error:\t\t\t %u\n",
+                priv->isr_stats.hw);
+        pos += scnprintf(buf + pos, bufsz - pos, "SW Error:\t\t\t %u\n",
+                priv->isr_stats.sw);
+        if (priv->isr_stats.sw > 0) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                        "\tLast Restarting Code:  0x%X\n",
+                        priv->isr_stats.sw_err);
+        }
+#ifdef CONFIG_IWLWIFI_DEBUG
+        pos += scnprintf(buf + pos, bufsz - pos, "Frame transmitted:\t\t %u\n",
+                priv->isr_stats.sch);
+        pos += scnprintf(buf + pos, bufsz - pos, "Alive interrupt:\t\t %u\n",
+                priv->isr_stats.alive);
+#endif
+        pos += scnprintf(buf + pos, bufsz - pos,
+                "HW RF KILL switch toggled:\t %u\n",
+                priv->isr_stats.rfkill);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "CT KILL:\t\t\t %u\n",
+                priv->isr_stats.ctkill);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Wakeup Interrupt:\t\t %u\n",
+                priv->isr_stats.wakeup);
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                "Rx command responses:\t\t %u\n",
+                priv->isr_stats.rx);
+        for (cnt = 0; cnt < REPLY_MAX; cnt++) {
+                if (priv->isr_stats.rx_handlers[cnt] > 0)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                "\tRx handler[%36s]:\t\t %u\n",
+                                get_cmd_string(cnt),
+                                priv->isr_stats.rx_handlers[cnt]);
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Tx/FH interrupt:\t\t %u\n",
+                priv->isr_stats.tx);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Unexpected INTA:\t\t %u\n",
+                priv->isr_stats.unhandled);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        u32 reset_flag;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%x", &reset_flag) != 1)
+                return -EFAULT;
+        if (reset_flag == 0)
+                iwl_clear_isr_stats(priv);
+
+        return count;
+}
+
+
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
 DEBUGFS_WRITE_FILE_OPS(log_event);
-DEBUGFS_READ_FILE_OPS(eeprom);
+DEBUGFS_READ_FILE_OPS(nvm);
 DEBUGFS_READ_FILE_OPS(stations);
 DEBUGFS_READ_FILE_OPS(rx_statistics);
 DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_FILE_OPS(channels);
 DEBUGFS_READ_FILE_OPS(status);
+DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
 
 /*
  * Create the debugfs files and directories
@@ -510,7 +603,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 
         DEBUGFS_ADD_DIR(data, dbgfs->dir_drv);
         DEBUGFS_ADD_DIR(rf, dbgfs->dir_drv);
-        DEBUGFS_ADD_FILE(eeprom, data);
+        DEBUGFS_ADD_FILE(nvm, data);
         DEBUGFS_ADD_FILE(sram, data);
         DEBUGFS_ADD_FILE(log_event, data);
         DEBUGFS_ADD_FILE(stations, data);
@@ -518,6 +611,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(tx_statistics, data);
         DEBUGFS_ADD_FILE(channels, data);
         DEBUGFS_ADD_FILE(status, data);
+        DEBUGFS_ADD_FILE(interrupt, data);
         DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
         DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
                          &priv->disable_chain_noise_cal);
@@ -540,7 +634,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         if (!priv->dbgfs)
                 return;
 
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_eeprom);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_nvm);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_rx_statistics);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_tx_statistics);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sram);
@@ -548,6 +642,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_stations);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_channels);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_status);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_interrupt);
         DEBUGFS_REMOVE(priv->dbgfs->dir_data);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_chain_noise);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index cf7f0db58fcf..e2d620f0b6e8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -41,7 +41,6 @@
 #include "iwl-prph.h"
 #include "iwl-fh.h"
 #include "iwl-debug.h"
-#include "iwl-rfkill.h"
 #include "iwl-4965-hw.h"
 #include "iwl-3945-hw.h"
 #include "iwl-3945-led.h"
@@ -289,11 +288,11 @@ struct iwl_frame {
 #define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
 
 enum {
-        /* CMD_SIZE_NORMAL = 0, */
+        CMD_SYNC = 0,
+        CMD_SIZE_NORMAL = 0,
+        CMD_NO_SKB = 0,
         CMD_SIZE_HUGE = (1 << 0),
-        /* CMD_SYNC = 0, */
         CMD_ASYNC = (1 << 1),
-        /* CMD_NO_SKB = 0, */
         CMD_WANT_SKB = (1 << 2),
 };
 
@@ -381,6 +380,7 @@ struct iwl_rx_queue {
         u32 read;
         u32 write;
         u32 free_count;
+        u32 write_actual;
         struct list_head rx_free;
         struct list_head rx_used;
         int need_update;
@@ -498,22 +498,13 @@ struct iwl_qos_info {
 #define STA_PS_STATUS_WAKE             0
 #define STA_PS_STATUS_SLEEP            1
 
-struct iwl3945_tid_data {
-        u16 seq_number;
-};
-
-struct iwl3945_hw_key {
-        enum ieee80211_key_alg alg;
-        int keylen;
-        u8 key[32];
-};
 
 struct iwl3945_station_entry {
         struct iwl3945_addsta_cmd sta;
-        struct iwl3945_tid_data tid[MAX_TID_COUNT];
+        struct iwl_tid_data tid[MAX_TID_COUNT];
         u8 used;
         u8 ps_status;
-        struct iwl3945_hw_key keyinfo;
+        struct iwl_hw_key keyinfo;
 };
 
 struct iwl_station_entry {
@@ -822,6 +813,26 @@ enum {
         MEASUREMENT_ACTIVE = (1 << 1),
 };
 
+enum iwl_nvm_type {
+        NVM_DEVICE_TYPE_EEPROM = 0,
+        NVM_DEVICE_TYPE_OTP,
+};
+
+/* interrupt statistics */
+struct isr_statistics {
+        u32 hw;
+        u32 sw;
+        u32 sw_err;
+        u32 sch;
+        u32 alive;
+        u32 rfkill;
+        u32 ctkill;
+        u32 wakeup;
+        u32 rx;
+        u32 rx_handlers[REPLY_MAX];
+        u32 tx;
+        u32 unhandled;
+};
 
 #define IWL_MAX_NUM_QUEUES      20 /* FIXME: do dynamic allocation */
 
@@ -877,15 +888,14 @@ struct iwl_priv {
         unsigned long scan_start_tsf;
         void *scan;
         int scan_bands;
-        int one_direct_scan;
-        u8 direct_ssid_len;
-        u8 direct_ssid[IW_ESSID_MAX_SIZE];
+        struct cfg80211_scan_request *scan_request;
         u8 scan_tx_ant[IEEE80211_NUM_BANDS];
         u8 mgmt_tx_ant;
 
         /* spinlock */
         spinlock_t lock;        /* protect general shared data */
         spinlock_t hcmd_lock;   /* protect hcmd */
+        spinlock_t reg_lock;    /* protect hw register access */
         struct mutex mutex;
 
         /* basic pci-network driver stuff */
@@ -919,16 +929,12 @@ struct iwl_priv {
         const struct iwl_rxon_cmd active_rxon;
         struct iwl_rxon_cmd staging_rxon;
 
-        int error_recovering;
         struct iwl_rxon_cmd recovery_rxon;
 
         /* 1st responses from initialize and runtime uCode images.
          * 4965's initialize alive response contains some calibration data. */
         struct iwl_init_alive_resp card_alive_init;
         struct iwl_alive_resp card_alive;
-#if defined(CONFIG_IWLWIFI_RFKILL)
-        struct rfkill *rfkill;
-#endif
 
 #ifdef CONFIG_IWLWIFI_LEDS
         unsigned long last_blink_time;
@@ -978,6 +984,9 @@ struct iwl_priv {
                 u64 bytes;
         } tx_stats[3], rx_stats[3];
 
+        /* counts interrupts */
+        struct isr_statistics isr_stats;
+
         struct iwl_power_mgr power_data;
 
         struct iwl_notif_statistics statistics;
@@ -1017,6 +1026,7 @@ struct iwl_priv {
 
         /* eeprom */
         u8 *eeprom;
+        int    nvm_device_type;
         struct iwl_eeprom_calib_info *calib_info;
 
         enum nl80211_iftype iw_mode;
@@ -1034,7 +1044,16 @@ struct iwl_priv {
         /*End*/
         struct iwl_hw_params hw_params;
 
+        /* INT ICT Table */
+        u32 *ict_tbl;
+        dma_addr_t ict_tbl_dma;
+        dma_addr_t aligned_ict_tbl_dma;
+        int ict_index;
+        void *ict_tbl_vir;
+        u32 inta;
+        bool use_ict;
 
+        u32 inta_mask;
         /* Current association information needed to configure the
          * hardware */
         u16 assoc_id;
@@ -1049,7 +1068,6 @@ struct iwl_priv {
         struct work_struct calibrated_work;
         struct work_struct scan_completed;
         struct work_struct rx_replenish;
-        struct work_struct rf_kill;
         struct work_struct abort_scan;
         struct work_struct update_link_led;
         struct work_struct auth_work;
@@ -1059,7 +1077,6 @@ struct iwl_priv {
 
         struct tasklet_struct irq_tasklet;
 
-        struct delayed_work set_power_save;
         struct delayed_work init_alive_start;
         struct delayed_work alive_start;
         struct delayed_work scan_check;
@@ -1090,14 +1107,12 @@ struct iwl_priv {
         u32 disable_tx_power_cal;
         struct work_struct run_time_calib_work;
         struct timer_list statistics_periodic;
-
+        bool hw_ready;
         /*For 3945*/
 #define IWL_DEFAULT_TX_POWER 0x0F
 
         struct iwl3945_notif_statistics statistics_39;
 
-        struct iwl3945_station_entry stations_39[IWL_STATION_COUNT];
-
         u32 sta_supp_rates;
 }; /*iwl_priv */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 75517d05df08..7d7554a2f341 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -152,6 +152,32 @@ int iwlcore_eeprom_verify_signature(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwlcore_eeprom_verify_signature);
 
+static int iwlcore_get_nvm_type(struct iwl_priv *priv)
+{
+        u32 otpgp;
+        int nvm_type;
+
+        /* OTP only valid for CP/PP and after */
+        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        case CSR_HW_REV_TYPE_3945:
+        case CSR_HW_REV_TYPE_4965:
+        case CSR_HW_REV_TYPE_5300:
+        case CSR_HW_REV_TYPE_5350:
+        case CSR_HW_REV_TYPE_5100:
+        case CSR_HW_REV_TYPE_5150:
+                nvm_type = NVM_DEVICE_TYPE_EEPROM;
+                break;
+        default:
+                otpgp = iwl_read32(priv, CSR_OTP_GP_REG);
+                if (otpgp & CSR_OTP_GP_REG_DEVICE_SELECT)
+                        nvm_type = NVM_DEVICE_TYPE_OTP;
+                else
+                        nvm_type = NVM_DEVICE_TYPE_EEPROM;
+                break;
+        }
+        return  nvm_type;
+}
+
 /*
  * The device's EEPROM semaphore prevents conflicts between driver and uCode
  * when accessing the EEPROM; each access is a series of pulses to/from the
@@ -198,6 +224,31 @@ const u8 *iwlcore_eeprom_query_addr(const struct iwl_priv *priv, size_t offset)
 }
 EXPORT_SYMBOL(iwlcore_eeprom_query_addr);
 
+static int iwl_init_otp_access(struct iwl_priv *priv)
+{
+        int ret;
+
+        /* Enable 40MHz radio clock */
+        _iwl_write32(priv, CSR_GP_CNTRL,
+                     _iwl_read32(priv, CSR_GP_CNTRL) |
+                     CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /* wait for clock to be ready */
+        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
+                                  CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                                  25000);
+        if (ret < 0)
+                IWL_ERR(priv, "Time out access OTP\n");
+        else {
+                iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
+                                  APMG_PS_CTRL_VAL_RESET_REQ);
+                udelay(5);
+                iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
+                                    APMG_PS_CTRL_VAL_RESET_REQ);
+        }
+        return ret;
+}
+
 /**
  * iwl_eeprom_init - read EEPROM contents
  *
@@ -209,11 +260,18 @@ int iwl_eeprom_init(struct iwl_priv *priv)
 {
         u16 *e;
         u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
-        int sz = priv->cfg->eeprom_size;
+        int sz;
         int ret;
         u16 addr;
+        u32 otpgp;
+
+        priv->nvm_device_type = iwlcore_get_nvm_type(priv);
 
         /* allocate eeprom */
+        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
+                priv->cfg->eeprom_size =
+                        OTP_BLOCK_SIZE * OTP_LOWER_BLOCKS_TOTAL;
+        sz = priv->cfg->eeprom_size;
         priv->eeprom = kzalloc(sz, GFP_KERNEL);
         if (!priv->eeprom) {
                 ret = -ENOMEM;
@@ -235,30 +293,77 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 ret = -ENOENT;
                 goto err;
         }
-
-        /* eeprom is an array of 16bit values */
-        for (addr = 0; addr < sz; addr += sizeof(u16)) {
-                u32 r;
-
-                _iwl_write32(priv, CSR_EEPROM_REG,
-                             CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
-
-                ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
-                                          CSR_EEPROM_REG_READ_VALID_MSK,
-                                          IWL_EEPROM_ACCESS_TIMEOUT);
-                if (ret < 0) {
-                        IWL_ERR(priv, "Time out reading EEPROM[%d]\n", addr);
-                        goto done;
+        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
+                ret = iwl_init_otp_access(priv);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to initialize OTP access.\n");
+                        ret = -ENOENT;
+                        goto err;
+                }
+                _iwl_write32(priv, CSR_EEPROM_GP,
+                             iwl_read32(priv, CSR_EEPROM_GP) &
+                             ~CSR_EEPROM_GP_IF_OWNER_MSK);
+                /* clear */
+                _iwl_write32(priv, CSR_OTP_GP_REG,
+                             iwl_read32(priv, CSR_OTP_GP_REG) |
+                             CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
+                             CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
+
+                for (addr = 0; addr < sz; addr += sizeof(u16)) {
+                        u32 r;
+
+                        _iwl_write32(priv, CSR_EEPROM_REG,
+                                     CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
+
+                        ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
+                                                  CSR_EEPROM_REG_READ_VALID_MSK,
+                                                  IWL_EEPROM_ACCESS_TIMEOUT);
+                        if (ret < 0) {
+                                IWL_ERR(priv, "Time out reading OTP[%d]\n", addr);
+                                goto done;
+                        }
+                        r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
+                        /* check for ECC errors: */
+                        otpgp = iwl_read32(priv, CSR_OTP_GP_REG);
+                        if (otpgp & CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK) {
+                                /* stop in this case */
+                                IWL_ERR(priv, "Uncorrectable OTP ECC error, Abort OTP read\n");
+                                goto done;
+                        }
+                        if (otpgp & CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK) {
+                                /* continue in this case */
+                                _iwl_write32(priv, CSR_OTP_GP_REG,
+                                             iwl_read32(priv, CSR_OTP_GP_REG) |
+                                             CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
+                                IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
+                        }
+                        e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+                }
+        } else {
+                /* eeprom is an array of 16bit values */
+                for (addr = 0; addr < sz; addr += sizeof(u16)) {
+                        u32 r;
+
+                        _iwl_write32(priv, CSR_EEPROM_REG,
+                                     CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
+
+                        ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
+                                                  CSR_EEPROM_REG_READ_VALID_MSK,
+                                                  IWL_EEPROM_ACCESS_TIMEOUT);
+                        if (ret < 0) {
+                                IWL_ERR(priv, "Time out reading EEPROM[%d]\n", addr);
+                                goto done;
+                        }
+                        r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
+                        e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
                 }
-                r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
-                e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
         }
         ret = 0;
 done:
         priv->cfg->ops->lib->eeprom_ops.release_semaphore(priv);
 err:
         if (ret)
-                kfree(priv->eeprom);
+                iwl_eeprom_free(priv);
 alloc_err:
         return ret;
 }
@@ -285,7 +390,7 @@ int iwl_eeprom_check_version(struct iwl_priv *priv)
 
         return 0;
 err:
-        IWL_ERR(priv, "Unsupported EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+        IWL_ERR(priv, "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
                   eeprom_ver, priv->cfg->eeprom_ver,
                   calib_ver,  priv->cfg->eeprom_calib_ver);
         return -EINVAL;
@@ -301,6 +406,8 @@ EXPORT_SYMBOL(iwl_eeprom_query_addr);
 
 u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset)
 {
+        if (!priv->eeprom)
+                return 0;
         return (u16)priv->eeprom[offset] | ((u16)priv->eeprom[offset + 1] << 8);
 }
 EXPORT_SYMBOL(iwl_eeprom_query16);
@@ -481,8 +588,8 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                         /* First write that fat is not enabled, and then enable
                          * one by one */
                         ch_info->fat_extension_channel =
-                                (IEEE80211_CHAN_NO_FAT_ABOVE |
-                                 IEEE80211_CHAN_NO_FAT_BELOW);
+                                (IEEE80211_CHAN_NO_HT40PLUS |
+                                 IEEE80211_CHAN_NO_HT40MINUS);
 
                         if (!(is_channel_valid(ch_info))) {
                                 IWL_DEBUG_INFO(priv, "Ch. %d Flags %x [%sGHz] - "
@@ -561,7 +668,7 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                                 fat_extension_chan = 0;
                         else
                                 fat_extension_chan =
-                                        IEEE80211_CHAN_NO_FAT_BELOW;
+                                        IEEE80211_CHAN_NO_HT40MINUS;
 
                         /* Set up driver's info for lower half */
                         iwl_set_fat_chan_info(priv, ieeeband,
@@ -573,7 +680,7 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                         iwl_set_fat_chan_info(priv, ieeeband,
                                                 (eeprom_ch_index[ch] + 4),
                                                 &(eeprom_ch_info[ch]),
-                                                IEEE80211_CHAN_NO_FAT_ABOVE);
+                                                IEEE80211_CHAN_NO_HT40PLUS);
                 }
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 3479153d96ca..195b4ef12c27 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -179,6 +179,10 @@ struct iwl_eeprom_channel {
 #define EEPROM_5050_TX_POWER_VERSION    (4)
 #define EEPROM_5050_EEPROM_VERSION      (0x21E)
 
+/* OTP */
+#define OTP_LOWER_BLOCKS_TOTAL          (3)
+#define OTP_BLOCK_SIZE                  (0x400)
+
 /* 2.4 GHz */
 extern const u8 iwl_eeprom_band_1[14];
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 083ea1ffbe87..d30cb0275d19 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -131,9 +131,23 @@ static inline void __iwl_set_bit(const char *f, u32 l,
         IWL_DEBUG_IO(priv, "set_bit(0x%08X, 0x%08X) = 0x%08X\n", reg, mask, val);
         _iwl_write32(priv, reg, val);
 }
-#define iwl_set_bit(p, r, m) __iwl_set_bit(__FILE__, __LINE__, p, r, m)
+static inline void iwl_set_bit(struct iwl_priv *p, u32 r, u32 m)
+{
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&p->reg_lock, reg_flags);
+        __iwl_set_bit(__FILE__, __LINE__, p, r, m);
+        spin_unlock_irqrestore(&p->reg_lock, reg_flags);
+}
 #else
-#define iwl_set_bit(p, r, m) _iwl_set_bit(p, r, m)
+static inline void iwl_set_bit(struct iwl_priv *p, u32 r, u32 m)
+{
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&p->reg_lock, reg_flags);
+        _iwl_set_bit(p, r, m);
+        spin_unlock_irqrestore(&p->reg_lock, reg_flags);
+}
 #endif
 
 static inline void _iwl_clear_bit(struct iwl_priv *priv, u32 reg, u32 mask)
@@ -148,19 +162,30 @@ static inline void __iwl_clear_bit(const char *f, u32 l,
         IWL_DEBUG_IO(priv, "clear_bit(0x%08X, 0x%08X) = 0x%08X\n", reg, mask, val);
         _iwl_write32(priv, reg, val);
 }
-#define iwl_clear_bit(p, r, m) __iwl_clear_bit(__FILE__, __LINE__, p, r, m)
+static inline void iwl_clear_bit(struct iwl_priv *p, u32 r, u32 m)
+{
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&p->reg_lock, reg_flags);
+        __iwl_clear_bit(__FILE__, __LINE__, p, r, m);
+        spin_unlock_irqrestore(&p->reg_lock, reg_flags);
+}
 #else
-#define iwl_clear_bit(p, r, m) _iwl_clear_bit(p, r, m)
+static inline void iwl_clear_bit(struct iwl_priv *p, u32 r, u32 m)
+{
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&p->reg_lock, reg_flags);
+        _iwl_clear_bit(p, r, m);
+        spin_unlock_irqrestore(&p->reg_lock, reg_flags);
+}
 #endif
 
 static inline int _iwl_grab_nic_access(struct iwl_priv *priv)
 {
         int ret;
         u32 val;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (atomic_read(&priv->restrict_refcnt))
-                return 0;
-#endif
+
         /* this bit wakes up the NIC */
         _iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
         ret = _iwl_poll_bit(priv, CSR_GP_CNTRL,
@@ -170,12 +195,10 @@ static inline int _iwl_grab_nic_access(struct iwl_priv *priv)
         if (ret < 0) {
                 val = _iwl_read32(priv, CSR_GP_CNTRL);
                 IWL_ERR(priv, "MAC is in deep sleep!.  CSR_GP_CNTRL = 0x%08X\n", val);
+                _iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_FORCE_NMI);
                 return -EIO;
         }
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-        atomic_inc(&priv->restrict_refcnt);
-#endif
         return 0;
 }
 
@@ -183,9 +206,6 @@ static inline int _iwl_grab_nic_access(struct iwl_priv *priv)
 static inline int __iwl_grab_nic_access(const char *f, u32 l,
                                                struct iwl_priv *priv)
 {
-        if (atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Grabbing access while already held %s %d.\n", f, l);
-
         IWL_DEBUG_IO(priv, "grabbing nic access - %s %d\n", f, l);
         return _iwl_grab_nic_access(priv);
 }
@@ -198,18 +218,13 @@ static inline int __iwl_grab_nic_access(const char *f, u32 l,
 
 static inline void _iwl_release_nic_access(struct iwl_priv *priv)
 {
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (atomic_dec_and_test(&priv->restrict_refcnt))
-#endif
-                _iwl_clear_bit(priv, CSR_GP_CNTRL,
-                               CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+        _iwl_clear_bit(priv, CSR_GP_CNTRL,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 }
 #ifdef CONFIG_IWLWIFI_DEBUG
 static inline void __iwl_release_nic_access(const char *f, u32 l,
                                             struct iwl_priv *priv)
 {
-        if (atomic_read(&priv->restrict_refcnt) <= 0)
-                IWL_ERR(priv, "Release unheld nic access at line %s %d.\n", f, l);
 
         IWL_DEBUG_IO(priv, "releasing nic access - %s %d\n", f, l);
         _iwl_release_nic_access(priv);
@@ -230,16 +245,37 @@ static inline u32 __iwl_read_direct32(const char *f, u32 l,
                                         struct iwl_priv *priv, u32 reg)
 {
         u32 value = _iwl_read_direct32(priv, reg);
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s %d\n", f, l);
         IWL_DEBUG_IO(priv, "read_direct32(0x%4X) = 0x%08x - %s %d \n", reg, value,
                      f, l);
         return value;
 }
-#define iwl_read_direct32(priv, reg) \
-        __iwl_read_direct32(__FILE__, __LINE__, priv, reg)
+static inline u32 iwl_read_direct32(struct iwl_priv *priv, u32 reg)
+{
+        u32 value;
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+        value = __iwl_read_direct32(__FILE__, __LINE__, priv, reg);
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return value;
+}
+
 #else
-#define iwl_read_direct32 _iwl_read_direct32
+static inline u32 iwl_read_direct32(struct iwl_priv *priv, u32 reg)
+{
+        u32 value;
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+        value = _iwl_read_direct32(priv, reg);
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return value;
+
+}
 #endif
 
 static inline void _iwl_write_direct32(struct iwl_priv *priv,
@@ -247,19 +283,17 @@ static inline void _iwl_write_direct32(struct iwl_priv *priv,
 {
         _iwl_write32(priv, reg, value);
 }
-#ifdef CONFIG_IWLWIFI_DEBUG
-static void __iwl_write_direct32(const char *f , u32 line,
-                                   struct iwl_priv *priv, u32 reg, u32 value)
+static inline void iwl_write_direct32(struct iwl_priv *priv, u32 reg, u32 value)
 {
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s line %d\n", f, line);
-        _iwl_write_direct32(priv, reg, value);
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (!iwl_grab_nic_access(priv)) {
+                _iwl_write_direct32(priv, reg, value);
+                iwl_release_nic_access(priv);
+        }
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
-#define iwl_write_direct32(priv, reg, value) \
-        __iwl_write_direct32(__func__, __LINE__, priv, reg, value)
-#else
-#define iwl_write_direct32 _iwl_write_direct32
-#endif
 
 static inline void iwl_write_reg_buf(struct iwl_priv *priv,
                                                u32 reg, u32 len, u32 *values)
@@ -268,14 +302,23 @@ static inline void iwl_write_reg_buf(struct iwl_priv *priv,
 
         if ((priv != NULL) && (values != NULL)) {
                 for (; 0 < len; len -= count, reg += count, values++)
-                        _iwl_write_direct32(priv, reg, *values);
+                        iwl_write_direct32(priv, reg, *values);
         }
 }
 
 static inline int _iwl_poll_direct_bit(struct iwl_priv *priv, u32 addr,
                                        u32 mask, int timeout)
 {
-        return _iwl_poll_bit(priv, addr, mask, mask, timeout);
+        int t = 0;
+
+        do {
+                if ((iwl_read_direct32(priv, addr) & mask) == mask)
+                        return t;
+                udelay(IWL_POLL_INTERVAL);
+                t += IWL_POLL_INTERVAL;
+        } while (t < timeout);
+
+        return -ETIMEDOUT;
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -305,20 +348,18 @@ static inline u32 _iwl_read_prph(struct iwl_priv *priv, u32 reg)
         rmb();
         return _iwl_read_direct32(priv, HBUS_TARG_PRPH_RDAT);
 }
-#ifdef CONFIG_IWLWIFI_DEBUG
-static inline u32 __iwl_read_prph(const char *f, u32 line,
-                                  struct iwl_priv *priv, u32 reg)
+static inline u32 iwl_read_prph(struct iwl_priv *priv, u32 reg)
 {
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s line %d\n", f, line);
-        return _iwl_read_prph(priv, reg);
-}
+        unsigned long reg_flags;
+        u32 val;
 
-#define iwl_read_prph(priv, reg) \
-        __iwl_read_prph(__func__, __LINE__, priv, reg)
-#else
-#define iwl_read_prph _iwl_read_prph
-#endif
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+        val = _iwl_read_prph(priv, reg);
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return val;
+}
 
 static inline void _iwl_write_prph(struct iwl_priv *priv,
                                              u32 addr, u32 val)
@@ -328,83 +369,107 @@ static inline void _iwl_write_prph(struct iwl_priv *priv,
         wmb();
         _iwl_write_direct32(priv, HBUS_TARG_PRPH_WDAT, val);
 }
-#ifdef CONFIG_IWLWIFI_DEBUG
-static inline void __iwl_write_prph(const char *f, u32 line,
-                                    struct iwl_priv *priv, u32 addr, u32 val)
+
+static inline void iwl_write_prph(struct iwl_priv *priv, u32 addr, u32 val)
 {
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s line %d\n", f, line);
-        _iwl_write_prph(priv, addr, val);
-}
+        unsigned long reg_flags;
 
-#define iwl_write_prph(priv, addr, val) \
-        __iwl_write_prph(__func__, __LINE__, priv, addr, val);
-#else
-#define iwl_write_prph _iwl_write_prph
-#endif
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (!iwl_grab_nic_access(priv)) {
+                _iwl_write_prph(priv, addr, val);
+                iwl_release_nic_access(priv);
+        }
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+}
 
 #define _iwl_set_bits_prph(priv, reg, mask) \
         _iwl_write_prph(priv, reg, (_iwl_read_prph(priv, reg) | mask))
-#ifdef CONFIG_IWLWIFI_DEBUG
-static inline void __iwl_set_bits_prph(const char *f, u32 line,
-                                       struct iwl_priv *priv,
-                                       u32 reg, u32 mask)
+
+static inline void iwl_set_bits_prph(struct iwl_priv *priv, u32 reg, u32 mask)
 {
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s line %d\n", f, line);
+        unsigned long reg_flags;
 
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
         _iwl_set_bits_prph(priv, reg, mask);
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
-#define iwl_set_bits_prph(priv, reg, mask) \
-        __iwl_set_bits_prph(__func__, __LINE__, priv, reg, mask)
-#else
-#define iwl_set_bits_prph _iwl_set_bits_prph
-#endif
 
 #define _iwl_set_bits_mask_prph(priv, reg, bits, mask) \
         _iwl_write_prph(priv, reg, ((_iwl_read_prph(priv, reg) & mask) | bits))
 
-#ifdef CONFIG_IWLWIFI_DEBUG
-static inline void __iwl_set_bits_mask_prph(const char *f, u32 line,
-                struct iwl_priv *priv, u32 reg, u32 bits, u32 mask)
+static inline void iwl_set_bits_mask_prph(struct iwl_priv *priv, u32 reg,
+                                u32 bits, u32 mask)
 {
-        if (!atomic_read(&priv->restrict_refcnt))
-                IWL_ERR(priv, "Nic access not held from %s line %d\n", f, line);
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
         _iwl_set_bits_mask_prph(priv, reg, bits, mask);
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
-#define iwl_set_bits_mask_prph(priv, reg, bits, mask) \
-        __iwl_set_bits_mask_prph(__func__, __LINE__, priv, reg, bits, mask)
-#else
-#define iwl_set_bits_mask_prph _iwl_set_bits_mask_prph
-#endif
 
 static inline void iwl_clear_bits_prph(struct iwl_priv
                                                  *priv, u32 reg, u32 mask)
 {
-        u32 val = _iwl_read_prph(priv, reg);
+        unsigned long reg_flags;
+        u32 val;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+        val = _iwl_read_prph(priv, reg);
         _iwl_write_prph(priv, reg, (val & ~mask));
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
 
 static inline u32 iwl_read_targ_mem(struct iwl_priv *priv, u32 addr)
 {
-        iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, addr);
+        unsigned long reg_flags;
+        u32 value;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        iwl_grab_nic_access(priv);
+
+        _iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR, addr);
         rmb();
-        return iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+        value = _iwl_read_direct32(priv, HBUS_TARG_MEM_RDAT);
+
+        iwl_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
+        return value;
 }
 
 static inline void iwl_write_targ_mem(struct iwl_priv *priv, u32 addr, u32 val)
 {
-        iwl_write_direct32(priv, HBUS_TARG_MEM_WADDR, addr);
-        wmb();
-        iwl_write_direct32(priv, HBUS_TARG_MEM_WDAT, val);
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (!iwl_grab_nic_access(priv)) {
+                _iwl_write_direct32(priv, HBUS_TARG_MEM_WADDR, addr);
+                wmb();
+                _iwl_write_direct32(priv, HBUS_TARG_MEM_WDAT, val);
+                iwl_release_nic_access(priv);
+        }
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
 
 static inline void iwl_write_targ_mem_buf(struct iwl_priv *priv, u32 addr,
                                           u32 len, u32 *values)
 {
-        iwl_write_direct32(priv, HBUS_TARG_MEM_WADDR, addr);
-        wmb();
-        for (; 0 < len; len -= sizeof(u32), values++)
-                iwl_write_direct32(priv, HBUS_TARG_MEM_WDAT, *values);
+        unsigned long reg_flags;
+
+        spin_lock_irqsave(&priv->reg_lock, reg_flags);
+        if (!iwl_grab_nic_access(priv)) {
+                _iwl_write_direct32(priv, HBUS_TARG_MEM_WADDR, addr);
+                wmb();
+                for (; 0 < len; len -= sizeof(u32), values++)
+                        _iwl_write_direct32(priv, HBUS_TARG_MEM_WDAT, *values);
+
+                iwl_release_nic_access(priv);
+        }
+        spin_unlock_irqrestore(&priv->reg_lock, reg_flags);
 }
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index 19680f72087f..5e64252f80f6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -176,10 +176,6 @@ static int iwl_led_associate(struct iwl_priv *priv, int led_id)
 static int iwl_led_disassociate(struct iwl_priv *priv, int led_id)
 {
         priv->allow_blinking = 0;
-        if (iwl_is_rfkill(priv))
-                iwl4965_led_off_reg(priv, led_id);
-        else
-                iwl4965_led_on_reg(priv, led_id);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 47c894530eb5..f2ea3f05f6e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -41,38 +41,33 @@
 #include "iwl-power.h"
 
 /*
- * Setting power level allow the card to go to sleep when not busy
- * there are three factor that decide the power level to go to, they
- * are list here with its priority
- *  1- critical_power_setting this will be set according to card temperature.
- *  2- system_power_setting this will be set by system PM manager.
- *  3- user_power_setting this will be set by user either by writing to sys or
- *      mac80211
+ * Setting power level allow the card to go to sleep when not busy.
  *
- * if system_power_setting and user_power_setting is set to auto
- * the power level will be decided according to association status and battery
- * status.
+ * The power level is set to INDEX_1 (the least deep state) by
+ * default, and will, in the future, be the deepest state unless
+ * otherwise required by pm_qos network latency requirements.
  *
+ * Using INDEX_1 without pm_qos is ok because mac80211 will disable
+ * PS when even checking every beacon for the TIM bit would exceed
+ * the required latency.
  */
 
-#define MSEC_TO_USEC 1024
 #define IWL_POWER_RANGE_0_MAX  (2)
 #define IWL_POWER_RANGE_1_MAX  (10)
 
 
-
-#define IWL_POWER_ON_BATTERY            IWL_POWER_INDEX_5
-#define IWL_POWER_ON_AC_DISASSOC        IWL_POWER_MODE_CAM
-#define IWL_POWER_ON_AC_ASSOC           IWL_POWER_MODE_CAM
-
-
-#define IWL_CT_KILL_TEMPERATURE         110
-#define IWL_MIN_POWER_TEMPERATURE       100
-#define IWL_REDUCED_POWER_TEMPERATURE   95
-
+#define NOSLP cpu_to_le16(0), 0, 0
+#define SLP IWL_POWER_DRIVER_ALLOW_SLEEP_MSK, 0, 0
+#define TU_TO_USEC 1024
+#define SLP_TOUT(T) cpu_to_le32((T) * TU_TO_USEC)
+#define SLP_VEC(X0, X1, X2, X3, X4) {cpu_to_le32(X0), \
+                                     cpu_to_le32(X1), \
+                                     cpu_to_le32(X2), \
+                                     cpu_to_le32(X3), \
+                                     cpu_to_le32(X4)}
 /* default power management (not Tx power) table values */
-/* for TIM  0-10 */
-static struct iwl_power_vec_entry range_0[IWL_POWER_MAX] = {
+/* for DTIM period 0 through IWL_POWER_RANGE_0_MAX */
+static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
         {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
@@ -82,8 +77,8 @@ static struct iwl_power_vec_entry range_0[IWL_POWER_MAX] = {
 };
 
 
-/* for TIM = 3-10 */
-static struct iwl_power_vec_entry range_1[IWL_POWER_MAX] = {
+/* for DTIM period IWL_POWER_RANGE_0_MAX + 1 through IWL_POWER_RANGE_1_MAX */
+static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
         {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 3, 4, 7)}, 0},
@@ -92,8 +87,8 @@ static struct iwl_power_vec_entry range_1[IWL_POWER_MAX] = {
         {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 7, 10, 10)}, 2}
 };
 
-/* for TIM > 11 */
-static struct iwl_power_vec_entry range_2[IWL_POWER_MAX] = {
+/* for DTIM period > IWL_POWER_RANGE_1_MAX */
+static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
         {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
@@ -106,39 +101,15 @@ static struct iwl_power_vec_entry range_2[IWL_POWER_MAX] = {
 /* set card power command */
 static int iwl_set_power(struct iwl_priv *priv, void *cmd)
 {
-        return iwl_send_cmd_pdu_async(priv, POWER_TABLE_CMD,
-                                      sizeof(struct iwl_powertable_cmd),
-                                      cmd, NULL);
-}
-/* decide the right power level according to association status
- * and battery status
- */
-static u16 iwl_get_auto_power_mode(struct iwl_priv *priv)
-{
-        u16 mode;
-
-        switch (priv->power_data.user_power_setting) {
-        case IWL_POWER_AUTO:
-                /* if running on battery */
-                if (priv->power_data.is_battery_active)
-                        mode = IWL_POWER_ON_BATTERY;
-                else if (iwl_is_associated(priv))
-                        mode = IWL_POWER_ON_AC_ASSOC;
-                else
-                        mode = IWL_POWER_ON_AC_DISASSOC;
-                break;
-        default:
-                mode = priv->power_data.user_power_setting;
-                break;
-        }
-        return mode;
+        return iwl_send_cmd_pdu(priv, POWER_TABLE_CMD,
+                                sizeof(struct iwl_powertable_cmd), cmd);
 }
 
 /* initialize to default */
 static void iwl_power_init_handle(struct iwl_priv *priv)
 {
         struct iwl_power_mgr *pow_data;
-        int size = sizeof(struct iwl_power_vec_entry) * IWL_POWER_MAX;
+        int size = sizeof(struct iwl_power_vec_entry) * IWL_POWER_NUM;
         struct iwl_powertable_cmd *cmd;
         int i;
         u16 lctl;
@@ -157,7 +128,7 @@ static void iwl_power_init_handle(struct iwl_priv *priv)
 
         IWL_DEBUG_POWER(priv, "adjust power command flags\n");
 
-        for (i = 0; i < IWL_POWER_MAX; i++) {
+        for (i = 0; i < IWL_POWER_NUM; i++) {
                 cmd = &pow_data->pwr_range_0[i].cmd;
 
                 if (lctl & PCI_CFG_LINK_CTRL_VAL_L0S_EN)
@@ -247,33 +218,12 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
         update_chains = priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE ||
                         priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
 
-        /* If on battery, set to 3,
-         * if plugged into AC power, set to CAM ("continuously aware mode"),
-         * else user level */
-
-        switch (setting->system_power_setting) {
-        case IWL_POWER_SYS_AUTO:
-                final_mode = iwl_get_auto_power_mode(priv);
-                break;
-        case IWL_POWER_SYS_BATTERY:
-                final_mode = IWL_POWER_INDEX_3;
-                break;
-        case IWL_POWER_SYS_AC:
-                final_mode = IWL_POWER_MODE_CAM;
-                break;
-        default:
-                final_mode = IWL_POWER_INDEX_3;
-                WARN_ON(1);
-        }
-
-        if (setting->critical_power_setting > final_mode)
-                final_mode = setting->critical_power_setting;
+        final_mode = priv->power_data.user_power_setting;
 
-        /* driver only support CAM for non STA network */
-        if (priv->iw_mode != NL80211_IFTYPE_STATION)
+        if (setting->power_disabled)
                 final_mode = IWL_POWER_MODE_CAM;
 
-        if (iwl_is_ready_rf(priv) && !setting->power_disabled &&
+        if (iwl_is_ready_rf(priv) &&
             ((setting->power_mode != final_mode) || force)) {
                 struct iwl_powertable_cmd cmd;
 
@@ -290,8 +240,6 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 
                 if (final_mode == IWL_POWER_MODE_CAM)
                         clear_bit(STATUS_POWER_PMI, &priv->status);
-                else
-                        set_bit(STATUS_POWER_PMI, &priv->status);
 
                 if (priv->cfg->ops->lib->update_chain_flags && update_chains)
                         priv->cfg->ops->lib->update_chain_flags(priv);
@@ -307,51 +255,10 @@ int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 }
 EXPORT_SYMBOL(iwl_power_update_mode);
 
-/* Allow other iwl code to disable/enable power management active
- * this will be useful for rate scale to disable PM during heavy
- * Tx/Rx activities
- */
-int iwl_power_disable_management(struct iwl_priv *priv, u32 ms)
-{
-        u16 prev_mode;
-        int ret = 0;
-
-        if (priv->power_data.power_disabled)
-                return -EBUSY;
-
-        prev_mode = priv->power_data.user_power_setting;
-        priv->power_data.user_power_setting = IWL_POWER_MODE_CAM;
-        ret = iwl_power_update_mode(priv, 0);
-        priv->power_data.power_disabled = 1;
-        priv->power_data.user_power_setting = prev_mode;
-        cancel_delayed_work(&priv->set_power_save);
-        if (ms)
-                queue_delayed_work(priv->workqueue, &priv->set_power_save,
-                                   msecs_to_jiffies(ms));
-
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_power_disable_management);
-
-/* Allow other iwl code to disable/enable power management active
- * this will be useful for rate scale to disable PM during high
- * volume activities
- */
-int iwl_power_enable_management(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        priv->power_data.power_disabled = 0;
-        ret = iwl_power_update_mode(priv, 0);
-        return ret;
-}
-EXPORT_SYMBOL(iwl_power_enable_management);
-
 /* set user_power_setting */
 int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode)
 {
-        if (mode > IWL_POWER_MAX)
+        if (mode >= IWL_POWER_NUM)
                 return -EINVAL;
 
         priv->power_data.user_power_setting = mode;
@@ -360,86 +267,12 @@ int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode)
 }
 EXPORT_SYMBOL(iwl_power_set_user_mode);
 
-/* set system_power_setting. This should be set by over all
- * PM application.
- */
-int iwl_power_set_system_mode(struct iwl_priv *priv, u16 mode)
-{
-        if (mode < IWL_POWER_SYS_MAX)
-                priv->power_data.system_power_setting = mode;
-        else
-                return -EINVAL;
-        return iwl_power_update_mode(priv, 0);
-}
-EXPORT_SYMBOL(iwl_power_set_system_mode);
-
 /* initialize to default */
 void iwl_power_initialize(struct iwl_priv *priv)
 {
         iwl_power_init_handle(priv);
-        priv->power_data.user_power_setting = IWL_POWER_AUTO;
-        priv->power_data.system_power_setting = IWL_POWER_SYS_AUTO;
-        priv->power_data.power_disabled = 0;
-        priv->power_data.is_battery_active = 0;
-        priv->power_data.critical_power_setting = 0;
+        priv->power_data.user_power_setting = IWL_POWER_INDEX_1;
+        /* default to disabled until mac80211 says otherwise */
+        priv->power_data.power_disabled = 1;
 }
 EXPORT_SYMBOL(iwl_power_initialize);
-
-/* set critical_power_setting according to temperature value */
-int iwl_power_temperature_change(struct iwl_priv *priv)
-{
-        int ret = 0;
-        s32 temperature = KELVIN_TO_CELSIUS(priv->last_temperature);
-        u16 new_critical = priv->power_data.critical_power_setting;
-
-        if (temperature > IWL_CT_KILL_TEMPERATURE)
-                return 0;
-        else if (temperature > IWL_MIN_POWER_TEMPERATURE)
-                new_critical = IWL_POWER_INDEX_5;
-        else if (temperature > IWL_REDUCED_POWER_TEMPERATURE)
-                new_critical = IWL_POWER_INDEX_3;
-        else
-                new_critical = IWL_POWER_MODE_CAM;
-
-        if (new_critical != priv->power_data.critical_power_setting)
-                priv->power_data.critical_power_setting = new_critical;
-
-        if (priv->power_data.critical_power_setting >
-                                priv->power_data.power_mode)
-                ret = iwl_power_update_mode(priv, 0);
-
-        return ret;
-}
-EXPORT_SYMBOL(iwl_power_temperature_change);
-
-static void iwl_bg_set_power_save(struct work_struct *work)
-{
-        struct iwl_priv *priv = container_of(work,
-                                struct iwl_priv, set_power_save.work);
-        IWL_DEBUG_POWER(priv, "update power\n");
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        mutex_lock(&priv->mutex);
-
-        /* on starting association we disable power management
-         * until association, if association failed then this
-         * timer will expire and enable PM again.
-         */
-        if (!iwl_is_associated(priv))
-                iwl_power_enable_management(priv);
-
-        mutex_unlock(&priv->mutex);
-}
-void iwl_setup_power_deferred_work(struct iwl_priv *priv)
-{
-        INIT_DELAYED_WORK(&priv->set_power_save, iwl_bg_set_power_save);
-}
-EXPORT_SYMBOL(iwl_setup_power_deferred_work);
-
-void iwl_power_cancel_timeout(struct iwl_priv *priv)
-{
-        cancel_delayed_work(&priv->set_power_save);
-}
-EXPORT_SYMBOL(iwl_power_cancel_timeout);
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index 18963392121e..37ba3bb7a25a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -40,56 +40,29 @@ enum {
         IWL_POWER_INDEX_3,
         IWL_POWER_INDEX_4,
         IWL_POWER_INDEX_5,
-        IWL_POWER_AUTO,
-        IWL_POWER_MAX = IWL_POWER_AUTO,
+        IWL_POWER_NUM
 };
 
-enum {
-        IWL_POWER_SYS_AUTO,
-        IWL_POWER_SYS_AC,
-        IWL_POWER_SYS_BATTERY,
-        IWL_POWER_SYS_MAX,
-};
-
-
 /* Power management (not Tx power) structures */
 
-#define NOSLP cpu_to_le16(0), 0, 0
-#define SLP IWL_POWER_DRIVER_ALLOW_SLEEP_MSK, 0, 0
-#define SLP_TOUT(T) cpu_to_le32((T) * MSEC_TO_USEC)
-#define SLP_VEC(X0, X1, X2, X3, X4) {cpu_to_le32(X0), \
-                                     cpu_to_le32(X1), \
-                                     cpu_to_le32(X2), \
-                                     cpu_to_le32(X3), \
-                                     cpu_to_le32(X4)}
 struct iwl_power_vec_entry {
         struct iwl_powertable_cmd cmd;
         u8 no_dtim;
 };
 
 struct iwl_power_mgr {
-        spinlock_t lock;
-        struct iwl_power_vec_entry pwr_range_0[IWL_POWER_MAX];
-        struct iwl_power_vec_entry pwr_range_1[IWL_POWER_MAX];
-        struct iwl_power_vec_entry pwr_range_2[IWL_POWER_MAX];
+        struct iwl_power_vec_entry pwr_range_0[IWL_POWER_NUM];
+        struct iwl_power_vec_entry pwr_range_1[IWL_POWER_NUM];
+        struct iwl_power_vec_entry pwr_range_2[IWL_POWER_NUM];
         u32 dtim_period;
         /* final power level that used to calculate final power command */
         u8 power_mode;
-        u8 user_power_setting; /* set by user through mac80211 or sysfs */
-        u8 system_power_setting; /* set by kernel system tools */
-        u8 critical_power_setting; /* set if driver over heated */
-        u8 is_battery_active; /* DC/AC power */
-        u8 power_disabled; /* flag to disable using power saving level */
+        u8 user_power_setting; /* set by user through sysfs */
+        u8 power_disabled; /* set by mac80211's CONF_PS */
 };
 
-void iwl_setup_power_deferred_work(struct iwl_priv *priv);
-void iwl_power_cancel_timeout(struct iwl_priv *priv);
 int iwl_power_update_mode(struct iwl_priv *priv, bool force);
-int iwl_power_disable_management(struct iwl_priv *priv, u32 ms);
-int iwl_power_enable_management(struct iwl_priv *priv);
 int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode);
-int iwl_power_set_system_mode(struct iwl_priv *priv, u16 mode);
 void iwl_power_initialize(struct iwl_priv *priv);
-int iwl_power_temperature_change(struct iwl_priv *priv);
 
 #endif  /* __iwl_power_setting_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-rfkill.c b/drivers/net/wireless/iwlwifi/iwl-rfkill.c
deleted file mode 100644
index 2ad9faf1508a..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-rfkill.c
+++ /dev/null
@@ -1,145 +0,0 @@
-/******************************************************************************
- *
- * Copyright(c) 2003 - 2009 Intel Corporation. All rights reserved.
- *
- * Portions of this file are derived from the ipw3945 project, as well
- * as portions of the ieee80211 subsystem header files.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *****************************************************************************/
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-
-#include <net/mac80211.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-core.h"
-
-/* software rf-kill from user */
-static int iwl_rfkill_soft_rf_kill(void *data, enum rfkill_state state)
-{
-        struct iwl_priv *priv = data;
-        int err = 0;
-
-        if (!priv->rfkill)
-                return 0;
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return 0;
-
-        IWL_DEBUG_RF_KILL(priv, "we received soft RFKILL set to state %d\n", state);
-        mutex_lock(&priv->mutex);
-
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (iwl_is_rfkill_hw(priv)) {
-                        err = -EBUSY;
-                        goto out_unlock;
-                }
-                iwl_radio_kill_sw_enable_radio(priv);
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                iwl_radio_kill_sw_disable_radio(priv);
-                break;
-        default:
-                IWL_WARN(priv, "we received unexpected RFKILL state %d\n",
-                        state);
-                break;
-        }
-out_unlock:
-        mutex_unlock(&priv->mutex);
-
-        return err;
-}
-
-int iwl_rfkill_init(struct iwl_priv *priv)
-{
-        struct device *device = wiphy_dev(priv->hw->wiphy);
-        int ret = 0;
-
-        BUG_ON(device == NULL);
-
-        IWL_DEBUG_RF_KILL(priv, "Initializing RFKILL.\n");
-        priv->rfkill = rfkill_allocate(device, RFKILL_TYPE_WLAN);
-        if (!priv->rfkill) {
-                IWL_ERR(priv, "Unable to allocate RFKILL device.\n");
-                ret = -ENOMEM;
-                goto error;
-        }
-
-        priv->rfkill->name = priv->cfg->name;
-        priv->rfkill->data = priv;
-        priv->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        priv->rfkill->toggle_radio = iwl_rfkill_soft_rf_kill;
-        priv->rfkill->user_claim_unsupported = 1;
-
-        priv->rfkill->dev.class->suspend = NULL;
-        priv->rfkill->dev.class->resume = NULL;
-
-        ret = rfkill_register(priv->rfkill);
-        if (ret) {
-                IWL_ERR(priv, "Unable to register RFKILL: %d\n", ret);
-                goto free_rfkill;
-        }
-
-        IWL_DEBUG_RF_KILL(priv, "RFKILL initialization complete.\n");
-        return ret;
-
-free_rfkill:
-        if (priv->rfkill != NULL)
-                rfkill_free(priv->rfkill);
-        priv->rfkill = NULL;
-
-error:
-        IWL_DEBUG_RF_KILL(priv, "RFKILL initialization complete.\n");
-        return ret;
-}
-EXPORT_SYMBOL(iwl_rfkill_init);
-
-void iwl_rfkill_unregister(struct iwl_priv *priv)
-{
-
-        if (priv->rfkill)
-                rfkill_unregister(priv->rfkill);
-
-        priv->rfkill = NULL;
-}
-EXPORT_SYMBOL(iwl_rfkill_unregister);
-
-/* set RFKILL to the right state. */
-void iwl_rfkill_set_hw_state(struct iwl_priv *priv)
-{
-        if (!priv->rfkill)
-                return;
-
-        if (iwl_is_rfkill_hw(priv)) {
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_HARD_BLOCKED);
-                return;
-        }
-
-        if (!iwl_is_rfkill_sw(priv))
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_UNBLOCKED);
-        else
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_SOFT_BLOCKED);
-}
-EXPORT_SYMBOL(iwl_rfkill_set_hw_state);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rfkill.h b/drivers/net/wireless/iwlwifi/iwl-rfkill.h
deleted file mode 100644
index 633dafb4bf1b..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-rfkill.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
- *
- * Portions of this file are derived from the ipw3945 project, as well
- * as portions of the ieee80211 subsystem header files.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *****************************************************************************/
-#ifndef __iwl_rf_kill_h__
-#define __iwl_rf_kill_h__
-
-struct iwl_priv;
-
-#include <linux/rfkill.h>
-
-#ifdef CONFIG_IWLWIFI_RFKILL
-
-void iwl_rfkill_set_hw_state(struct iwl_priv *priv);
-void iwl_rfkill_unregister(struct iwl_priv *priv);
-int iwl_rfkill_init(struct iwl_priv *priv);
-#else
-static inline void iwl_rfkill_set_hw_state(struct iwl_priv *priv) {}
-static inline void iwl_rfkill_unregister(struct iwl_priv *priv) {}
-static inline int iwl_rfkill_init(struct iwl_priv *priv) { return 0; }
-#endif
-
-
-
-#endif  /* __iwl_rf_kill_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 8f65908f66f1..2b8d40b37a1c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -145,18 +145,14 @@ int iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q)
                         goto exit_unlock;
                 }
 
-                ret = iwl_grab_nic_access(priv);
-                if (ret)
-                        goto exit_unlock;
-
-                /* Device expects a multiple of 8 */
-                iwl_write_direct32(priv, rx_wrt_ptr_reg, q->write & ~0x7);
-                iwl_release_nic_access(priv);
+                q->write_actual = (q->write & ~0x7);
+                iwl_write_direct32(priv, rx_wrt_ptr_reg, q->write_actual);
 
         /* Else device is assumed to be awake */
         } else {
                 /* Device expects a multiple of 8 */
-                iwl_write32(priv, rx_wrt_ptr_reg, q->write & ~0x7);
+                q->write_actual = (q->write & ~0x7);
+                iwl_write_direct32(priv, rx_wrt_ptr_reg, q->write_actual);
         }
 
         q->need_update = 0;
@@ -218,7 +214,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
 
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
-        if (write != (rxq->write & ~0x7)) {
+        if (rxq->write_actual != (rxq->write & ~0x7)) {
                 spin_lock_irqsave(&rxq->lock, flags);
                 rxq->need_update = 1;
                 spin_unlock_irqrestore(&rxq->lock, flags);
@@ -238,7 +234,7 @@ EXPORT_SYMBOL(iwl_rx_queue_restock);
  * Also restock the Rx queue via iwl_rx_queue_restock.
  * This is called as a scheduled work item (except for during initialization)
  */
-void iwl_rx_allocate(struct iwl_priv *priv)
+void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
@@ -260,7 +256,8 @@ void iwl_rx_allocate(struct iwl_priv *priv)
 
                 /* Alloc a new receive buffer */
                 rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
-                                     GFP_KERNEL);
+                                                priority);
+
                 if (!rxb->skb) {
                         IWL_CRIT(priv, "Can not allocate SKB buffers\n");
                         /* We don't reschedule replenish work here -- we will
@@ -295,7 +292,7 @@ void iwl_rx_replenish(struct iwl_priv *priv)
 {
         unsigned long flags;
 
-        iwl_rx_allocate(priv);
+        iwl_rx_allocate(priv, GFP_KERNEL);
 
         spin_lock_irqsave(&priv->lock, flags);
         iwl_rx_queue_restock(priv);
@@ -303,6 +300,14 @@ void iwl_rx_replenish(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_rx_replenish);
 
+void iwl_rx_replenish_now(struct iwl_priv *priv)
+{
+        iwl_rx_allocate(priv, GFP_ATOMIC);
+
+        iwl_rx_queue_restock(priv);
+}
+EXPORT_SYMBOL(iwl_rx_replenish_now);
+
 
 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
@@ -358,6 +363,7 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
         /* Set us so that we have processed and used all buffers, but have
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
+        rxq->write_actual = 0;
         rxq->free_count = 0;
         rxq->need_update = 0;
         return 0;
@@ -396,6 +402,7 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         /* Set us so that we have processed and used all buffers, but have
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
+        rxq->write_actual = 0;
         rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
@@ -403,18 +410,12 @@ EXPORT_SYMBOL(iwl_rx_queue_reset);
 
 int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
-        int ret;
-        unsigned long flags;
         u32 rb_size;
         const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
-        const u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT why this stalls RX */
+        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
 
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (ret) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
+        if (!priv->cfg->use_isr_legacy)
+                rb_timeout = RX_RB_TIMEOUT;
 
         if (priv->cfg->mod_params->amsdu_size_8K)
                 rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
@@ -452,35 +453,19 @@ int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                            (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
                            (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
 
-        iwl_release_nic_access(priv);
-
         iwl_write32(priv, CSR_INT_COALESCING, 0x40);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return 0;
 }
 
 int iwl_rxq_stop(struct iwl_priv *priv)
 {
-        int ret;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (unlikely(ret)) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return ret;
-        }
 
         /* stop Rx DMA */
         iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
         iwl_poll_direct_bit(priv, FH_MEM_RSSR_RX_STATUS_REG,
                             FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
 
-        iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return 0;
 }
 EXPORT_SYMBOL(iwl_rxq_stop);
@@ -582,8 +567,8 @@ void iwl_rx_statistics(struct iwl_priv *priv,
 
         iwl_leds_background(priv);
 
-        if (priv->cfg->ops->lib->temperature && change)
-                priv->cfg->ops->lib->temperature(priv);
+        if (priv->cfg->ops->lib->temp_ops.temperature && change)
+                priv->cfg->ops->lib->temp_ops.temperature(priv);
 }
 EXPORT_SYMBOL(iwl_rx_statistics);
 
@@ -1102,13 +1087,6 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
         if (rx_start->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
                 rx_status.flag |= RX_FLAG_SHORTPRE;
 
-        /* Take shortcut when only in monitor mode */
-        if (priv->iw_mode == NL80211_IFTYPE_MONITOR) {
-                iwl_pass_packet_to_mac80211(priv, include_phy,
-                                                 rxb, &rx_status);
-                return;
-        }
-
         network_packet = iwl_is_network_packet(priv, header);
         if (network_packet) {
                 priv->last_rx_rssi = rx_status.signal;
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 6330b91e37ce..e26875dbe859 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -445,13 +445,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
         unsigned long flags;
         struct iwl_priv *priv = hw->priv;
         int ret;
-        u8 *ssid = NULL;
-        size_t ssid_len = 0;
-
-        if (req->n_ssids) {
-                ssid = req->ssids[0].ssid;
-                ssid_len = req->ssids[0].ssid_len;
-        }
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
@@ -485,13 +478,7 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        if (ssid_len) {
-                priv->one_direct_scan = 1;
-                priv->direct_ssid_len =  ssid_len;
-                memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
-        } else {
-                priv->one_direct_scan = 0;
-        }
+        priv->scan_request = req;
 
         ret = iwl_scan_initiate(priv);
 
@@ -530,73 +517,14 @@ void iwl_bg_scan_check(struct work_struct *data)
 EXPORT_SYMBOL(iwl_bg_scan_check);
 
 /**
- * iwl_supported_rate_to_ie - fill in the supported rate in IE field
- *
- * return : set the bit for each supported rate insert in ie
- */
-static u16 iwl_supported_rate_to_ie(u8 *ie, u16 supported_rate,
-                                    u16 basic_rate, int *left)
-{
-        u16 ret_rates = 0, bit;
-        int i;
-        u8 *cnt = ie;
-        u8 *rates = ie + 1;
-
-        for (bit = 1, i = 0; i < IWL_RATE_COUNT; i++, bit <<= 1) {
-                if (bit & supported_rate) {
-                        ret_rates |= bit;
-                        rates[*cnt] = iwl_rates[i].ieee |
-                                ((bit & basic_rate) ? 0x80 : 0x00);
-                        (*cnt)++;
-                        (*left)--;
-                        if ((*left <= 0) ||
-                            (*cnt >= IWL_SUPPORTED_RATES_IE_LEN))
-                                break;
-                }
-        }
-
-        return ret_rates;
-}
-
-
-static void iwl_ht_cap_to_ie(const struct ieee80211_supported_band *sband,
-                             u8 *pos, int *left)
-{
-        struct ieee80211_ht_cap *ht_cap;
-
-        if (!sband || !sband->ht_cap.ht_supported)
-                return;
-
-        if (*left < sizeof(struct ieee80211_ht_cap))
-                return;
-
-        *pos++ = sizeof(struct ieee80211_ht_cap);
-        ht_cap = (struct ieee80211_ht_cap *) pos;
-
-        ht_cap->cap_info = cpu_to_le16(sband->ht_cap.cap);
-        memcpy(&ht_cap->mcs, &sband->ht_cap.mcs, 16);
-        ht_cap->ampdu_params_info =
-                (sband->ht_cap.ampdu_factor & IEEE80211_HT_AMPDU_PARM_FACTOR) |
-                ((sband->ht_cap.ampdu_density << 2) &
-                        IEEE80211_HT_AMPDU_PARM_DENSITY);
-        *left -= sizeof(struct ieee80211_ht_cap);
-}
-
-/**
  * iwl_fill_probe_req - fill in all required fields and IE for probe request
  */
 
-u16 iwl_fill_probe_req(struct iwl_priv *priv,
-                       enum ieee80211_band band,
-                       struct ieee80211_mgmt *frame,
-                       int left)
+u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
+                       const u8 *ies, int ie_len, int left)
 {
         int len = 0;
         u8 *pos = NULL;
-        u16 active_rates, ret_rates, cck_rates, active_rate_basic;
-        const struct ieee80211_supported_band *sband =
-                                                iwl_get_hw_mode(priv, band);
-
 
         /* Make sure there is enough space for the probe request,
          * two mandatory IEs and the data */
@@ -624,62 +552,12 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv,
 
         len += 2;
 
-        /* fill in supported rate */
-        left -= 2;
-        if (left < 0)
-                return 0;
-
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos = 0;
-
-        /* exclude 60M rate */
-        active_rates = priv->rates_mask;
-        active_rates &= ~IWL_RATE_60M_MASK;
-
-        active_rate_basic = active_rates & IWL_BASIC_RATES_MASK;
-
-        cck_rates = IWL_CCK_RATES_MASK & active_rates;
-        ret_rates = iwl_supported_rate_to_ie(pos, cck_rates,
-                                             active_rate_basic, &left);
-        active_rates &= ~ret_rates;
-
-        ret_rates = iwl_supported_rate_to_ie(pos, active_rates,
-                                             active_rate_basic, &left);
-        active_rates &= ~ret_rates;
-
-        len += 2 + *pos;
-        pos += (*pos) + 1;
+        if (WARN_ON(left < ie_len))
+                return len;
 
-        if (active_rates == 0)
-                goto fill_end;
-
-        /* fill in supported extended rate */
-        /* ...next IE... */
-        left -= 2;
-        if (left < 0)
-                return 0;
-        /* ... fill it in... */
-        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-        *pos = 0;
-        iwl_supported_rate_to_ie(pos, active_rates, active_rate_basic, &left);
-        if (*pos > 0) {
-                len += 2 + *pos;
-                pos += (*pos) + 1;
-        } else {
-                pos--;
-        }
-
- fill_end:
-
-        left -= 2;
-        if (left < 0)
-                return 0;
-
-        *pos++ = WLAN_EID_HT_CAPABILITY;
-        *pos = 0;
-        iwl_ht_cap_to_ie(sband, pos, &left);
-        if (*pos > 0)
-                len += 2 + *pos;
+        memcpy(pos, ies, ie_len);
+        len += ie_len;
+        left -= ie_len;
 
         return (u16)len;
 }
@@ -699,11 +577,13 @@ static void iwl_bg_request_scan(struct work_struct *data)
         int ret = 0;
         u32 rate_flags = 0;
         u16 cmd_len;
+        u16 rx_chain = 0;
         enum ieee80211_band band;
-        u8 n_probes = 2;
-        u8 rx_chain = priv->hw_params.valid_rx_ant;
+        u8 n_probes = 0;
+        u8 rx_ant = priv->hw_params.valid_rx_ant;
         u8 rate;
-        DECLARE_SSID_BUF(ssid);
+        bool is_active = false;
+        int  chan_mod;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -795,19 +675,25 @@ static void iwl_bg_request_scan(struct work_struct *data)
                                scan_suspend_time, interval);
         }
 
-        /* We should add the ability for user to lock to PASSIVE ONLY */
-        if (priv->one_direct_scan) {
-                IWL_DEBUG_SCAN(priv, "Start direct scan for '%s'\n",
-                                print_ssid(ssid, priv->direct_ssid,
-                                           priv->direct_ssid_len));
-                scan->direct_scan[0].id = WLAN_EID_SSID;
-                scan->direct_scan[0].len = priv->direct_ssid_len;
-                memcpy(scan->direct_scan[0].ssid,
-                       priv->direct_ssid, priv->direct_ssid_len);
-                n_probes++;
-        } else {
-                IWL_DEBUG_SCAN(priv, "Start indirect scan.\n");
-        }
+        if (priv->scan_request->n_ssids) {
+                int i, p = 0;
+                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+                for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                        /* always does wildcard anyway */
+                        if (!priv->scan_request->ssids[i].ssid_len)
+                                continue;
+                        scan->direct_scan[p].id = WLAN_EID_SSID;
+                        scan->direct_scan[p].len =
+                                priv->scan_request->ssids[i].ssid_len;
+                        memcpy(scan->direct_scan[p].ssid,
+                               priv->scan_request->ssids[i].ssid,
+                               priv->scan_request->ssids[i].ssid_len);
+                        n_probes++;
+                        p++;
+                }
+                is_active = true;
+        } else
+                IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
 
         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
         scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
@@ -817,7 +703,9 @@ static void iwl_bg_request_scan(struct work_struct *data)
         if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
                 band = IEEE80211_BAND_2GHZ;
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
-                if (priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_PURE_40_MSK) {
+                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
+                                       >> RXON_FLG_CHANNEL_MODE_POS;
+                if (chan_mod == CHANNEL_MODE_PURE_40) {
                         rate = IWL_RATE_6M_PLCP;
                 } else {
                         rate = IWL_RATE_1M_PLCP;
@@ -827,13 +715,18 @@ static void iwl_bg_request_scan(struct work_struct *data)
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
-                scan->good_CRC_th = IWL_GOOD_CRC_TH;
+                /*
+                 * If active scaning is requested but a certain channel
+                 * is marked passive, we can do active scanning if we
+                 * detect transmissions.
+                 */
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
                  */
                 if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
-                        rx_chain = 0x6;
+                        rx_ant = ANT_BC;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
                 goto done;
@@ -845,26 +738,27 @@ static void iwl_bg_request_scan(struct work_struct *data)
         scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
 
         /* MIMO is not used here, but value is required */
-        scan->rx_chain = RXON_RX_CHAIN_DRIVER_FORCE_MSK |
-                                cpu_to_le16((0x7 << RXON_RX_CHAIN_VALID_POS) |
-                                (rx_chain << RXON_RX_CHAIN_FORCE_SEL_POS) |
-                                (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
-
-        cmd_len = iwl_fill_probe_req(priv, band,
-                                     (struct ieee80211_mgmt *)scan->data,
-                                     IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        rx_chain |= ANT_ABC << RXON_RX_CHAIN_VALID_POS;
+        rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
+        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
+        scan->rx_chain = cpu_to_le16(rx_chain);
+        cmd_len = iwl_fill_probe_req(priv,
+                                (struct ieee80211_mgmt *)scan->data,
+                                priv->scan_request->ie,
+                                priv->scan_request->ie_len,
+                                IWL_MAX_SCAN_SIZE - sizeof(*scan));
 
         scan->tx_cmd.len = cpu_to_le16(cmd_len);
 
-        if (priv->iw_mode == NL80211_IFTYPE_MONITOR)
+        if (iwl_is_monitor_mode(priv))
                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
 
         scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
                                RXON_FILTER_BCON_AWARE_MSK);
 
         scan->channel_count =
-                iwl_get_channels_for_scan(priv, band, 1, /* active */
-                        n_probes,
+                iwl_get_channels_for_scan(priv, band, is_active, n_probes,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
         if (scan->channel_count == 0) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 44ab03a12e40..2addf735b193 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -86,8 +86,7 @@ static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
-            !(priv->stations_39[sta_id].used & IWL_STA_DRIVER_ACTIVE))
+        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
                 IWL_ERR(priv, "ACTIVATE a non DRIVER active station %d\n",
                         sta_id);
 
@@ -228,15 +227,16 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
 }
 
 /**
- * iwl_add_station_flags - Add station to tables in driver and device
+ * iwl_add_station - Add station to tables in driver and device
  */
-u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
-                         u8 flags, struct ieee80211_sta_ht_cap *ht_info)
+u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
+                struct ieee80211_sta_ht_cap *ht_info)
 {
-        int i;
-        int sta_id = IWL_INVALID_STATION;
         struct iwl_station_entry *station;
         unsigned long flags_spin;
+        int i;
+        int sta_id = IWL_INVALID_STATION;
+        u16 rate;
 
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
         if (is_ap)
@@ -288,6 +288,12 @@ u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
             priv->iw_mode != NL80211_IFTYPE_ADHOC)
                 iwl_set_ht_add_station(priv, sta_id, ht_info);
 
+        /* 3945 only */
+        rate = (priv->band == IEEE80211_BAND_5GHZ) ?
+                IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP;
+        /* Turn on both antennas for the station... */
+        station->sta.rate_n_flags = cpu_to_le16(rate | RATE_MCS_ANT_AB_MSK);
+
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
         /* Add station to device's station table */
@@ -295,7 +301,7 @@ u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
         return sta_id;
 
 }
-EXPORT_SYMBOL(iwl_add_station_flags);
+EXPORT_SYMBOL(iwl_add_station);
 
 static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
 {
@@ -408,7 +414,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
 /**
  * iwl_remove_station - Remove driver's knowledge of station.
  */
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
+int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         int sta_id = IWL_INVALID_STATION;
         int i, ret = -EINVAL;
@@ -490,7 +496,7 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         /* keep track of static keys */
         for (i = 0; i < WEP_KEYS_MAX ; i++) {
                 if (priv->wep_keys[i].key_size)
-                        test_and_set_bit(i, &priv->ucode_key_table);
+                        set_bit(i, &priv->ucode_key_table);
         }
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
@@ -946,7 +952,7 @@ EXPORT_SYMBOL(iwl_send_lq_cmd);
  *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
  *       which requires station table entry to exist).
  */
-static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
+static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         int i, r;
         struct iwl_link_quality_cmd link_cmd = {
@@ -979,8 +985,9 @@ static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
         link_cmd.general_params.single_stream_ant_msk =
                                 first_antenna(priv->hw_params.valid_tx_ant);
         link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = 3;
-        link_cmd.agg_params.agg_time_limit = cpu_to_le16(4000);
+        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd.agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
 
         /* Update the rate scaling for control frame Tx to AP */
         link_cmd.sta_id = is_ap ? IWL_AP_ID : priv->hw_params.bcast_sta_id;
@@ -995,7 +1002,7 @@ static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
  * there is only one AP station with id= IWL_AP_ID
  * NOTE: mutex must be held before calling this function
  */
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
+int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         struct ieee80211_sta *sta;
         struct ieee80211_sta_ht_cap ht_config;
@@ -1020,8 +1027,7 @@ int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
                 rcu_read_unlock();
         }
 
-        sta_id = iwl_add_station_flags(priv, addr, is_ap,
-                                       0, cur_ht_config);
+        sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
 
         /* Set up default rate scaling table in device's station table */
         iwl_sta_init_lq(priv, addr, is_ap);
@@ -1067,8 +1073,8 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                         return sta_id;
 
                 /* Create new station table entry */
-                sta_id = iwl_add_station_flags(priv, hdr->addr1,
-                                                   0, CMD_ASYNC, NULL);
+                sta_id = iwl_add_station(priv, hdr->addr1, false,
+                                        CMD_ASYNC, NULL);
 
                 if (sta_id != IWL_INVALID_STATION)
                         return sta_id;
@@ -1079,11 +1085,6 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                 iwl_print_hex_dump(priv, IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
                 return priv->hw_params.bcast_sta_id;
 
-        /* If we are in monitor mode, use BCAST. This is required for
-         * packet injection. */
-        case NL80211_IFTYPE_MONITOR:
-                return priv->hw_params.bcast_sta_id;
-
         default:
                 IWL_WARN(priv, "Unknown mode of operation: %d\n",
                         priv->iw_mode);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 59a586b6b56c..6deebade6361 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -51,16 +51,15 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *keyconf,
                         const u8 *addr, u32 iv32, u16 *phase1key);
 
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap);
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap);
+int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
+int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_clear_stations_table(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
 int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr,
-                        int is_ap, u8 flags,
+u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
                         struct ieee80211_sta_ht_cap *ht_info);
 void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
 int iwl_sta_rx_agg_start(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 71d5b8a1a73e..85ae7a62109c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -102,13 +102,8 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                         return ret;
                 }
 
-                /* restore this queue's parameters in nic hardware. */
-                ret = iwl_grab_nic_access(priv);
-                if (ret)
-                        return ret;
                 iwl_write_direct32(priv, HBUS_TARG_WRPTR,
                                      txq->q.write_ptr | (txq_id << 8));
-                iwl_release_nic_access(priv);
 
         /* else not in power-save mode, uCode will never sleep when we're
          * trying to tx (during RFKILL, we're not trying to tx). */
@@ -429,11 +424,6 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
                 goto error_kw;
         }
         spin_lock_irqsave(&priv->lock, flags);
-        ret = iwl_grab_nic_access(priv);
-        if (unlikely(ret)) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                goto error_reset;
-        }
 
         /* Turn off all Tx DMA fifos */
         priv->cfg->ops->lib->txq_set_sched(priv, 0);
@@ -441,7 +431,6 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
         /* Tell NIC where to find the "keep warm" buffer */
         iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
 
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         /* Alloc and init all Tx queues, including the command queue (#4) */
@@ -460,7 +449,6 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
 
  error:
         iwl_hw_txq_ctx_free(priv);
- error_reset:
         iwl_free_dma_ptr(priv, &priv->kw);
  error_kw:
         iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
@@ -478,10 +466,6 @@ void iwl_txq_ctx_stop(struct iwl_priv *priv)
 
         /* Turn off all Tx DMA fifos */
         spin_lock_irqsave(&priv->lock, flags);
-        if (iwl_grab_nic_access(priv)) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return;
-        }
 
         priv->cfg->ops->lib->txq_set_sched(priv, 0);
 
@@ -492,7 +476,6 @@ void iwl_txq_ctx_stop(struct iwl_priv *priv)
                                     FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
                                     1000);
         }
-        iwl_release_nic_access(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         /* Deallocate memory for all Tx queues */
@@ -728,7 +711,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* drop all data frame if we are not associated */
         if (ieee80211_is_data(fc) &&
-            (priv->iw_mode != NL80211_IFTYPE_MONITOR ||
+            (!iwl_is_monitor_mode(priv) ||
             !(info->flags & IEEE80211_TX_CTL_INJECTED)) && /* packet injection */
             (!iwl_is_associated(priv) ||
              ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id) ||
@@ -1183,8 +1166,10 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                         __func__, ra, tid);
 
         sta_id = iwl_find_station(priv, ra);
-        if (sta_id == IWL_INVALID_STATION)
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Start AGG on invalid station\n");
                 return -ENXIO;
+        }
 
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                 IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
@@ -1192,8 +1177,10 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
         }
 
         txq_id = iwl_txq_ctx_activate_free(priv);
-        if (txq_id == -1)
+        if (txq_id == -1) {
+                IWL_ERR(priv, "No free aggregation queue available\n");
                 return -ENXIO;
+        }
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         tid_data = &priv->stations[sta_id].tid[tid];
@@ -1207,7 +1194,7 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                 return ret;
 
         if (tid_data->tfds_in_queue == 0) {
-                IWL_ERR(priv, "HW queue is empty\n");
+                IWL_DEBUG_HT(priv, "HW queue is empty\n");
                 tid_data->agg.state = IWL_AGG_ON;
                 ieee80211_start_tx_ba_cb_irqsafe(priv->hw, ra, tid);
         } else {
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index ff4d0e41d7c4..83d31606dd00 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -95,188 +95,6 @@ struct iwl_mod_params iwl3945_mod_params = {
         /* the rest are 0 by default */
 };
 
-/*************** STATION TABLE MANAGEMENT ****
- * mac80211 should be examined to determine if sta_info is duplicating
- * the functionality provided here
- */
-
-/**************************************************************/
-#if 0 /* temporary disable till we add real remove station */
-/**
- * iwl3945_remove_station - Remove driver's knowledge of station.
- *
- * NOTE:  This does not remove station from device's station table.
- */
-static u8 iwl3945_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
-{
-        int index = IWL_INVALID_STATION;
-        int i;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        if (is_ap)
-                index = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                index = priv->hw_params.bcast_sta_id;
-        else
-                for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++)
-                        if (priv->stations_39[i].used &&
-                            !compare_ether_addr(priv->stations_39[i].sta.sta.addr,
-                                                addr)) {
-                                index = i;
-                                break;
-                        }
-
-        if (unlikely(index == IWL_INVALID_STATION))
-                goto out;
-
-        if (priv->stations_39[index].used) {
-                priv->stations_39[index].used = 0;
-                priv->num_stations--;
-        }
-
-        BUG_ON(priv->num_stations < 0);
-
-out:
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return 0;
-}
-#endif
-
-/**
- * iwl3945_clear_stations_table - Clear the driver's station table
- *
- * NOTE:  This does not clear or otherwise alter the device's station table.
- */
-static void iwl3945_clear_stations_table(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        priv->num_stations = 0;
-        memset(priv->stations_39, 0, sizeof(priv->stations_39));
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-}
-
-/**
- * iwl3945_add_station - Add station to station tables in driver and device
- */
-u8 iwl3945_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap, u8 flags)
-{
-        int i;
-        int index = IWL_INVALID_STATION;
-        struct iwl3945_station_entry *station;
-        unsigned long flags_spin;
-        u8 rate;
-
-        spin_lock_irqsave(&priv->sta_lock, flags_spin);
-        if (is_ap)
-                index = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                index = priv->hw_params.bcast_sta_id;
-        else
-                for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++) {
-                        if (!compare_ether_addr(priv->stations_39[i].sta.sta.addr,
-                                                addr)) {
-                                index = i;
-                                break;
-                        }
-
-                        if (!priv->stations_39[i].used &&
-                            index == IWL_INVALID_STATION)
-                                index = i;
-                }
-
-        /* These two conditions has the same outcome but keep them separate
-          since they have different meaning */
-        if (unlikely(index == IWL_INVALID_STATION)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-                return index;
-        }
-
-        if (priv->stations_39[index].used &&
-           !compare_ether_addr(priv->stations_39[index].sta.sta.addr, addr)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-                return index;
-        }
-
-        IWL_DEBUG_ASSOC(priv, "Add STA ID %d: %pM\n", index, addr);
-        station = &priv->stations_39[index];
-        station->used = 1;
-        priv->num_stations++;
-
-        /* Set up the REPLY_ADD_STA command to send to device */
-        memset(&station->sta, 0, sizeof(struct iwl3945_addsta_cmd));
-        memcpy(station->sta.sta.addr, addr, ETH_ALEN);
-        station->sta.mode = 0;
-        station->sta.sta.sta_id = index;
-        station->sta.station_flags = 0;
-
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                rate = IWL_RATE_6M_PLCP;
-        else
-                rate =  IWL_RATE_1M_PLCP;
-
-        /* Turn on both antennas for the station... */
-        station->sta.rate_n_flags =
-                        iwl3945_hw_set_rate_n_flags(rate, RATE_MCS_ANT_AB_MSK);
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-
-        /* Add station to device's station table */
-        iwl_send_add_sta(priv,
-                         (struct iwl_addsta_cmd *)&station->sta, flags);
-        return index;
-
-}
-
-static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
-{
-        int rc = 0;
-        struct iwl_rx_packet *res = NULL;
-        struct iwl3945_rxon_assoc_cmd rxon_assoc;
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_RXON_ASSOC,
-                .len = sizeof(rxon_assoc),
-                .meta.flags = CMD_WANT_SKB,
-                .data = &rxon_assoc,
-        };
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
-
-        if ((rxon1->flags == rxon2->flags) &&
-            (rxon1->filter_flags == rxon2->filter_flags) &&
-            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
-            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
-                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
-                return 0;
-        }
-
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
-        rxon_assoc.reserved = 0;
-
-        rc = iwl_send_cmd_sync(priv, &cmd);
-        if (rc)
-                return rc;
-
-        res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_RXON_ASSOC command\n");
-                rc = -EIO;
-        }
-
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.meta.u.skb);
-
-        return rc;
-}
-
 /**
  * iwl3945_get_antenna_flags - Get antenna flags for RXON command
  * @priv: eeprom and antenna fields are used to determine antenna flags
@@ -314,150 +132,6 @@ __le32 iwl3945_get_antenna_flags(const struct iwl_priv *priv)
         return 0;               /* "diversity" is default if error */
 }
 
-/**
- * iwl3945_commit_rxon - commit staging_rxon to hardware
- *
- * The RXON command in staging_rxon is committed to the hardware and
- * the active_rxon structure is updated with the new data.  This
- * function correctly transitions out of the RXON_ASSOC_MSK state if
- * a HW tune is required based on the RXON structure changes.
- */
-static int iwl3945_commit_rxon(struct iwl_priv *priv)
-{
-        /* cast away the const for active_rxon in this function */
-        struct iwl3945_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
-        struct iwl3945_rxon_cmd *staging_rxon = (void *)&priv->staging_rxon;
-        int rc = 0;
-        bool new_assoc =
-                !!(priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK);
-
-        if (!iwl_is_alive(priv))
-                return -1;
-
-        /* always get timestamp with Rx frame */
-        staging_rxon->flags |= RXON_FLG_TSF2HOST_MSK;
-
-        /* select antenna */
-        staging_rxon->flags &=
-            ~(RXON_FLG_DIS_DIV_MSK | RXON_FLG_ANT_SEL_MSK);
-        staging_rxon->flags |= iwl3945_get_antenna_flags(priv);
-
-        rc = iwl_check_rxon_cmd(priv);
-        if (rc) {
-                IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
-                return -EINVAL;
-        }
-
-        /* If we don't need to send a full RXON, we can use
-         * iwl3945_rxon_assoc_cmd which is used to reconfigure filter
-         * and other flags for the current radio configuration. */
-        if (!iwl_full_rxon_required(priv)) {
-                rc = iwl3945_send_rxon_assoc(priv);
-                if (rc) {
-                        IWL_ERR(priv, "Error setting RXON_ASSOC "
-                                  "configuration (%d).\n", rc);
-                        return rc;
-                }
-
-                memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
-
-                return 0;
-        }
-
-        /* If we are currently associated and the new config requires
-         * an RXON_ASSOC and the new config wants the associated mask enabled,
-         * we must clear the associated from the active configuration
-         * before we apply the new config */
-        if (iwl_is_associated(priv) && new_assoc) {
-                IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
-                active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-
-                /*
-                 * reserved4 and 5 could have been filled by the iwlcore code.
-                 * Let's clear them before pushing to the 3945.
-                 */
-                active_rxon->reserved4 = 0;
-                active_rxon->reserved5 = 0;
-                rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
-                                      sizeof(struct iwl3945_rxon_cmd),
-                                      &priv->active_rxon);
-
-                /* If the mask clearing failed then we set
-                 * active_rxon back to what it was previously */
-                if (rc) {
-                        active_rxon->filter_flags |= RXON_FILTER_ASSOC_MSK;
-                        IWL_ERR(priv, "Error clearing ASSOC_MSK on current "
-                                  "configuration (%d).\n", rc);
-                        return rc;
-                }
-        }
-
-        IWL_DEBUG_INFO(priv, "Sending RXON\n"
-                       "* with%s RXON_FILTER_ASSOC_MSK\n"
-                       "* channel = %d\n"
-                       "* bssid = %pM\n",
-                       (new_assoc ? "" : "out"),
-                       le16_to_cpu(staging_rxon->channel),
-                       staging_rxon->bssid_addr);
-
-        /*
-         * reserved4 and 5 could have been filled by the iwlcore code.
-         * Let's clear them before pushing to the 3945.
-         */
-        staging_rxon->reserved4 = 0;
-        staging_rxon->reserved5 = 0;
-
-        iwl_set_rxon_hwcrypto(priv, !priv->hw_params.sw_crypto);
-
-        /* Apply the new configuration */
-        rc = iwl_send_cmd_pdu(priv, REPLY_RXON,
-                              sizeof(struct iwl3945_rxon_cmd),
-                              staging_rxon);
-        if (rc) {
-                IWL_ERR(priv, "Error setting new configuration (%d).\n", rc);
-                return rc;
-        }
-
-        memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
-
-        iwl3945_clear_stations_table(priv);
-
-        /* If we issue a new RXON command which required a tune then we must
-         * send a new TXPOWER command or we won't be able to Tx any frames */
-        rc = priv->cfg->ops->lib->send_tx_power(priv);
-        if (rc) {
-                IWL_ERR(priv, "Error setting Tx power (%d).\n", rc);
-                return rc;
-        }
-
-        /* Add the broadcast address so we can send broadcast frames */
-        if (iwl3945_add_station(priv, iwl_bcast_addr, 0, 0) ==
-            IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
-                return -EIO;
-        }
-
-        /* If we have set the ASSOC_MSK and we are in BSS mode then
-         * add the IWL_AP_ID to the station rate table */
-        if (iwl_is_associated(priv) &&
-            (priv->iw_mode == NL80211_IFTYPE_STATION))
-                if (iwl3945_add_station(priv, priv->active_rxon.bssid_addr,
-                                        1, 0)
-                    == IWL_INVALID_STATION) {
-                        IWL_ERR(priv, "Error adding AP address for transmit\n");
-                        return -EIO;
-                }
-
-        /* Init the hardware's rate fallback order based on the band */
-        rc = iwl3945_init_hw_rate_table(priv);
-        if (rc) {
-                IWL_ERR(priv, "Error setting HW rate table: %02X\n", rc);
-                return -EIO;
-        }
-
-        return 0;
-}
-
 static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
                                    struct ieee80211_key_conf *keyconf,
                                    u8 sta_id)
@@ -477,32 +151,31 @@ static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         key_flags &= ~STA_KEY_FLG_INVALID;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations_39[sta_id].keyinfo.alg = keyconf->alg;
-        priv->stations_39[sta_id].keyinfo.keylen = keyconf->keylen;
-        memcpy(priv->stations_39[sta_id].keyinfo.key, keyconf->key,
+        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
+        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
                keyconf->keylen);
 
-        memcpy(priv->stations_39[sta_id].sta.key.key, keyconf->key,
+        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key,
                keyconf->keylen);
 
-        if ((priv->stations_39[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
                         == STA_KEY_FLG_NO_ENC)
-                priv->stations_39[sta_id].sta.key.key_offset =
+                priv->stations[sta_id].sta.key.key_offset =
                                  iwl_get_free_ucode_key_index(priv);
         /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
 
-        WARN(priv->stations_39[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
-        priv->stations_39[sta_id].sta.key.key_flags = key_flags;
-        priv->stations_39[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations_39[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
         IWL_DEBUG_INFO(priv, "hwcrypto: modify ucode station key info\n");
 
-        ret = iwl_send_add_sta(priv,
-                (struct iwl_addsta_cmd *)&priv->stations_39[sta_id].sta, CMD_ASYNC);
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
@@ -528,17 +201,16 @@ static int iwl3945_clear_sta_key_info(struct iwl_priv *priv, u8 sta_id)
         unsigned long flags;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        memset(&priv->stations_39[sta_id].keyinfo, 0, sizeof(struct iwl3945_hw_key));
-        memset(&priv->stations_39[sta_id].sta.key, 0,
+        memset(&priv->stations[sta_id].keyinfo, 0, sizeof(struct iwl_hw_key));
+        memset(&priv->stations[sta_id].sta.key, 0,
                 sizeof(struct iwl4965_keyinfo));
-        priv->stations_39[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
-        priv->stations_39[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations_39[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        priv->stations[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         IWL_DEBUG_INFO(priv, "hwcrypto: clear ucode station key info\n");
-        iwl_send_add_sta(priv,
-                (struct iwl_addsta_cmd *)&priv->stations_39[sta_id].sta, 0);
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, 0);
         return 0;
 }
 
@@ -739,7 +411,8 @@ static void iwl3945_setup_rxon_timing(struct iwl_priv *priv)
                 priv->rxon_timing.atim_window = 0;
         } else {
                 priv->rxon_timing.beacon_interval =
-                        iwl3945_adjust_beacon_interval(conf->beacon_int);
+                        iwl3945_adjust_beacon_interval(
+                                priv->vif->bss_conf.beacon_int);
                 /* TODO: we need to get atim_window from upper stack
                  * for now we set to 0 */
                 priv->rxon_timing.atim_window = 0;
@@ -758,35 +431,6 @@ static void iwl3945_setup_rxon_timing(struct iwl_priv *priv)
                 le16_to_cpu(priv->rxon_timing.atim_window));
 }
 
-static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
-{
-        if (mode == NL80211_IFTYPE_ADHOC) {
-                const struct iwl_channel_info *ch_info;
-
-                ch_info = iwl_get_channel_info(priv,
-                        priv->band,
-                        le16_to_cpu(priv->staging_rxon.channel));
-
-                if (!ch_info || !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d not IBSS channel\n",
-                                  le16_to_cpu(priv->staging_rxon.channel));
-                        return -EINVAL;
-                }
-        }
-
-        iwl_connection_init_rx_config(priv, mode);
-
-        iwl3945_clear_stations_table(priv);
-
-        /* don't commit rxon if rf-kill is on*/
-        if (!iwl_is_ready_rf(priv))
-                return -EAGAIN;
-
-        iwl3945_commit_rxon(priv);
-
-        return 0;
-}
-
 static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                       struct ieee80211_tx_info *info,
                                       struct iwl_cmd *cmd,
@@ -794,8 +438,7 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                       int sta_id)
 {
         struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
-        struct iwl3945_hw_key *keyinfo =
-            &priv->stations_39[sta_id].keyinfo;
+        struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
 
         switch (keyinfo->alg) {
         case ALG_CCMP:
@@ -893,64 +536,6 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
         tx->next_frame_len = 0;
 }
 
-/**
- * iwl3945_get_sta_id - Find station's index within station table
- */
-static int iwl3945_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
-{
-        int sta_id;
-        u16 fc = le16_to_cpu(hdr->frame_control);
-
-        /* If this frame is broadcast or management, use broadcast station id */
-        if (((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) ||
-            is_multicast_ether_addr(hdr->addr1))
-                return priv->hw_params.bcast_sta_id;
-
-        switch (priv->iw_mode) {
-
-        /* If we are a client station in a BSS network, use the special
-         * AP station entry (that's the only station we communicate with) */
-        case NL80211_IFTYPE_STATION:
-                return IWL_AP_ID;
-
-        /* If we are an AP, then find the station, or use BCAST */
-        case NL80211_IFTYPE_AP:
-                sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-                return priv->hw_params.bcast_sta_id;
-
-        /* If this frame is going out to an IBSS network, find the station,
-         * or create a new station table entry */
-        case NL80211_IFTYPE_ADHOC: {
-                /* Create new station table entry */
-                sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-
-                sta_id = iwl3945_add_station(priv, hdr->addr1, 0, CMD_ASYNC);
-
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-
-                IWL_DEBUG_DROP(priv, "Station %pM not in station map. "
-                               "Defaulting to broadcast...\n",
-                               hdr->addr1);
-                iwl_print_hex_dump(priv, IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
-                return priv->hw_params.bcast_sta_id;
-        }
-        /* If we are in monitor mode, use BCAST. This is required for
-         * packet injection. */
-        case NL80211_IFTYPE_MONITOR:
-                return priv->hw_params.bcast_sta_id;
-
-        default:
-                IWL_WARN(priv, "Unknown mode of operation: %d\n",
-                        priv->iw_mode);
-                return priv->hw_params.bcast_sta_id;
-        }
-}
-
 /*
  * start REPLY_TX command process
  */
@@ -1004,7 +589,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* drop all data frame if we are not associated */
         if (ieee80211_is_data(fc) &&
-            (priv->iw_mode != NL80211_IFTYPE_MONITOR) && /* packet injection */
+            (!iwl_is_monitor_mode(priv)) && /* packet injection */
             (!iwl_is_associated(priv) ||
              ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id))) {
                 IWL_DEBUG_DROP(priv, "Dropping - !iwl_is_associated\n");
@@ -1016,7 +601,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find (or create) index into station table for destination station */
-        sta_id = iwl3945_get_sta_id(priv, hdr);
+        sta_id = iwl_get_sta_id(priv, hdr);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
@@ -1028,7 +613,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (ieee80211_is_data_qos(fc)) {
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
-                seq_number = priv->stations_39[sta_id].tid[tid].seq_number &
+                seq_number = priv->stations[sta_id].tid[tid].seq_number &
                                 IEEE80211_SCTL_SEQ;
                 hdr->seq_ctrl = cpu_to_le16(seq_number) |
                         (hdr->seq_ctrl &
@@ -1088,7 +673,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
                 if (qc)
-                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
         } else {
                 wait_write_ptr = 1;
                 txq->need_update = 0;
@@ -1424,18 +1009,12 @@ static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
 
 
-        if (flags & SW_CARD_DISABLED)
-                set_bit(STATUS_RF_KILL_SW, &priv->status);
-        else
-                clear_bit(STATUS_RF_KILL_SW, &priv->status);
-
         iwl_scan_cancel(priv);
 
         if ((test_bit(STATUS_RF_KILL_HW, &status) !=
-             test_bit(STATUS_RF_KILL_HW, &priv->status)) ||
-            (test_bit(STATUS_RF_KILL_SW, &status) !=
-             test_bit(STATUS_RF_KILL_SW, &priv->status)))
-                queue_work(priv->workqueue, &priv->rf_kill);
+             test_bit(STATUS_RF_KILL_HW, &priv->status)))
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+                                test_bit(STATUS_RF_KILL_HW, &priv->status));
         else
                 wake_up_interruptible(&priv->wait_command_queue);
 }
@@ -1591,7 +1170,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
 
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
-        if ((write != (rxq->write & ~0x7))
+        if ((rxq->write_actual != (rxq->write & ~0x7))
             || (abs(rxq->write - rxq->read) > 7)) {
                 spin_lock_irqsave(&rxq->lock, flags);
                 rxq->need_update = 1;
@@ -1612,21 +1191,30 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
  * Also restock the Rx queue via iwl3945_rx_queue_restock.
  * This is called as a scheduled work item (except for during initialization)
  */
-static void iwl3945_rx_allocate(struct iwl_priv *priv)
+static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
         unsigned long flags;
-        spin_lock_irqsave(&rxq->lock, flags);
-        while (!list_empty(&rxq->rx_used)) {
+
+        while (1) {
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        return;
+                }
+
                 element = rxq->rx_used.next;
                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+                spin_unlock_irqrestore(&rxq->lock, flags);
 
                 /* Alloc a new receive buffer */
                 rxb->skb =
                     alloc_skb(priv->hw_params.rx_buf_size,
-                                __GFP_NOWARN | GFP_ATOMIC);
+                                priority);
                 if (!rxb->skb) {
                         if (net_ratelimit())
                                 IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
@@ -1644,18 +1232,18 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
                  */
                 skb_reserve(rxb->skb, 4);
 
-                priv->alloc_rxb_skb++;
-                list_del(element);
-
                 /* Get physical address of RB/SKB */
                 rxb->real_dma_addr = pci_map_single(priv->pci_dev,
                                                 rxb->skb->data,
                                                 priv->hw_params.rx_buf_size,
                                                 PCI_DMA_FROMDEVICE);
+
+                spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &rxq->rx_free);
+                priv->alloc_rxb_skb++;
                 rxq->free_count++;
+                spin_unlock_irqrestore(&rxq->lock, flags);
         }
-        spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
 void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
@@ -1685,33 +1273,30 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
         rxq->free_count = 0;
+        rxq->write_actual = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
-/*
- * this should be called while priv->lock is locked
- */
-static void __iwl3945_rx_replenish(void *data)
-{
-        struct iwl_priv *priv = data;
-
-        iwl3945_rx_allocate(priv);
-        iwl3945_rx_queue_restock(priv);
-}
-
-
 void iwl3945_rx_replenish(void *data)
 {
         struct iwl_priv *priv = data;
         unsigned long flags;
 
-        iwl3945_rx_allocate(priv);
+        iwl3945_rx_allocate(priv, GFP_KERNEL);
 
         spin_lock_irqsave(&priv->lock, flags);
         iwl3945_rx_queue_restock(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
+static void iwl3945_rx_replenish_now(struct iwl_priv *priv)
+{
+        iwl3945_rx_allocate(priv, GFP_ATOMIC);
+
+        iwl3945_rx_queue_restock(priv);
+}
+
+
 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
  * This free routine walks the list of POOL entries and if SKB is set to
@@ -1834,13 +1419,19 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         unsigned long flags;
         u8 fill_rx = 0;
         u32 count = 8;
+        int total_empty = 0;
 
         /* uCode's read index (stored in shared DRAM) indicates the last Rx
          * buffer that the driver may process (last buffer filled by ucode). */
         r = le16_to_cpu(rxq->rb_stts->closed_rb_num) &  0x0FFF;
         i = rxq->read;
 
-        if (iwl_rx_queue_space(rxq) > (RX_QUEUE_SIZE / 2))
+        /* calculate total frames need to be restock after handling RX */
+        total_empty = r - priv->rxq.write_actual;
+        if (total_empty < 0)
+                total_empty += RX_QUEUE_SIZE;
+
+        if (total_empty > (RX_QUEUE_SIZE / 2))
                 fill_rx = 1;
         /* Rx interrupt, but nothing sent from uCode */
         if (i == r)
@@ -1879,6 +1470,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                                 "r = %d, i = %d, %s, 0x%02x\n", r, i,
                                 get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
                         priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
+                        priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
                 } else {
                         /* No handling needed */
                         IWL_DEBUG(priv, IWL_DL_HCMD | IWL_DL_RX | IWL_DL_ISR,
@@ -1916,7 +1508,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 priv->rxq.read = i;
-                                __iwl3945_rx_replenish(priv);
+                                iwl3945_rx_replenish_now(priv);
                                 count = 0;
                         }
                 }
@@ -1924,7 +1516,10 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
 
         /* Backtrack one entry */
         priv->rxq.read = i;
-        iwl3945_rx_queue_restock(priv);
+        if (fill_rx)
+                iwl3945_rx_replenish_now(priv);
+        else
+                iwl3945_rx_queue_restock(priv);
 }
 
 /* call this function to flush any scheduled tasklet */
@@ -1963,7 +1558,6 @@ static void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
         u32 i;
         u32 desc, time, count, base, data1;
         u32 blink1, blink2, ilink1, ilink2;
-        int rc;
 
         base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
 
@@ -1972,11 +1566,6 @@ static void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
                 return;
         }
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                IWL_WARN(priv, "Can not read from adapter at this time.\n");
-                return;
-        }
 
         count = iwl_read_targ_mem(priv, base);
 
@@ -2011,8 +1600,6 @@ static void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
                         ilink1, ilink2, data1);
         }
 
-        iwl_release_nic_access(priv);
-
 }
 
 #define EVENT_START_OFFSET  (6 * sizeof(u32))
@@ -2020,7 +1607,6 @@ static void iwl3945_dump_nic_error_log(struct iwl_priv *priv)
 /**
  * iwl3945_print_event_log - Dump error event log to syslog
  *
- * NOTE: Must be called with iwl_grab_nic_access() already obtained!
  */
 static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
                                 u32 num_events, u32 mode)
@@ -2063,7 +1649,6 @@ static void iwl3945_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
 static void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
 {
-        int rc;
         u32 base;       /* SRAM byte address of event log header */
         u32 capacity;   /* event log capacity in # entries */
         u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
@@ -2077,12 +1662,6 @@ static void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
                 return;
         }
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                IWL_WARN(priv, "Can not read from adapter at this time.\n");
-                return;
-        }
-
         /* event log header */
         capacity = iwl_read_targ_mem(priv, base);
         mode = iwl_read_targ_mem(priv, base + (1 * sizeof(u32)));
@@ -2094,7 +1673,6 @@ static void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
         /* bail out if nothing in log */
         if (size == 0) {
                 IWL_ERR(priv, "Start IWL Event Log Dump: nothing in log\n");
-                iwl_release_nic_access(priv);
                 return;
         }
 
@@ -2110,24 +1688,6 @@ static void iwl3945_dump_nic_event_log(struct iwl_priv *priv)
         /* (then/else) start at top of log */
         iwl3945_print_event_log(priv, 0, next_entry, mode);
 
-        iwl_release_nic_access(priv);
-}
-
-static void iwl3945_error_recovery(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        memcpy(&priv->staging_rxon, &priv->recovery_rxon,
-               sizeof(priv->staging_rxon));
-        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwl3945_commit_rxon(priv);
-
-        iwl3945_add_station(priv, priv->bssid, 1, 0);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->assoc_id = le16_to_cpu(priv->staging_rxon.assoc_id);
-        priv->error_recovering = 0;
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void iwl3945_irq_tasklet(struct iwl_priv *priv)
@@ -2178,6 +1738,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 /* Tell the device to stop sending interrupts */
                 iwl_disable_interrupts(priv);
 
+                priv->isr_stats.hw++;
                 iwl_irq_handle_error(priv);
 
                 handled |= CSR_INT_BIT_HW_ERR;
@@ -2190,13 +1751,17 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (priv->debug_level & (IWL_DL_ISR)) {
                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
-                if (inta & CSR_INT_BIT_SCD)
+                if (inta & CSR_INT_BIT_SCD) {
                         IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
                                       "the frame/frames.\n");
+                        priv->isr_stats.sch++;
+                }
 
                 /* Alive notification via Rx interrupt will do the real work */
-                if (inta & CSR_INT_BIT_ALIVE)
+                if (inta & CSR_INT_BIT_ALIVE) {
                         IWL_DEBUG_ISR(priv, "Alive interrupt\n");
+                        priv->isr_stats.alive++;
+                }
         }
 #endif
         /* Safely ignore these bits for debug checks below */
@@ -2206,6 +1771,8 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         if (inta & CSR_INT_BIT_SW_ERR) {
                 IWL_ERR(priv, "Microcode SW error detected. "
                         "Restarting 0x%X.\n", inta);
+                priv->isr_stats.sw++;
+                priv->isr_stats.sw_err = inta;
                 iwl_irq_handle_error(priv);
                 handled |= CSR_INT_BIT_SW_ERR;
         }
@@ -2221,6 +1788,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 iwl_txq_update_write_ptr(priv, &priv->txq[4]);
                 iwl_txq_update_write_ptr(priv, &priv->txq[5]);
 
+                priv->isr_stats.wakeup++;
                 handled |= CSR_INT_BIT_WAKEUP;
         }
 
@@ -2229,27 +1797,28 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
          * notifications from uCode come through here*/
         if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                 iwl3945_rx_handle(priv);
+                priv->isr_stats.rx++;
                 handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
         }
 
         if (inta & CSR_INT_BIT_FH_TX) {
                 IWL_DEBUG_ISR(priv, "Tx interrupt\n");
+                priv->isr_stats.tx++;
 
                 iwl_write32(priv, CSR_FH_INT_STATUS, (1 << 6));
-                if (!iwl_grab_nic_access(priv)) {
-                        iwl_write_direct32(priv, FH39_TCSR_CREDIT
-                                             (FH39_SRVC_CHNL), 0x0);
-                        iwl_release_nic_access(priv);
-                }
+                iwl_write_direct32(priv, FH39_TCSR_CREDIT
+                                        (FH39_SRVC_CHNL), 0x0);
                 handled |= CSR_INT_BIT_FH_TX;
         }
 
-        if (inta & ~handled)
+        if (inta & ~handled) {
                 IWL_ERR(priv, "Unhandled INTA bits 0x%08x\n", inta & ~handled);
+                priv->isr_stats.unhandled++;
+        }
 
-        if (inta & ~CSR_INI_SET_MASK) {
+        if (inta & ~priv->inta_mask) {
                 IWL_WARN(priv, "Disabled INTA bits 0x%08x were pending\n",
-                         inta & ~CSR_INI_SET_MASK);
+                         inta & ~priv->inta_mask);
                 IWL_WARN(priv, "   with FH_INT = 0x%08x\n", inta_fh);
         }
 
@@ -2413,10 +1982,6 @@ static int iwl3945_verify_inst_full(struct iwl_priv *priv, __le32 *image, u32 le
 
         IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc)
-                return rc;
-
         iwl_write_direct32(priv, HBUS_TARG_MEM_RADDR,
                                IWL39_RTC_INST_LOWER_BOUND);
 
@@ -2437,7 +2002,6 @@ static int iwl3945_verify_inst_full(struct iwl_priv *priv, __le32 *image, u32 le
                 }
         }
 
-        iwl_release_nic_access(priv);
 
         if (!errcnt)
                 IWL_DEBUG_INFO(priv,
@@ -2461,10 +2025,6 @@ static int iwl3945_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32
 
         IWL_DEBUG_INFO(priv, "ucode inst image size is %u\n", len);
 
-        rc = iwl_grab_nic_access(priv);
-        if (rc)
-                return rc;
-
         for (i = 0; i < len; i += 100, image += 100/sizeof(u32)) {
                 /* read data comes through single port, auto-incr addr */
                 /* NOTE: Use the debugless read so we don't flood kernel log
@@ -2485,8 +2045,6 @@ static int iwl3945_verify_inst_sparse(struct iwl_priv *priv, __le32 *image, u32
                 }
         }
 
-        iwl_release_nic_access(priv);
-
         return rc;
 }
 
@@ -2810,20 +2368,11 @@ static int iwl3945_set_ucode_ptrs(struct iwl_priv *priv)
 {
         dma_addr_t pinst;
         dma_addr_t pdata;
-        int rc = 0;
-        unsigned long flags;
 
         /* bits 31:0 for 3945 */
         pinst = priv->ucode_code.p_addr;
         pdata = priv->ucode_data_backup.p_addr;
 
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
-
         /* Tell bootstrap uCode where to find image to load */
         iwl_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
         iwl_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
@@ -2835,13 +2384,9 @@ static int iwl3945_set_ucode_ptrs(struct iwl_priv *priv)
         iwl_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG,
                                  priv->ucode_code.len | BSM_DRAM_INST_LOAD);
 
-        iwl_release_nic_access(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         IWL_DEBUG_INFO(priv, "Runtime uCode pointers are set.\n");
 
-        return rc;
+        return 0;
 }
 
 /**
@@ -2887,11 +2432,6 @@ static void iwl3945_init_alive_start(struct iwl_priv *priv)
         queue_work(priv->workqueue, &priv->restart);
 }
 
-
-/* temporary */
-static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw,
-                                     struct sk_buff *skb);
-
 /**
  * iwl3945_alive_start - called after REPLY_ALIVE notification received
  *                   from protocol/runtime uCode (initialization uCode's
@@ -2899,7 +2439,6 @@ static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw,
  */
 static void iwl3945_alive_start(struct iwl_priv *priv)
 {
-        int rc = 0;
         int thermal_spin = 0;
         u32 rfkill;
 
@@ -2922,17 +2461,10 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        iwl3945_clear_stations_table(priv);
-
-        rc = iwl_grab_nic_access(priv);
-        if (rc) {
-                IWL_WARN(priv, "Can not read RFKILL status from adapter\n");
-                return;
-        }
+        iwl_clear_stations_table(priv);
 
         rfkill = iwl_read_prph(priv, APMG_RFKILL_REG);
         IWL_DEBUG_INFO(priv, "RFKILL status: 0x%x\n", rfkill);
-        iwl_release_nic_access(priv);
 
         if (rfkill & 0x1) {
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
@@ -2952,9 +2484,6 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send commands to 3945 uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
-        /* Clear out the uCode error bit if it is set */
-        clear_bit(STATUS_FW_ERROR, &priv->status);
-
         if (iwl_is_rfkill(priv))
                 return;
 
@@ -2981,7 +2510,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         iwl_send_bt_config(priv);
 
         /* Configure the adapter for unassociated operation */
-        iwl3945_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         iwl3945_reg_txpower_periodic(priv);
 
@@ -2991,17 +2520,17 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
-        if (priv->error_recovering)
-                iwl3945_error_recovery(priv);
-
         /* reassociate for ADHOC mode */
         if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
                 struct sk_buff *beacon = ieee80211_beacon_get(priv->hw,
                                                                 priv->vif);
                 if (beacon)
-                        iwl3945_mac_beacon_update(priv->hw, beacon);
+                        iwl_mac_beacon_update(priv->hw, beacon);
         }
 
+        if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
+                iwl_set_mode(priv, priv->iw_mode);
+
         return;
 
  restart:
@@ -3024,7 +2553,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         iwl3945_led_unregister(priv);
-        iwl3945_clear_stations_table(priv);
+        iwl_clear_stations_table(priv);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -3047,31 +2576,23 @@ static void __iwl3945_down(struct iwl_priv *priv)
                 ieee80211_stop_queues(priv->hw);
 
         /* If we have not previously called iwl3945_init() then
-         * clear all bits but the RF Kill and SUSPEND bits and return */
+         * clear all bits but the RF Kill bits and return */
         if (!iwl_is_init(priv)) {
                 priv->status = test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                         STATUS_RF_KILL_HW |
-                               test_bit(STATUS_RF_KILL_SW, &priv->status) <<
-                                        STATUS_RF_KILL_SW |
                                test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
                                         STATUS_GEO_CONFIGURED |
-                               test_bit(STATUS_IN_SUSPEND, &priv->status) <<
-                                        STATUS_IN_SUSPEND |
                                 test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                         STATUS_EXIT_PENDING;
                 goto exit;
         }
 
-        /* ...otherwise clear out all the status bits but the RF Kill and
-         * SUSPEND bits and continue taking the NIC down. */
+        /* ...otherwise clear out all the status bits but the RF Kill
+         * bit and continue taking the NIC down. */
         priv->status &= test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                 STATUS_RF_KILL_HW |
-                        test_bit(STATUS_RF_KILL_SW, &priv->status) <<
-                                STATUS_RF_KILL_SW |
                         test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
                                 STATUS_GEO_CONFIGURED |
-                        test_bit(STATUS_IN_SUSPEND, &priv->status) <<
-                                STATUS_IN_SUSPEND |
                         test_bit(STATUS_FW_ERROR, &priv->status) <<
                                 STATUS_FW_ERROR |
                         test_bit(STATUS_EXIT_PENDING, &priv->status) <<
@@ -3085,17 +2606,12 @@ static void __iwl3945_down(struct iwl_priv *priv)
         iwl3945_hw_txq_ctx_stop(priv);
         iwl3945_hw_rxq_stop(priv);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!iwl_grab_nic_access(priv)) {
-                iwl_write_prph(priv, APMG_CLK_DIS_REG,
-                                         APMG_CLK_VAL_DMA_CLK_RQT);
-                iwl_release_nic_access(priv);
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
+        iwl_write_prph(priv, APMG_CLK_DIS_REG,
+                                APMG_CLK_VAL_DMA_CLK_RQT);
 
         udelay(5);
 
-        if (exit_pending || test_bit(STATUS_IN_SUSPEND, &priv->status))
+        if (exit_pending)
                 priv->cfg->ops->lib->apm_ops.stop(priv);
         else
                 priv->cfg->ops->lib->apm_ops.reset(priv);
@@ -3131,12 +2647,6 @@ static int __iwl3945_up(struct iwl_priv *priv)
                 return -EIO;
         }
 
-        if (test_bit(STATUS_RF_KILL_SW, &priv->status)) {
-                IWL_WARN(priv, "Radio disabled by SW RF kill (module "
-                            "parameter)\n");
-                return -ENODEV;
-        }
-
         if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
                 IWL_ERR(priv, "ucode not available for device bring up\n");
                 return -EIO;
@@ -3148,10 +2658,8 @@ static int __iwl3945_up(struct iwl_priv *priv)
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
         else {
                 set_bit(STATUS_RF_KILL_HW, &priv->status);
-                if (!test_bit(STATUS_IN_SUSPEND, &priv->status)) {
-                        IWL_WARN(priv, "Radio disabled by HW RF Kill switch\n");
-                        return -ENODEV;
-                }
+                IWL_WARN(priv, "Radio disabled by HW RF Kill switch\n");
+                return -ENODEV;
         }
 
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
@@ -3187,7 +2695,7 @@ static int __iwl3945_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                iwl3945_clear_stations_table(priv);
+                iwl_clear_stations_table(priv);
 
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
@@ -3255,15 +2763,14 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 {
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, rfkill_poll.work);
-        unsigned long status = priv->status;
 
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
         else
                 set_bit(STATUS_RF_KILL_HW, &priv->status);
 
-        if (test_bit(STATUS_RF_KILL_HW, &status) != test_bit(STATUS_RF_KILL_HW, &priv->status))
-                queue_work(priv->workqueue, &priv->rf_kill);
+        wiphy_rfkill_set_hw_state(priv->hw->wiphy,
+                        test_bit(STATUS_RF_KILL_HW, &priv->status));
 
         queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
                            round_jiffies_relative(2 * HZ));
@@ -3283,9 +2790,9 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         int rc = 0;
         struct iwl3945_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
-        u8 n_probes = 2;
+        u8 n_probes = 0;
         enum ieee80211_band band;
-        DECLARE_SSID_BUF(ssid);
+        bool is_active = false;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -3386,18 +2893,25 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                                scan_suspend_time, interval);
         }
 
-        /* We should add the ability for user to lock to PASSIVE ONLY */
-        if (priv->one_direct_scan) {
-                IWL_DEBUG_SCAN(priv, "Kicking off one direct scan for '%s'\n",
-                                print_ssid(ssid, priv->direct_ssid,
-                                priv->direct_ssid_len));
-                scan->direct_scan[0].id = WLAN_EID_SSID;
-                scan->direct_scan[0].len = priv->direct_ssid_len;
-                memcpy(scan->direct_scan[0].ssid,
-                       priv->direct_ssid, priv->direct_ssid_len);
-                n_probes++;
+        if (priv->scan_request->n_ssids) {
+                int i, p = 0;
+                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+                for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                        /* always does wildcard anyway */
+                        if (!priv->scan_request->ssids[i].ssid_len)
+                                continue;
+                        scan->direct_scan[p].id = WLAN_EID_SSID;
+                        scan->direct_scan[p].len =
+                                priv->scan_request->ssids[i].ssid_len;
+                        memcpy(scan->direct_scan[p].ssid,
+                               priv->scan_request->ssids[i].ssid,
+                               priv->scan_request->ssids[i].ssid_len);
+                        n_probes++;
+                        p++;
+                }
+                is_active = true;
         } else
-                IWL_DEBUG_SCAN(priv, "Kicking off one indirect scan.\n");
+                IWL_DEBUG_SCAN(priv, "Kicking off passive scan.\n");
 
         /* We don't build a direct scan probe request; the uCode will do
          * that based on the direct_mask added to each channel entry */
@@ -3414,7 +2928,12 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 band = IEEE80211_BAND_2GHZ;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
-                scan->good_CRC_th = IWL_GOOD_CRC_TH;
+                /*
+                 * If active scaning is requested but a certain channel
+                 * is marked passive, we can do active scanning if we
+                 * detect transmissions.
+                 */
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
@@ -3422,19 +2941,20 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         }
 
         scan->tx_cmd.len = cpu_to_le16(
-                iwl_fill_probe_req(priv, band,
-                                   (struct ieee80211_mgmt *)scan->data,
-                                   IWL_MAX_SCAN_SIZE - sizeof(*scan)));
+                        iwl_fill_probe_req(priv,
+                                (struct ieee80211_mgmt *)scan->data,
+                                priv->scan_request->ie,
+                                priv->scan_request->ie_len,
+                                IWL_MAX_SCAN_SIZE - sizeof(*scan)));
 
         /* select Rx antennas */
         scan->flags |= iwl3945_get_antenna_flags(priv);
 
-        if (priv->iw_mode == NL80211_IFTYPE_MONITOR)
+        if (iwl_is_monitor_mode(priv))
                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
 
         scan->channel_count =
-                iwl3945_get_channels_for_scan(priv, band, 1, /* active */
-                                              n_probes,
+                iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
         if (scan->channel_count == 0) {
@@ -3482,7 +3002,6 @@ static void iwl3945_bg_up(struct work_struct *data)
         mutex_lock(&priv->mutex);
         __iwl3945_up(priv);
         mutex_unlock(&priv->mutex);
-        iwl_rfkill_set_hw_state(priv);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -3492,8 +3011,17 @@ static void iwl3945_bg_restart(struct work_struct *data)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        iwl3945_down(priv);
-        queue_work(priv->workqueue, &priv->up);
+        if (test_and_clear_bit(STATUS_FW_ERROR, &priv->status)) {
+                mutex_lock(&priv->mutex);
+                priv->vif = NULL;
+                priv->is_open = 0;
+                mutex_unlock(&priv->mutex);
+                iwl3945_down(priv);
+                ieee80211_restart_hw(priv->hw);
+        } else {
+                iwl3945_down(priv);
+                queue_work(priv->workqueue, &priv->up);
+        }
 }
 
 static void iwl3945_bg_rx_replenish(struct work_struct *data)
@@ -3511,7 +3039,7 @@ static void iwl3945_bg_rx_replenish(struct work_struct *data)
 
 #define IWL_DELAY_NEXT_SCAN (HZ*2)
 
-static void iwl3945_post_associate(struct iwl_priv *priv)
+void iwl3945_post_associate(struct iwl_priv *priv)
 {
         int rc = 0;
         struct ieee80211_conf *conf = NULL;
@@ -3536,7 +3064,7 @@ static void iwl3945_post_associate(struct iwl_priv *priv)
         conf = ieee80211_get_hw_conf(priv->hw);
 
         priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwl3945_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
         iwl3945_setup_rxon_timing(priv);
@@ -3569,7 +3097,7 @@ static void iwl3945_post_associate(struct iwl_priv *priv)
 
         }
 
-        iwl3945_commit_rxon(priv);
+        iwlcore_commit_rxon(priv);
 
         switch (priv->iw_mode) {
         case NL80211_IFTYPE_STATION:
@@ -3579,7 +3107,7 @@ static void iwl3945_post_associate(struct iwl_priv *priv)
         case NL80211_IFTYPE_ADHOC:
 
                 priv->assoc_id = 1;
-                iwl3945_add_station(priv, priv->bssid, 0, 0);
+                iwl_add_station(priv, priv->bssid, 0, CMD_SYNC, NULL);
                 iwl3945_sync_sta(priv, IWL_STA_ID,
                                  (priv->band == IEEE80211_BAND_5GHZ) ?
                                  IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
@@ -3601,8 +3129,6 @@ static void iwl3945_post_associate(struct iwl_priv *priv)
         priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
 }
 
-static int iwl3945_mac_config(struct ieee80211_hw *hw, u32 changed);
-
 /*****************************************************************************
  *
  * mac80211 entry point functions
@@ -3638,16 +3164,11 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
 
         mutex_unlock(&priv->mutex);
 
-        iwl_rfkill_set_hw_state(priv);
-
         if (ret)
                 goto out_release_irq;
 
         IWL_DEBUG_INFO(priv, "Start UP work.\n");
 
-        if (test_bit(STATUS_IN_SUSPEND, &priv->status))
-                return 0;
-
         /* Wait for START_ALIVE from ucode. Otherwise callbacks from
          * mac80211 will not be run successfully. */
         ret = wait_event_interruptible_timeout(priv->wait_command_queue,
@@ -3726,144 +3247,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
-static int iwl3945_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter: type %d\n", conf->type);
-
-        if (priv->vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
-                return -EOPNOTSUPP;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->vif = conf->vif;
-        priv->iw_mode = conf->type;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->mac_addr) {
-                IWL_DEBUG_MAC80211(priv, "Set: %pM\n", conf->mac_addr);
-                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
-        }
-
-        if (iwl_is_ready(priv))
-                iwl3945_set_mode(priv, conf->type);
-
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
-}
-
-/**
- * iwl3945_mac_config - mac80211 config callback
- *
- * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
- * be set inappropriately and the driver currently sets the hardware up to
- * use it whenever needed.
- */
-static int iwl3945_mac_config(struct ieee80211_hw *hw, u32 changed)
-{
-        struct iwl_priv *priv = hw->priv;
-        const struct iwl_channel_info *ch_info;
-        struct ieee80211_conf *conf = &hw->conf;
-        unsigned long flags;
-        int ret = 0;
-
-        mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211(priv, "enter to channel %d\n",
-                                conf->channel->hw_value);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                ret = -EIO;
-                goto out;
-        }
-
-        if (unlikely(!iwl3945_mod_params.disable_hw_scan &&
-                     test_bit(STATUS_SCANNING, &priv->status))) {
-                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
-                set_bit(STATUS_CONF_PENDING, &priv->status);
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        ch_info = iwl_get_channel_info(priv, conf->channel->band,
-                                       conf->channel->hw_value);
-        if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_SCAN(priv,
-                                "Channel %d [%d] is INVALID for this band.\n",
-                                conf->channel->hw_value, conf->channel->band);
-                IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
-                spin_unlock_irqrestore(&priv->lock, flags);
-                ret = -EINVAL;
-                goto out;
-        }
-
-        iwl_set_rxon_channel(priv, conf->channel);
-
-        iwl_set_flags_for_band(priv, conf->channel->band);
-
-        /* The list of supported rates and rate mask can be different
-         * for each phymode; since the phymode may have changed, reset
-         * the rate mask to what mac80211 lists */
-        iwl_set_rate(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
-        if (conf->flags & IEEE80211_CONF_CHANNEL_SWITCH) {
-                iwl3945_hw_channel_switch(priv, conf->channel);
-                goto out;
-        }
-#endif
-
-        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
-                if (conf->radio_enabled &&
-                    iwl_radio_kill_sw_enable_radio(priv)) {
-                        IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - "
-                                                 "waiting for uCode\n");
-                        goto out;
-                }
-
-                if (!conf->radio_enabled) {
-                        iwl_radio_kill_sw_disable_radio(priv);
-                        IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
-                        goto out;
-                }
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF kill\n");
-                ret = -EIO;
-                goto out;
-        }
-
-        iwl_set_rate(priv);
-
-        if (memcmp(&priv->active_rxon,
-                   &priv->staging_rxon, sizeof(priv->staging_rxon)))
-                iwl3945_commit_rxon(priv);
-        else
-                IWL_DEBUG_INFO(priv, "Not re-sending same RXON configuration\n");
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-out:
-        clear_bit(STATUS_CONF_PENDING, &priv->status);
-        mutex_unlock(&priv->mutex);
-        return ret;
-}
-
-static void iwl3945_config_ap(struct iwl_priv *priv)
+void iwl3945_config_ap(struct iwl_priv *priv)
 {
         int rc = 0;
 
@@ -3875,7 +3259,7 @@ static void iwl3945_config_ap(struct iwl_priv *priv)
 
                 /* RXON - unassoc (to set timing command) */
                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl3945_commit_rxon(priv);
+                iwlcore_commit_rxon(priv);
 
                 /* RXON Timing */
                 memset(&priv->rxon_timing, 0, sizeof(struct iwl_rxon_time_cmd));
@@ -3911,8 +3295,8 @@ static void iwl3945_config_ap(struct iwl_priv *priv)
                 }
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwl3945_commit_rxon(priv);
-                iwl3945_add_station(priv, iwl_bcast_addr, 0, 0);
+                iwlcore_commit_rxon(priv);
+                iwl_add_station(priv, iwl_bcast_addr, 0, CMD_SYNC, NULL);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3921,189 +3305,6 @@ static void iwl3945_config_ap(struct iwl_priv *priv)
          * clear sta table, add BCAST sta... */
 }
 
-static int iwl3945_mac_config_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif,
-                                        struct ieee80211_if_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-        int rc;
-
-        if (conf == NULL)
-                return -EIO;
-
-        if (priv->vif != vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - priv->vif != vif\n");
-                return 0;
-        }
-
-        /* handle this temporarily here */
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            conf->changed & IEEE80211_IFCC_BEACON) {
-                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-                if (!beacon)
-                        return -ENOMEM;
-                mutex_lock(&priv->mutex);
-                rc = iwl3945_mac_beacon_update(hw, beacon);
-                mutex_unlock(&priv->mutex);
-                if (rc)
-                        return rc;
-        }
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->bssid)
-                IWL_DEBUG_MAC80211(priv, "bssid: %pM\n", conf->bssid);
-
-/*
- * very dubious code was here; the probe filtering flag is never set:
- *
-        if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
-            !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
- */
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                if (!conf->bssid) {
-                        conf->bssid = priv->mac_addr;
-                        memcpy(priv->bssid, priv->mac_addr, ETH_ALEN);
-                        IWL_DEBUG_MAC80211(priv, "bssid was set to: %pM\n",
-                                           conf->bssid);
-                }
-                if (priv->ibss_beacon)
-                        dev_kfree_skb(priv->ibss_beacon);
-
-                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
-        }
-
-        if (iwl_is_rfkill(priv))
-                goto done;
-
-        if (conf->bssid && !is_zero_ether_addr(conf->bssid) &&
-            !is_multicast_ether_addr(conf->bssid)) {
-                /* If there is currently a HW scan going on in the background
-                 * then we need to cancel it else the RXON below will fail. */
-                if (iwl_scan_cancel_timeout(priv, 100)) {
-                        IWL_WARN(priv, "Aborted scan still in progress "
-                                    "after 100ms\n");
-                        IWL_DEBUG_MAC80211(priv, "leaving:scan abort failed\n");
-                        mutex_unlock(&priv->mutex);
-                        return -EAGAIN;
-                }
-                memcpy(priv->staging_rxon.bssid_addr, conf->bssid, ETH_ALEN);
-
-                /* TODO: Audit driver for usage of these members and see
-                 * if mac80211 deprecates them (priv->bssid looks like it
-                 * shouldn't be there, but I haven't scanned the IBSS code
-                 * to verify) - jpk */
-                memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-
-                if (priv->iw_mode == NL80211_IFTYPE_AP)
-                        iwl3945_config_ap(priv);
-                else {
-                        rc = iwl3945_commit_rxon(priv);
-                        if ((priv->iw_mode == NL80211_IFTYPE_STATION) && rc)
-                                iwl3945_add_station(priv,
-                                        priv->active_rxon.bssid_addr, 1, 0);
-                }
-
-        } else {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl3945_commit_rxon(priv);
-        }
-
- done:
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        mutex_unlock(&priv->mutex);
-
-        return 0;
-}
-
-static void iwl3945_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_if_init_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        mutex_lock(&priv->mutex);
-
-        if (iwl_is_ready_rf(priv)) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl3945_commit_rxon(priv);
-        }
-        if (priv->vif == conf->vif) {
-                priv->vif = NULL;
-                memset(priv->bssid, 0, ETH_ALEN);
-        }
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-}
-
-#define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
-
-static void iwl3945_bss_info_changed(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_bss_conf *bss_conf,
-                                     u32 changes)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
-
-        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
-                IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
-                                   bss_conf->use_short_preamble);
-                if (bss_conf->use_short_preamble)
-                        priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
-                else
-                        priv->staging_rxon.flags &=
-                                ~RXON_FLG_SHORT_PREAMBLE_MSK;
-        }
-
-        if (changes & BSS_CHANGED_ERP_CTS_PROT) {
-                IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n",
-                                   bss_conf->use_cts_prot);
-                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
-                        priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
-                else
-                        priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
-        }
-
-        if (changes & BSS_CHANGED_ASSOC) {
-                IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
-                /* This should never happen as this function should
-                 * never be called from interrupt context. */
-                if (WARN_ON_ONCE(in_interrupt()))
-                        return;
-                if (bss_conf->assoc) {
-                        priv->assoc_id = bss_conf->aid;
-                        priv->beacon_int = bss_conf->beacon_int;
-                        priv->timestamp = bss_conf->timestamp;
-                        priv->assoc_capability = bss_conf->assoc_capability;
-                        priv->power_data.dtim_period = bss_conf->dtim_period;
-                        priv->next_scan_jiffies = jiffies +
-                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
-                        mutex_lock(&priv->mutex);
-                        iwl3945_post_associate(priv);
-                        mutex_unlock(&priv->mutex);
-                } else {
-                        priv->assoc_id = 0;
-                        IWL_DEBUG_MAC80211(priv,
-                                        "DISASSOC %d\n", bss_conf->assoc);
-                }
-        } else if (changes && iwl_is_associated(priv) && priv->assoc_id) {
-                        IWL_DEBUG_MAC80211(priv,
-                                        "Associated Changes %d\n", changes);
-                        iwl3945_send_rxon_assoc(priv);
-        }
-
-}
-
 static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                                struct ieee80211_vif *vif,
                                struct ieee80211_sta *sta,
@@ -4126,7 +3327,7 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         static_key = !iwl_is_associated(priv);
 
         if (!static_key) {
-                sta_id = iwl3945_hw_find_station(priv, addr);
+                sta_id = iwl_find_station(priv, addr);
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                             addr);
@@ -4162,185 +3363,6 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
-static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
-                           const struct ieee80211_tx_queue_params *params)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        int q;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        if (queue >= AC_NUM) {
-                IWL_DEBUG_MAC80211(priv, "leave - queue >= AC_NUM %d\n", queue);
-                return 0;
-        }
-
-        q = AC_NUM - 1 - queue;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->qos_data.def_qos_parm.ac[q].cw_min = cpu_to_le16(params->cw_min);
-        priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
-        priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
-        priv->qos_data.def_qos_parm.ac[q].edca_txop =
-                        cpu_to_le16((params->txop * 32));
-
-        priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
-        priv->qos_data.qos_active = 1;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        mutex_lock(&priv->mutex);
-        if (priv->iw_mode == NL80211_IFTYPE_AP)
-                iwl_activate_qos(priv, 1);
-        else if (priv->assoc_id && iwl_is_associated(priv))
-                iwl_activate_qos(priv, 0);
-
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        return 0;
-}
-
-static int iwl3945_mac_get_tx_stats(struct ieee80211_hw *hw,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-        int i, avail;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        for (i = 0; i < AC_NUM; i++) {
-                txq = &priv->txq[i];
-                q = &txq->q;
-                avail = iwl_queue_space(q);
-
-                stats[i].len = q->n_window - avail;
-                stats[i].limit = q->n_window - q->high_mark;
-                stats[i].count = q->n_window;
-
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-
-static void iwl3945_mac_reset_tsf(struct ieee80211_hw *hw)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-
-        mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        iwl_reset_qos(priv);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->assoc_id = 0;
-        priv->assoc_capability = 0;
-
-        /* new association get rid of ibss beacon skb */
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-
-        priv->ibss_beacon = NULL;
-
-        priv->beacon_int = priv->hw->conf.beacon_int;
-        priv->timestamp = 0;
-        if ((priv->iw_mode == NL80211_IFTYPE_STATION))
-                priv->beacon_int = 0;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
-
-        /* we are restarting association process
-         * clear RXON_FILTER_ASSOC_MSK bit
-        */
-        if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwl3945_commit_rxon(priv);
-        }
-
-        /* Per mac80211.h: This is only used in IBSS mode... */
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-
-                IWL_DEBUG_MAC80211(priv, "leave - not in IBSS\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
-
-        iwl_set_rate(priv);
-
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-}
-
-static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        __le64 timestamp;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not IBSS\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        if (priv->ibss_beacon)
-                dev_kfree_skb(priv->ibss_beacon);
-
-        priv->ibss_beacon = skb;
-
-        priv->assoc_id = 0;
-        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        iwl_reset_qos(priv);
-
-        iwl3945_post_associate(priv);
-
-
-        return 0;
-}
-
 /*****************************************************************************
  *
  * sysfs attributes
@@ -4359,7 +3381,7 @@ static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%08X\n", priv->debug_level);
 }
@@ -4367,7 +3389,7 @@ static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -4388,7 +3410,7 @@ static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
 static ssize_t show_temperature(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -4401,7 +3423,7 @@ static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
 static ssize_t show_tx_power(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
 }
 
@@ -4409,7 +3431,7 @@ static ssize_t store_tx_power(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
         u32 val;
 
@@ -4427,7 +3449,7 @@ static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 static ssize_t show_flags(struct device *d,
                           struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
 }
@@ -4436,7 +3458,7 @@ static ssize_t store_flags(struct device *d,
                            struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         u32 flags = simple_strtoul(buf, NULL, 0);
 
         mutex_lock(&priv->mutex);
@@ -4448,7 +3470,7 @@ static ssize_t store_flags(struct device *d,
                         IWL_DEBUG_INFO(priv, "Committing rxon.flags = 0x%04X\n",
                                        flags);
                         priv->staging_rxon.flags = cpu_to_le32(flags);
-                        iwl3945_commit_rxon(priv);
+                        iwlcore_commit_rxon(priv);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -4461,7 +3483,7 @@ static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
 static ssize_t show_filter_flags(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n",
                 le32_to_cpu(priv->active_rxon.filter_flags));
@@ -4471,7 +3493,7 @@ static ssize_t store_filter_flags(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         u32 filter_flags = simple_strtoul(buf, NULL, 0);
 
         mutex_lock(&priv->mutex);
@@ -4484,7 +3506,7 @@ static ssize_t store_filter_flags(struct device *d,
                                        "0x%04X\n", filter_flags);
                         priv->staging_rxon.filter_flags =
                                 cpu_to_le32(filter_flags);
-                        iwl3945_commit_rxon(priv);
+                        iwlcore_commit_rxon(priv);
                 }
         }
         mutex_unlock(&priv->mutex);
@@ -4624,26 +3646,11 @@ static ssize_t show_power_level(struct device *d,
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
         int mode = priv->power_data.user_power_setting;
-        int system = priv->power_data.system_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        switch (system) {
-        case IWL_POWER_SYS_AUTO:
-                p += sprintf(p, "SYSTEM:auto");
-                break;
-        case IWL_POWER_SYS_AC:
-                p += sprintf(p, "SYSTEM:ac");
-                break;
-        case IWL_POWER_SYS_BATTERY:
-                p += sprintf(p, "SYSTEM:battery");
-                break;
-        }
-
-        p += sprintf(p, "\tMODE:%s", (mode < IWL_POWER_AUTO) ?
-                        "fixed" : "auto");
-        p += sprintf(p, "\tINDEX:%d", level);
-        p += sprintf(p, "\n");
+        p += sprintf(p, "INDEX:%d\t", level);
+        p += sprintf(p, "USER:%d\n", mode);
         return p - buf + 1;
 }
 
@@ -4756,7 +3763,7 @@ static DEVICE_ATTR(antenna, S_IWUSR | S_IRUGO, show_antenna, store_antenna);
 static ssize_t show_status(struct device *d,
                            struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
         return sprintf(buf, "0x%08x\n", (int)priv->status);
@@ -4768,10 +3775,11 @@ static ssize_t dump_error_log(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
 
         if (p[0] == '1')
-                iwl3945_dump_nic_error_log((struct iwl_priv *)d->driver_data);
+                iwl3945_dump_nic_error_log(priv);
 
         return strnlen(buf, count);
 }
@@ -4782,10 +3790,11 @@ static ssize_t dump_event_log(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
 
         if (p[0] == '1')
-                iwl3945_dump_nic_event_log((struct iwl_priv *)d->driver_data);
+                iwl3945_dump_nic_event_log(priv);
 
         return strnlen(buf, count);
 }
@@ -4807,7 +3816,6 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->up, iwl3945_bg_up);
         INIT_WORK(&priv->restart, iwl3945_bg_restart);
         INIT_WORK(&priv->rx_replenish, iwl3945_bg_rx_replenish);
-        INIT_WORK(&priv->rf_kill, iwl_bg_rf_kill);
         INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl3945_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
@@ -4864,16 +3872,15 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .tx = iwl3945_mac_tx,
         .start = iwl3945_mac_start,
         .stop = iwl3945_mac_stop,
-        .add_interface = iwl3945_mac_add_interface,
-        .remove_interface = iwl3945_mac_remove_interface,
-        .config = iwl3945_mac_config,
-        .config_interface = iwl3945_mac_config_interface,
+        .add_interface = iwl_mac_add_interface,
+        .remove_interface = iwl_mac_remove_interface,
+        .config = iwl_mac_config,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl3945_mac_set_key,
-        .get_tx_stats = iwl3945_mac_get_tx_stats,
-        .conf_tx = iwl3945_mac_conf_tx,
-        .reset_tsf = iwl3945_mac_reset_tsf,
-        .bss_info_changed = iwl3945_bss_info_changed,
+        .get_tx_stats = iwl_mac_get_tx_stats,
+        .conf_tx = iwl_mac_conf_tx,
+        .reset_tsf = iwl_mac_reset_tsf,
+        .bss_info_changed = iwl_bss_info_changed,
         .hw_scan = iwl_mac_hw_scan
 };
 
@@ -4886,7 +3893,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->ibss_beacon = NULL;
 
         spin_lock_init(&priv->lock);
-        spin_lock_init(&priv->power_data.lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -4895,7 +3901,7 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
 
         /* Clear the driver's (not device's) station table */
-        iwl3945_clear_stations_table(priv);
+        iwl_clear_stations_table(priv);
 
         priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
@@ -4966,13 +3972,13 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         hw->wiphy->custom_regulatory = true;
 
-        hw->wiphy->max_scan_ssids = 1; /* WILL FIX */
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
+        /* we create the 802.11 header and a zero-length SSID element */
+        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
 
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 
-        hw->conf.beacon_int = 100;
-
         if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
                 priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &priv->bands[IEEE80211_BAND_2GHZ];
@@ -5037,6 +4043,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
         priv->cfg = cfg;
         priv->pci_dev = pdev;
+        priv->inta_mask = CSR_INI_SET_MASK;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         priv->debug_level = iwl3945_mod_params.debug;
@@ -5083,6 +4090,11 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, 0x41, 0x00);
 
+        /* this spin lock will be used in apm_ops.init and EEPROM access
+         * we should init now
+         */
+        spin_lock_init(&priv->reg_lock);
+
         /* amp init */
         err = priv->cfg->ops->lib->apm_ops.init(priv);
         if (err < 0) {
@@ -5128,20 +4140,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s\n",
                 priv->cfg->name);
 
-        /***********************************
-         * 7. Initialize Module Parameters
-         * **********************************/
-
-        /* Initialize module parameter values here */
-        /* Disable radio (SW RF KILL) via parameter when loading driver */
-        if (iwl3945_mod_params.disable) {
-                set_bit(STATUS_RF_KILL_SW, &priv->status);
-                IWL_DEBUG_INFO(priv, "Radio disabled.\n");
-        }
-
-
         /***********************
-         * 8. Setup Services
+         * 7. Setup Services
          * ********************/
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -5150,8 +4150,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         pci_enable_msi(priv->pci_dev);
 
-        err = request_irq(priv->pci_dev->irq, iwl_isr, IRQF_SHARED,
-                          DRV_NAME, priv);
+        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr,
+                          IRQF_SHARED, DRV_NAME, priv);
         if (err) {
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
                 goto out_disable_msi;
@@ -5169,7 +4169,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         iwl3945_setup_rx_handlers(priv);
 
         /*********************************
-         * 9. Setup and Register mac80211
+         * 8. Setup and Register mac80211
          * *******************************/
 
         iwl_enable_interrupts(priv);
@@ -5178,12 +4178,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         if (err)
                 goto  out_remove_sysfs;
 
-        err = iwl_rfkill_init(priv);
+        err = iwl_dbgfs_register(priv, DRV_NAME);
         if (err)
-                IWL_ERR(priv, "Unable to initialize RFKILL system. "
-                                  "Ignoring error: %d\n", err);
-        else
-                iwl_rfkill_set_hw_state(priv);
+                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
         /* Start monitoring the killswitch */
         queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
@@ -5228,6 +4225,8 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         IWL_DEBUG_INFO(priv, "*** UNLOAD DRIVER ***\n");
 
+        iwl_dbgfs_unregister(priv);
+
         set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         if (priv->mac80211_registered) {
@@ -5248,7 +4247,6 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 
-        iwl_rfkill_unregister(priv);
         cancel_delayed_work_sync(&priv->rfkill_poll);
 
         iwl3945_dealloc_ucode_pci(priv);
@@ -5258,7 +4256,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         iwl3945_hw_txq_ctx_free(priv);
 
         iwl3945_unset_hw_params(priv);
-        iwl3945_clear_stations_table(priv);
+        iwl_clear_stations_table(priv);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
@@ -5286,43 +4284,6 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         ieee80211_free_hw(priv->hw);
 }
 
-#ifdef CONFIG_PM
-
-static int iwl3945_pci_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct iwl_priv *priv = pci_get_drvdata(pdev);
-
-        if (priv->is_open) {
-                set_bit(STATUS_IN_SUSPEND, &priv->status);
-                iwl3945_mac_stop(priv->hw);
-                priv->is_open = 1;
-        }
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
-        return 0;
-}
-
-static int iwl3945_pci_resume(struct pci_dev *pdev)
-{
-        struct iwl_priv *priv = pci_get_drvdata(pdev);
-        int ret;
-
-        pci_set_power_state(pdev, PCI_D0);
-        ret = pci_enable_device(pdev);
-        if (ret)
-                return ret;
-        pci_restore_state(pdev);
-
-        if (priv->is_open)
-                iwl3945_mac_start(priv->hw);
-
-        clear_bit(STATUS_IN_SUSPEND, &priv->status);
-        return 0;
-}
-
-#endif /* CONFIG_PM */
 
 /*****************************************************************************
  *
@@ -5336,8 +4297,8 @@ static struct pci_driver iwl3945_driver = {
         .probe = iwl3945_pci_probe,
         .remove = __devexit_p(iwl3945_pci_remove),
 #ifdef CONFIG_PM
-        .suspend = iwl3945_pci_suspend,
-        .resume = iwl3945_pci_resume,
+        .suspend = iwl_pci_suspend,
+        .resume = iwl_pci_resume,
 #endif
 };
 
@@ -5378,8 +4339,6 @@ MODULE_FIRMWARE(IWL3945_MODULE_FIRMWARE(IWL3945_UCODE_API_MAX));
 
 module_param_named(antenna, iwl3945_mod_params.antenna, int, 0444);
 MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(disable, iwl3945_mod_params.disable, int, 0444);
-MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
 module_param_named(swcrypto, iwl3945_mod_params.sw_crypto, int, 0444);
 MODULE_PARM_DESC(swcrypto,
                  "using software crypto (default 1 [software])\n");