]> nv-tegra.nvidia Code Review - linux-2.6.git/blobdiff - drivers/net/wireless/iwlwifi/iwl-agn-lib.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
[linux-2.6.git] / drivers / net / wireless / iwlwifi / iwl-agn-lib.c
index 48c48f1fac3784067dcea40f154a30f7893d61dd..90d366e15d2fad1ee89b7d15916cd64072abdbc9 100644 (file)
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2011 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -40,7 +40,7 @@
 #include "iwl-agn.h"
 #include "iwl-sta.h"
 
-static inline u32 iwlagn_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
+static inline u32 iwlagn_get_scd_ssn(struct iwlagn_tx_resp *tx_resp)
 {
        return le32_to_cpup((__le32 *)&tx_resp->status +
                            tx_resp->frame_count) & MAX_SN;
@@ -172,7 +172,8 @@ static void iwlagn_count_agg_tx_err_status(struct iwl_priv *priv, u16 status)
 
 static void iwlagn_set_tx_status(struct iwl_priv *priv,
                                 struct ieee80211_tx_info *info,
-                                struct iwl5000_tx_resp *tx_resp,
+                                struct iwl_rxon_context *ctx,
+                                struct iwlagn_tx_resp *tx_resp,
                                 int txq_id, bool is_agg)
 {
        u16  status = le16_to_cpu(tx_resp->status.status);
@@ -186,6 +187,13 @@ static void iwlagn_set_tx_status(struct iwl_priv *priv,
        if (!iwl_is_tx_success(status))
                iwlagn_count_tx_err_status(priv, status);
 
+       if (status == TX_STATUS_FAIL_PASSIVE_NO_RX &&
+           iwl_is_associated_ctx(ctx) && ctx->vif &&
+           ctx->vif->type == NL80211_IFTYPE_STATION) {
+               ctx->last_tx_rejected = true;
+               iwl_stop_queue(priv, &priv->txq[txq_id]);
+       }
+
        IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
                           "0x%x retries %d\n",
                           txq_id,
@@ -223,7 +231,7 @@ const char *iwl_get_agg_tx_fail_reason(u16 status)
 
 static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
                                      struct iwl_ht_agg *agg,
-                                     struct iwl5000_tx_resp *tx_resp,
+                                     struct iwlagn_tx_resp *tx_resp,
                                      int txq_id, u16 start_idx)
 {
        u16 status;
@@ -242,15 +250,16 @@ static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
 
        /* # frames attempted by Tx command */
        if (agg->frame_count == 1) {
+               struct iwl_tx_info *txb;
+
                /* Only one frame was attempted; no block-ack will arrive */
                idx = start_idx;
 
                IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
                                   agg->frame_count, agg->start_idx, idx);
-               iwlagn_set_tx_status(priv,
-                                    IEEE80211_SKB_CB(
-                                       priv->txq[txq_id].txb[idx].skb),
-                                    tx_resp, txq_id, true);
+               txb = &priv->txq[txq_id].txb[idx];
+               iwlagn_set_tx_status(priv, IEEE80211_SKB_CB(txb->skb),
+                                    txb->ctx, tx_resp, txq_id, true);
                agg->wait_for_ba = 0;
        } else {
                /* Two or more frames were attempted; expect block-ack */
@@ -390,26 +399,31 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
        int index = SEQ_TO_INDEX(sequence);
        struct iwl_tx_queue *txq = &priv->txq[txq_id];
        struct ieee80211_tx_info *info;
-       struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
-       u32  status = le16_to_cpu(tx_resp->status.status);
+       struct iwlagn_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+       struct iwl_tx_info *txb;
+       u32 status = le16_to_cpu(tx_resp->status.status);
        int tid;
        int sta_id;
        int freed;
        unsigned long flags;
 
        if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
-               IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
-                         "is out of range [0-%d] %d %d\n", txq_id,
-                         index, txq->q.n_bd, txq->q.write_ptr,
+               IWL_ERR(priv, "%s: Read index for DMA queue txq_id (%d) "
+                         "index %d is out of range [0-%d] %d %d\n", __func__,
+                         txq_id, index, txq->q.n_bd, txq->q.write_ptr,
                          txq->q.read_ptr);
                return;
        }
 
-       info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb);
+       txq->time_stamp = jiffies;
+       txb = &txq->txb[txq->q.read_ptr];
+       info = IEEE80211_SKB_CB(txb->skb);
        memset(&info->status, 0, sizeof(info->status));
 
-       tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
-       sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
+       tid = (tx_resp->ra_tid & IWLAGN_TX_RES_TID_MSK) >>
+               IWLAGN_TX_RES_TID_POS;
+       sta_id = (tx_resp->ra_tid & IWLAGN_TX_RES_RA_MSK) >>
+               IWLAGN_TX_RES_RA_POS;
 
        spin_lock_irqsave(&priv->sta_lock, flags);
        if (txq->sched_retry) {
@@ -424,7 +438,7 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
                if (tx_resp->bt_kill_count && tx_resp->frame_count == 1 &&
                    priv->cfg->bt_params &&
                    priv->cfg->bt_params->advanced_bt_coexist) {
-                       IWL_WARN(priv, "receive reply tx with bt_kill\n");
+                       IWL_DEBUG_COEX(priv, "receive reply tx with bt_kill\n");
                }
                iwlagn_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
 
@@ -443,22 +457,19 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
 
                        if (priv->mac80211_registered &&
                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                           (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
-                               if (agg->state == IWL_AGG_OFF)
-                                       iwl_wake_queue(priv, txq_id);
-                               else
-                                       iwl_wake_queue(priv, txq->swq_id);
-                       }
+                           (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
+                               iwl_wake_queue(priv, txq);
                }
        } else {
-               BUG_ON(txq_id != txq->swq_id);
-               iwlagn_set_tx_status(priv, info, tx_resp, txq_id, false);
+               iwlagn_set_tx_status(priv, info, txb->ctx, tx_resp,
+                                    txq_id, false);
                freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                if (priv->mac80211_registered &&
-                   (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                       iwl_wake_queue(priv, txq_id);
+                   iwl_queue_space(&txq->q) > txq->q.low_mark &&
+                   status != TX_STATUS_FAIL_PASSIVE_NO_RX)
+                       iwl_wake_queue(priv, txq);
        }
 
        iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
@@ -472,15 +483,20 @@ void iwlagn_rx_handler_setup(struct iwl_priv *priv)
        /* init calibration handlers */
        priv->rx_handlers[CALIBRATION_RES_NOTIFICATION] =
                                        iwlagn_rx_calib_result;
-       priv->rx_handlers[CALIBRATION_COMPLETE_NOTIFICATION] =
-                                       iwlagn_rx_calib_complete;
        priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;
+
+       /* set up notification wait support */
+       spin_lock_init(&priv->_agn.notif_wait_lock);
+       INIT_LIST_HEAD(&priv->_agn.notif_waits);
+       init_waitqueue_head(&priv->_agn.notif_waitq);
 }
 
 void iwlagn_setup_deferred_work(struct iwl_priv *priv)
 {
-       /* in agn, the tx power calibration is done in uCode */
-       priv->disable_tx_power_cal = 1;
+       /*
+        * nothing need to be done here anymore
+        * still keep for future use if needed
+        */
 }
 
 int iwlagn_hw_valid_rtc_data_addr(u32 addr)
@@ -494,6 +510,10 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
        struct iwlagn_tx_power_dbm_cmd tx_power_cmd;
        u8 tx_ant_cfg_cmd;
 
+       if (WARN_ONCE(test_bit(STATUS_SCAN_HW, &priv->status),
+                     "TX Power requested while scanning!\n"))
+               return -EAGAIN;
+
        /* half dBm need to multiply */
        tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
 
@@ -520,16 +540,14 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
        else
                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
 
-       return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
-                                      sizeof(tx_power_cmd), &tx_power_cmd,
-                                      NULL);
+       return iwl_send_cmd_pdu(priv, tx_ant_cfg_cmd, sizeof(tx_power_cmd),
+                               &tx_power_cmd);
 }
 
 void iwlagn_temperature(struct iwl_priv *priv)
 {
-       /* store temperature from statistics (in Celsius) */
-       priv->temperature =
-               le32_to_cpu(priv->_agn.statistics.general.common.temperature);
+       /* store temperature from correct statistics (in Celsius) */
+       priv->temperature = le32_to_cpu(priv->statistics.common.temperature);
        iwl_tt_handler(priv);
 }
 
@@ -567,6 +585,12 @@ static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
        case INDIRECT_REGULATORY:
                offset = iwl_eeprom_query16(priv, EEPROM_LINK_REGULATORY);
                break;
+       case INDIRECT_TXP_LIMIT:
+               offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT);
+               break;
+       case INDIRECT_TXP_LIMIT_SIZE:
+               offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT_SIZE);
+               break;
        case INDIRECT_CALIBRATION:
                offset = iwl_eeprom_query16(priv, EEPROM_LINK_CALIBRATION);
                break;
@@ -597,51 +621,22 @@ const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
 struct iwl_mod_params iwlagn_mod_params = {
        .amsdu_size_8K = 1,
        .restart_fw = 1,
+       .plcp_check = true,
+       .bt_coex_active = true,
+       .no_sleep_autoadjust = true,
+       .power_level = IWL_POWER_INDEX_1,
        /* the rest are 0 by default */
 };
 
-void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-       unsigned long flags;
-       int i;
-       spin_lock_irqsave(&rxq->lock, flags);
-       INIT_LIST_HEAD(&rxq->rx_free);
-       INIT_LIST_HEAD(&rxq->rx_used);
-       /* Fill the rx_used queue with _all_ of the Rx buffers */
-       for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
-               /* In the reset function, these buffers may have been allocated
-                * to an SKB, so we need to unmap and free potential storage */
-               if (rxq->pool[i].page != NULL) {
-                       pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                               PAGE_SIZE << priv->hw_params.rx_page_order,
-                               PCI_DMA_FROMDEVICE);
-                       __iwl_free_pages(priv, rxq->pool[i].page);
-                       rxq->pool[i].page = NULL;
-               }
-               list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
-       }
-
-       for (i = 0; i < RX_QUEUE_SIZE; i++)
-               rxq->queue[i] = NULL;
-
-       /* Set us so that we have processed and used all buffers, but have
-        * not restocked the Rx queue with fresh buffers */
-       rxq->read = rxq->write = 0;
-       rxq->write_actual = 0;
-       rxq->free_count = 0;
-       spin_unlock_irqrestore(&rxq->lock, flags);
-}
-
 int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
        u32 rb_size;
        const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
 
-       if (!priv->cfg->base_params->use_isr_legacy)
-               rb_timeout = RX_RB_TIMEOUT;
+       rb_timeout = RX_RB_TIMEOUT;
 
-       if (priv->cfg->mod_params->amsdu_size_8K)
+       if (iwlagn_mod_params.amsdu_size_8K)
                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
        else
                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
@@ -683,11 +678,27 @@ int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
        return 0;
 }
 
+static void iwlagn_set_pwr_vmain(struct iwl_priv *priv)
+{
+/*
+ * (for documentation purposes)
+ * to set power to V_AUX, do:
+
+               if (pci_pme_capable(priv->pci_dev, PCI_D3cold))
+                       iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
+                                              APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
+                                              ~APMG_PS_CTRL_MSK_PWR_SRC);
+ */
+
+       iwl_set_bits_mask_prph(priv, APMG_PS_CTRL_REG,
+                              APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
+                              ~APMG_PS_CTRL_MSK_PWR_SRC);
+}
+
 int iwlagn_hw_nic_init(struct iwl_priv *priv)
 {
        unsigned long flags;
        struct iwl_rx_queue *rxq = &priv->rxq;
-       int ret;
 
        /* nic_init */
        spin_lock_irqsave(&priv->lock, flags);
@@ -698,19 +709,12 @@ int iwlagn_hw_nic_init(struct iwl_priv *priv)
 
        spin_unlock_irqrestore(&priv->lock, flags);
 
-       ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
+       iwlagn_set_pwr_vmain(priv);
 
        priv->cfg->ops->lib->apm_ops.config(priv);
 
        /* Allocate the RX queue, or reset if it is already allocated */
-       if (!rxq->bd) {
-               ret = iwl_rx_queue_alloc(priv);
-               if (ret) {
-                       IWL_ERR(priv, "Unable to initialize Rx queue\n");
-                       return -ENOMEM;
-               }
-       } else
-               iwlagn_rx_queue_reset(priv, rxq);
+       priv->trans.ops->rx_init(priv);
 
        iwlagn_rx_replenish(priv);
 
@@ -724,12 +728,14 @@ int iwlagn_hw_nic_init(struct iwl_priv *priv)
        spin_unlock_irqrestore(&priv->lock, flags);
 
        /* Allocate or reset and init all Tx and Command queues */
-       if (!priv->txq) {
-               ret = iwlagn_txq_ctx_alloc(priv);
-               if (ret)
-                       return ret;
-       } else
-               iwlagn_txq_ctx_reset(priv);
+       if (priv->trans.ops->tx_init(priv))
+               return -ENOMEM;
+
+       if (priv->cfg->base_params->shadow_reg_enable) {
+               /* enable shadow regs in HW */
+               iwl_set_bit(priv, CSR_MAC_SHADOW_REG_CTRL,
+                       0x800FFFFF);
+       }
 
        set_bit(STATUS_INIT, &priv->status);
 
@@ -864,9 +870,9 @@ void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                BUG_ON(rxb->page);
                rxb->page = page;
                /* Get physical address of the RB */
-               rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+               rxb->page_dma = dma_map_page(priv->bus.dev, page, 0,
                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                               PCI_DMA_FROMDEVICE);
+                               DMA_FROM_DEVICE);
                /* dma address must be no more than 36 bits */
                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                /* and also 256 byte aligned! */
@@ -876,7 +882,6 @@ void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 
                list_add_tail(&rxb->list, &rxq->rx_free);
                rxq->free_count++;
-               priv->alloc_rxb_page++;
 
                spin_unlock_irqrestore(&rxq->lock, flags);
        }
@@ -900,32 +905,6 @@ void iwlagn_rx_replenish_now(struct iwl_priv *priv)
        iwlagn_rx_queue_restock(priv);
 }
 
-/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
- * If an SKB has been detached, the POOL needs to have its SKB set to NULL
- * This free routine walks the list of POOL entries and if SKB is set to
- * non NULL it is unmapped and freed
- */
-void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-       int i;
-       for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-               if (rxq->pool[i].page != NULL) {
-                       pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                               PAGE_SIZE << priv->hw_params.rx_page_order,
-                               PCI_DMA_FROMDEVICE);
-                       __iwl_free_pages(priv, rxq->pool[i].page);
-                       rxq->pool[i].page = NULL;
-               }
-       }
-
-       dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                         rxq->bd_dma);
-       dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
-                         rxq->rb_stts, rxq->rb_stts_dma);
-       rxq->bd = NULL;
-       rxq->rb_stts  = NULL;
-}
-
 int iwlagn_rxq_stop(struct iwl_priv *priv)
 {
 
@@ -958,240 +937,6 @@ int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band)
        return -1;
 }
 
-/* Calc max signal level (dBm) among 3 possible receivers */
-static inline int iwlagn_calc_rssi(struct iwl_priv *priv,
-                               struct iwl_rx_phy_res *rx_resp)
-{
-       return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
-}
-
-static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
-{
-       u32 decrypt_out = 0;
-
-       if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
-                                       RX_RES_STATUS_STATION_FOUND)
-               decrypt_out |= (RX_RES_STATUS_STATION_FOUND |
-                               RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
-
-       decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
-
-       /* packet was not encrypted */
-       if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                       RX_RES_STATUS_SEC_TYPE_NONE)
-               return decrypt_out;
-
-       /* packet was encrypted with unknown alg */
-       if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                       RX_RES_STATUS_SEC_TYPE_ERR)
-               return decrypt_out;
-
-       /* decryption was not done in HW */
-       if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
-                                       RX_MPDU_RES_STATUS_DEC_DONE_MSK)
-               return decrypt_out;
-
-       switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
-
-       case RX_RES_STATUS_SEC_TYPE_CCMP:
-               /* alg is CCM: check MIC only */
-               if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
-                       /* Bad MIC */
-                       decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-               else
-                       decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-
-               break;
-
-       case RX_RES_STATUS_SEC_TYPE_TKIP:
-               if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
-                       /* Bad TTAK */
-                       decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
-                       break;
-               }
-               /* fall through if TTAK OK */
-       default:
-               if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
-                       decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-               else
-                       decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-               break;
-       }
-
-       IWL_DEBUG_RX(priv, "decrypt_in:0x%x  decrypt_out = 0x%x\n",
-                                       decrypt_in, decrypt_out);
-
-       return decrypt_out;
-}
-
-static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
-                                       struct ieee80211_hdr *hdr,
-                                       u16 len,
-                                       u32 ampdu_status,
-                                       struct iwl_rx_mem_buffer *rxb,
-                                       struct ieee80211_rx_status *stats)
-{
-       struct sk_buff *skb;
-       __le16 fc = hdr->frame_control;
-
-       /* We only process data packets if the interface is open */
-       if (unlikely(!priv->is_open)) {
-               IWL_DEBUG_DROP_LIMIT(priv,
-                   "Dropping packet while interface is not open.\n");
-               return;
-       }
-
-       /* In case of HW accelerated crypto and bad decryption, drop */
-       if (!priv->cfg->mod_params->sw_crypto &&
-           iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
-               return;
-
-       skb = dev_alloc_skb(128);
-       if (!skb) {
-               IWL_ERR(priv, "dev_alloc_skb failed\n");
-               return;
-       }
-
-       skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
-
-       iwl_update_stats(priv, false, fc, len);
-       memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
-
-       ieee80211_rx(priv->hw, skb);
-       priv->alloc_rxb_page--;
-       rxb->page = NULL;
-}
-
-/* Called for REPLY_RX (legacy ABG frames), or
- * REPLY_RX_MPDU_CMD (HT high-throughput N frames). */
-void iwlagn_rx_reply_rx(struct iwl_priv *priv,
-                               struct iwl_rx_mem_buffer *rxb)
-{
-       struct ieee80211_hdr *header;
-       struct ieee80211_rx_status rx_status;
-       struct iwl_rx_packet *pkt = rxb_addr(rxb);
-       struct iwl_rx_phy_res *phy_res;
-       __le32 rx_pkt_status;
-       struct iwl_rx_mpdu_res_start *amsdu;
-       u32 len;
-       u32 ampdu_status;
-       u32 rate_n_flags;
-
-       /**
-        * REPLY_RX and REPLY_RX_MPDU_CMD are handled differently.
-        *      REPLY_RX: physical layer info is in this buffer
-        *      REPLY_RX_MPDU_CMD: physical layer info was sent in separate
-        *              command and cached in priv->last_phy_res
-        *
-        * Here we set up local variables depending on which command is
-        * received.
-        */
-       if (pkt->hdr.cmd == REPLY_RX) {
-               phy_res = (struct iwl_rx_phy_res *)pkt->u.raw;
-               header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res)
-                               + phy_res->cfg_phy_cnt);
-
-               len = le16_to_cpu(phy_res->byte_count);
-               rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*phy_res) +
-                               phy_res->cfg_phy_cnt + len);
-               ampdu_status = le32_to_cpu(rx_pkt_status);
-       } else {
-               if (!priv->_agn.last_phy_res_valid) {
-                       IWL_ERR(priv, "MPDU frame without cached PHY data\n");
-                       return;
-               }
-               phy_res = &priv->_agn.last_phy_res;
-               amsdu = (struct iwl_rx_mpdu_res_start *)pkt->u.raw;
-               header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
-               len = le16_to_cpu(amsdu->byte_count);
-               rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
-               ampdu_status = iwlagn_translate_rx_status(priv,
-                               le32_to_cpu(rx_pkt_status));
-       }
-
-       if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
-               IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d/n",
-                               phy_res->cfg_phy_cnt);
-               return;
-       }
-
-       if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
-           !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
-               IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
-                               le32_to_cpu(rx_pkt_status));
-               return;
-       }
-
-       /* This will be used in several places later */
-       rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-       /* rx_status carries information about the packet to mac80211 */
-       rx_status.mactime = le64_to_cpu(phy_res->timestamp);
-       rx_status.freq =
-               ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel));
-       rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                               IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
-       rx_status.rate_idx =
-               iwlagn_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
-       rx_status.flag = 0;
-
-       /* TSF isn't reliable. In order to allow smooth user experience,
-        * this W/A doesn't propagate it to the mac80211 */
-       /*rx_status.flag |= RX_FLAG_TSFT;*/
-
-       priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
-
-       /* Find max signal strength (dBm) among 3 antenna/receiver chains */
-       rx_status.signal = iwlagn_calc_rssi(priv, phy_res);
-
-       iwl_dbg_log_rx_data_frame(priv, len, header);
-       IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, TSF %llu\n",
-               rx_status.signal, (unsigned long long)rx_status.mactime);
-
-       /*
-        * "antenna number"
-        *
-        * It seems that the antenna field in the phy flags value
-        * is actually a bit field. This is undefined by radiotap,
-        * it wants an actual antenna number but I always get "7"
-        * for most legacy frames I receive indicating that the
-        * same frame was received on all three RX chains.
-        *
-        * I think this field should be removed in favor of a
-        * new 802.11n radiotap field "RX chains" that is defined
-        * as a bitmask.
-        */
-       rx_status.antenna =
-               (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
-               >> RX_RES_PHY_FLAGS_ANTENNA_POS;
-
-       /* set the preamble flag if appropriate */
-       if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
-               rx_status.flag |= RX_FLAG_SHORTPRE;
-
-       /* Set up the HT phy flags */
-       if (rate_n_flags & RATE_MCS_HT_MSK)
-               rx_status.flag |= RX_FLAG_HT;
-       if (rate_n_flags & RATE_MCS_HT40_MSK)
-               rx_status.flag |= RX_FLAG_40MHZ;
-       if (rate_n_flags & RATE_MCS_SGI_MSK)
-               rx_status.flag |= RX_FLAG_SHORT_GI;
-
-       iwlagn_pass_packet_to_mac80211(priv, header, len, ampdu_status,
-                                   rxb, &rx_status);
-}
-
-/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).
- * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
-void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
-                           struct iwl_rx_mem_buffer *rxb)
-{
-       struct iwl_rx_packet *pkt = rxb_addr(rxb);
-       priv->_agn.last_phy_res_valid = true;
-       memcpy(&priv->_agn.last_phy_res, pkt->u.raw,
-              sizeof(struct iwl_rx_phy_res));
-}
-
 static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
                                           struct ieee80211_vif *vif,
                                           enum ieee80211_band band,
@@ -1312,12 +1057,23 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
        return added;
 }
 
+static int iwl_fill_offch_tx(struct iwl_priv *priv, void *data, size_t maxlen)
+{
+       struct sk_buff *skb = priv->_agn.offchan_tx_skb;
+
+       if (skb->len < maxlen)
+               maxlen = skb->len;
+
+       memcpy(data, skb->data, maxlen);
+
+       return maxlen;
+}
+
 int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
        struct iwl_host_cmd cmd = {
                .id = REPLY_SCAN_CMD,
-               .len = sizeof(struct iwl_scan_cmd),
-               .flags = CMD_SIZE_HUGE,
+               .len = { sizeof(struct iwl_scan_cmd), },
        };
        struct iwl_scan_cmd *scan;
        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
@@ -1354,20 +1110,25 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
        scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 
-       if (iwl_is_any_associated(priv)) {
+       if (priv->scan_type != IWL_SCAN_OFFCH_TX &&
+           iwl_is_any_associated(priv)) {
                u16 interval = 0;
                u32 extra;
                u32 suspend_time = 100;
                u32 scan_suspend_time = 100;
-               unsigned long flags;
 
                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
-               spin_lock_irqsave(&priv->lock, flags);
-               if (priv->is_internal_short_scan)
+               switch (priv->scan_type) {
+               case IWL_SCAN_OFFCH_TX:
+                       WARN_ON(1);
+                       break;
+               case IWL_SCAN_RADIO_RESET:
                        interval = 0;
-               else
+                       break;
+               case IWL_SCAN_NORMAL:
                        interval = vif->bss_conf.beacon_int;
-               spin_unlock_irqrestore(&priv->lock, flags);
+                       break;
+               }
 
                scan->suspend_time = 0;
                scan->max_out_time = cpu_to_le32(200 * 1024);
@@ -1380,29 +1141,41 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                scan->suspend_time = cpu_to_le32(scan_suspend_time);
                IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
                               scan_suspend_time, interval);
+       } else if (priv->scan_type == IWL_SCAN_OFFCH_TX) {
+               scan->suspend_time = 0;
+               scan->max_out_time =
+                       cpu_to_le32(1024 * priv->_agn.offchan_tx_timeout);
        }
 
-       if (priv->is_internal_short_scan) {
+       switch (priv->scan_type) {
+       case IWL_SCAN_RADIO_RESET:
                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
-       } else if (priv->scan_request->n_ssids) {
-               int i, p = 0;
-               IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-               for (i = 0; i < priv->scan_request->n_ssids; i++) {
-                       /* always does wildcard anyway */
-                       if (!priv->scan_request->ssids[i].ssid_len)
-                               continue;
-                       scan->direct_scan[p].id = WLAN_EID_SSID;
-                       scan->direct_scan[p].len =
-                               priv->scan_request->ssids[i].ssid_len;
-                       memcpy(scan->direct_scan[p].ssid,
-                              priv->scan_request->ssids[i].ssid,
-                              priv->scan_request->ssids[i].ssid_len);
-                       n_probes++;
-                       p++;
-               }
-               is_active = true;
-       } else
-               IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
+               break;
+       case IWL_SCAN_NORMAL:
+               if (priv->scan_request->n_ssids) {
+                       int i, p = 0;
+                       IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+                       for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                               /* always does wildcard anyway */
+                               if (!priv->scan_request->ssids[i].ssid_len)
+                                       continue;
+                               scan->direct_scan[p].id = WLAN_EID_SSID;
+                               scan->direct_scan[p].len =
+                                       priv->scan_request->ssids[i].ssid_len;
+                               memcpy(scan->direct_scan[p].ssid,
+                                      priv->scan_request->ssids[i].ssid,
+                                      priv->scan_request->ssids[i].ssid_len);
+                               n_probes++;
+                               p++;
+                       }
+                       is_active = true;
+               } else
+                       IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
+               break;
+       case IWL_SCAN_OFFCH_TX:
+               IWL_DEBUG_SCAN(priv, "Start offchannel TX scan.\n");
+               break;
+       }
 
        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
        scan->tx_cmd.sta_id = ctx->bcast_sta_id;
@@ -1428,49 +1201,53 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                if (priv->cfg->bt_params &&
                    priv->cfg->bt_params->advanced_bt_coexist)
                        scan->tx_cmd.tx_flags |= TX_CMD_FLG_IGNORE_BT;
-               scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
                break;
        case IEEE80211_BAND_5GHZ:
                rate = IWL_RATE_6M_PLCP;
-               /*
-                * If active scanning is requested but a certain channel is
-                * marked passive, we can do active scanning if we detect
-                * transmissions.
-                *
-                * There is an issue with some firmware versions that triggers
-                * a sysassert on a "good CRC threshold" of zero (== disabled),
-                * on a radar channel even though this means that we should NOT
-                * send probes.
-                *
-                * The "good CRC threshold" is the number of frames that we
-                * need to receive during our dwell time on a channel before
-                * sending out probes -- setting this to a huge value will
-                * mean we never reach it, but at the same time work around
-                * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
-                * here instead of IWL_GOOD_CRC_TH_DISABLED.
-                */
-               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
-                                               IWL_GOOD_CRC_TH_NEVER;
                break;
        default:
                IWL_WARN(priv, "Invalid scan band\n");
                return -EIO;
        }
 
+       /*
+        * If active scanning is requested but a certain channel is
+        * marked passive, we can do active scanning if we detect
+        * transmissions.
+        *
+        * There is an issue with some firmware versions that triggers
+        * a sysassert on a "good CRC threshold" of zero (== disabled),
+        * on a radar channel even though this means that we should NOT
+        * send probes.
+        *
+        * The "good CRC threshold" is the number of frames that we
+        * need to receive during our dwell time on a channel before
+        * sending out probes -- setting this to a huge value will
+        * mean we never reach it, but at the same time work around
+        * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+        * here instead of IWL_GOOD_CRC_TH_DISABLED.
+        *
+        * This was fixed in later versions along with some other
+        * scan changes, and the threshold behaves as a flag in those
+        * versions.
+        */
+       if (priv->new_scan_threshold_behaviour)
+               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                               IWL_GOOD_CRC_TH_DISABLED;
+       else
+               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                               IWL_GOOD_CRC_TH_NEVER;
+
        band = priv->scan_band;
 
        if (priv->cfg->scan_rx_antennas[band])
                rx_ant = priv->cfg->scan_rx_antennas[band];
 
-       if (priv->cfg->scan_tx_antennas[band])
-               scan_tx_antennas = priv->cfg->scan_tx_antennas[band];
-
-       if (priv->cfg->bt_params &&
-           priv->cfg->bt_params->advanced_bt_coexist &&
-           priv->bt_full_concurrent) {
-               /* operated as 1x1 in full concurrency mode */
-               scan_tx_antennas = first_antenna(
-                       priv->cfg->scan_tx_antennas[band]);
+       if (band == IEEE80211_BAND_2GHZ &&
+           priv->cfg->bt_params &&
+           priv->cfg->bt_params->advanced_bt_coexist) {
+               /* transmit 2.4 GHz probes only on first antenna */
+               scan_tx_antennas = first_antenna(scan_tx_antennas);
        }
 
        priv->scan_tx_ant[band] = iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band],
@@ -1504,60 +1281,99 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
        scan->rx_chain = cpu_to_le16(rx_chain);
-       if (!priv->is_internal_short_scan) {
+       switch (priv->scan_type) {
+       case IWL_SCAN_NORMAL:
                cmd_len = iwl_fill_probe_req(priv,
                                        (struct ieee80211_mgmt *)scan->data,
                                        vif->addr,
                                        priv->scan_request->ie,
                                        priv->scan_request->ie_len,
                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-       } else {
+               break;
+       case IWL_SCAN_RADIO_RESET:
                /* use bcast addr, will not be transmitted but must be valid */
                cmd_len = iwl_fill_probe_req(priv,
                                        (struct ieee80211_mgmt *)scan->data,
                                        iwl_bcast_addr, NULL, 0,
                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-
+               break;
+       case IWL_SCAN_OFFCH_TX:
+               cmd_len = iwl_fill_offch_tx(priv, scan->data,
+                                           IWL_MAX_SCAN_SIZE
+                                            - sizeof(*scan)
+                                            - sizeof(struct iwl_scan_channel));
+               scan->scan_flags |= IWL_SCAN_FLAGS_ACTION_FRAME_TX;
+               break;
+       default:
+               BUG();
        }
        scan->tx_cmd.len = cpu_to_le16(cmd_len);
 
        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
                               RXON_FILTER_BCON_AWARE_MSK);
 
-       if (priv->is_internal_short_scan) {
+       switch (priv->scan_type) {
+       case IWL_SCAN_RADIO_RESET:
                scan->channel_count =
                        iwl_get_single_channel_for_scan(priv, vif, band,
-                               (void *)&scan->data[le16_to_cpu(
-                               scan->tx_cmd.len)]);
-       } else {
+                               (void *)&scan->data[cmd_len]);
+               break;
+       case IWL_SCAN_NORMAL:
                scan->channel_count =
                        iwl_get_channels_for_scan(priv, vif, band,
                                is_active, n_probes,
-                               (void *)&scan->data[le16_to_cpu(
-                               scan->tx_cmd.len)]);
+                               (void *)&scan->data[cmd_len]);
+               break;
+       case IWL_SCAN_OFFCH_TX: {
+               struct iwl_scan_channel *scan_ch;
+
+               scan->channel_count = 1;
+
+               scan_ch = (void *)&scan->data[cmd_len];
+               scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
+               scan_ch->channel =
+                       cpu_to_le16(priv->_agn.offchan_tx_chan->hw_value);
+               scan_ch->active_dwell =
+                       cpu_to_le16(priv->_agn.offchan_tx_timeout);
+               scan_ch->passive_dwell = 0;
+
+               /* Set txpower levels to defaults */
+               scan_ch->dsp_atten = 110;
+
+               /* NOTE: if we were doing 6Mb OFDM for scans we'd use
+                * power level:
+                * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
+                */
+               if (priv->_agn.offchan_tx_chan->band == IEEE80211_BAND_5GHZ)
+                       scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+               else
+                       scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+               }
+               break;
        }
+
        if (scan->channel_count == 0) {
                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
                return -EIO;
        }
 
-       cmd.len += le16_to_cpu(scan->tx_cmd.len) +
+       cmd.len[0] += le16_to_cpu(scan->tx_cmd.len) +
            scan->channel_count * sizeof(struct iwl_scan_channel);
-       cmd.data = scan;
-       scan->len = cpu_to_le16(cmd.len);
-
-       if (priv->cfg->ops->hcmd->set_pan_params) {
-               ret = priv->cfg->ops->hcmd->set_pan_params(priv);
-               if (ret)
-                       return ret;
-       }
+       cmd.data[0] = scan;
+       cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
+       scan->len = cpu_to_le16(cmd.len[0]);
 
+       /* set scan bit here for PAN params */
        set_bit(STATUS_SCAN_HW, &priv->status);
+
+       ret = iwlagn_set_pan_params(priv);
+       if (ret)
+               return ret;
+
        ret = iwl_send_cmd_sync(priv, &cmd);
        if (ret) {
                clear_bit(STATUS_SCAN_HW, &priv->status);
-               if (priv->cfg->ops->hcmd->set_pan_params)
-                       priv->cfg->ops->hcmd->set_pan_params(priv);
+               iwlagn_set_pan_params(priv);
        }
 
        return ret;
@@ -1569,9 +1385,9 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
 
        if (add)
-               return iwl_add_bssid_station(priv, vif_priv->ctx,
-                                            vif->bss_conf.bssid, true,
-                                            &vif_priv->ibss_bssid_sta_id);
+               return iwlagn_add_bssid_station(priv, vif_priv->ctx,
+                                               vif->bss_conf.bssid,
+                                               &vif_priv->ibss_bssid_sta_id);
        return iwl_remove_station(priv, vif_priv->ibss_bssid_sta_id,
                                  vif->bss_conf.bssid);
 }
@@ -1634,17 +1450,26 @@ int iwlagn_txfifo_flush(struct iwl_priv *priv, u16 flush_control)
        struct iwl_txfifo_flush_cmd flush_cmd;
        struct iwl_host_cmd cmd = {
                .id = REPLY_TXFIFO_FLUSH,
-               .len = sizeof(struct iwl_txfifo_flush_cmd),
+               .len = { sizeof(struct iwl_txfifo_flush_cmd), },
                .flags = CMD_SYNC,
-               .data = &flush_cmd,
+               .data = { &flush_cmd, },
        };
 
        might_sleep();
 
        memset(&flush_cmd, 0, sizeof(flush_cmd));
-       flush_cmd.fifo_control = IWL_TX_FIFO_VO_MSK | IWL_TX_FIFO_VI_MSK |
-                                IWL_TX_FIFO_BE_MSK | IWL_TX_FIFO_BK_MSK;
-       if (priv->cfg->sku & IWL_SKU_N)
+       if (flush_control & BIT(IWL_RXON_CTX_BSS))
+               flush_cmd.fifo_control = IWL_SCD_VO_MSK | IWL_SCD_VI_MSK |
+                                IWL_SCD_BE_MSK | IWL_SCD_BK_MSK |
+                                IWL_SCD_MGMT_MSK;
+       if ((flush_control & BIT(IWL_RXON_CTX_PAN)) &&
+           (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS)))
+               flush_cmd.fifo_control |= IWL_PAN_SCD_VO_MSK |
+                               IWL_PAN_SCD_VI_MSK | IWL_PAN_SCD_BE_MSK |
+                               IWL_PAN_SCD_BK_MSK | IWL_PAN_SCD_MGMT_MSK |
+                               IWL_PAN_SCD_MULTICAST_MSK;
+
+       if (priv->cfg->sku & EEPROM_SKU_CAP_11N_ENABLE)
                flush_cmd.fifo_control |= IWL_AGG_TX_QUEUE_MSK;
 
        IWL_DEBUG_INFO(priv, "fifo queue control: 0X%x\n",
@@ -1658,7 +1483,7 @@ void iwlagn_dev_txfifo_flush(struct iwl_priv *priv, u16 flush_control)
 {
        mutex_lock(&priv->mutex);
        ieee80211_stop_queues(priv->hw);
-       if (priv->cfg->ops->lib->txfifo_flush(priv, IWL_DROP_ALL)) {
+       if (iwlagn_txfifo_flush(priv, IWL_DROP_ALL)) {
                IWL_ERR(priv, "flush request fail\n");
                goto done;
        }
@@ -1753,7 +1578,7 @@ static const __le32 iwlagn_def_3w_lookup[12] = {
        cpu_to_le32(0xc0004000),
        cpu_to_le32(0x00004000),
        cpu_to_le32(0xf0005000),
-       cpu_to_le32(0xf0004000),
+       cpu_to_le32(0xf0005000),
 };
 
 static const __le32 iwlagn_concurrent_lookup[12] = {
@@ -1773,25 +1598,39 @@ static const __le32 iwlagn_concurrent_lookup[12] = {
 
 void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
 {
-       struct iwlagn_bt_cmd bt_cmd = {
+       struct iwl_basic_bt_cmd basic = {
                .max_kill = IWLAGN_BT_MAX_KILL_DEFAULT,
                .bt3_timer_t7_value = IWLAGN_BT3_T7_DEFAULT,
                .bt3_prio_sample_time = IWLAGN_BT3_PRIO_SAMPLE_DEFAULT,
                .bt3_timer_t2_value = IWLAGN_BT3_T2_DEFAULT,
        };
+       struct iwl6000_bt_cmd bt_cmd_6000;
+       struct iwl2000_bt_cmd bt_cmd_2000;
+       int ret;
 
        BUILD_BUG_ON(sizeof(iwlagn_def_3w_lookup) !=
-                       sizeof(bt_cmd.bt3_lookup_table));
+                       sizeof(basic.bt3_lookup_table));
+
+       if (priv->cfg->bt_params) {
+               if (priv->cfg->bt_params->bt_session_2) {
+                       bt_cmd_2000.prio_boost = cpu_to_le32(
+                               priv->cfg->bt_params->bt_prio_boost);
+                       bt_cmd_2000.tx_prio_boost = 0;
+                       bt_cmd_2000.rx_prio_boost = 0;
+               } else {
+                       bt_cmd_6000.prio_boost =
+                               priv->cfg->bt_params->bt_prio_boost;
+                       bt_cmd_6000.tx_prio_boost = 0;
+                       bt_cmd_6000.rx_prio_boost = 0;
+               }
+       } else {
+               IWL_ERR(priv, "failed to construct BT Coex Config\n");
+               return;
+       }
 
-       if (priv->cfg->bt_params)
-               bt_cmd.prio_boost = priv->cfg->bt_params->bt_prio_boost;
-       else
-               bt_cmd.prio_boost = 0;
-       bt_cmd.kill_ack_mask = priv->kill_ack_mask;
-       bt_cmd.kill_cts_mask = priv->kill_cts_mask;
-       bt_cmd.valid = priv->bt_valid;
-       bt_cmd.tx_prio_boost = 0;
-       bt_cmd.rx_prio_boost = 0;
+       basic.kill_ack_mask = priv->kill_ack_mask;
+       basic.kill_cts_mask = priv->kill_cts_mask;
+       basic.valid = priv->bt_valid;
 
        /*
         * Configure BT coex mode to "no coexistence" when the
@@ -1799,45 +1638,47 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
         * (might be in monitor mode), or the interface is in
         * IBSS mode (no proper uCode support for coex then).
         */
-       if (!bt_coex_active || priv->iw_mode == NL80211_IFTYPE_ADHOC) {
-               bt_cmd.flags = 0;
+       if (!iwlagn_mod_params.bt_coex_active ||
+           priv->iw_mode == NL80211_IFTYPE_ADHOC) {
+               basic.flags = IWLAGN_BT_FLAG_COEX_MODE_DISABLED;
        } else {
-               bt_cmd.flags = IWLAGN_BT_FLAG_COEX_MODE_3W <<
+               basic.flags = IWLAGN_BT_FLAG_COEX_MODE_3W <<
                                        IWLAGN_BT_FLAG_COEX_MODE_SHIFT;
+               if (priv->cfg->bt_params &&
+                   priv->cfg->bt_params->bt_sco_disable)
+                       basic.flags |= IWLAGN_BT_FLAG_SYNC_2_BT_DISABLE;
+
                if (priv->bt_ch_announce)
-                       bt_cmd.flags |= IWLAGN_BT_FLAG_CHANNEL_INHIBITION;
-               IWL_DEBUG_INFO(priv, "BT coex flag: 0X%x\n", bt_cmd.flags);
+                       basic.flags |= IWLAGN_BT_FLAG_CHANNEL_INHIBITION;
+               IWL_DEBUG_COEX(priv, "BT coex flag: 0X%x\n", basic.flags);
        }
+       priv->bt_enable_flag = basic.flags;
        if (priv->bt_full_concurrent)
-               memcpy(bt_cmd.bt3_lookup_table, iwlagn_concurrent_lookup,
+               memcpy(basic.bt3_lookup_table, iwlagn_concurrent_lookup,
                        sizeof(iwlagn_concurrent_lookup));
        else
-               memcpy(bt_cmd.bt3_lookup_table, iwlagn_def_3w_lookup,
+               memcpy(basic.bt3_lookup_table, iwlagn_def_3w_lookup,
                        sizeof(iwlagn_def_3w_lookup));
 
-       IWL_DEBUG_INFO(priv, "BT coex %s in %s mode\n",
-                      bt_cmd.flags ? "active" : "disabled",
+       IWL_DEBUG_COEX(priv, "BT coex %s in %s mode\n",
+                      basic.flags ? "active" : "disabled",
                       priv->bt_full_concurrent ?
                       "full concurrency" : "3-wire");
 
-       if (iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG, sizeof(bt_cmd), &bt_cmd))
+       if (priv->cfg->bt_params->bt_session_2) {
+               memcpy(&bt_cmd_2000.basic, &basic,
+                       sizeof(basic));
+               ret = iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
+                       sizeof(bt_cmd_2000), &bt_cmd_2000);
+       } else {
+               memcpy(&bt_cmd_6000.basic, &basic,
+                       sizeof(basic));
+               ret = iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
+                       sizeof(bt_cmd_6000), &bt_cmd_6000);
+       }
+       if (ret)
                IWL_ERR(priv, "failed to send BT Coex Config\n");
 
-       /*
-        * When we are doing a restart, need to also reconfigure BT
-        * SCO to the device. If not doing a restart, bt_sco_active
-        * will always be false, so there's no need to have an extra
-        * variable to check for it.
-        */
-       if (priv->bt_sco_active) {
-               struct iwlagn_bt_sco_cmd sco_cmd = { .flags = 0 };
-
-               if (priv->bt_sco_active)
-                       sco_cmd.flags |= IWLAGN_BT_SCO_ACTIVE;
-               if (iwl_send_cmd_pdu(priv, REPLY_BT_COEX_SCO,
-                                    sizeof(sco_cmd), &sco_cmd))
-                       IWL_ERR(priv, "failed to send BT SCO command\n");
-       }
 }
 
 static void iwlagn_bt_traffic_change_work(struct work_struct *work)
@@ -1847,12 +1688,25 @@ static void iwlagn_bt_traffic_change_work(struct work_struct *work)
        struct iwl_rxon_context *ctx;
        int smps_request = -1;
 
-       IWL_DEBUG_INFO(priv, "BT traffic load changes: %d\n",
+       if (priv->bt_enable_flag == IWLAGN_BT_FLAG_COEX_MODE_DISABLED) {
+               /* bt coex disabled */
+               return;
+       }
+
+       /*
+        * Note: bt_traffic_load can be overridden by scan complete and
+        * coex profile notifications. Ignore that since only bad consequence
+        * can be not matching debug print with actual state.
+        */
+       IWL_DEBUG_COEX(priv, "BT traffic load changes: %d\n",
                       priv->bt_traffic_load);
 
        switch (priv->bt_traffic_load) {
        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
-               smps_request = IEEE80211_SMPS_AUTOMATIC;
+               if (priv->bt_status)
+                       smps_request = IEEE80211_SMPS_DYNAMIC;
+               else
+                       smps_request = IEEE80211_SMPS_AUTOMATIC;
                break;
        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                smps_request = IEEE80211_SMPS_DYNAMIC;
@@ -1869,23 +1723,34 @@ static void iwlagn_bt_traffic_change_work(struct work_struct *work)
 
        mutex_lock(&priv->mutex);
 
+       /*
+        * We can not send command to firmware while scanning. When the scan
+        * complete we will schedule this work again. We do check with mutex
+        * locked to prevent new scan request to arrive. We do not check
+        * STATUS_SCANNING to avoid race when queue_work two times from
+        * different notifications, but quit and not perform any work at all.
+        */
+       if (test_bit(STATUS_SCAN_HW, &priv->status))
+               goto out;
+
        if (priv->cfg->ops->lib->update_chain_flags)
                priv->cfg->ops->lib->update_chain_flags(priv);
 
        if (smps_request != -1) {
+               priv->current_ht_config.smps = smps_request;
                for_each_context(priv, ctx) {
                        if (ctx->vif && ctx->vif->type == NL80211_IFTYPE_STATION)
                                ieee80211_request_smps(ctx->vif, smps_request);
                }
        }
-
+out:
        mutex_unlock(&priv->mutex);
 }
 
 static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                                struct iwl_bt_uart_msg *uart_msg)
 {
-       IWL_DEBUG_NOTIF(priv, "Message Type = 0x%X, SSN = 0x%X, "
+       IWL_DEBUG_COEX(priv, "Message Type = 0x%X, SSN = 0x%X, "
                        "Update Req = 0x%X",
                (BT_UART_MSG_FRAME1MSGTYPE_MSK & uart_msg->frame1) >>
                        BT_UART_MSG_FRAME1MSGTYPE_POS,
@@ -1894,7 +1759,7 @@ static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                (BT_UART_MSG_FRAME1UPDATEREQ_MSK & uart_msg->frame1) >>
                        BT_UART_MSG_FRAME1UPDATEREQ_POS);
 
-       IWL_DEBUG_NOTIF(priv, "Open connections = 0x%X, Traffic load = 0x%X, "
+       IWL_DEBUG_COEX(priv, "Open connections = 0x%X, Traffic load = 0x%X, "
                        "Chl_SeqN = 0x%X, In band = 0x%X",
                (BT_UART_MSG_FRAME2OPENCONNECTIONS_MSK & uart_msg->frame2) >>
                        BT_UART_MSG_FRAME2OPENCONNECTIONS_POS,
@@ -1905,7 +1770,7 @@ static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                (BT_UART_MSG_FRAME2INBAND_MSK & uart_msg->frame2) >>
                        BT_UART_MSG_FRAME2INBAND_POS);
 
-       IWL_DEBUG_NOTIF(priv, "SCO/eSCO = 0x%X, Sniff = 0x%X, A2DP = 0x%X, "
+       IWL_DEBUG_COEX(priv, "SCO/eSCO = 0x%X, Sniff = 0x%X, A2DP = 0x%X, "
                        "ACL = 0x%X, Master = 0x%X, OBEX = 0x%X",
                (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3) >>
                        BT_UART_MSG_FRAME3SCOESCO_POS,
@@ -1920,11 +1785,11 @@ static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                (BT_UART_MSG_FRAME3OBEX_MSK & uart_msg->frame3) >>
                        BT_UART_MSG_FRAME3OBEX_POS);
 
-       IWL_DEBUG_NOTIF(priv, "Idle duration = 0x%X",
+       IWL_DEBUG_COEX(priv, "Idle duration = 0x%X",
                (BT_UART_MSG_FRAME4IDLEDURATION_MSK & uart_msg->frame4) >>
                        BT_UART_MSG_FRAME4IDLEDURATION_POS);
 
-       IWL_DEBUG_NOTIF(priv, "Tx Activity = 0x%X, Rx Activity = 0x%X, "
+       IWL_DEBUG_COEX(priv, "Tx Activity = 0x%X, Rx Activity = 0x%X, "
                        "eSCO Retransmissions = 0x%X",
                (BT_UART_MSG_FRAME5TXACTIVITY_MSK & uart_msg->frame5) >>
                        BT_UART_MSG_FRAME5TXACTIVITY_POS,
@@ -1933,40 +1798,47 @@ static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                (BT_UART_MSG_FRAME5ESCORETRANSMIT_MSK & uart_msg->frame5) >>
                        BT_UART_MSG_FRAME5ESCORETRANSMIT_POS);
 
-       IWL_DEBUG_NOTIF(priv, "Sniff Interval = 0x%X, Discoverable = 0x%X",
+       IWL_DEBUG_COEX(priv, "Sniff Interval = 0x%X, Discoverable = 0x%X",
                (BT_UART_MSG_FRAME6SNIFFINTERVAL_MSK & uart_msg->frame6) >>
                        BT_UART_MSG_FRAME6SNIFFINTERVAL_POS,
                (BT_UART_MSG_FRAME6DISCOVERABLE_MSK & uart_msg->frame6) >>
                        BT_UART_MSG_FRAME6DISCOVERABLE_POS);
 
-       IWL_DEBUG_NOTIF(priv, "Sniff Activity = 0x%X, Inquiry/Page SR Mode = "
-                       "0x%X, Connectable = 0x%X",
+       IWL_DEBUG_COEX(priv, "Sniff Activity = 0x%X, Page = "
+                       "0x%X, Inquiry = 0x%X, Connectable = 0x%X",
                (BT_UART_MSG_FRAME7SNIFFACTIVITY_MSK & uart_msg->frame7) >>
                        BT_UART_MSG_FRAME7SNIFFACTIVITY_POS,
-               (BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_MSK & uart_msg->frame7) >>
-                       BT_UART_MSG_FRAME7INQUIRYPAGESRMODE_POS,
+               (BT_UART_MSG_FRAME7PAGE_MSK & uart_msg->frame7) >>
+                       BT_UART_MSG_FRAME7PAGE_POS,
+               (BT_UART_MSG_FRAME7INQUIRY_MSK & uart_msg->frame7) >>
+                       BT_UART_MSG_FRAME7INQUIRY_POS,
                (BT_UART_MSG_FRAME7CONNECTABLE_MSK & uart_msg->frame7) >>
                        BT_UART_MSG_FRAME7CONNECTABLE_POS);
 }
 
-static void iwlagn_set_kill_ack_msk(struct iwl_priv *priv,
-                                    struct iwl_bt_uart_msg *uart_msg)
+static void iwlagn_set_kill_msk(struct iwl_priv *priv,
+                               struct iwl_bt_uart_msg *uart_msg)
 {
-       u8 kill_ack_msk;
-       __le32 bt_kill_ack_msg[2] = {
-                       cpu_to_le32(0xFFFFFFF), cpu_to_le32(0xFFFFFC00) };
-
-       kill_ack_msk = (((BT_UART_MSG_FRAME3A2DP_MSK |
-                       BT_UART_MSG_FRAME3SNIFF_MSK |
-                       BT_UART_MSG_FRAME3SCOESCO_MSK) &
-                       uart_msg->frame3) == 0) ? 1 : 0;
-       if (priv->kill_ack_mask != bt_kill_ack_msg[kill_ack_msk]) {
+       u8 kill_msk;
+       static const __le32 bt_kill_ack_msg[2] = {
+               IWLAGN_BT_KILL_ACK_MASK_DEFAULT,
+               IWLAGN_BT_KILL_ACK_CTS_MASK_SCO };
+       static const __le32 bt_kill_cts_msg[2] = {
+               IWLAGN_BT_KILL_CTS_MASK_DEFAULT,
+               IWLAGN_BT_KILL_ACK_CTS_MASK_SCO };
+
+       kill_msk = (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3)
+               ? 1 : 0;
+       if (priv->kill_ack_mask != bt_kill_ack_msg[kill_msk] ||
+           priv->kill_cts_mask != bt_kill_cts_msg[kill_msk]) {
                priv->bt_valid |= IWLAGN_BT_VALID_KILL_ACK_MASK;
-               priv->kill_ack_mask = bt_kill_ack_msg[kill_ack_msk];
+               priv->kill_ack_mask = bt_kill_ack_msg[kill_msk];
+               priv->bt_valid |= IWLAGN_BT_VALID_KILL_CTS_MASK;
+               priv->kill_cts_mask = bt_kill_cts_msg[kill_msk];
+
                /* schedule to send runtime bt_config */
                queue_work(priv->workqueue, &priv->bt_runtime_config);
        }
-
 }
 
 void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
@@ -1975,22 +1847,24 @@ void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
        unsigned long flags;
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_bt_coex_profile_notif *coex = &pkt->u.bt_coex_profile_notif;
-       struct iwlagn_bt_sco_cmd sco_cmd = { .flags = 0 };
        struct iwl_bt_uart_msg *uart_msg = &coex->last_bt_uart_msg;
-       u8 last_traffic_load;
 
-       IWL_DEBUG_NOTIF(priv, "BT Coex notification:\n");
-       IWL_DEBUG_NOTIF(priv, "    status: %d\n", coex->bt_status);
-       IWL_DEBUG_NOTIF(priv, "    traffic load: %d\n", coex->bt_traffic_load);
-       IWL_DEBUG_NOTIF(priv, "    CI compliance: %d\n",
+       if (priv->bt_enable_flag == IWLAGN_BT_FLAG_COEX_MODE_DISABLED) {
+               /* bt coex disabled */
+               return;
+       }
+
+       IWL_DEBUG_COEX(priv, "BT Coex notification:\n");
+       IWL_DEBUG_COEX(priv, "    status: %d\n", coex->bt_status);
+       IWL_DEBUG_COEX(priv, "    traffic load: %d\n", coex->bt_traffic_load);
+       IWL_DEBUG_COEX(priv, "    CI compliance: %d\n",
                        coex->bt_ci_compliance);
        iwlagn_print_uartmsg(priv, uart_msg);
 
-       last_traffic_load = priv->notif_bt_traffic_load;
-       priv->notif_bt_traffic_load = coex->bt_traffic_load;
+       priv->last_bt_traffic_load = priv->bt_traffic_load;
        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
                if (priv->bt_status != coex->bt_status ||
-                   last_traffic_load != coex->bt_traffic_load) {
+                   priv->last_bt_traffic_load != coex->bt_traffic_load) {
                        if (coex->bt_status) {
                                /* BT on */
                                if (!priv->bt_ch_announce)
@@ -2008,18 +1882,9 @@ void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
                        queue_work(priv->workqueue,
                                   &priv->bt_traffic_change_work);
                }
-               if (priv->bt_sco_active !=
-                   (uart_msg->frame3 & BT_UART_MSG_FRAME3SCOESCO_MSK)) {
-                       priv->bt_sco_active = uart_msg->frame3 &
-                               BT_UART_MSG_FRAME3SCOESCO_MSK;
-                       if (priv->bt_sco_active)
-                               sco_cmd.flags |= IWLAGN_BT_SCO_ACTIVE;
-                       iwl_send_cmd_pdu_async(priv, REPLY_BT_COEX_SCO,
-                                      sizeof(sco_cmd), &sco_cmd, NULL);
-               }
        }
 
-       iwlagn_set_kill_ack_msk(priv, uart_msg);
+       iwlagn_set_kill_msk(priv, uart_msg);
 
        /* FIXME: based on notification, adjust the prio_boost */
 
@@ -2047,3 +1912,426 @@ void iwlagn_bt_cancel_deferred_work(struct iwl_priv *priv)
 {
        cancel_work_sync(&priv->bt_traffic_change_work);
 }
+
+static bool is_single_rx_stream(struct iwl_priv *priv)
+{
+       return priv->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
+              priv->current_ht_config.single_chain_sufficient;
+}
+
+#define IWL_NUM_RX_CHAINS_MULTIPLE     3
+#define IWL_NUM_RX_CHAINS_SINGLE       2
+#define IWL_NUM_IDLE_CHAINS_DUAL       2
+#define IWL_NUM_IDLE_CHAINS_SINGLE     1
+
+/*
+ * Determine how many receiver/antenna chains to use.
+ *
+ * More provides better reception via diversity.  Fewer saves power
+ * at the expense of throughput, but only when not in powersave to
+ * start with.
+ *
+ * MIMO (dual stream) requires at least 2, but works better with 3.
+ * This does not determine *which* chains to use, just how many.
+ */
+static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
+{
+       if (priv->cfg->bt_params &&
+           priv->cfg->bt_params->advanced_bt_coexist &&
+           (priv->bt_full_concurrent ||
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+               /*
+                * only use chain 'A' in bt high traffic load or
+                * full concurrency mode
+                */
+               return IWL_NUM_RX_CHAINS_SINGLE;
+       }
+       /* # of Rx chains to use when expecting MIMO. */
+       if (is_single_rx_stream(priv))
+               return IWL_NUM_RX_CHAINS_SINGLE;
+       else
+               return IWL_NUM_RX_CHAINS_MULTIPLE;
+}
+
+/*
+ * When we are in power saving mode, unless device support spatial
+ * multiplexing power save, use the active count for rx chain count.
+ */
+static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+{
+       /* # Rx chains when idling, depending on SMPS mode */
+       switch (priv->current_ht_config.smps) {
+       case IEEE80211_SMPS_STATIC:
+       case IEEE80211_SMPS_DYNAMIC:
+               return IWL_NUM_IDLE_CHAINS_SINGLE;
+       case IEEE80211_SMPS_OFF:
+               return active_cnt;
+       default:
+               WARN(1, "invalid SMPS mode %d",
+                    priv->current_ht_config.smps);
+               return active_cnt;
+       }
+}
+
+/* up to 4 chains */
+static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
+{
+       u8 res;
+       res = (chain_bitmap & BIT(0)) >> 0;
+       res += (chain_bitmap & BIT(1)) >> 1;
+       res += (chain_bitmap & BIT(2)) >> 2;
+       res += (chain_bitmap & BIT(3)) >> 3;
+       return res;
+}
+
+/**
+ * iwlagn_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
+ *
+ * Selects how many and which Rx receivers/antennas/chains to use.
+ * This should not be used for scan command ... it puts data in wrong place.
+ */
+void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+       bool is_single = is_single_rx_stream(priv);
+       bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+       u8 idle_rx_cnt, active_rx_cnt, valid_rx_cnt;
+       u32 active_chains;
+       u16 rx_chain;
+
+       /* Tell uCode which antennas are actually connected.
+        * Before first association, we assume all antennas are connected.
+        * Just after first association, iwl_chain_noise_calibration()
+        *    checks which antennas actually *are* connected. */
+       if (priv->chain_noise_data.active_chains)
+               active_chains = priv->chain_noise_data.active_chains;
+       else
+               active_chains = priv->hw_params.valid_rx_ant;
+
+       if (priv->cfg->bt_params &&
+           priv->cfg->bt_params->advanced_bt_coexist &&
+           (priv->bt_full_concurrent ||
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
+               /*
+                * only use chain 'A' in bt high traffic load or
+                * full concurrency mode
+                */
+               active_chains = first_antenna(active_chains);
+       }
+
+       rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
+
+       /* How many receivers should we use? */
+       active_rx_cnt = iwl_get_active_rx_chain_count(priv);
+       idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
+
+
+       /* correct rx chain count according hw settings
+        * and chain noise calibration
+        */
+       valid_rx_cnt = iwl_count_chain_bitmap(active_chains);
+       if (valid_rx_cnt < active_rx_cnt)
+               active_rx_cnt = valid_rx_cnt;
+
+       if (valid_rx_cnt < idle_rx_cnt)
+               idle_rx_cnt = valid_rx_cnt;
+
+       rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
+       rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
+
+       ctx->staging.rx_chain = cpu_to_le16(rx_chain);
+
+       if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
+               ctx->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
+       else
+               ctx->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
+
+       IWL_DEBUG_ASSOC(priv, "rx_chain=0x%X active=%d idle=%d\n",
+                       ctx->staging.rx_chain,
+                       active_rx_cnt, idle_rx_cnt);
+
+       WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
+               active_rx_cnt < idle_rx_cnt);
+}
+
+u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant, u8 valid)
+{
+       int i;
+       u8 ind = ant;
+
+       if (priv->band == IEEE80211_BAND_2GHZ &&
+           priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
+               return 0;
+
+       for (i = 0; i < RATE_ANT_NUM - 1; i++) {
+               ind = (ind + 1) < RATE_ANT_NUM ?  ind + 1 : 0;
+               if (valid & BIT(ind))
+                       return ind;
+       }
+       return ant;
+}
+
+static const char *get_csr_string(int cmd)
+{
+       switch (cmd) {
+       IWL_CMD(CSR_HW_IF_CONFIG_REG);
+       IWL_CMD(CSR_INT_COALESCING);
+       IWL_CMD(CSR_INT);
+       IWL_CMD(CSR_INT_MASK);
+       IWL_CMD(CSR_FH_INT_STATUS);
+       IWL_CMD(CSR_GPIO_IN);
+       IWL_CMD(CSR_RESET);
+       IWL_CMD(CSR_GP_CNTRL);
+       IWL_CMD(CSR_HW_REV);
+       IWL_CMD(CSR_EEPROM_REG);
+       IWL_CMD(CSR_EEPROM_GP);
+       IWL_CMD(CSR_OTP_GP_REG);
+       IWL_CMD(CSR_GIO_REG);
+       IWL_CMD(CSR_GP_UCODE_REG);
+       IWL_CMD(CSR_GP_DRIVER_REG);
+       IWL_CMD(CSR_UCODE_DRV_GP1);
+       IWL_CMD(CSR_UCODE_DRV_GP2);
+       IWL_CMD(CSR_LED_REG);
+       IWL_CMD(CSR_DRAM_INT_TBL_REG);
+       IWL_CMD(CSR_GIO_CHICKEN_BITS);
+       IWL_CMD(CSR_ANA_PLL_CFG);
+       IWL_CMD(CSR_HW_REV_WA_REG);
+       IWL_CMD(CSR_DBG_HPET_MEM_REG);
+       default:
+               return "UNKNOWN";
+       }
+}
+
+void iwl_dump_csr(struct iwl_priv *priv)
+{
+       int i;
+       static const u32 csr_tbl[] = {
+               CSR_HW_IF_CONFIG_REG,
+               CSR_INT_COALESCING,
+               CSR_INT,
+               CSR_INT_MASK,
+               CSR_FH_INT_STATUS,
+               CSR_GPIO_IN,
+               CSR_RESET,
+               CSR_GP_CNTRL,
+               CSR_HW_REV,
+               CSR_EEPROM_REG,
+               CSR_EEPROM_GP,
+               CSR_OTP_GP_REG,
+               CSR_GIO_REG,
+               CSR_GP_UCODE_REG,
+               CSR_GP_DRIVER_REG,
+               CSR_UCODE_DRV_GP1,
+               CSR_UCODE_DRV_GP2,
+               CSR_LED_REG,
+               CSR_DRAM_INT_TBL_REG,
+               CSR_GIO_CHICKEN_BITS,
+               CSR_ANA_PLL_CFG,
+               CSR_HW_REV_WA_REG,
+               CSR_DBG_HPET_MEM_REG
+       };
+       IWL_ERR(priv, "CSR values:\n");
+       IWL_ERR(priv, "(2nd byte of CSR_INT_COALESCING is "
+               "CSR_INT_PERIODIC_REG)\n");
+       for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
+               IWL_ERR(priv, "  %25s: 0X%08x\n",
+                       get_csr_string(csr_tbl[i]),
+                       iwl_read32(priv, csr_tbl[i]));
+       }
+}
+
+static const char *get_fh_string(int cmd)
+{
+       switch (cmd) {
+       IWL_CMD(FH_RSCSR_CHNL0_STTS_WPTR_REG);
+       IWL_CMD(FH_RSCSR_CHNL0_RBDCB_BASE_REG);
+       IWL_CMD(FH_RSCSR_CHNL0_WPTR);
+       IWL_CMD(FH_MEM_RCSR_CHNL0_CONFIG_REG);
+       IWL_CMD(FH_MEM_RSSR_SHARED_CTRL_REG);
+       IWL_CMD(FH_MEM_RSSR_RX_STATUS_REG);
+       IWL_CMD(FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
+       IWL_CMD(FH_TSSR_TX_STATUS_REG);
+       IWL_CMD(FH_TSSR_TX_ERROR_REG);
+       default:
+               return "UNKNOWN";
+       }
+}
+
+int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
+{
+       int i;
+#ifdef CONFIG_IWLWIFI_DEBUG
+       int pos = 0;
+       size_t bufsz = 0;
+#endif
+       static const u32 fh_tbl[] = {
+               FH_RSCSR_CHNL0_STTS_WPTR_REG,
+               FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+               FH_RSCSR_CHNL0_WPTR,
+               FH_MEM_RCSR_CHNL0_CONFIG_REG,
+               FH_MEM_RSSR_SHARED_CTRL_REG,
+               FH_MEM_RSSR_RX_STATUS_REG,
+               FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
+               FH_TSSR_TX_STATUS_REG,
+               FH_TSSR_TX_ERROR_REG
+       };
+#ifdef CONFIG_IWLWIFI_DEBUG
+       if (display) {
+               bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+               *buf = kmalloc(bufsz, GFP_KERNEL);
+               if (!*buf)
+                       return -ENOMEM;
+               pos += scnprintf(*buf + pos, bufsz - pos,
+                               "FH register values:\n");
+               for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+                       pos += scnprintf(*buf + pos, bufsz - pos,
+                               "  %34s: 0X%08x\n",
+                               get_fh_string(fh_tbl[i]),
+                               iwl_read_direct32(priv, fh_tbl[i]));
+               }
+               return pos;
+       }
+#endif
+       IWL_ERR(priv, "FH register values:\n");
+       for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+               IWL_ERR(priv, "  %34s: 0X%08x\n",
+                       get_fh_string(fh_tbl[i]),
+                       iwl_read_direct32(priv, fh_tbl[i]));
+       }
+       return 0;
+}
+
+/* notification wait support */
+void iwlagn_init_notification_wait(struct iwl_priv *priv,
+                                  struct iwl_notification_wait *wait_entry,
+                                  u8 cmd,
+                                  void (*fn)(struct iwl_priv *priv,
+                                             struct iwl_rx_packet *pkt,
+                                             void *data),
+                                  void *fn_data)
+{
+       wait_entry->fn = fn;
+       wait_entry->fn_data = fn_data;
+       wait_entry->cmd = cmd;
+       wait_entry->triggered = false;
+       wait_entry->aborted = false;
+
+       spin_lock_bh(&priv->_agn.notif_wait_lock);
+       list_add(&wait_entry->list, &priv->_agn.notif_waits);
+       spin_unlock_bh(&priv->_agn.notif_wait_lock);
+}
+
+int iwlagn_wait_notification(struct iwl_priv *priv,
+                            struct iwl_notification_wait *wait_entry,
+                            unsigned long timeout)
+{
+       int ret;
+
+       ret = wait_event_timeout(priv->_agn.notif_waitq,
+                                wait_entry->triggered || wait_entry->aborted,
+                                timeout);
+
+       spin_lock_bh(&priv->_agn.notif_wait_lock);
+       list_del(&wait_entry->list);
+       spin_unlock_bh(&priv->_agn.notif_wait_lock);
+
+       if (wait_entry->aborted)
+               return -EIO;
+
+       /* return value is always >= 0 */
+       if (ret <= 0)
+               return -ETIMEDOUT;
+       return 0;
+}
+
+void iwlagn_remove_notification(struct iwl_priv *priv,
+                               struct iwl_notification_wait *wait_entry)
+{
+       spin_lock_bh(&priv->_agn.notif_wait_lock);
+       list_del(&wait_entry->list);
+       spin_unlock_bh(&priv->_agn.notif_wait_lock);
+}
+
+int iwlagn_start_device(struct iwl_priv *priv)
+{
+       int ret;
+
+       if ((priv->cfg->sku & EEPROM_SKU_CAP_AMT_ENABLE) &&
+            iwl_prepare_card_hw(priv)) {
+               IWL_WARN(priv, "Exit HW not ready\n");
+               return -EIO;
+       }
+
+       /* If platform's RF_KILL switch is NOT set to KILL */
+       if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
+               clear_bit(STATUS_RF_KILL_HW, &priv->status);
+       else
+               set_bit(STATUS_RF_KILL_HW, &priv->status);
+
+       if (iwl_is_rfkill(priv)) {
+               wiphy_rfkill_set_hw_state(priv->hw->wiphy, true);
+               iwl_enable_interrupts(priv);
+               return -ERFKILL;
+       }
+
+       iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
+
+       ret = iwlagn_hw_nic_init(priv);
+       if (ret) {
+               IWL_ERR(priv, "Unable to init nic\n");
+               return ret;
+       }
+
+       /* make sure rfkill handshake bits are cleared */
+       iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+       iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
+                   CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
+
+       /* clear (again), then enable host interrupts */
+       iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
+       iwl_enable_interrupts(priv);
+
+       /* really make sure rfkill handshake bits are cleared */
+       iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+       iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
+
+       return 0;
+}
+
+void iwlagn_stop_device(struct iwl_priv *priv)
+{
+       unsigned long flags;
+
+       /* stop and reset the on-board processor */
+       iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
+
+       /* tell the device to stop sending interrupts */
+       spin_lock_irqsave(&priv->lock, flags);
+       iwl_disable_interrupts(priv);
+       spin_unlock_irqrestore(&priv->lock, flags);
+       iwl_synchronize_irq(priv);
+
+       /* device going down, Stop using ICT table */
+       iwl_disable_ict(priv);
+
+       /*
+        * If a HW restart happens during firmware loading,
+        * then the firmware loading might call this function
+        * and later it might be called again due to the
+        * restart. So don't process again if the device is
+        * already dead.
+        */
+       if (test_bit(STATUS_DEVICE_ENABLED, &priv->status)) {
+                iwlagn_txq_ctx_stop(priv);
+                iwlagn_rxq_stop(priv);
+
+                /* Power-down device's busmaster DMA clocks */
+                iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
+                udelay(5);
+        }
+
+       /* Make sure (redundant) we've released our request to stay awake */
+       iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+
+       /* Stop the device, and put it in low power state */
+       iwl_apm_stop(priv);
+}