44 files changed, 666 insertions, 489 deletions

diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 88279e325dca..157337febc2b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -203,7 +203,7 @@ static void ar9002_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                         i);
 
                 ath_dbg(common, ATH_DBG_CALIBRATE,
-                        "Orignal: Chn %diq_corr_meas = 0x%08x\n",
+                        "Original: Chn %d iq_corr_meas = 0x%08x\n",
                         i, ah->totalIqCorrMeas[i]);
 
                 iqCorrNeg = 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index ddeba8693fab..23b3a6c57800 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -226,7 +226,7 @@ static void ar9003_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
                         i);
 
                 ath_dbg(common, ATH_DBG_CALIBRATE,
-                        "Orignal: Chn %diq_corr_meas = 0x%08x\n",
+                        "Original: Chn %d iq_corr_meas = 0x%08x\n",
                         i, ah->totalIqCorrMeas[i]);
 
                 iqCorrNeg = 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 259a6f312afb..dc2054f0378e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -41,24 +41,24 @@ static const u32 ar9462_pciephy_clkreq_enable_L1_2p0[][2] = {
 
 static const u32 ar9462_2p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
-        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
-        {0x00009824, 0x5ac640de, 0x5ac640d0, 0x5ac640d0, 0x5ac640de},
-        {0x00009828, 0x0796be89, 0x0696b081, 0x0696b881, 0x0796be89},
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a01ae},
+        {0x00009824, 0x5ac640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
+        {0x00009828, 0x0796be89, 0x0696b081, 0x0696b881, 0x09143e81},
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
         {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
         {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
-        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
-        {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x92c84d2e},
-        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
+        {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x33795d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c782},
-        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
+        {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
         {0x0000a204, 0x013187c0, 0x013187c4, 0x013187c4, 0x013187c0},
@@ -81,6 +81,15 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a3a4, 0x00000010, 0x00000010, 0x00000000, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa},
+        {0x0000a3ac, 0xaaaaaa00, 0xaaaaaa30, 0xaaaaaa00, 0xaaaaaa00},
+        {0x0000a41c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a420, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
+        {0x0000a424, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a428, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
         {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1107,11 +1116,11 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x15262820},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
-        {0x00009e54, 0xe4c355c7},
-        {0x00009e58, 0xfd897735},
+        {0x00009e54, 0xe4c555c2},
+        {0x00009e58, 0xfd857722},
         {0x00009e5c, 0xe9198724},
         {0x00009fc0, 0x803e4788},
         {0x00009fc4, 0x0001efb5},
@@ -1142,9 +1151,6 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x0000a398, 0x001f0e0f},
         {0x0000a39c, 0x0075393f},
         {0x0000a3a0, 0xb79f6427},
-        {0x0000a3a4, 0x00000000},
-        {0x0000a3a8, 0xaaaaaaaa},
-        {0x0000a3ac, 0x3c466478},
         {0x0000a3c0, 0x20202020},
         {0x0000a3c4, 0x22222220},
         {0x0000a3c8, 0x20200020},
@@ -1167,12 +1173,6 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x0000a40c, 0x00820820},
         {0x0000a414, 0x1ce739ce},
         {0x0000a418, 0x2d001dce},
-        {0x0000a41c, 0x1ce739ce},
-        {0x0000a420, 0x000001ce},
-        {0x0000a424, 0x1ce739ce},
-        {0x0000a428, 0x000001ce},
-        {0x0000a42c, 0x1ce739ce},
-        {0x0000a430, 0x1ce739ce},
         {0x0000a434, 0x00000000},
         {0x0000a438, 0x00001801},
         {0x0000a43c, 0x00100000},
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 0b9a0e8a4958..f8ce4ea6f65c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -808,7 +808,8 @@ void ath9k_htc_ani_work(struct work_struct *work)
         }
 
         /* Verify whether we must check ANI */
-        if ((timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
+        if (ah->config.enable_ani &&
+            (timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
                 aniflag = true;
                 common->ani.checkani_timer = timestamp;
         }
@@ -838,7 +839,7 @@ set_timer:
         * short calibration and long calibration.
         */
         cal_interval = ATH_LONG_CALINTERVAL;
-        if (priv->ah->config.enable_ani)
+        if (ah->config.enable_ani)
                 cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
         if (!common->ani.caldone)
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6ceb2e188080..7f8fc65f2cb4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -504,7 +504,7 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 return ecode;
         }
 
-        if (!AR_SREV_9100(ah) && !AR_SREV_9340(ah)) {
+        if (ah->config.enable_ani) {
                 ath9k_hw_ani_setup(ah);
                 ath9k_hw_ani_init(ah);
         }
@@ -610,6 +610,10 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
 
+        /* disable ANI for 9340 */
+        if (AR_SREV_9340(ah))
+                ah->config.enable_ani = false;
+
         ath9k_hw_init_mode_regs(ah);
 
         if (!ah->is_pciexpress)
@@ -1967,7 +1971,8 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
         }
 
         /* Clear Bit 14 of AR_WA after putting chip into Full Sleep mode. */
-        REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index c9c3b1889965..36968c046119 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1110,7 +1110,6 @@ bool ath9k_hw_disable(struct ath_hw *ah);
 void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test);
 void ath9k_hw_setopmode(struct ath_hw *ah);
 void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1);
-void ath9k_hw_setbssidmask(struct ath_hw *ah);
 void ath9k_hw_write_associd(struct ath_hw *ah);
 u32 ath9k_hw_gettsf32(struct ath_hw *ah);
 u64 ath9k_hw_gettsf64(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e9711e2b48c6..41b72faca77f 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -258,6 +258,8 @@ static void setup_ht_cap(struct ath_softc *sc,
 
         if (AR_SREV_9330(ah) || AR_SREV_9485(ah))
                 max_streams = 1;
+        else if (AR_SREV_9462(ah))
+                max_streams = 2;
         else if (AR_SREV_9300_20_OR_LATER(ah))
                 max_streams = 3;
         else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index fd59c1f25c43..5007297c9447 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -118,7 +118,7 @@ void ath9k_ps_restore(struct ath_softc *sc)
         if (--sc->ps_usecount != 0)
                 goto unlock;
 
-        if (sc->ps_idle)
+        if (sc->ps_idle && (sc->ps_flags & PS_WAIT_FOR_TX_ACK))
                 mode = ATH9K_PM_FULL_SLEEP;
         else if (sc->ps_enabled &&
                  !(sc->ps_flags & (PS_WAIT_FOR_BEACON |
@@ -332,7 +332,8 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
                 hchan = ah->curchan;
         }
 
-        if (fastcc && !ath9k_hw_check_alive(ah))
+        if (fastcc && (ah->chip_fullsleep ||
+            !ath9k_hw_check_alive(ah)))
                 fastcc = false;
 
         if (!ath_prepare_reset(sc, retry_tx, flush))
@@ -561,7 +562,6 @@ void ath_ani_calibrate(unsigned long data)
         /* Long calibration runs independently of short calibration. */
         if ((timestamp - common->ani.longcal_timer) >= long_cal_interval) {
                 longcal = true;
-                ath_dbg(common, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
                 common->ani.longcal_timer = timestamp;
         }
 
@@ -569,8 +569,6 @@ void ath_ani_calibrate(unsigned long data)
         if (!common->ani.caldone) {
                 if ((timestamp - common->ani.shortcal_timer) >= short_cal_interval) {
                         shortcal = true;
-                        ath_dbg(common, ATH_DBG_ANI,
-                                "shortcal @%lu\n", jiffies);
                         common->ani.shortcal_timer = timestamp;
                         common->ani.resetcal_timer = timestamp;
                 }
@@ -584,8 +582,9 @@ void ath_ani_calibrate(unsigned long data)
         }
 
         /* Verify whether we must check ANI */
-        if ((timestamp - common->ani.checkani_timer) >=
-             ah->config.ani_poll_interval) {
+        if (sc->sc_ah->config.enable_ani
+            && (timestamp - common->ani.checkani_timer) >=
+            ah->config.ani_poll_interval) {
                 aniflag = true;
                 common->ani.checkani_timer = timestamp;
         }
@@ -605,6 +604,11 @@ void ath_ani_calibrate(unsigned long data)
                                                 ah->rxchainmask, longcal);
         }
 
+        ath_dbg(common, ATH_DBG_ANI,
+                "Calibration @%lu finished: %s %s %s, caldone: %s\n", jiffies,
+                longcal ? "long" : "", shortcal ? "short" : "",
+                aniflag ? "ani" : "", common->ani.caldone ? "true" : "false");
+
         ath9k_ps_restore(sc);
 
 set_timer:
@@ -886,82 +890,6 @@ chip_reset:
 #undef SCHED_INTR
 }
 
-static void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_channel *channel = hw->conf.channel;
-        int r;
-
-        ath9k_ps_wakeup(sc);
-        spin_lock_bh(&sc->sc_pcu_lock);
-        atomic_set(&ah->intr_ref_cnt, -1);
-
-        ath9k_hw_configpcipowersave(ah, false);
-
-        if (!ah->curchan)
-                ah->curchan = ath9k_cmn_get_curchannel(sc->hw, ah);
-
-        r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
-        if (r) {
-                ath_err(common,
-                        "Unable to reset channel (%u MHz), reset status %d\n",
-                        channel->center_freq, r);
-        }
-
-        ath_complete_reset(sc, true);
-
-        /* Enable LED */
-        ath9k_hw_cfg_output(ah, ah->led_pin,
-                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-        ath9k_hw_set_gpio(ah, ah->led_pin, 0);
-
-        spin_unlock_bh(&sc->sc_pcu_lock);
-
-        ath9k_ps_restore(sc);
-}
-
-void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ieee80211_channel *channel = hw->conf.channel;
-        int r;
-
-        ath9k_ps_wakeup(sc);
-
-        ath_cancel_work(sc);
-
-        spin_lock_bh(&sc->sc_pcu_lock);
-
-        /*
-         * Keep the LED on when the radio is disabled
-         * during idle unassociated state.
-         */
-        if (!sc->ps_idle) {
-                ath9k_hw_set_gpio(ah, ah->led_pin, 1);
-                ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
-        }
-
-        ath_prepare_reset(sc, false, true);
-
-        if (!ah->curchan)
-                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
-
-        r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
-        if (r) {
-                ath_err(ath9k_hw_common(sc->sc_ah),
-                        "Unable to reset channel (%u MHz), reset status %d\n",
-                        channel->center_freq, r);
-        }
-
-        ath9k_hw_phy_disable(ah);
-
-        ath9k_hw_configpcipowersave(ah, true);
-
-        spin_unlock_bh(&sc->sc_pcu_lock);
-        ath9k_ps_restore(sc);
-}
-
 static int ath_reset(struct ath_softc *sc, bool retry_tx)
 {
         int r;
@@ -1097,6 +1025,9 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * and then setup of the interrupt mask.
          */
         spin_lock_bh(&sc->sc_pcu_lock);
+
+        atomic_set(&ah->intr_ref_cnt, -1);
+
         r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (r) {
                 ath_err(common,
@@ -1138,6 +1069,18 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 goto mutex_unlock;
         }
 
+        if (ah->led_pin >= 0) {
+                ath9k_hw_cfg_output(ah, ah->led_pin,
+                                    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+                ath9k_hw_set_gpio(ah, ah->led_pin, 0);
+        }
+
+        /*
+         * Reset key cache to sane defaults (all entries cleared) instead of
+         * semi-random values after suspend/resume.
+         */
+        ath9k_cmn_init_crypto(sc->sc_ah);
+
         spin_unlock_bh(&sc->sc_pcu_lock);
 
         if ((ah->btcoex_hw.scheme != ATH_BTCOEX_CFG_NONE) &&
@@ -1183,6 +1126,13 @@ static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 }
         }
 
+        /*
+         * Cannot tx while the hardware is in full sleep, it first needs a full
+         * chip reset to recover from that
+         */
+        if (unlikely(sc->sc_ah->power_mode == ATH9K_PM_FULL_SLEEP))
+                goto exit;
+
         if (unlikely(sc->sc_ah->power_mode != ATH9K_PM_AWAKE)) {
                 /*
                  * We are using PS-Poll and mac80211 can request TX while in
@@ -1229,6 +1179,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        bool prev_idle;
 
         mutex_lock(&sc->mutex);
 
@@ -1259,35 +1210,45 @@ static void ath9k_stop(struct ieee80211_hw *hw)
          * before setting the invalid flag. */
         ath9k_hw_disable_interrupts(ah);
 
-        if (!(sc->sc_flags & SC_OP_INVALID)) {
-                ath_drain_all_txq(sc, false);
-                ath_stoprecv(sc);
-                ath9k_hw_phy_disable(ah);
-        } else
-                sc->rx.rxlink = NULL;
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
+        /* we can now sync irq and kill any running tasklets, since we already
+         * disabled interrupts and not holding a spin lock */
+        synchronize_irq(sc->irq);
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
+
+        prev_idle = sc->ps_idle;
+        sc->ps_idle = true;
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
+        if (ah->led_pin >= 0) {
+                ath9k_hw_set_gpio(ah, ah->led_pin, 1);
+                ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
+        }
+
+        ath_prepare_reset(sc, false, true);
 
         if (sc->rx.frag) {
                 dev_kfree_skb_any(sc->rx.frag);
                 sc->rx.frag = NULL;
         }
 
-        /* disable HAL and put h/w to sleep */
-        ath9k_hw_disable(ah);
+        if (!ah->curchan)
+                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
 
-        spin_unlock_bh(&sc->sc_pcu_lock);
+        ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
+        ath9k_hw_phy_disable(ah);
 
-        /* we can now sync irq and kill any running tasklets, since we already
-         * disabled interrupts and not holding a spin lock */
-        synchronize_irq(sc->irq);
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
+        ath9k_hw_configpcipowersave(ah, true);
 
-        ath9k_ps_restore(sc);
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
-        sc->ps_idle = true;
-        ath_radio_disable(sc, hw);
+        ath9k_ps_restore(sc);
 
         sc->sc_flags |= SC_OP_INVALID;
+        sc->ps_idle = prev_idle;
 
         mutex_unlock(&sc->mutex);
 
@@ -1627,8 +1588,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_conf *conf = &hw->conf;
-        bool disable_radio = false;
 
+        ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
         /*
@@ -1639,13 +1600,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
          */
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                 sc->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE);
-                if (!sc->ps_idle) {
-                        ath_radio_enable(sc, hw);
-                        ath_dbg(common, ATH_DBG_CONFIG,
-                                "not-idle: enabling radio\n");
-                } else {
-                        disable_radio = true;
-                }
+                if (sc->ps_idle)
+                        ath_cancel_work(sc);
         }
 
         /*
@@ -1752,18 +1708,12 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 ath_dbg(common, ATH_DBG_CONFIG,
                         "Set power: %d\n", conf->power_level);
                 sc->config.txpowlimit = 2 * conf->power_level;
-                ath9k_ps_wakeup(sc);
                 ath9k_cmn_update_txpow(ah, sc->curtxpow,
                                        sc->config.txpowlimit, &sc->curtxpow);
-                ath9k_ps_restore(sc);
-        }
-
-        if (disable_radio) {
-                ath_dbg(common, ATH_DBG_CONFIG, "idle: disabling radio\n");
-                ath_radio_disable(sc, hw);
         }
 
         mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 
         return 0;
 }
@@ -2331,9 +2281,6 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
                 return;
         }
 
-        if (drop)
-                timeout = 1;
-
         for (j = 0; j < timeout; j++) {
                 bool npend = false;
 
@@ -2351,21 +2298,22 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
                 }
 
                 if (!npend)
-                    goto out;
+                    break;
         }
 
-        ath9k_ps_wakeup(sc);
-        spin_lock_bh(&sc->sc_pcu_lock);
-        drain_txq = ath_drain_all_txq(sc, false);
-        spin_unlock_bh(&sc->sc_pcu_lock);
+        if (drop) {
+                ath9k_ps_wakeup(sc);
+                spin_lock_bh(&sc->sc_pcu_lock);
+                drain_txq = ath_drain_all_txq(sc, false);
+                spin_unlock_bh(&sc->sc_pcu_lock);
 
-        if (!drain_txq)
-                ath_reset(sc, false);
+                if (!drain_txq)
+                        ath_reset(sc, false);
 
-        ath9k_ps_restore(sc);
-        ieee80211_wake_queues(hw);
+                ath9k_ps_restore(sc);
+                ieee80211_wake_queues(hw);
+        }
 
-out:
         ieee80211_queue_delayed_work(hw, &sc->tx_complete_work, 0);
         mutex_unlock(&sc->mutex);
 }
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 2dcdf63cb390..a439edc5dc06 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -307,12 +307,11 @@ static int ath_pci_suspend(struct device *device)
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_softc *sc = hw->priv;
 
-        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
-
         /* The device has to be moved to FULLSLEEP forcibly.
          * Otherwise the chip never moved to full sleep,
          * when no interface is up.
          */
+        ath9k_hw_disable(sc->sc_ah);
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
 
         return 0;
@@ -321,8 +320,6 @@ static int ath_pci_suspend(struct device *device)
 static int ath_pci_resume(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
-        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
-        struct ath_softc *sc = hw->priv;
         u32 val;
 
         /*
@@ -334,22 +331,6 @@ static int ath_pci_resume(struct device *device)
         if ((val & 0x0000ff00) != 0)
                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
-        ath9k_ps_wakeup(sc);
-        /* Enable LED */
-        ath9k_hw_cfg_output(sc->sc_ah, sc->sc_ah->led_pin,
-                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 0);
-
-          /*
-           * Reset key cache to sane defaults (all entries cleared) instead of
-           * semi-random values after suspend/resume.
-           */
-        ath9k_cmn_init_crypto(sc->sc_ah);
-        ath9k_ps_restore(sc);
-
-        sc->ps_idle = true;
-        ath_radio_disable(sc, hw);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 80639e3e4ac9..9e65c3198ca7 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1954,7 +1954,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 skb_pull(skb, padsize);
         }
 
-        if (sc->ps_flags & PS_WAIT_FOR_TX_ACK) {
+        if ((sc->ps_flags & PS_WAIT_FOR_TX_ACK) && !txq->axq_depth) {
                 sc->ps_flags &= ~PS_WAIT_FOR_TX_ACK;
                 ath_dbg(common, ATH_DBG_PS,
                         "Going back to sleep after having received TX status (0x%lx)\n",
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 7e2924f332a7..881ba043770a 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -2786,9 +2786,8 @@ il_tx_queue_alloc(struct il_priv *il, struct il_tx_queue *txq, u32 id)
         /* Driver ilate data, only for Tx (not command) queues,
          * not shared with device. */
         if (id != il->cmd_queue) {
-                txq->txb =
-                    kzalloc(sizeof(txq->txb[0]) * TFD_QUEUE_SIZE_MAX,
-                            GFP_KERNEL);
+                txq->txb = kcalloc(TFD_QUEUE_SIZE_MAX, sizeof(txq->txb[0]),
+                                   GFP_KERNEL);
                 if (!txq->txb) {
                         IL_ERR("kmalloc for auxiliary BD "
                                "structures failed\n");
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index a7ab280994c8..86344cefd32f 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,7 +1,7 @@
 # WIFI
 obj-$(CONFIG_IWLWIFI)   += iwlwifi.o
 iwlwifi-objs            := iwl-agn.o iwl-agn-rs.o iwl-mac80211.o
-iwlwifi-objs            += iwl-agn-ucode.o iwl-agn-tx.o
+iwlwifi-objs            += iwl-ucode.o iwl-agn-tx.o
 iwlwifi-objs            += iwl-agn-lib.o iwl-agn-calib.o iwl-io.o
 iwlwifi-objs            += iwl-agn-tt.o iwl-agn-sta.o iwl-agn-rx.o
 
@@ -18,7 +18,7 @@ iwlwifi-objs		+= iwl-trans-pcie.o iwl-trans-pcie-rx.o iwl-trans-pcie-tx.o
 
 iwlwifi-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
-iwlwifi-$(CONFIG_IWLWIFI_DEVICE_SVTOOL) += iwl-sv-open.o
+iwlwifi-$(CONFIG_IWLWIFI_DEVICE_SVTOOL) += iwl-testmode.o
 
 CFLAGS_iwl-devtrace.o := -I$(src)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index bc9bbbb2b494..8d3bad7ea5d3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -182,6 +182,7 @@ static struct iwl_base_params iwl1000_base_params = {
         .chain_noise_scale = 1000,
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 128,
+        .wd_disable = true,
 };
 static struct iwl_ht_params iwl1000_ht_params = {
         .ht_greenfield_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 3a3f83032382..cf2fb47529b3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -350,6 +350,7 @@ static struct iwl_base_params iwl5000_base_params = {
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .no_idle_support = true,
+        .wd_disable = true,
 };
 static struct iwl_ht_params iwl5000_ht_params = {
         .ht_greenfield_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 0bc962217351..575d1bb8e8cc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -934,57 +934,6 @@ u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
         return ant;
 }
 
-/* notification wait support */
-void iwlagn_init_notification_wait(struct iwl_priv *priv,
-                                   struct iwl_notification_wait *wait_entry,
-                                   u8 cmd,
-                                   void (*fn)(struct iwl_priv *priv,
-                                              struct iwl_rx_packet *pkt,
-                                              void *data),
-                                   void *fn_data)
-{
-        wait_entry->fn = fn;
-        wait_entry->fn_data = fn_data;
-        wait_entry->cmd = cmd;
-        wait_entry->triggered = false;
-        wait_entry->aborted = false;
-
-        spin_lock_bh(&priv->notif_wait_lock);
-        list_add(&wait_entry->list, &priv->notif_waits);
-        spin_unlock_bh(&priv->notif_wait_lock);
-}
-
-int iwlagn_wait_notification(struct iwl_priv *priv,
-                             struct iwl_notification_wait *wait_entry,
-                             unsigned long timeout)
-{
-        int ret;
-
-        ret = wait_event_timeout(priv->notif_waitq,
-                                 wait_entry->triggered || wait_entry->aborted,
-                                 timeout);
-
-        spin_lock_bh(&priv->notif_wait_lock);
-        list_del(&wait_entry->list);
-        spin_unlock_bh(&priv->notif_wait_lock);
-
-        if (wait_entry->aborted)
-                return -EIO;
-
-        /* return value is always >= 0 */
-        if (ret <= 0)
-                return -ETIMEDOUT;
-        return 0;
-}
-
-void iwlagn_remove_notification(struct iwl_priv *priv,
-                                struct iwl_notification_wait *wait_entry)
-{
-        spin_lock_bh(&priv->notif_wait_lock);
-        list_del(&wait_entry->list);
-        spin_unlock_bh(&priv->notif_wait_lock);
-}
-
 #ifdef CONFIG_PM_SLEEP
 static void iwlagn_convert_p1k(u16 *p1k, __le16 *out)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index 087fd52e5727..90c55ea4cc39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -1131,9 +1131,9 @@ void iwl_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;
 
         /* set up notification wait support */
-        spin_lock_init(&priv->notif_wait_lock);
-        INIT_LIST_HEAD(&priv->notif_waits);
-        init_waitqueue_head(&priv->notif_waitq);
+        spin_lock_init(&priv->shrd->notif_wait_lock);
+        INIT_LIST_HEAD(&priv->shrd->notif_waits);
+        init_waitqueue_head(&priv->shrd->notif_waitq);
 
         /* Set up BT Rx handlers */
         if (priv->cfg->lib->bt_rx_handler_setup)
@@ -1152,11 +1152,11 @@ int iwl_rx_dispatch(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb,
          * even if the RX handler consumes the RXB we have
          * access to it in the notification wait entry.
          */
-        if (!list_empty(&priv->notif_waits)) {
+        if (!list_empty(&priv->shrd->notif_waits)) {
                 struct iwl_notification_wait *w;
 
-                spin_lock(&priv->notif_wait_lock);
-                list_for_each_entry(w, &priv->notif_waits, list) {
+                spin_lock(&priv->shrd->notif_wait_lock);
+                list_for_each_entry(w, &priv->shrd->notif_waits, list) {
                         if (w->cmd != pkt->hdr.cmd)
                                 continue;
                         IWL_DEBUG_RX(priv,
@@ -1167,9 +1167,9 @@ int iwl_rx_dispatch(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb,
                         if (w->fn)
                                 w->fn(priv, pkt, w->fn_data);
                 }
-                spin_unlock(&priv->notif_wait_lock);
+                spin_unlock(&priv->shrd->notif_wait_lock);
 
-                wake_up_all(&priv->notif_waitq);
+                wake_up_all(&priv->shrd->notif_waitq);
         }
 
         if (priv->pre_rx_handler)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index 8de97f5a1825..466e4ab544f7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -60,7 +60,7 @@ static int iwlagn_disable_pan(struct iwl_priv *priv,
         u8 old_dev_type = send->dev_type;
         int ret;
 
-        iwlagn_init_notification_wait(priv, &disable_wait,
+        iwl_init_notification_wait(priv->shrd, &disable_wait,
                                       REPLY_WIPAN_DEACTIVATION_COMPLETE,
                                       NULL, NULL);
 
@@ -74,9 +74,9 @@ static int iwlagn_disable_pan(struct iwl_priv *priv,
 
         if (ret) {
                 IWL_ERR(priv, "Error disabling PAN (%d)\n", ret);
-                iwlagn_remove_notification(priv, &disable_wait);
+                iwl_remove_notification(priv->shrd, &disable_wait);
         } else {
-                ret = iwlagn_wait_notification(priv, &disable_wait, HZ);
+                ret = iwl_wait_notification(priv->shrd, &disable_wait, HZ);
                 if (ret)
                         IWL_ERR(priv, "Timed out waiting for PAN disable\n");
         }
@@ -529,6 +529,24 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         return 0;
 }
 
+void iwlagn_config_ht40(struct ieee80211_conf *conf,
+        struct iwl_rxon_context *ctx)
+{
+        if (conf_is_ht40_minus(conf)) {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                ctx->ht.is_40mhz = true;
+        } else if (conf_is_ht40_plus(conf)) {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                ctx->ht.is_40mhz = true;
+        } else {
+                ctx->ht.extension_chan_offset =
+                        IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                ctx->ht.is_40mhz = false;
+        }
+}
+
 int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct iwl_priv *priv = hw->priv;
@@ -590,19 +608,11 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                                 ctx->ht.enabled = conf_is_ht(conf);
 
                         if (ctx->ht.enabled) {
-                                if (conf_is_ht40_minus(conf)) {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                                        ctx->ht.is_40mhz = true;
-                                } else if (conf_is_ht40_plus(conf)) {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                        ctx->ht.is_40mhz = true;
-                                } else {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                        ctx->ht.is_40mhz = false;
-                                }
+                                /* if HT40 is used, it should not change
+                                 * after associated except channel switch */
+                                if (iwl_is_associated_ctx(ctx) &&
+                                     !ctx->ht.is_40mhz)
+                                        iwlagn_config_ht40(conf, ctx);
                         } else
                                 ctx->ht.is_40mhz = false;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 901fd9485d75..626ed701100e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1250,9 +1250,6 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
 
         switch (keyconf->cipher) {
         case WLAN_CIPHER_SUITE_TKIP:
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-
                 if (sta)
                         addr = sta->addr;
                 else /* station mode case only */
@@ -1265,8 +1262,6 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
                                           seq.tkip.iv32, p1k, CMD_SYNC);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                /* fall through */
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
                 ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index db0d3a84b1e4..daf010dad70c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1232,14 +1232,14 @@ int iwl_alive_start(struct iwl_priv *priv)
                 priv->bt_valid = IWLAGN_BT_VALID_ENABLE_FLAGS;
                 priv->cur_rssi_ctx = NULL;
 
-                iwlagn_send_prio_tbl(priv);
+                iwl_send_prio_tbl(trans(priv));
 
                 /* FIXME: w/a to force change uCode BT state machine */
-                ret = iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                ret = iwl_send_bt_env(trans(priv), IWL_BT_COEX_ENV_OPEN,
                                          BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
-                ret = iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_CLOSE,
+                ret = iwl_send_bt_env(trans(priv), IWL_BT_COEX_ENV_CLOSE,
                                          BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
@@ -2022,9 +2022,10 @@ MODULE_PARM_DESC(plcp_check, "Check plcp health (default: 1 [enabled])");
 module_param_named(ack_check, iwlagn_mod_params.ack_check, bool, S_IRUGO);
 MODULE_PARM_DESC(ack_check, "Check ack health (default: 0 [disabled])");
 
-module_param_named(wd_disable, iwlagn_mod_params.wd_disable, bool, S_IRUGO);
+module_param_named(wd_disable, iwlagn_mod_params.wd_disable, int, S_IRUGO);
 MODULE_PARM_DESC(wd_disable,
-                "Disable stuck queue watchdog timer (default: 0 [enabled])");
+                "Disable stuck queue watchdog timer 0=system default, "
+                "1=disable, 2=enable (default: 0)");
 
 /*
  * set bt_coex_active to true, uCode will do kill/defer
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 5d8d2f445923..f2f10702754d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -101,13 +101,15 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
                              struct ieee80211_bss_conf *bss_conf,
                              u32 changes);
+void iwlagn_config_ht40(struct ieee80211_conf *conf,
+                        struct iwl_rxon_context *ctx);
 
 /* uCode */
 int iwlagn_rx_calib_result(struct iwl_priv *priv,
                             struct iwl_rx_mem_buffer *rxb,
                             struct iwl_device_cmd *cmd);
-int iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
-void iwlagn_send_prio_tbl(struct iwl_priv *priv);
+int iwl_send_bt_env(struct iwl_trans *trans, u8 action, u8 type);
+void iwl_send_prio_tbl(struct iwl_trans *trans);
 int iwlagn_run_init_ucode(struct iwl_priv *priv);
 int iwlagn_load_ucode_wait_alive(struct iwl_priv *priv,
                                  enum iwl_ucode_type ucode_type);
@@ -354,22 +356,6 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv);
 void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac);
 
-/* notification wait support */
-void __acquires(wait_entry)
-iwlagn_init_notification_wait(struct iwl_priv *priv,
-                              struct iwl_notification_wait *wait_entry,
-                              u8 cmd,
-                              void (*fn)(struct iwl_priv *priv,
-                                         struct iwl_rx_packet *pkt,
-                                         void *data),
-                              void *fn_data);
-int __must_check __releases(wait_entry)
-iwlagn_wait_notification(struct iwl_priv *priv,
-                         struct iwl_notification_wait *wait_entry,
-                         unsigned long timeout);
-void __releases(wait_entry)
-iwlagn_remove_notification(struct iwl_priv *priv,
-                           struct iwl_notification_wait *wait_entry);
 extern int iwlagn_init_alive_start(struct iwl_priv *priv);
 extern int iwl_alive_start(struct iwl_priv *priv);
 /* svtool */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index f9e9170e977a..3b6f48bfe0e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -836,19 +836,6 @@ void iwl_print_rx_config_cmd(struct iwl_priv *priv,
 }
 #endif
 
-static void iwlagn_abort_notification_waits(struct iwl_priv *priv)
-{
-        unsigned long flags;
-        struct iwl_notification_wait *wait_entry;
-
-        spin_lock_irqsave(&priv->notif_wait_lock, flags);
-        list_for_each_entry(wait_entry, &priv->notif_waits, list)
-                wait_entry->aborted = true;
-        spin_unlock_irqrestore(&priv->notif_wait_lock, flags);
-
-        wake_up_all(&priv->notif_waitq);
-}
-
 void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
 {
         unsigned int reload_msec;
@@ -860,7 +847,7 @@ void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
         /* Cancel currently queued command. */
         clear_bit(STATUS_HCMD_ACTIVE, &priv->shrd->status);
 
-        iwlagn_abort_notification_waits(priv);
+        iwl_abort_notification_waits(priv->shrd);
 
         /* Keep the restart process from trying to send host
          * commands by clearing the ready bit */
@@ -1505,11 +1492,23 @@ void iwl_setup_watchdog(struct iwl_priv *priv)
 {
         unsigned int timeout = priv->cfg->base_params->wd_timeout;
 
-        if (timeout && !iwlagn_mod_params.wd_disable)
-                mod_timer(&priv->watchdog,
-                          jiffies + msecs_to_jiffies(IWL_WD_TICK(timeout)));
-        else
-                del_timer(&priv->watchdog);
+        if (!iwlagn_mod_params.wd_disable) {
+                /* use system default */
+                if (timeout && !priv->cfg->base_params->wd_disable)
+                        mod_timer(&priv->watchdog,
+                                jiffies +
+                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
+                else
+                        del_timer(&priv->watchdog);
+        } else {
+                /* module parameter overwrite default configuration */
+                if (timeout && iwlagn_mod_params.wd_disable == 2)
+                        mod_timer(&priv->watchdog,
+                                jiffies +
+                                msecs_to_jiffies(IWL_WD_TICK(timeout)));
+                else
+                        del_timer(&priv->watchdog);
+        }
 }
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index f1d9d0c13e4c..6da53a36c1be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -113,6 +113,7 @@ struct iwl_lib_ops {
  * @shadow_reg_enable: HW shadhow register bit
  * @no_idle_support: do not support idle mode
  * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
+ * wd_disable: disable watchdog timer
  */
 struct iwl_base_params {
         int eeprom_size;
@@ -134,6 +135,7 @@ struct iwl_base_params {
         const bool shadow_reg_enable;
         const bool no_idle_support;
         const bool hd_v2;
+        const bool wd_disable;
 };
 /*
  * @advanced_bt_coexist: support advanced bt coexist
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 44a7bdd7ccfd..f8fc2393dd4c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -134,48 +134,43 @@ static inline void iwl_dbgfs_unregister(struct iwl_priv *priv)
  */
 
 /* 0x0000000F - 0x00000001 */
-#define IWL_DL_INFO             (1 << 0)
-#define IWL_DL_MAC80211         (1 << 1)
-#define IWL_DL_HCMD             (1 << 2)
-#define IWL_DL_STATE            (1 << 3)
+#define IWL_DL_INFO             0x00000001
+#define IWL_DL_MAC80211         0x00000002
+#define IWL_DL_HCMD             0x00000004
+#define IWL_DL_STATE            0x00000008
 /* 0x000000F0 - 0x00000010 */
-#define IWL_DL_MACDUMP          (1 << 4)
-#define IWL_DL_HCMD_DUMP        (1 << 5)
-#define IWL_DL_EEPROM           (1 << 6)
-#define IWL_DL_RADIO            (1 << 7)
+#define IWL_DL_EEPROM           0x00000040
+#define IWL_DL_RADIO            0x00000080
 /* 0x00000F00 - 0x00000100 */
-#define IWL_DL_POWER            (1 << 8)
-#define IWL_DL_TEMP             (1 << 9)
-/* reserved (1 << 10) */
-#define IWL_DL_SCAN             (1 << 11)
+#define IWL_DL_POWER            0x00000100
+#define IWL_DL_TEMP             0x00000200
+#define IWL_DL_SCAN             0x00000800
 /* 0x0000F000 - 0x00001000 */
-#define IWL_DL_ASSOC            (1 << 12)
-#define IWL_DL_DROP             (1 << 13)
-/* reserved (1 << 14) */
-#define IWL_DL_COEX             (1 << 15)
+#define IWL_DL_ASSOC            0x00001000
+#define IWL_DL_DROP             0x00002000
+#define IWL_DL_COEX             0x00008000
 /* 0x000F0000 - 0x00010000 */
-#define IWL_DL_FW               (1 << 16)
-#define IWL_DL_RF_KILL          (1 << 17)
-#define IWL_DL_FW_ERRORS        (1 << 18)
-#define IWL_DL_LED              (1 << 19)
+#define IWL_DL_FW               0x00010000
+#define IWL_DL_RF_KILL          0x00020000
+#define IWL_DL_FW_ERRORS        0x00040000
+#define IWL_DL_LED              0x00080000
 /* 0x00F00000 - 0x00100000 */
-#define IWL_DL_RATE             (1 << 20)
-#define IWL_DL_CALIB            (1 << 21)
-#define IWL_DL_WEP              (1 << 22)
-#define IWL_DL_TX               (1 << 23)
+#define IWL_DL_RATE             0x00100000
+#define IWL_DL_CALIB            0x00200000
+#define IWL_DL_WEP              0x00400000
+#define IWL_DL_TX               0x00800000
 /* 0x0F000000 - 0x01000000 */
-#define IWL_DL_RX               (1 << 24)
-#define IWL_DL_ISR              (1 << 25)
-#define IWL_DL_HT               (1 << 26)
+#define IWL_DL_RX               0x01000000
+#define IWL_DL_ISR              0x02000000
+#define IWL_DL_HT               0x04000000
 /* 0xF0000000 - 0x10000000 */
-#define IWL_DL_11H              (1 << 28)
-#define IWL_DL_STATS            (1 << 29)
-#define IWL_DL_TX_REPLY         (1 << 30)
-#define IWL_DL_TX_QUEUES        (1 << 31)
+#define IWL_DL_11H              0x10000000
+#define IWL_DL_STATS            0x20000000
+#define IWL_DL_TX_REPLY         0x40000000
+#define IWL_DL_TX_QUEUES        0x80000000
 
 #define IWL_DEBUG_INFO(p, f, a...)      IWL_DEBUG(p, IWL_DL_INFO, f, ## a)
 #define IWL_DEBUG_MAC80211(p, f, a...)  IWL_DEBUG(p, IWL_DL_MAC80211, f, ## a)
-#define IWL_DEBUG_MACDUMP(p, f, a...)   IWL_DEBUG(p, IWL_DL_MACDUMP, f, ## a)
 #define IWL_DEBUG_TEMP(p, f, a...)      IWL_DEBUG(p, IWL_DL_TEMP, f, ## a)
 #define IWL_DEBUG_SCAN(p, f, a...)      IWL_DEBUG(p, IWL_DL_SCAN, f, ## a)
 #define IWL_DEBUG_RX(p, f, a...)        IWL_DEBUG(p, IWL_DL_RX, f, ## a)
@@ -184,7 +179,6 @@ static inline void iwl_dbgfs_unregister(struct iwl_priv *priv)
 #define IWL_DEBUG_LED(p, f, a...)       IWL_DEBUG(p, IWL_DL_LED, f, ## a)
 #define IWL_DEBUG_WEP(p, f, a...)       IWL_DEBUG(p, IWL_DL_WEP, f, ## a)
 #define IWL_DEBUG_HC(p, f, a...)        IWL_DEBUG(p, IWL_DL_HCMD, f, ## a)
-#define IWL_DEBUG_HC_DUMP(p, f, a...)   IWL_DEBUG(p, IWL_DL_HCMD_DUMP, f, ## a)
 #define IWL_DEBUG_EEPROM(p, f, a...)    IWL_DEBUG(p, IWL_DL_EEPROM, f, ## a)
 #define IWL_DEBUG_CALIB(p, f, a...)     IWL_DEBUG(p, IWL_DL_CALIB, f, ## a)
 #define IWL_DEBUG_FW(p, f, a...)        IWL_DEBUG(p, IWL_DL_FW, f, ## a)
@@ -206,8 +200,6 @@ static inline void iwl_dbgfs_unregister(struct iwl_priv *priv)
 #define IWL_DEBUG_STATS_LIMIT(p, f, a...)       \
                 IWL_DEBUG_LIMIT(p, IWL_DL_STATS, f, ## a)
 #define IWL_DEBUG_TX_REPLY(p, f, a...)  IWL_DEBUG(p, IWL_DL_TX_REPLY, f, ## a)
-#define IWL_DEBUG_TX_REPLY_LIMIT(p, f, a...) \
-                IWL_DEBUG_LIMIT(p, IWL_DL_TX_REPLY, f, ## a)
 #define IWL_DEBUG_TX_QUEUES(p, f, a...) IWL_DEBUG(p, IWL_DL_TX_QUEUES, f, ## a)
 #define IWL_DEBUG_RADIO(p, f, a...)     IWL_DEBUG(p, IWL_DL_RADIO, f, ## a)
 #define IWL_DEBUG_POWER(p, f, a...)     IWL_DEBUG(p, IWL_DL_POWER, f, ## a)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 68b04f5b10ce..ccbcab40e78f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -234,11 +234,12 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
 
         /* default is to dump the entire data segment */
         if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
+                struct iwl_trans *trans = trans(priv);
                 priv->dbgfs_sram_offset = 0x800000;
-                if (priv->ucode_type == IWL_UCODE_INIT)
-                        priv->dbgfs_sram_len = trans(priv)->ucode_init.data.len;
+                if (trans->shrd->ucode_type == IWL_UCODE_INIT)
+                        priv->dbgfs_sram_len = trans->ucode_init.data.len;
                 else
-                        priv->dbgfs_sram_len = trans(priv)->ucode_rt.data.len;
+                        priv->dbgfs_sram_len = trans->ucode_rt.data.len;
         }
         len = priv->dbgfs_sram_len;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 0c95ad3048a0..6f6a647d34f6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -689,35 +689,6 @@ struct iwl_force_reset {
  */
 #define IWLAGN_EXT_BEACON_TIME_POS      22
 
-/**
- * struct iwl_notification_wait - notification wait entry
- * @list: list head for global list
- * @fn: function called with the notification
- * @cmd: command ID
- *
- * This structure is not used directly, to wait for a
- * notification declare it on the stack, and call
- * iwlagn_init_notification_wait() with appropriate
- * parameters. Then do whatever will cause the ucode
- * to notify the driver, and to wait for that then
- * call iwlagn_wait_notification().
- *
- * Each notification is one-shot. If at some point we
- * need to support multi-shot notifications (which
- * can't be allocated on the stack) we need to modify
- * the code for them.
- */
-struct iwl_notification_wait {
-        struct list_head list;
-
-        void (*fn)(struct iwl_priv *priv, struct iwl_rx_packet *pkt,
-                   void *data);
-        void *fn_data;
-
-        u8 cmd;
-        bool triggered, aborted;
-};
-
 struct iwl_rxon_context {
         struct ieee80211_vif *vif;
 
@@ -790,6 +761,12 @@ struct iwl_testmode_trace {
         dma_addr_t dma_addr;
         bool trace_enabled;
 };
+struct iwl_testmode_sram {
+        u32 buff_size;
+        u32 num_chunks;
+        u8 *buff_addr;
+        bool sram_readed;
+};
 #endif
 
 struct iwl_wipan_noa_data {
@@ -883,7 +860,6 @@ struct iwl_priv {
         u32 ucode_ver;                  /* version of ucode, copy of
                                            iwl_ucode.ver */
 
-        enum iwl_ucode_type ucode_type;
         char firmware_name[25];
 
         struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
@@ -987,10 +963,6 @@ struct iwl_priv {
         /* counts reply_tx error */
         struct reply_tx_error_statistics reply_tx_stats;
         struct reply_agg_tx_error_statistics reply_agg_tx_stats;
-        /* notification wait support */
-        struct list_head notif_waits;
-        spinlock_t notif_wait_lock;
-        wait_queue_head_t notif_waitq;
 
         /* remain-on-channel offload support */
         struct ieee80211_channel *hw_roc_channel;
@@ -1070,6 +1042,7 @@ struct iwl_priv {
         bool led_registered;
 #ifdef CONFIG_IWLWIFI_DEVICE_SVTOOL
         struct iwl_testmode_trace testmode_trace;
+        struct iwl_testmode_sram testmode_sram;
         u32 tm_fixed_rate;
 #endif
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index 05b1f0d2f387..794b735264e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -481,15 +481,11 @@ static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct iwl_priv *priv = hw->priv;
 
-        IWL_DEBUG_MACDUMP(priv, "enter\n");
-
         IWL_DEBUG_TX(priv, "dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
                      ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
         if (iwlagn_tx_skb(priv, skb))
                 dev_kfree_skb_any(skb);
-
-        IWL_DEBUG_MACDUMP(priv, "leave\n");
 }
 
 static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/iwl-shared.h b/drivers/net/wireless/iwlwifi/iwl-shared.h
index 47be77a8a0a7..39aa9cf5b847 100644
--- a/drivers/net/wireless/iwlwifi/iwl-shared.h
+++ b/drivers/net/wireless/iwlwifi/iwl-shared.h
@@ -120,7 +120,7 @@ extern struct iwl_mod_params iwlagn_mod_params;
  * @restart_fw: restart firmware, default = 1
  * @plcp_check: enable plcp health check, default = true
  * @ack_check: disable ack health check, default = false
- * @wd_disable: enable stuck queue check, default = false
+ * @wd_disable: enable stuck queue check, default = 0
  * @bt_coex_active: enable bt coex, default = true
  * @led_mode: system default, default = 0
  * @no_sleep_autoadjust: disable autoadjust, default = true
@@ -141,7 +141,7 @@ struct iwl_mod_params {
         int restart_fw;
         bool plcp_check;
         bool ack_check;
-        bool wd_disable;
+        int  wd_disable;
         bool bt_coex_active;
         int led_mode;
         bool no_sleep_autoadjust;
@@ -257,6 +257,52 @@ struct iwl_tid_data {
 };
 
 /**
+ * enum iwl_ucode_type
+ *
+ * The type of ucode currently loaded on the hardware.
+ *
+ * @IWL_UCODE_NONE: No ucode loaded
+ * @IWL_UCODE_REGULAR: Normal runtime ucode
+ * @IWL_UCODE_INIT: Initial ucode
+ * @IWL_UCODE_WOWLAN: Wake on Wireless enabled ucode
+ */
+enum iwl_ucode_type {
+        IWL_UCODE_NONE,
+        IWL_UCODE_REGULAR,
+        IWL_UCODE_INIT,
+        IWL_UCODE_WOWLAN,
+};
+
+/**
+ * struct iwl_notification_wait - notification wait entry
+ * @list: list head for global list
+ * @fn: function called with the notification
+ * @cmd: command ID
+ *
+ * This structure is not used directly, to wait for a
+ * notification declare it on the stack, and call
+ * iwlagn_init_notification_wait() with appropriate
+ * parameters. Then do whatever will cause the ucode
+ * to notify the driver, and to wait for that then
+ * call iwlagn_wait_notification().
+ *
+ * Each notification is one-shot. If at some point we
+ * need to support multi-shot notifications (which
+ * can't be allocated on the stack) we need to modify
+ * the code for them.
+ */
+struct iwl_notification_wait {
+        struct list_head list;
+
+        void (*fn)(struct iwl_priv *priv, struct iwl_rx_packet *pkt,
+                   void *data);
+        void *fn_data;
+
+        u8 cmd;
+        bool triggered, aborted;
+};
+
+/**
  * struct iwl_shared - shared fields for all the layers of the driver
  *
  * @dbg_level_dev: dbg level set per device. Prevails on
@@ -273,6 +319,10 @@ struct iwl_tid_data {
  * @sta_lock: protects the station table.
  *      If lock and sta_lock are needed, lock must be acquired first.
  * @mutex:
+ * @ucode_type: indicator of loaded ucode image
+ * @notif_waits: things waiting for notification
+ * @notif_wait_lock: lock protecting notification
+ * @notif_waitq: head of notification wait queue
  */
 struct iwl_shared {
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -300,6 +350,14 @@ struct iwl_shared {
         struct iwl_tid_data tid_data[IWLAGN_STATION_COUNT][IWL_MAX_TID_COUNT];
 
         wait_queue_head_t wait_command_queue;
+
+        /* ucode related variables */
+        enum iwl_ucode_type ucode_type;
+
+        /* notification wait support */
+        struct list_head notif_waits;
+        spinlock_t notif_wait_lock;
+        wait_queue_head_t notif_waitq;
 };
 
 /*Whatever _m is (iwl_trans, iwl_priv, iwl_bus, these macros will work */
@@ -443,6 +501,24 @@ bool iwl_check_for_ct_kill(struct iwl_priv *priv);
 void iwl_stop_sw_queue(struct iwl_priv *priv, u8 ac);
 void iwl_wake_sw_queue(struct iwl_priv *priv, u8 ac);
 
+/* notification wait support */
+void iwl_abort_notification_waits(struct iwl_shared *shrd);
+void __acquires(wait_entry)
+iwl_init_notification_wait(struct iwl_shared *shrd,
+                              struct iwl_notification_wait *wait_entry,
+                              u8 cmd,
+                              void (*fn)(struct iwl_priv *priv,
+                                         struct iwl_rx_packet *pkt,
+                                         void *data),
+                              void *fn_data);
+int __must_check __releases(wait_entry)
+iwl_wait_notification(struct iwl_shared *shrd,
+                         struct iwl_notification_wait *wait_entry,
+                         unsigned long timeout);
+void __releases(wait_entry)
+iwl_remove_notification(struct iwl_shared *shrd,
+                           struct iwl_notification_wait *wait_entry);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_reset_traffic_log(struct iwl_priv *priv);
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/iwlwifi/iwl-sv-open.c b/drivers/net/wireless/iwlwifi/iwl-testmode.c
index be16cafbbc27..ff72dbcfd52d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sv-open.c
+++ b/drivers/net/wireless/iwlwifi/iwl-testmode.c
@@ -106,6 +106,10 @@ struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 
         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
+
+        [IWL_TM_ATTR_SRAM_ADDR] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_SRAM_SIZE] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_SRAM_DUMP] = { .type = NLA_UNSPEC, },
 };
 
 /*
@@ -177,6 +181,18 @@ void iwl_testmode_init(struct iwl_priv *priv)
 {
         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
         priv->testmode_trace.trace_enabled = false;
+        priv->testmode_sram.sram_readed = false;
+}
+
+static void iwl_sram_cleanup(struct iwl_priv *priv)
+{
+        if (priv->testmode_sram.sram_readed) {
+                kfree(priv->testmode_sram.buff_addr);
+                priv->testmode_sram.buff_addr = NULL;
+                priv->testmode_sram.buff_size = 0;
+                priv->testmode_sram.num_chunks = 0;
+                priv->testmode_sram.sram_readed = false;
+        }
 }
 
 static void iwl_trace_cleanup(struct iwl_priv *priv)
@@ -201,6 +217,7 @@ static void iwl_trace_cleanup(struct iwl_priv *priv)
 void iwl_testmode_cleanup(struct iwl_priv *priv)
 {
         iwl_trace_cleanup(priv);
+        iwl_sram_cleanup(priv);
 }
 
 /*
@@ -356,7 +373,7 @@ static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
         struct iwl_notification_wait calib_wait;
         int ret;
 
-        iwlagn_init_notification_wait(priv, &calib_wait,
+        iwl_init_notification_wait(priv->shrd, &calib_wait,
                                       CALIBRATION_COMPLETE_NOTIFICATION,
                                       NULL, NULL);
         ret = iwlagn_init_alive_start(priv);
@@ -366,14 +383,14 @@ static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
                 goto cfg_init_calib_error;
         }
 
-        ret = iwlagn_wait_notification(priv, &calib_wait, 2 * HZ);
+        ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
         if (ret)
                 IWL_DEBUG_INFO(priv, "Error detecting"
                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
         return ret;
 
 cfg_init_calib_error:
-        iwlagn_remove_notification(priv, &calib_wait);
+        iwl_remove_notification(priv->shrd, &calib_wait);
         return ret;
 }
 
@@ -446,6 +463,21 @@ static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
                                 "Error starting the device: %d\n", status);
                 break;
 
+        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
+                iwl_scan_cancel_timeout(priv, 200);
+                iwl_trans_stop_device(trans(priv));
+                status = iwlagn_load_ucode_wait_alive(priv, IWL_UCODE_WOWLAN);
+                if (status) {
+                        IWL_DEBUG_INFO(priv,
+                                "Error loading WOWLAN ucode: %d\n", status);
+                        break;
+                }
+                status = iwl_alive_start(priv);
+                if (status)
+                        IWL_DEBUG_INFO(priv,
+                                "Error starting the device: %d\n", status);
+                break;
+
         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
                 if (priv->eeprom) {
                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
@@ -558,7 +590,7 @@ static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
                 }
                 priv->testmode_trace.num_chunks =
                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
-                                     TRACE_CHUNK_SIZE);
+                                     DUMP_CHUNK_SIZE);
                 break;
 
         case IWL_TM_CMD_APP2DEV_END_TRACE:
@@ -590,15 +622,15 @@ static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
                 idx = cb->args[4];
                 if (idx >= priv->testmode_trace.num_chunks)
                         return -ENOENT;
-                length = TRACE_CHUNK_SIZE;
+                length = DUMP_CHUNK_SIZE;
                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
-                    (priv->testmode_trace.buff_size % TRACE_CHUNK_SIZE))
+                    (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
                         length = priv->testmode_trace.buff_size %
-                                TRACE_CHUNK_SIZE;
+                                DUMP_CHUNK_SIZE;
 
                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
                         priv->testmode_trace.trace_addr +
-                        (TRACE_CHUNK_SIZE * idx));
+                        (DUMP_CHUNK_SIZE * idx));
                 idx++;
                 cb->args[4] = idx;
                 return 0;
@@ -644,6 +676,110 @@ static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
         return 0;
 }
 
+/*
+ * This function handles the user application commands for SRAM data dump
+ *
+ * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
+ * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
+ *
+ * Several error will be retured, -EBUSY if the SRAM data retrieved by
+ * previous command has not been delivered to userspace, or -ENOMSG if
+ * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
+ * are missing, or -ENOMEM if the buffer allocation fails.
+ *
+ * Otherwise 0 is replied indicating the success of the SRAM reading.
+ *
+ * @hw: ieee80211_hw object that represents the device
+ * @tb: gnl message fields from the user space
+ */
+static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
+{
+        struct iwl_priv *priv = hw->priv;
+        u32 base, ofs, size, maxsize;
+
+        if (priv->testmode_sram.sram_readed)
+                return -EBUSY;
+
+        if (!tb[IWL_TM_ATTR_SRAM_ADDR]) {
+                IWL_DEBUG_INFO(priv, "Error finding SRAM offset address\n");
+                return -ENOMSG;
+        }
+        ofs = nla_get_u32(tb[IWL_TM_ATTR_SRAM_ADDR]);
+        if (!tb[IWL_TM_ATTR_SRAM_SIZE]) {
+                IWL_DEBUG_INFO(priv, "Error finding size for SRAM reading\n");
+                return -ENOMSG;
+        }
+        size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
+        switch (priv->shrd->ucode_type) {
+        case IWL_UCODE_REGULAR:
+                maxsize = trans(priv)->ucode_rt.data.len;
+                break;
+        case IWL_UCODE_INIT:
+                maxsize = trans(priv)->ucode_init.data.len;
+                break;
+        case IWL_UCODE_WOWLAN:
+                maxsize = trans(priv)->ucode_wowlan.data.len;
+                break;
+        case IWL_UCODE_NONE:
+                IWL_DEBUG_INFO(priv, "Error, uCode does not been loaded\n");
+                return -ENOSYS;
+        default:
+                IWL_DEBUG_INFO(priv, "Error, unsupported uCode type\n");
+                return -ENOSYS;
+        }
+        if ((ofs + size) > maxsize) {
+                IWL_DEBUG_INFO(priv, "Invalid offset/size: out of range\n");
+                return -EINVAL;
+        }
+        priv->testmode_sram.buff_size = (size / 4) * 4;
+        priv->testmode_sram.buff_addr =
+                kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);
+        if (priv->testmode_sram.buff_addr == NULL) {
+                IWL_DEBUG_INFO(priv, "Error allocating memory\n");
+                return -ENOMEM;
+        }
+        base = 0x800000;
+        _iwl_read_targ_mem_words(bus(priv), base + ofs,
+                                        priv->testmode_sram.buff_addr,
+                                        priv->testmode_sram.buff_size / 4);
+        priv->testmode_sram.num_chunks =
+                DIV_ROUND_UP(priv->testmode_sram.buff_size, DUMP_CHUNK_SIZE);
+        priv->testmode_sram.sram_readed = true;
+        return 0;
+}
+
+static int iwl_testmode_sram_dump(struct ieee80211_hw *hw, struct nlattr **tb,
+                                   struct sk_buff *skb,
+                                   struct netlink_callback *cb)
+{
+        struct iwl_priv *priv = hw->priv;
+        int idx, length;
+
+        if (priv->testmode_sram.sram_readed) {
+                idx = cb->args[4];
+                if (idx >= priv->testmode_sram.num_chunks) {
+                        iwl_sram_cleanup(priv);
+                        return -ENOENT;
+                }
+                length = DUMP_CHUNK_SIZE;
+                if (((idx + 1) == priv->testmode_sram.num_chunks) &&
+                    (priv->testmode_sram.buff_size % DUMP_CHUNK_SIZE))
+                        length = priv->testmode_sram.buff_size %
+                                DUMP_CHUNK_SIZE;
+
+                NLA_PUT(skb, IWL_TM_ATTR_SRAM_DUMP, length,
+                        priv->testmode_sram.buff_addr +
+                        (DUMP_CHUNK_SIZE * idx));
+                idx++;
+                cb->args[4] = idx;
+                return 0;
+        } else
+                return -EFAULT;
+
+ nla_put_failure:
+        return -ENOBUFS;
+}
+
 
 /* The testmode gnl message handler that takes the gnl message from the
  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
@@ -705,6 +841,7 @@ int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
+        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
                 result = iwl_testmode_driver(hw, tb);
                 break;
@@ -721,6 +858,11 @@ int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
                 result = iwl_testmode_ownership(hw, tb);
                 break;
 
+        case IWL_TM_CMD_APP2DEV_READ_SRAM:
+                IWL_DEBUG_INFO(priv, "testmode sram read cmd to driver\n");
+                result = iwl_testmode_sram(hw, tb);
+                break;
+
         default:
                 IWL_DEBUG_INFO(priv, "Unknown testmode command\n");
                 result = -ENOSYS;
@@ -769,6 +911,10 @@ int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
                 break;
+        case IWL_TM_CMD_APP2DEV_DUMP_SRAM:
+                IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
+                result = iwl_testmode_sram_dump(hw, tb, skb, cb);
+                break;
         default:
                 result = -EINVAL;
                 break;
diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.h b/drivers/net/wireless/iwlwifi/iwl-testmode.h
index 177964850b7c..deedd27c5f3d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-testmode.h
@@ -103,14 +103,22 @@
  * @IWL_TM_CMD_DEV2APP_EEPROM_RSP:
  *      commands from kernel space to carry the eeprom response
  *      to user application
+ *
  * @IWL_TM_CMD_APP2DEV_OWNERSHIP:
  *      commands from user application to own change the ownership of the uCode
  *      if application has the ownership, the only host command from
  *      testmode will deliver to uCode. Default owner is driver
+ *
  * @IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
  * @IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
  *      commands from user applicaiton to indirectly access peripheral register
  *
+ * @IWL_TM_CMD_APP2DEV_READ_SRAM:
+ * @IWL_TM_CMD_APP2DEV_DUMP_SRAM:
+ *      commands from user applicaiton to read data in sram
+ *
+ * @IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW: load Weak On Wireless LAN uCode image
+ *
  */
 enum iwl_tm_cmd_t {
         IWL_TM_CMD_APP2DEV_UCODE                = 1,
@@ -132,7 +140,10 @@ enum iwl_tm_cmd_t {
         IWL_TM_CMD_APP2DEV_OWNERSHIP            = 17,
         IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32  = 18,
         IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32 = 19,
-        IWL_TM_CMD_MAX                          = 20,
+        IWL_TM_CMD_APP2DEV_READ_SRAM            = 20,
+        IWL_TM_CMD_APP2DEV_DUMP_SRAM            = 21,
+        IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW       = 22,
+        IWL_TM_CMD_MAX                          = 23,
 };
 
 /*
@@ -202,6 +213,18 @@ enum iwl_tm_cmd_t {
  *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_OWNERSHIP,
  *      The mandatory fields are:
  *      IWL_TM_ATTR_UCODE_OWNER for the new owner
+ *
+ * @IWL_TM_ATTR_SRAM_ADDR:
+ * @IWL_TM_ATTR_SRAM_SIZE:
+ *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_READ_SRAM,
+ *      The mandatory fields are:
+ *      IWL_TM_ATTR_SRAM_ADDR for the address in sram
+ *      IWL_TM_ATTR_SRAM_SIZE for the buffer size of data reading
+ *
+ * @IWL_TM_ATTR_SRAM_DUMP:
+ *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_DUMP_SRAM,
+ *      IWL_TM_ATTR_SRAM_DUMP for the data in sram
+ *
  */
 enum iwl_tm_attr_t {
         IWL_TM_ATTR_NOT_APPLICABLE              = 0,
@@ -219,7 +242,10 @@ enum iwl_tm_attr_t {
         IWL_TM_ATTR_TRACE_DUMP                  = 12,
         IWL_TM_ATTR_FIXRATE                     = 13,
         IWL_TM_ATTR_UCODE_OWNER                 = 14,
-        IWL_TM_ATTR_MAX                         = 15,
+        IWL_TM_ATTR_SRAM_ADDR                   = 15,
+        IWL_TM_ATTR_SRAM_SIZE                   = 16,
+        IWL_TM_ATTR_SRAM_DUMP                   = 17,
+        IWL_TM_ATTR_MAX                         = 18,
 };
 
 /* uCode trace buffer */
@@ -227,6 +253,8 @@ enum iwl_tm_attr_t {
 #define TRACE_BUFF_SIZE_MIN     0x20000
 #define TRACE_BUFF_SIZE_DEF     TRACE_BUFF_SIZE_MIN
 #define TRACE_BUFF_PADD         0x2000
-#define TRACE_CHUNK_SIZE        (PAGE_SIZE - 1024)
+
+/* Maximum data size of each dump it packet */
+#define DUMP_CHUNK_SIZE         (PAGE_SIZE - 1024)
 
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
index ee126f844a5c..becd92173ddd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
@@ -595,7 +595,7 @@ static void iwl_dump_nic_error_log(struct iwl_trans *trans)
                 IWL_TRANS_GET_PCIE_TRANS(trans);
 
         base = priv->device_pointers.error_event_table;
-        if (priv->ucode_type == IWL_UCODE_INIT) {
+        if (trans->shrd->ucode_type == IWL_UCODE_INIT) {
                 if (!base)
                         base = priv->init_errlog_ptr;
         } else {
@@ -607,7 +607,7 @@ static void iwl_dump_nic_error_log(struct iwl_trans *trans)
                 IWL_ERR(trans,
                         "Not valid error log pointer 0x%08X for %s uCode\n",
                         base,
-                        (priv->ucode_type == IWL_UCODE_INIT)
+                        (trans->shrd->ucode_type == IWL_UCODE_INIT)
                                         ? "Init" : "RT");
                 return;
         }
@@ -710,7 +710,7 @@ static int iwl_print_event_log(struct iwl_trans *trans, u32 start_idx,
                 return pos;
 
         base = priv->device_pointers.log_event_table;
-        if (priv->ucode_type == IWL_UCODE_INIT) {
+        if (trans->shrd->ucode_type == IWL_UCODE_INIT) {
                 if (!base)
                         base = priv->init_evtlog_ptr;
         } else {
@@ -824,7 +824,7 @@ int iwl_dump_nic_event_log(struct iwl_trans *trans, bool full_log,
         struct iwl_priv *priv = priv(trans);
 
         base = priv->device_pointers.log_event_table;
-        if (priv->ucode_type == IWL_UCODE_INIT) {
+        if (trans->shrd->ucode_type == IWL_UCODE_INIT) {
                 logsize = priv->init_evtlog_size;
                 if (!base)
                         base = priv->init_evtlog_ptr;
@@ -838,7 +838,7 @@ int iwl_dump_nic_event_log(struct iwl_trans *trans, bool full_log,
                 IWL_ERR(trans,
                         "Invalid event log pointer 0x%08X for %s uCode\n",
                         base,
-                        (priv->ucode_type == IWL_UCODE_INIT)
+                        (trans->shrd->ucode_type == IWL_UCODE_INIT)
                                         ? "Init" : "RT");
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index 2ac75427f10b..304b2ea0375c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -990,29 +990,16 @@ static int iwl_trans_tx_stop(struct iwl_trans *trans)
         return 0;
 }
 
-static void iwl_trans_pcie_disable_sync_irq(struct iwl_trans *trans)
+static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 {
         unsigned long flags;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
+        /* tell the device to stop sending interrupts */
         spin_lock_irqsave(&trans->shrd->lock, flags);
         iwl_disable_interrupts(trans);
         spin_unlock_irqrestore(&trans->shrd->lock, flags);
 
-        /* wait to make sure we flush pending tasklet*/
-        synchronize_irq(bus(trans)->irq);
-        tasklet_kill(&trans_pcie->irq_tasklet);
-}
-
-static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
-{
-        /* stop and reset the on-board processor */
-        iwl_write32(bus(trans), CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
-
-        /* tell the device to stop sending interrupts */
-        iwl_trans_pcie_disable_sync_irq(trans);
-
         /* device going down, Stop using ICT table */
         iwl_disable_ict(trans);
 
@@ -1039,6 +1026,20 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 
         /* Stop the device, and put it in low power state */
         iwl_apm_stop(priv(trans));
+
+        /* Upon stop, the APM issues an interrupt if HW RF kill is set.
+         * Clean again the interrupt here
+         */
+        spin_lock_irqsave(&trans->shrd->lock, flags);
+        iwl_disable_interrupts(trans);
+        spin_unlock_irqrestore(&trans->shrd->lock, flags);
+
+        /* wait to make sure we flush pending tasklet*/
+        synchronize_irq(bus(trans)->irq);
+        tasklet_kill(&trans_pcie->irq_tasklet);
+
+        /* stop and reset the on-board processor */
+        iwl_write32(bus(trans), CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 }
 
 static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 50227ebc0ee2..4a29b8ab998e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -220,13 +220,6 @@ struct fw_img {
         struct fw_desc data;    /* firmware data image */
 };
 
-enum iwl_ucode_type {
-        IWL_UCODE_NONE,
-        IWL_UCODE_REGULAR,
-        IWL_UCODE_INIT,
-        IWL_UCODE_WOWLAN,
-};
-
 /**
  * struct iwl_trans - transport common data
  * @ops - pointer to iwl_trans_ops
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-ucode.c
index 76949106dafc..b365de457b1b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-ucode.c
@@ -122,7 +122,7 @@ int iwl_alloc_fw_desc(struct iwl_bus *bus, struct fw_desc *desc,
 /*
  * ucode
  */
-static int iwlagn_load_section(struct iwl_trans *trans, const char *name,
+static int iwl_load_section(struct iwl_trans *trans, const char *name,
                                 struct fw_desc *image, u32 dst_addr)
 {
         struct iwl_bus *bus = bus(trans);
@@ -188,7 +188,7 @@ static inline struct fw_img *iwl_get_ucode_image(struct iwl_trans *trans,
         return NULL;
 }
 
-static int iwlagn_load_given_ucode(struct iwl_trans *trans,
+static int iwl_load_given_ucode(struct iwl_trans *trans,
                                    enum iwl_ucode_type ucode_type)
 {
         int ret = 0;
@@ -201,19 +201,19 @@ static int iwlagn_load_given_ucode(struct iwl_trans *trans,
                 return -EINVAL;
         }
 
-        ret = iwlagn_load_section(trans, "INST", &image->code,
+        ret = iwl_load_section(trans, "INST", &image->code,
                                    IWLAGN_RTC_INST_LOWER_BOUND);
         if (ret)
                 return ret;
 
-        return iwlagn_load_section(trans, "DATA", &image->data,
+        return iwl_load_section(trans, "DATA", &image->data,
                                     IWLAGN_RTC_DATA_LOWER_BOUND);
 }
 
 /*
  *  Calibration
  */
-static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
+static int iwl_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
         __le16 *xtal_calib =
@@ -225,7 +225,7 @@ static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
         return iwl_calib_set(priv, (void *)&cmd, sizeof(cmd));
 }
 
-static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
+static int iwl_set_temperature_offset_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_cmd cmd;
         __le16 *offset_calib =
@@ -242,7 +242,7 @@ static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
         return iwl_calib_set(priv, (void *)&cmd, sizeof(cmd));
 }
 
-static int iwlagn_set_temperature_offset_calib_v2(struct iwl_priv *priv)
+static int iwl_set_temperature_offset_calib_v2(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_v2_cmd cmd;
         __le16 *offset_calib_high = (__le16 *)iwl_eeprom_query_addr(priv,
@@ -277,7 +277,7 @@ static int iwlagn_set_temperature_offset_calib_v2(struct iwl_priv *priv)
         return iwl_calib_set(priv, (void *)&cmd, sizeof(cmd));
 }
 
-static int iwlagn_send_calib_cfg(struct iwl_priv *priv)
+static int iwl_send_calib_cfg(struct iwl_trans *trans)
 {
         struct iwl_calib_cfg_cmd calib_cfg_cmd;
         struct iwl_host_cmd cmd = {
@@ -293,7 +293,7 @@ static int iwlagn_send_calib_cfg(struct iwl_priv *priv)
         calib_cfg_cmd.ucd_calib_cfg.flags =
                 IWL_CALIB_CFG_FLAG_SEND_COMPLETE_NTFY_MSK;
 
-        return iwl_trans_send_cmd(trans(priv), &cmd);
+        return iwl_trans_send_cmd(trans, &cmd);
 }
 
 int iwlagn_rx_calib_result(struct iwl_priv *priv,
@@ -326,14 +326,14 @@ int iwlagn_init_alive_start(struct iwl_priv *priv)
                  * no need to close the envlope since we are going
                  * to load the runtime uCode later.
                  */
-                ret = iwlagn_send_bt_env(priv, IWL_BT_COEX_ENV_OPEN,
+                ret = iwl_send_bt_env(trans(priv), IWL_BT_COEX_ENV_OPEN,
                         BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
 
         }
 
-        ret = iwlagn_send_calib_cfg(priv);
+        ret = iwl_send_calib_cfg(trans(priv));
         if (ret)
                 return ret;
 
@@ -343,15 +343,15 @@ int iwlagn_init_alive_start(struct iwl_priv *priv)
          */
         if (priv->cfg->need_temp_offset_calib) {
                 if (priv->cfg->temp_offset_v2)
-                        return iwlagn_set_temperature_offset_calib_v2(priv);
+                        return iwl_set_temperature_offset_calib_v2(priv);
                 else
-                        return iwlagn_set_temperature_offset_calib(priv);
+                        return iwl_set_temperature_offset_calib(priv);
         }
 
         return 0;
 }
 
-static int iwlagn_send_wimax_coex(struct iwl_priv *priv)
+static int iwl_send_wimax_coex(struct iwl_priv *priv)
 {
         struct iwl_wimax_coex_cmd coex_cmd;
 
@@ -379,7 +379,7 @@ static int iwlagn_send_wimax_coex(struct iwl_priv *priv)
                                 sizeof(coex_cmd), &coex_cmd);
 }
 
-static const u8 iwlagn_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
+static const u8 iwl_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
         ((BT_COEX_PRIO_TBL_PRIO_BYPASS << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
                 (0 << IWL_BT_COEX_PRIO_TBL_SHARED_ANTENNA_POS)),
         ((BT_COEX_PRIO_TBL_PRIO_BYPASS << IWL_BT_COEX_PRIO_TBL_PRIO_POS) |
@@ -401,42 +401,42 @@ static const u8 iwlagn_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
         0, 0, 0, 0, 0, 0, 0
 };
 
-void iwlagn_send_prio_tbl(struct iwl_priv *priv)
+void iwl_send_prio_tbl(struct iwl_trans *trans)
 {
         struct iwl_bt_coex_prio_table_cmd prio_tbl_cmd;
 
-        memcpy(prio_tbl_cmd.prio_tbl, iwlagn_bt_prio_tbl,
-                sizeof(iwlagn_bt_prio_tbl));
-        if (iwl_trans_send_cmd_pdu(trans(priv),
+        memcpy(prio_tbl_cmd.prio_tbl, iwl_bt_prio_tbl,
+                sizeof(iwl_bt_prio_tbl));
+        if (iwl_trans_send_cmd_pdu(trans,
                                 REPLY_BT_COEX_PRIO_TABLE, CMD_SYNC,
                                 sizeof(prio_tbl_cmd), &prio_tbl_cmd))
-                IWL_ERR(priv, "failed to send BT prio tbl command\n");
+                IWL_ERR(trans, "failed to send BT prio tbl command\n");
 }
 
-int iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
+int iwl_send_bt_env(struct iwl_trans *trans, u8 action, u8 type)
 {
         struct iwl_bt_coex_prot_env_cmd env_cmd;
         int ret;
 
         env_cmd.action = action;
         env_cmd.type = type;
-        ret = iwl_trans_send_cmd_pdu(trans(priv),
+        ret = iwl_trans_send_cmd_pdu(trans,
                                REPLY_BT_COEX_PROT_ENV, CMD_SYNC,
                                sizeof(env_cmd), &env_cmd);
         if (ret)
-                IWL_ERR(priv, "failed to send BT env command\n");
+                IWL_ERR(trans, "failed to send BT env command\n");
         return ret;
 }
 
 
-static int iwlagn_alive_notify(struct iwl_priv *priv)
+static int iwl_alive_notify(struct iwl_priv *priv)
 {
         struct iwl_rxon_context *ctx;
         int ret;
 
         if (!priv->tx_cmd_pool)
                 priv->tx_cmd_pool =
-                        kmem_cache_create("iwlagn_dev_cmd",
+                        kmem_cache_create("iwl_dev_cmd",
                                           sizeof(struct iwl_device_cmd),
                                           sizeof(void *), 0, NULL);
 
@@ -447,12 +447,12 @@ static int iwlagn_alive_notify(struct iwl_priv *priv)
         for_each_context(priv, ctx)
                 ctx->last_tx_rejected = false;
 
-        ret = iwlagn_send_wimax_coex(priv);
+        ret = iwl_send_wimax_coex(priv);
         if (ret)
                 return ret;
 
         if (!priv->cfg->no_xtal_calib) {
-                ret = iwlagn_set_Xtal_calib(priv);
+                ret = iwl_set_Xtal_calib(priv);
                 if (ret)
                         return ret;
         }
@@ -548,7 +548,7 @@ struct iwlagn_alive_data {
         u8 subtype;
 };
 
-static void iwlagn_alive_fn(struct iwl_priv *priv,
+static void iwl_alive_fn(struct iwl_priv *priv,
                             struct iwl_rx_packet *pkt,
                             void *data)
 {
@@ -571,6 +571,70 @@ static void iwlagn_alive_fn(struct iwl_priv *priv,
         alive_data->valid = palive->is_valid == UCODE_VALID_OK;
 }
 
+/* notification wait support */
+void iwl_init_notification_wait(struct iwl_shared *shrd,
+                                   struct iwl_notification_wait *wait_entry,
+                                   u8 cmd,
+                                   void (*fn)(struct iwl_priv *priv,
+                                              struct iwl_rx_packet *pkt,
+                                              void *data),
+                                   void *fn_data)
+{
+        wait_entry->fn = fn;
+        wait_entry->fn_data = fn_data;
+        wait_entry->cmd = cmd;
+        wait_entry->triggered = false;
+        wait_entry->aborted = false;
+
+        spin_lock_bh(&shrd->notif_wait_lock);
+        list_add(&wait_entry->list, &shrd->notif_waits);
+        spin_unlock_bh(&shrd->notif_wait_lock);
+}
+
+int iwl_wait_notification(struct iwl_shared *shrd,
+                             struct iwl_notification_wait *wait_entry,
+                             unsigned long timeout)
+{
+        int ret;
+
+        ret = wait_event_timeout(shrd->notif_waitq,
+                                 wait_entry->triggered || wait_entry->aborted,
+                                 timeout);
+
+        spin_lock_bh(&shrd->notif_wait_lock);
+        list_del(&wait_entry->list);
+        spin_unlock_bh(&shrd->notif_wait_lock);
+
+        if (wait_entry->aborted)
+                return -EIO;
+
+        /* return value is always >= 0 */
+        if (ret <= 0)
+                return -ETIMEDOUT;
+        return 0;
+}
+
+void iwl_remove_notification(struct iwl_shared *shrd,
+                                struct iwl_notification_wait *wait_entry)
+{
+        spin_lock_bh(&shrd->notif_wait_lock);
+        list_del(&wait_entry->list);
+        spin_unlock_bh(&shrd->notif_wait_lock);
+}
+
+void iwl_abort_notification_waits(struct iwl_shared *shrd)
+{
+        unsigned long flags;
+        struct iwl_notification_wait *wait_entry;
+
+        spin_lock_irqsave(&shrd->notif_wait_lock, flags);
+        list_for_each_entry(wait_entry, &shrd->notif_waits, list)
+                wait_entry->aborted = true;
+        spin_unlock_irqrestore(&shrd->notif_wait_lock, flags);
+
+        wake_up_all(&shrd->notif_waitq);
+}
+
 #define UCODE_ALIVE_TIMEOUT     HZ
 #define UCODE_CALIB_TIMEOUT     (2*HZ)
 
@@ -579,41 +643,43 @@ int iwlagn_load_ucode_wait_alive(struct iwl_priv *priv,
 {
         struct iwl_notification_wait alive_wait;
         struct iwlagn_alive_data alive_data;
+        struct iwl_trans *trans = trans(priv);
         int ret;
         enum iwl_ucode_type old_type;
 
-        ret = iwl_trans_start_device(trans(priv));
+        ret = iwl_trans_start_device(trans);
         if (ret)
                 return ret;
 
-        iwlagn_init_notification_wait(priv, &alive_wait, REPLY_ALIVE,
-                                      iwlagn_alive_fn, &alive_data);
+        iwl_init_notification_wait(trans->shrd, &alive_wait, REPLY_ALIVE,
+                                      iwl_alive_fn, &alive_data);
 
-        old_type = priv->ucode_type;
-        priv->ucode_type = ucode_type;
+        old_type = trans->shrd->ucode_type;
+        trans->shrd->ucode_type = ucode_type;
 
-        ret = iwlagn_load_given_ucode(trans(priv), ucode_type);
+        ret = iwl_load_given_ucode(trans, ucode_type);
         if (ret) {
-                priv->ucode_type = old_type;
-                iwlagn_remove_notification(priv, &alive_wait);
+                trans->shrd->ucode_type = old_type;
+                iwl_remove_notification(trans->shrd, &alive_wait);
                 return ret;
         }
 
-        iwl_trans_kick_nic(trans(priv));
+        iwl_trans_kick_nic(trans);
 
         /*
          * Some things may run in the background now, but we
          * just wait for the ALIVE notification here.
          */
-        ret = iwlagn_wait_notification(priv, &alive_wait, UCODE_ALIVE_TIMEOUT);
+        ret = iwl_wait_notification(trans->shrd, &alive_wait,
+                                        UCODE_ALIVE_TIMEOUT);
         if (ret) {
-                priv->ucode_type = old_type;
+                trans->shrd->ucode_type = old_type;
                 return ret;
         }
 
         if (!alive_data.valid) {
                 IWL_ERR(priv, "Loaded ucode is not valid!\n");
-                priv->ucode_type = old_type;
+                trans->shrd->ucode_type = old_type;
                 return -EIO;
         }
 
@@ -623,9 +689,9 @@ int iwlagn_load_ucode_wait_alive(struct iwl_priv *priv,
          * skip it for WoWLAN.
          */
         if (ucode_type != IWL_UCODE_WOWLAN) {
-                ret = iwl_verify_ucode(trans(priv), ucode_type);
+                ret = iwl_verify_ucode(trans, ucode_type);
                 if (ret) {
-                        priv->ucode_type = old_type;
+                        trans->shrd->ucode_type = old_type;
                         return ret;
                 }
 
@@ -633,11 +699,11 @@ int iwlagn_load_ucode_wait_alive(struct iwl_priv *priv,
                 msleep(5);
         }
 
-        ret = iwlagn_alive_notify(priv);
+        ret = iwl_alive_notify(priv);
         if (ret) {
                 IWL_WARN(priv,
                         "Could not complete ALIVE transition: %d\n", ret);
-                priv->ucode_type = old_type;
+                trans->shrd->ucode_type = old_type;
                 return ret;
         }
 
@@ -655,10 +721,10 @@ int iwlagn_run_init_ucode(struct iwl_priv *priv)
         if (!trans(priv)->ucode_init.code.len)
                 return 0;
 
-        if (priv->ucode_type != IWL_UCODE_NONE)
+        if (priv->shrd->ucode_type != IWL_UCODE_NONE)
                 return 0;
 
-        iwlagn_init_notification_wait(priv, &calib_wait,
+        iwl_init_notification_wait(priv->shrd, &calib_wait,
                                       CALIBRATION_COMPLETE_NOTIFICATION,
                                       NULL, NULL);
 
@@ -675,12 +741,13 @@ int iwlagn_run_init_ucode(struct iwl_priv *priv)
          * Some things may run in the background now, but we
          * just wait for the calibration complete notification.
          */
-        ret = iwlagn_wait_notification(priv, &calib_wait, UCODE_CALIB_TIMEOUT);
+        ret = iwl_wait_notification(priv->shrd, &calib_wait,
+                                        UCODE_CALIB_TIMEOUT);
 
         goto out;
 
  error:
-        iwlagn_remove_notification(priv, &calib_wait);
+        iwl_remove_notification(priv->shrd, &calib_wait);
  out:
         /* Whatever happened, stop the device */
         iwl_trans_stop_device(trans(priv));
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 89f34ad8d34a..d1d84e0e30fc 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -635,7 +635,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         if (channel &&
                             !(channel->flags & IEEE80211_CHAN_DISABLED)) {
                                 bss = cfg80211_inform_bss(wiphy, channel,
-                                        bssid, le64_to_cpu(*(__le64 *)tsfdesc),
+                                        bssid, get_unaligned_le64(tsfdesc),
                                         capa, intvl, ie, ielen,
                                         LBS_SCAN_RSSI_TO_MBM(rssi),
                                         GFP_KERNEL);
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 0c87f42fa660..50b1ee7721e9 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -995,6 +995,7 @@ static int if_spi_host_to_card(struct lbs_private *priv,
                 spin_unlock_irqrestore(&card->buffer_lock, flags);
                 break;
         default:
+                kfree(packet);
                 netdev_err(priv->dev, "can't transfer buffer of type %d\n",
                            type);
                 err = -EINVAL;
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 8a18bcc23b26..b8b9d37b01a9 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -819,8 +819,10 @@ mwifiex_scan_setup_scan_config(struct mwifiex_private *priv,
                         wildcard_ssid_tlv->header.len = cpu_to_le16(
                                 (u16) (ssid_len + sizeof(wildcard_ssid_tlv->
                                                          max_ssid_length)));
-                        wildcard_ssid_tlv->max_ssid_length =
-                                user_scan_in->ssid_list[ssid_idx].max_len;
+
+                        /* max_ssid_length = 0 tells firmware to perform
+                           specific scan for the SSID filled */
+                        wildcard_ssid_tlv->max_ssid_length = 0;
 
                         memcpy(wildcard_ssid_tlv->ssid,
                                user_scan_in->ssid_list[ssid_idx].ssid,
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 546551389a1d..7faed62c6378 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -584,8 +584,6 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
         mutex_lock(&priv->mutex);
         WARN_ON(priv->fw_state != FW_STATE_READY);
 
-        cancel_work_sync(&priv->work);
-
         p54spi_power_off(priv);
         spin_lock_irqsave(&priv->tx_lock, flags);
         INIT_LIST_HEAD(&priv->tx_pending);
@@ -593,6 +591,8 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
 
         priv->fw_state = FW_STATE_OFF;
         mutex_unlock(&priv->mutex);
+
+        cancel_work_sync(&priv->work);
 }
 
 static int __devinit p54spi_probe(struct spi_device *spi)
@@ -652,6 +652,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
         init_completion(&priv->fw_comp);
         INIT_LIST_HEAD(&priv->tx_pending);
         mutex_init(&priv->mutex);
+        spin_lock_init(&priv->tx_lock);
         SET_IEEE80211_DEV(hw, &spi->dev);
         priv->common.open = p54spi_op_start;
         priv->common.stop = p54spi_op_stop;
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index f83bc5a5e81f..4e44b1af119a 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
                 dwrq->flags = 0;
                 dwrq->length = 0;
         }
-        essid->octets[essid->length] = '\0';
+        essid->octets[dwrq->length] = '\0';
         memcpy(extra, essid->octets, dwrq->length);
         kfree(essid);
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 25dab2987131..e5df380d4fbe 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3773,7 +3773,7 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
         /* Apparently the data is read from end to start */
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
         /* The returned value is in CPU order, but eeprom is le */
-        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
+        *(u32 *)&rt2x00dev->eeprom[i] = cpu_to_le32(reg);
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
         *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index f1565792f270..377876315b8d 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -919,6 +919,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x935b) },
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00e8) },
+        { USB_DEVICE(0x0411, 0x0158) },
         { USB_DEVICE(0x0411, 0x016f) },
         { USB_DEVICE(0x0411, 0x01a2) },
         /* Corega */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 2ec5c00235e6..99ff12d0c29d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -943,6 +943,7 @@ struct rt2x00_dev {
          * Powersaving work
          */
         struct delayed_work autowakeup_work;
+        struct work_struct sleep_work;
 
         /*
          * Data queue arrays for RX, TX, Beacon and ATIM.
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index e1fb2a8569be..c3e1aa7c1a80 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -465,6 +465,23 @@ static u8 *rt2x00lib_find_ie(u8 *data, unsigned int len, u8 ie)
         return NULL;
 }
 
+static void rt2x00lib_sleep(struct work_struct *work)
+{
+        struct rt2x00_dev *rt2x00dev =
+            container_of(work, struct rt2x00_dev, sleep_work);
+
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return;
+
+        /*
+         * Check again is powersaving is enabled, to prevent races from delayed
+         * work execution.
+         */
+        if (!test_bit(CONFIG_POWERSAVING, &rt2x00dev->flags))
+                rt2x00lib_config(rt2x00dev, &rt2x00dev->hw->conf,
+                                 IEEE80211_CONF_CHANGE_PS);
+}
+
 static void rt2x00lib_rxdone_check_ps(struct rt2x00_dev *rt2x00dev,
                                       struct sk_buff *skb,
                                       struct rxdone_entry_desc *rxdesc)
@@ -512,8 +529,7 @@ static void rt2x00lib_rxdone_check_ps(struct rt2x00_dev *rt2x00dev,
         cam |= (tim_ie->bitmap_ctrl & 0x01);
 
         if (!cam && !test_bit(CONFIG_POWERSAVING, &rt2x00dev->flags))
-                rt2x00lib_config(rt2x00dev, &rt2x00dev->hw->conf,
-                                 IEEE80211_CONF_CHANGE_PS);
+                queue_work(rt2x00dev->workqueue, &rt2x00dev->sleep_work);
 }
 
 static int rt2x00lib_rxdone_read_signal(struct rt2x00_dev *rt2x00dev,
@@ -815,11 +831,11 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
         if (spec->supported_rates & SUPPORT_RATE_OFDM)
                 num_rates += 8;
 
-        channels = kzalloc(sizeof(*channels) * spec->num_channels, GFP_KERNEL);
+        channels = kcalloc(spec->num_channels, sizeof(*channels), GFP_KERNEL);
         if (!channels)
                 return -ENOMEM;
 
-        rates = kzalloc(sizeof(*rates) * num_rates, GFP_KERNEL);
+        rates = kcalloc(num_rates, sizeof(*rates), GFP_KERNEL);
         if (!rates)
                 goto exit_free_channels;
 
@@ -1141,6 +1157,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 
         INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
         INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
+        INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
 
         /*
          * Let the driver probe the device to detect the capabilities.
@@ -1197,6 +1214,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
          */
         cancel_work_sync(&rt2x00dev->intf_work);
         cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
+        cancel_work_sync(&rt2x00dev->sleep_work);
         if (rt2x00_is_usb(rt2x00dev)) {
                 del_timer_sync(&rt2x00dev->txstatus_timer);
                 cancel_work_sync(&rt2x00dev->rxdone_work);
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index db5262844543..55c8e50f45fd 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -395,7 +395,7 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
         if (mac->link_state != MAC80211_LINKED)
                 return;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
 
         /* Idle for a while if we connect to AP a while ago. */
         if (mac->cnt_after_linked >= 2) {
@@ -407,7 +407,7 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
                 }
         }
 
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 }
 
 /*Leave the leisure power save mode.*/
@@ -416,8 +416,9 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        unsigned long flags;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irqsave(&rtlpriv->locks.lps_lock, flags);
 
         if (ppsc->fwctrl_lps) {
                 if (ppsc->dot11_psmode != EACTIVE) {
@@ -438,7 +439,7 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
                         rtl_lps_set_psmode(hw, EACTIVE);
                 }
         }
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flags);
 }
 
 /* For sw LPS*/
@@ -539,9 +540,9 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
                 RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM);
         }
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
         rtl_ps_set_rf_state(hw, ERFON, RF_CHANGE_BY_PS);
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 }
 
 void rtl_swlps_rfon_wq_callback(void *data)
@@ -574,9 +575,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
         if (rtlpriv->link_info.busytraffic)
                 return;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
         rtl_ps_set_rf_state(hw, ERFSLEEP, RF_CHANGE_BY_PS);
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 
         if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM &&
                 !RT_IN_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM)) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index fa393dfe136c..931d97979b04 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -262,10 +262,10 @@ int rtl92c_download_fw(struct ieee80211_hw *hw)
         u32 fwsize;
         enum version_8192c version = rtlhal->version;
 
-        pr_info("Loading firmware file %s\n", rtlpriv->cfg->fw_name);
         if (!rtlhal->pfirmware)
                 return 1;
 
+        pr_info("Loading firmware file %s\n", rtlpriv->cfg->fw_name);
         pfwheader = (struct rtl92c_firmware_header *)rtlhal->pfirmware;
         pfwdata = (u8 *) rtlhal->pfirmware;
         fwsize = rtlhal->fwsize;