Merge tag 'wireless-drivers-next-for-davem-2016-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers patches for 4.6

Major changes:

ath10k

* dt: add bindings for ipq4019 wifi block
* start adding support for qca4019 chip

ath9k

* add device ID for Toshiba WLM-20U2/GN-1080
* allow more than one interface on DFS channels

bcma

* move flash detection code to ChipCommon core driver

brcmfmac

* IPv6 Neighbor discovery offload
* driver settings that can be populated from different sources
* country code setting in firmware
* length checks to validate firmware events
* new way to determine device memory size needed for BCM4366
* various offloads during Wake on Wireless LAN (WoWLAN)
* full Management Frame Protection (MFP) support

iwlwifi

* add support for thermal device / cooling device
* improvements in scheduled scan without profiles
* new firmware support (-21.ucode)
* add MSIX support for 9000 devices
* enable MU-MIMO and take care of firmware restart
* add support for large SKBs in mvm to reach A-MSDU
* add support for filtering frames from a BA session
* start implementing the new Rx path for 9000 devices
* enable the new Radio Resource Management (RRM) nl80211 feature flag
* add a new module paramater to disable VHT
* build infrastructure for Dynamic Queue Allocation
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

162 files changed, 6422 insertions, 1819 deletions

diff --git a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt
index edefc26c6204..96aae6b4f736 100644
--- a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt
+++ b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt
@@ -1,17 +1,46 @@
 * Qualcomm Atheros ath10k wireless devices
 
-For ath10k devices the calibration data can be provided through Device
-Tree. The node is a child node of the PCI controller.
-
 Required properties:
--compatible : Should be "qcom,ath10k"
+- compatible: Should be one of the following:
+        * "qcom,ath10k"
+        * "qcom,ipq4019-wifi"
+
+PCI based devices uses compatible string "qcom,ath10k" and takes only
+calibration data via "qcom,ath10k-calibration-data". Rest of the properties
+are not applicable for PCI based devices.
+
+AHB based devices (i.e. ipq4019) uses compatible string "qcom,ipq4019-wifi"
+and also uses most of the properties defined in this doc.
 
 Optional properties:
+- reg: Address and length of the register set for the device.
+- resets: Must contain an entry for each entry in reset-names.
+          See ../reset/reseti.txt for details.
+- reset-names: Must include the list of following reset names,
+               "wifi_cpu_init"
+               "wifi_radio_srif"
+               "wifi_radio_warm"
+               "wifi_radio_cold"
+               "wifi_core_warm"
+               "wifi_core_cold"
+- clocks: List of clock specifiers, must contain an entry for each required
+          entry in clock-names.
+- clock-names: Should contain the clock names "wifi_wcss_cmd", "wifi_wcss_ref",
+               "wifi_wcss_rtc".
+- interrupts: List of interrupt lines. Must contain an entry
+              for each entry in the interrupt-names property.
+- interrupt-names: Must include the entries for MSI interrupt
+                   names ("msi0" to "msi15") and legacy interrupt
+                   name ("legacy"),
+- qcom,msi_addr: MSI interrupt address.
+- qcom,msi_base: Base value to add before writing MSI data into
+                MSI address register.
 - qcom,ath10k-calibration-data : calibration data as an array, the
                                  length can vary between hw versions
 
+Example (to supply the calibration data alone):
 
-Example:
+In this example, the node is defined as child node of the PCI controller.
 
 pci {
         pcie@0 {
@@ -28,3 +57,53 @@ pci {
                 };
         };
 };
+
+Example (to supply ipq4019 SoC wifi block details):
+
+wifi0: wifi@a000000 {
+        compatible = "qcom,ipq4019-wifi";
+        reg = <0xa000000 0x200000>;
+        resets = <&gcc WIFI0_CPU_INIT_RESET>,
+                 <&gcc WIFI0_RADIO_SRIF_RESET>,
+                 <&gcc WIFI0_RADIO_WARM_RESET>,
+                 <&gcc WIFI0_RADIO_COLD_RESET>,
+                 <&gcc WIFI0_CORE_WARM_RESET>,
+                 <&gcc WIFI0_CORE_COLD_RESET>;
+        reset-names = "wifi_cpu_init",
+                      "wifi_radio_srif",
+                      "wifi_radio_warm",
+                      "wifi_radio_cold",
+                      "wifi_core_warm",
+                      "wifi_core_cold";
+        clocks = <&gcc GCC_WCSS2G_CLK>,
+                 <&gcc GCC_WCSS2G_REF_CLK>,
+                 <&gcc GCC_WCSS2G_RTC_CLK>;
+        clock-names = "wifi_wcss_cmd",
+                      "wifi_wcss_ref",
+                      "wifi_wcss_rtc";
+        interrupts = <0 0x20 0x1>,
+                     <0 0x21 0x1>,
+                     <0 0x22 0x1>,
+                     <0 0x23 0x1>,
+                     <0 0x24 0x1>,
+                     <0 0x25 0x1>,
+                     <0 0x26 0x1>,
+                     <0 0x27 0x1>,
+                     <0 0x28 0x1>,
+                     <0 0x29 0x1>,
+                     <0 0x2a 0x1>,
+                     <0 0x2b 0x1>,
+                     <0 0x2c 0x1>,
+                     <0 0x2d 0x1>,
+                     <0 0x2e 0x1>,
+                     <0 0x2f 0x1>,
+                     <0 0xa8 0x0>;
+        interrupt-names = "msi0",  "msi1",  "msi2",  "msi3",
+                          "msi4",  "msi5",  "msi6",  "msi7",
+                          "msi8",  "msi9",  "msi10", "msi11",
+                          "msi12", "msi13", "msi14", "msi15",
+                          "legacy";
+        qcom,msi_addr = <0x0b006040>;
+        qcom,msi_base = <0x40>;
+        qcom,ath10k-calibration-data = [ 01 02 03 ... ];
+};
diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig
index 023d448ed3fa..efdc2ae8441a 100644
--- a/drivers/bcma/Kconfig
+++ b/drivers/bcma/Kconfig
@@ -70,6 +70,11 @@ config BCMA_DRIVER_MIPS
 
           If unsure, say N
 
+config BCMA_PFLASH
+        bool
+        depends on BCMA_DRIVER_MIPS
+        default y
+
 config BCMA_SFLASH
         bool
         depends on BCMA_DRIVER_MIPS
diff --git a/drivers/bcma/Makefile b/drivers/bcma/Makefile
index f32af9b76bcd..087948a1d20d 100644
--- a/drivers/bcma/Makefile
+++ b/drivers/bcma/Makefile
@@ -1,6 +1,7 @@
 bcma-y                                  += main.o scan.o core.o sprom.o
 bcma-y                                  += driver_chipcommon.o driver_chipcommon_pmu.o
 bcma-y                                  += driver_chipcommon_b.o
+bcma-$(CONFIG_BCMA_PFLASH)              += driver_chipcommon_pflash.o
 bcma-$(CONFIG_BCMA_SFLASH)              += driver_chipcommon_sflash.o
 bcma-$(CONFIG_BCMA_NFLASH)              += driver_chipcommon_nflash.o
 bcma-$(CONFIG_BCMA_DRIVER_PCI)          += driver_pci.o
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 7e4ddfb076d3..eda09090cb52 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -47,9 +47,6 @@ int bcma_sprom_get(struct bcma_bus *bus);
 void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
 void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
-#ifdef CONFIG_BCMA_DRIVER_MIPS
-extern struct platform_device bcma_pflash_dev;
-#endif /* CONFIG_BCMA_DRIVER_MIPS */
 
 /* driver_chipcommon_b.c */
 int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
@@ -61,6 +58,21 @@ void bcma_pmu_init(struct bcma_drv_cc *cc);
 u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc);
 u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc);
 
+/**************************************************
+ * driver_chipcommon_sflash.c
+ **************************************************/
+
+#ifdef CONFIG_BCMA_PFLASH
+extern struct platform_device bcma_pflash_dev;
+int bcma_pflash_init(struct bcma_drv_cc *cc);
+#else
+static inline int bcma_pflash_init(struct bcma_drv_cc *cc)
+{
+        bcma_err(cc->core->bus, "Parallel flash not supported\n");
+        return 0;
+}
+#endif /* CONFIG_BCMA_PFLASH */
+
 #ifdef CONFIG_BCMA_SFLASH
 /* driver_chipcommon_sflash.c */
 int bcma_sflash_init(struct bcma_drv_cc *cc);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index b0f44a2937b9..921ce1834673 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -115,6 +115,33 @@ int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc)
         return 0;
 }
 
+static void bcma_core_chipcommon_flash_detect(struct bcma_drv_cc *cc)
+{
+        struct bcma_bus *bus = cc->core->bus;
+
+        switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
+        case BCMA_CC_FLASHT_STSER:
+        case BCMA_CC_FLASHT_ATSER:
+                bcma_debug(bus, "Found serial flash\n");
+                bcma_sflash_init(cc);
+                break;
+        case BCMA_CC_FLASHT_PARA:
+                bcma_debug(bus, "Found parallel flash\n");
+                bcma_pflash_init(cc);
+                break;
+        default:
+                bcma_err(bus, "Flash type not supported\n");
+        }
+
+        if (cc->core->id.rev == 38 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
+                if (cc->capabilities & BCMA_CC_CAP_NFLASH) {
+                        bcma_debug(bus, "Found NAND flash\n");
+                        bcma_nflash_init(cc);
+                }
+        }
+}
+
 void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
 {
         struct bcma_bus *bus = cc->core->bus;
@@ -136,6 +163,9 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
         if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
                 bcma_chipco_serial_init(cc);
 
+        if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+                bcma_core_chipcommon_flash_detect(cc);
+
         cc->early_setup_done = true;
 }
 
diff --git a/drivers/bcma/driver_chipcommon_pflash.c b/drivers/bcma/driver_chipcommon_pflash.c
new file mode 100644
index 000000000000..3b497c9ee0d4
--- /dev/null
+++ b/drivers/bcma/driver_chipcommon_pflash.c
@@ -0,0 +1,49 @@
+/*
+ * Broadcom specific AMBA
+ * ChipCommon parallel flash
+ *
+ * Licensed under the GNU/GPL. See COPYING for details.
+ */
+
+#include "bcma_private.h"
+
+#include <linux/bcma/bcma.h>
+#include <linux/mtd/physmap.h>
+#include <linux/platform_device.h>
+
+static const char * const part_probes[] = { "bcm47xxpart", NULL };
+
+static struct physmap_flash_data bcma_pflash_data = {
+        .part_probe_types       = part_probes,
+};
+
+static struct resource bcma_pflash_resource = {
+        .name   = "bcma_pflash",
+        .flags  = IORESOURCE_MEM,
+};
+
+struct platform_device bcma_pflash_dev = {
+        .name           = "physmap-flash",
+        .dev            = {
+                .platform_data  = &bcma_pflash_data,
+        },
+        .resource       = &bcma_pflash_resource,
+        .num_resources  = 1,
+};
+
+int bcma_pflash_init(struct bcma_drv_cc *cc)
+{
+        struct bcma_pflash *pflash = &cc->pflash;
+
+        pflash->present = true;
+
+        if (!(bcma_read32(cc->core, BCMA_CC_FLASH_CFG) & BCMA_CC_FLASH_CFG_DS))
+                bcma_pflash_data.width = 1;
+        else
+                bcma_pflash_data.width = 2;
+
+        bcma_pflash_resource.start = BCMA_SOC_FLASH2;
+        bcma_pflash_resource.end = BCMA_SOC_FLASH2 + BCMA_SOC_FLASH2_SZ;
+
+        return 0;
+}
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index a40a203314db..96f171328200 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -14,8 +14,6 @@
 
 #include <linux/bcma/bcma.h>
 
-#include <linux/mtd/physmap.h>
-#include <linux/platform_device.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
@@ -32,26 +30,6 @@ enum bcma_boot_dev {
         BCMA_BOOT_DEV_NAND,
 };
 
-static const char * const part_probes[] = { "bcm47xxpart", NULL };
-
-static struct physmap_flash_data bcma_pflash_data = {
-        .part_probe_types       = part_probes,
-};
-
-static struct resource bcma_pflash_resource = {
-        .name   = "bcma_pflash",
-        .flags  = IORESOURCE_MEM,
-};
-
-struct platform_device bcma_pflash_dev = {
-        .name           = "physmap-flash",
-        .dev            = {
-                .platform_data  = &bcma_pflash_data,
-        },
-        .resource       = &bcma_pflash_resource,
-        .num_resources  = 1,
-};
-
 /* The 47162a0 hangs when reading MIPS DMP registers registers */
 static inline bool bcma_core_mips_bcm47162a0_quirk(struct bcma_device *dev)
 {
@@ -272,48 +250,11 @@ static enum bcma_boot_dev bcma_boot_dev(struct bcma_bus *bus)
         return BCMA_BOOT_DEV_SERIAL;
 }
 
-static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
+static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore)
 {
         struct bcma_bus *bus = mcore->core->bus;
-        struct bcma_drv_cc *cc = &bus->drv_cc;
-        struct bcma_pflash *pflash = &cc->pflash;
         enum bcma_boot_dev boot_dev;
 
-        switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
-        case BCMA_CC_FLASHT_STSER:
-        case BCMA_CC_FLASHT_ATSER:
-                bcma_debug(bus, "Found serial flash\n");
-                bcma_sflash_init(cc);
-                break;
-        case BCMA_CC_FLASHT_PARA:
-                bcma_debug(bus, "Found parallel flash\n");
-                pflash->present = true;
-                pflash->window = BCMA_SOC_FLASH2;
-                pflash->window_size = BCMA_SOC_FLASH2_SZ;
-
-                if ((bcma_read32(cc->core, BCMA_CC_FLASH_CFG) &
-                     BCMA_CC_FLASH_CFG_DS) == 0)
-                        pflash->buswidth = 1;
-                else
-                        pflash->buswidth = 2;
-
-                bcma_pflash_data.width = pflash->buswidth;
-                bcma_pflash_resource.start = pflash->window;
-                bcma_pflash_resource.end = pflash->window + pflash->window_size;
-
-                break;
-        default:
-                bcma_err(bus, "Flash type not supported\n");
-        }
-
-        if (cc->core->id.rev == 38 ||
-            bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
-                if (cc->capabilities & BCMA_CC_CAP_NFLASH) {
-                        bcma_debug(bus, "Found NAND flash\n");
-                        bcma_nflash_init(cc);
-                }
-        }
-
         /* Determine flash type this SoC boots from */
         boot_dev = bcma_boot_dev(bus);
         switch (boot_dev) {
@@ -340,7 +281,7 @@ void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
         if (mcore->early_setup_done)
                 return;
 
-        bcma_core_mips_flash_detect(mcore);
+        bcma_core_mips_nvram_init(mcore);
 
         mcore->early_setup_done = true;
 }
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index c466f752b067..786be8fed39e 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -350,7 +350,7 @@ static int bcma_register_devices(struct bcma_bus *bus)
                 bcma_register_core(bus, core);
         }
 
-#ifdef CONFIG_BCMA_DRIVER_MIPS
+#ifdef CONFIG_BCMA_PFLASH
         if (bus->drv_cc.pflash.present) {
                 err = platform_device_register(&bcma_pflash_dev);
                 if (err)
diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig
index 03aa35f999a1..db1ca629cbd6 100644
--- a/drivers/net/wireless/ath/ath10k/Kconfig
+++ b/drivers/net/wireless/ath/ath10k/Kconfig
@@ -15,6 +15,12 @@ config ATH10K_PCI
         ---help---
           This module adds support for PCIE bus
 
+config ATH10K_AHB
+        bool "Atheros ath10k AHB support"
+        depends on ATH10K_PCI && OF && RESET_CONTROLLER
+        ---help---
+          This module adds support for AHB bus
+
 config ATH10K_DEBUG
         bool "Atheros ath10k debugging"
         depends on ATH10K
diff --git a/drivers/net/wireless/ath/ath10k/Makefile b/drivers/net/wireless/ath/ath10k/Makefile
index c04fb00e7930..930fadd940d8 100644
--- a/drivers/net/wireless/ath/ath10k/Makefile
+++ b/drivers/net/wireless/ath/ath10k/Makefile
@@ -25,5 +25,7 @@ obj-$(CONFIG_ATH10K_PCI) += ath10k_pci.o
 ath10k_pci-y += pci.o \
                 ce.o
 
+ath10k_pci-$(CONFIG_ATH10K_AHB) += ahb.o
+
 # for tracing framework to find trace.h
 CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
new file mode 100644
index 000000000000..bd62bc19e758
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/ahb.c
@@ -0,0 +1,933 @@
+/*
+ * Copyright (c) 2016 Qualcomm Atheros, Inc. All rights reserved.
+ * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/clk.h>
+#include <linux/reset.h>
+#include "core.h"
+#include "debug.h"
+#include "pci.h"
+#include "ahb.h"
+
+static const struct of_device_id ath10k_ahb_of_match[] = {
+        /* TODO: enable this entry once everything in place.
+         * { .compatible = "qcom,ipq4019-wifi",
+         *   .data = (void *)ATH10K_HW_QCA4019 },
+         */
+        { }
+};
+
+MODULE_DEVICE_TABLE(of, ath10k_ahb_of_match);
+
+static inline struct ath10k_ahb *ath10k_ahb_priv(struct ath10k *ar)
+{
+        return &((struct ath10k_pci *)ar->drv_priv)->ahb[0];
+}
+
+static void ath10k_ahb_write32(struct ath10k *ar, u32 offset, u32 value)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        iowrite32(value, ar_ahb->mem + offset);
+}
+
+static u32 ath10k_ahb_read32(struct ath10k *ar, u32 offset)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        return ioread32(ar_ahb->mem + offset);
+}
+
+static u32 ath10k_ahb_gcc_read32(struct ath10k *ar, u32 offset)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        return ioread32(ar_ahb->gcc_mem + offset);
+}
+
+static void ath10k_ahb_tcsr_write32(struct ath10k *ar, u32 offset, u32 value)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        iowrite32(value, ar_ahb->tcsr_mem + offset);
+}
+
+static u32 ath10k_ahb_tcsr_read32(struct ath10k *ar, u32 offset)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        return ioread32(ar_ahb->tcsr_mem + offset);
+}
+
+static u32 ath10k_ahb_soc_read32(struct ath10k *ar, u32 addr)
+{
+        return ath10k_ahb_read32(ar, RTC_SOC_BASE_ADDRESS + addr);
+}
+
+static int ath10k_ahb_get_num_banks(struct ath10k *ar)
+{
+        if (ar->hw_rev == ATH10K_HW_QCA4019)
+                return 1;
+
+        ath10k_warn(ar, "unknown number of banks, assuming 1\n");
+        return 1;
+}
+
+static int ath10k_ahb_clock_init(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        struct device *dev;
+        int ret;
+
+        dev = &ar_ahb->pdev->dev;
+
+        ar_ahb->cmd_clk = clk_get(dev, "wifi_wcss_cmd");
+        if (IS_ERR_OR_NULL(ar_ahb->cmd_clk)) {
+                ath10k_err(ar, "failed to get cmd clk: %ld\n",
+                           PTR_ERR(ar_ahb->cmd_clk));
+                ret = ar_ahb->cmd_clk ? PTR_ERR(ar_ahb->cmd_clk) : -ENODEV;
+                goto out;
+        }
+
+        ar_ahb->ref_clk = clk_get(dev, "wifi_wcss_ref");
+        if (IS_ERR_OR_NULL(ar_ahb->ref_clk)) {
+                ath10k_err(ar, "failed to get ref clk: %ld\n",
+                           PTR_ERR(ar_ahb->ref_clk));
+                ret = ar_ahb->ref_clk ? PTR_ERR(ar_ahb->ref_clk) : -ENODEV;
+                goto err_cmd_clk_put;
+        }
+
+        ar_ahb->rtc_clk = clk_get(dev, "wifi_wcss_rtc");
+        if (IS_ERR_OR_NULL(ar_ahb->rtc_clk)) {
+                ath10k_err(ar, "failed to get rtc clk: %ld\n",
+                           PTR_ERR(ar_ahb->rtc_clk));
+                ret = ar_ahb->rtc_clk ? PTR_ERR(ar_ahb->rtc_clk) : -ENODEV;
+                goto err_ref_clk_put;
+        }
+
+        return 0;
+
+err_ref_clk_put:
+        clk_put(ar_ahb->ref_clk);
+
+err_cmd_clk_put:
+        clk_put(ar_ahb->cmd_clk);
+
+out:
+        return ret;
+}
+
+static void ath10k_ahb_clock_deinit(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->cmd_clk))
+                clk_put(ar_ahb->cmd_clk);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->ref_clk))
+                clk_put(ar_ahb->ref_clk);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->rtc_clk))
+                clk_put(ar_ahb->rtc_clk);
+
+        ar_ahb->cmd_clk = NULL;
+        ar_ahb->ref_clk = NULL;
+        ar_ahb->rtc_clk = NULL;
+}
+
+static int ath10k_ahb_clock_enable(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        struct device *dev;
+        int ret;
+
+        dev = &ar_ahb->pdev->dev;
+
+        if (IS_ERR_OR_NULL(ar_ahb->cmd_clk) ||
+            IS_ERR_OR_NULL(ar_ahb->ref_clk) ||
+            IS_ERR_OR_NULL(ar_ahb->rtc_clk)) {
+                ath10k_err(ar, "clock(s) is/are not initialized\n");
+                ret = -EIO;
+                goto out;
+        }
+
+        ret = clk_prepare_enable(ar_ahb->cmd_clk);
+        if (ret) {
+                ath10k_err(ar, "failed to enable cmd clk: %d\n", ret);
+                goto out;
+        }
+
+        ret = clk_prepare_enable(ar_ahb->ref_clk);
+        if (ret) {
+                ath10k_err(ar, "failed to enable ref clk: %d\n", ret);
+                goto err_cmd_clk_disable;
+        }
+
+        ret = clk_prepare_enable(ar_ahb->rtc_clk);
+        if (ret) {
+                ath10k_err(ar, "failed to enable rtc clk: %d\n", ret);
+                goto err_ref_clk_disable;
+        }
+
+        return 0;
+
+err_ref_clk_disable:
+        clk_disable_unprepare(ar_ahb->ref_clk);
+
+err_cmd_clk_disable:
+        clk_disable_unprepare(ar_ahb->cmd_clk);
+
+out:
+        return ret;
+}
+
+static void ath10k_ahb_clock_disable(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->cmd_clk))
+                clk_disable_unprepare(ar_ahb->cmd_clk);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->ref_clk))
+                clk_disable_unprepare(ar_ahb->ref_clk);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->rtc_clk))
+                clk_disable_unprepare(ar_ahb->rtc_clk);
+}
+
+static int ath10k_ahb_rst_ctrl_init(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        struct device *dev;
+        int ret;
+
+        dev = &ar_ahb->pdev->dev;
+
+        ar_ahb->core_cold_rst = reset_control_get(dev, "wifi_core_cold");
+        if (IS_ERR_OR_NULL(ar_ahb->core_cold_rst)) {
+                ath10k_err(ar, "failed to get core cold rst ctrl: %ld\n",
+                           PTR_ERR(ar_ahb->core_cold_rst));
+                ret = ar_ahb->core_cold_rst ?
+                        PTR_ERR(ar_ahb->core_cold_rst) : -ENODEV;
+                goto out;
+        }
+
+        ar_ahb->radio_cold_rst = reset_control_get(dev, "wifi_radio_cold");
+        if (IS_ERR_OR_NULL(ar_ahb->radio_cold_rst)) {
+                ath10k_err(ar, "failed to get radio cold rst ctrl: %ld\n",
+                           PTR_ERR(ar_ahb->radio_cold_rst));
+                ret = ar_ahb->radio_cold_rst ?
+                        PTR_ERR(ar_ahb->radio_cold_rst) : -ENODEV;
+                goto err_core_cold_rst_put;
+        }
+
+        ar_ahb->radio_warm_rst = reset_control_get(dev, "wifi_radio_warm");
+        if (IS_ERR_OR_NULL(ar_ahb->radio_warm_rst)) {
+                ath10k_err(ar, "failed to get radio warm rst ctrl: %ld\n",
+                           PTR_ERR(ar_ahb->radio_warm_rst));
+                ret = ar_ahb->radio_warm_rst ?
+                        PTR_ERR(ar_ahb->radio_warm_rst) : -ENODEV;
+                goto err_radio_cold_rst_put;
+        }
+
+        ar_ahb->radio_srif_rst = reset_control_get(dev, "wifi_radio_srif");
+        if (IS_ERR_OR_NULL(ar_ahb->radio_srif_rst)) {
+                ath10k_err(ar, "failed to get radio srif rst ctrl: %ld\n",
+                           PTR_ERR(ar_ahb->radio_srif_rst));
+                ret = ar_ahb->radio_srif_rst ?
+                        PTR_ERR(ar_ahb->radio_srif_rst) : -ENODEV;
+                goto err_radio_warm_rst_put;
+        }
+
+        ar_ahb->cpu_init_rst = reset_control_get(dev, "wifi_cpu_init");
+        if (IS_ERR_OR_NULL(ar_ahb->cpu_init_rst)) {
+                ath10k_err(ar, "failed to get cpu init rst ctrl: %ld\n",
+                           PTR_ERR(ar_ahb->cpu_init_rst));
+                ret = ar_ahb->cpu_init_rst ?
+                        PTR_ERR(ar_ahb->cpu_init_rst) : -ENODEV;
+                goto err_radio_srif_rst_put;
+        }
+
+        return 0;
+
+err_radio_srif_rst_put:
+        reset_control_put(ar_ahb->radio_srif_rst);
+
+err_radio_warm_rst_put:
+        reset_control_put(ar_ahb->radio_warm_rst);
+
+err_radio_cold_rst_put:
+        reset_control_put(ar_ahb->radio_cold_rst);
+
+err_core_cold_rst_put:
+        reset_control_put(ar_ahb->core_cold_rst);
+
+out:
+        return ret;
+}
+
+static void ath10k_ahb_rst_ctrl_deinit(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->core_cold_rst))
+                reset_control_put(ar_ahb->core_cold_rst);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->radio_cold_rst))
+                reset_control_put(ar_ahb->radio_cold_rst);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->radio_warm_rst))
+                reset_control_put(ar_ahb->radio_warm_rst);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->radio_srif_rst))
+                reset_control_put(ar_ahb->radio_srif_rst);
+
+        if (!IS_ERR_OR_NULL(ar_ahb->cpu_init_rst))
+                reset_control_put(ar_ahb->cpu_init_rst);
+
+        ar_ahb->core_cold_rst = NULL;
+        ar_ahb->radio_cold_rst = NULL;
+        ar_ahb->radio_warm_rst = NULL;
+        ar_ahb->radio_srif_rst = NULL;
+        ar_ahb->cpu_init_rst = NULL;
+}
+
+static int ath10k_ahb_release_reset(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        int ret;
+
+        if (IS_ERR_OR_NULL(ar_ahb->radio_cold_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->radio_warm_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->radio_srif_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->cpu_init_rst)) {
+                ath10k_err(ar, "rst ctrl(s) is/are not initialized\n");
+                return -EINVAL;
+        }
+
+        ret = reset_control_deassert(ar_ahb->radio_cold_rst);
+        if (ret) {
+                ath10k_err(ar, "failed to deassert radio cold rst: %d\n", ret);
+                return ret;
+        }
+
+        ret = reset_control_deassert(ar_ahb->radio_warm_rst);
+        if (ret) {
+                ath10k_err(ar, "failed to deassert radio warm rst: %d\n", ret);
+                return ret;
+        }
+
+        ret = reset_control_deassert(ar_ahb->radio_srif_rst);
+        if (ret) {
+                ath10k_err(ar, "failed to deassert radio srif rst: %d\n", ret);
+                return ret;
+        }
+
+        ret = reset_control_deassert(ar_ahb->cpu_init_rst);
+        if (ret) {
+                ath10k_err(ar, "failed to deassert cpu init rst: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static void ath10k_ahb_halt_axi_bus(struct ath10k *ar, u32 haltreq_reg,
+                                    u32 haltack_reg)
+{
+        unsigned long timeout;
+        u32 val;
+
+        /* Issue halt axi bus request */
+        val = ath10k_ahb_tcsr_read32(ar, haltreq_reg);
+        val |= AHB_AXI_BUS_HALT_REQ;
+        ath10k_ahb_tcsr_write32(ar, haltreq_reg, val);
+
+        /* Wait for axi bus halted ack */
+        timeout = jiffies + msecs_to_jiffies(ATH10K_AHB_AXI_BUS_HALT_TIMEOUT);
+        do {
+                val = ath10k_ahb_tcsr_read32(ar, haltack_reg);
+                if (val & AHB_AXI_BUS_HALT_ACK)
+                        break;
+
+                mdelay(1);
+        } while (time_before(jiffies, timeout));
+
+        if (!(val & AHB_AXI_BUS_HALT_ACK)) {
+                ath10k_err(ar, "failed to halt axi bus: %d\n", val);
+                return;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_AHB, "axi bus halted\n");
+}
+
+static void ath10k_ahb_halt_chip(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        u32 core_id, glb_cfg_reg, haltreq_reg, haltack_reg;
+        u32 val;
+        int ret;
+
+        if (IS_ERR_OR_NULL(ar_ahb->core_cold_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->radio_cold_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->radio_warm_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->radio_srif_rst) ||
+            IS_ERR_OR_NULL(ar_ahb->cpu_init_rst)) {
+                ath10k_err(ar, "rst ctrl(s) is/are not initialized\n");
+                return;
+        }
+
+        core_id = ath10k_ahb_read32(ar, ATH10K_AHB_WLAN_CORE_ID_REG);
+
+        switch (core_id) {
+        case 0:
+                glb_cfg_reg = ATH10K_AHB_TCSR_WIFI0_GLB_CFG;
+                haltreq_reg = ATH10K_AHB_TCSR_WCSS0_HALTREQ;
+                haltack_reg = ATH10K_AHB_TCSR_WCSS0_HALTACK;
+                break;
+        case 1:
+                glb_cfg_reg = ATH10K_AHB_TCSR_WIFI1_GLB_CFG;
+                haltreq_reg = ATH10K_AHB_TCSR_WCSS1_HALTREQ;
+                haltack_reg = ATH10K_AHB_TCSR_WCSS1_HALTACK;
+                break;
+        default:
+                ath10k_err(ar, "invalid core id %d found, skipping reset sequence\n",
+                           core_id);
+                return;
+        }
+
+        ath10k_ahb_halt_axi_bus(ar, haltreq_reg, haltack_reg);
+
+        val = ath10k_ahb_tcsr_read32(ar, glb_cfg_reg);
+        val |= TCSR_WIFIX_GLB_CFG_DISABLE_CORE_CLK;
+        ath10k_ahb_tcsr_write32(ar, glb_cfg_reg, val);
+
+        ret = reset_control_assert(ar_ahb->core_cold_rst);
+        if (ret)
+                ath10k_err(ar, "failed to assert core cold rst: %d\n", ret);
+        msleep(1);
+
+        ret = reset_control_assert(ar_ahb->radio_cold_rst);
+        if (ret)
+                ath10k_err(ar, "failed to assert radio cold rst: %d\n", ret);
+        msleep(1);
+
+        ret = reset_control_assert(ar_ahb->radio_warm_rst);
+        if (ret)
+                ath10k_err(ar, "failed to assert radio warm rst: %d\n", ret);
+        msleep(1);
+
+        ret = reset_control_assert(ar_ahb->radio_srif_rst);
+        if (ret)
+                ath10k_err(ar, "failed to assert radio srif rst: %d\n", ret);
+        msleep(1);
+
+        ret = reset_control_assert(ar_ahb->cpu_init_rst);
+        if (ret)
+                ath10k_err(ar, "failed to assert cpu init rst: %d\n", ret);
+        msleep(10);
+
+        /* Clear halt req and core clock disable req before
+         * deasserting wifi core reset.
+         */
+        val = ath10k_ahb_tcsr_read32(ar, haltreq_reg);
+        val &= ~AHB_AXI_BUS_HALT_REQ;
+        ath10k_ahb_tcsr_write32(ar, haltreq_reg, val);
+
+        val = ath10k_ahb_tcsr_read32(ar, glb_cfg_reg);
+        val &= ~TCSR_WIFIX_GLB_CFG_DISABLE_CORE_CLK;
+        ath10k_ahb_tcsr_write32(ar, glb_cfg_reg, val);
+
+        ret = reset_control_deassert(ar_ahb->core_cold_rst);
+        if (ret)
+                ath10k_err(ar, "failed to deassert core cold rst: %d\n", ret);
+
+        ath10k_dbg(ar, ATH10K_DBG_AHB, "core %d reset done\n", core_id);
+}
+
+static irqreturn_t ath10k_ahb_interrupt_handler(int irq, void *arg)
+{
+        struct ath10k *ar = arg;
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        if (!ath10k_pci_irq_pending(ar))
+                return IRQ_NONE;
+
+        ath10k_pci_disable_and_clear_legacy_irq(ar);
+        tasklet_schedule(&ar_pci->intr_tq);
+
+        return IRQ_HANDLED;
+}
+
+static int ath10k_ahb_request_irq_legacy(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        int ret;
+
+        ret = request_irq(ar_ahb->irq,
+                          ath10k_ahb_interrupt_handler,
+                          IRQF_SHARED, "ath10k_ahb", ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to request legacy irq %d: %d\n",
+                            ar_ahb->irq, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static void ath10k_ahb_release_irq_legacy(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        free_irq(ar_ahb->irq, ar);
+}
+
+static void ath10k_ahb_irq_disable(struct ath10k *ar)
+{
+        ath10k_ce_disable_interrupts(ar);
+        ath10k_pci_disable_and_clear_legacy_irq(ar);
+}
+
+static int ath10k_ahb_resource_init(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        struct platform_device *pdev;
+        struct device *dev;
+        struct resource *res;
+        int ret;
+
+        pdev = ar_ahb->pdev;
+        dev = &pdev->dev;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                ath10k_err(ar, "failed to get memory resource\n");
+                ret = -ENXIO;
+                goto out;
+        }
+
+        ar_ahb->mem = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(ar_ahb->mem)) {
+                ath10k_err(ar, "mem ioremap error\n");
+                ret = PTR_ERR(ar_ahb->mem);
+                goto out;
+        }
+
+        ar_ahb->mem_len = resource_size(res);
+
+        ar_ahb->gcc_mem = ioremap_nocache(ATH10K_GCC_REG_BASE,
+                                          ATH10K_GCC_REG_SIZE);
+        if (!ar_ahb->gcc_mem) {
+                ath10k_err(ar, "gcc mem ioremap error\n");
+                ret = -ENOMEM;
+                goto err_mem_unmap;
+        }
+
+        ar_ahb->tcsr_mem = ioremap_nocache(ATH10K_TCSR_REG_BASE,
+                                           ATH10K_TCSR_REG_SIZE);
+        if (!ar_ahb->tcsr_mem) {
+                ath10k_err(ar, "tcsr mem ioremap error\n");
+                ret = -ENOMEM;
+                goto err_gcc_mem_unmap;
+        }
+
+        ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+        if (ret) {
+                ath10k_err(ar, "failed to set 32-bit dma mask: %d\n", ret);
+                goto err_tcsr_mem_unmap;
+        }
+
+        ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+        if (ret) {
+                ath10k_err(ar, "failed to set 32-bit consistent dma: %d\n",
+                           ret);
+                goto err_tcsr_mem_unmap;
+        }
+
+        ret = ath10k_ahb_clock_init(ar);
+        if (ret)
+                goto err_tcsr_mem_unmap;
+
+        ret = ath10k_ahb_rst_ctrl_init(ar);
+        if (ret)
+                goto err_clock_deinit;
+
+        ar_ahb->irq = platform_get_irq_byname(pdev, "legacy");
+        if (ar_ahb->irq < 0) {
+                ath10k_err(ar, "failed to get irq number: %d\n", ar_ahb->irq);
+                goto err_clock_deinit;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "irq: %d\n", ar_ahb->irq);
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "mem: 0x%p mem_len: %lu gcc mem: 0x%p tcsr_mem: 0x%p\n",
+                   ar_ahb->mem, ar_ahb->mem_len,
+                   ar_ahb->gcc_mem, ar_ahb->tcsr_mem);
+        return 0;
+
+err_clock_deinit:
+        ath10k_ahb_clock_deinit(ar);
+
+err_tcsr_mem_unmap:
+        iounmap(ar_ahb->tcsr_mem);
+
+err_gcc_mem_unmap:
+        ar_ahb->tcsr_mem = NULL;
+        iounmap(ar_ahb->gcc_mem);
+
+err_mem_unmap:
+        ar_ahb->gcc_mem = NULL;
+        devm_iounmap(&pdev->dev, ar_ahb->mem);
+
+out:
+        ar_ahb->mem = NULL;
+        return ret;
+}
+
+static void ath10k_ahb_resource_deinit(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+        struct device *dev;
+
+        dev = &ar_ahb->pdev->dev;
+
+        if (ar_ahb->mem)
+                devm_iounmap(dev, ar_ahb->mem);
+
+        if (ar_ahb->gcc_mem)
+                iounmap(ar_ahb->gcc_mem);
+
+        if (ar_ahb->tcsr_mem)
+                iounmap(ar_ahb->tcsr_mem);
+
+        ar_ahb->mem = NULL;
+        ar_ahb->gcc_mem = NULL;
+        ar_ahb->tcsr_mem = NULL;
+
+        ath10k_ahb_clock_deinit(ar);
+        ath10k_ahb_rst_ctrl_deinit(ar);
+}
+
+static int ath10k_ahb_prepare_device(struct ath10k *ar)
+{
+        u32 val;
+        int ret;
+
+        ret = ath10k_ahb_clock_enable(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to enable clocks\n");
+                return ret;
+        }
+
+        /* Clock for the target is supplied from outside of target (ie,
+         * external clock module controlled by the host). Target needs
+         * to know what frequency target cpu is configured which is needed
+         * for target internal use. Read target cpu frequency info from
+         * gcc register and write into target's scratch register where
+         * target expects this information.
+         */
+        val = ath10k_ahb_gcc_read32(ar, ATH10K_AHB_GCC_FEPLL_PLL_DIV);
+        ath10k_ahb_write32(ar, ATH10K_AHB_WIFI_SCRATCH_5_REG, val);
+
+        ret = ath10k_ahb_release_reset(ar);
+        if (ret)
+                goto err_clk_disable;
+
+        ath10k_ahb_irq_disable(ar);
+
+        ath10k_ahb_write32(ar, FW_INDICATOR_ADDRESS, FW_IND_HOST_READY);
+
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret)
+                goto err_halt_chip;
+
+        return 0;
+
+err_halt_chip:
+        ath10k_ahb_halt_chip(ar);
+
+err_clk_disable:
+        ath10k_ahb_clock_disable(ar);
+
+        return ret;
+}
+
+static int ath10k_ahb_chip_reset(struct ath10k *ar)
+{
+        int ret;
+
+        ath10k_ahb_halt_chip(ar);
+        ath10k_ahb_clock_disable(ar);
+
+        ret = ath10k_ahb_prepare_device(ar);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
+static int ath10k_ahb_wake_target_cpu(struct ath10k *ar)
+{
+        u32 addr, val;
+
+        addr = SOC_CORE_BASE_ADDRESS | CORE_CTRL_ADDRESS;
+        val = ath10k_ahb_read32(ar, addr);
+        val |= ATH10K_AHB_CORE_CTRL_CPU_INTR_MASK;
+        ath10k_ahb_write32(ar, addr, val);
+
+        return 0;
+}
+
+static int ath10k_ahb_hif_start(struct ath10k *ar)
+{
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif start\n");
+
+        ath10k_ce_enable_interrupts(ar);
+        ath10k_pci_enable_legacy_irq(ar);
+
+        ath10k_pci_rx_post(ar);
+
+        return 0;
+}
+
+static void ath10k_ahb_hif_stop(struct ath10k *ar)
+{
+        struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif stop\n");
+
+        ath10k_ahb_irq_disable(ar);
+        synchronize_irq(ar_ahb->irq);
+
+        ath10k_pci_flush(ar);
+}
+
+static int ath10k_ahb_hif_power_up(struct ath10k *ar)
+{
+        int ret;
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif power up\n");
+
+        ret = ath10k_ahb_chip_reset(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to reset chip: %d\n", ret);
+                goto out;
+        }
+
+        ret = ath10k_pci_init_pipes(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to initialize CE: %d\n", ret);
+                goto out;
+        }
+
+        ret = ath10k_pci_init_config(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to setup init config: %d\n", ret);
+                goto err_ce_deinit;
+        }
+
+        ret = ath10k_ahb_wake_target_cpu(ar);
+        if (ret) {
+                ath10k_err(ar, "could not wake up target CPU: %d\n", ret);
+                goto err_ce_deinit;
+        }
+
+        return 0;
+
+err_ce_deinit:
+        ath10k_pci_ce_deinit(ar);
+out:
+        return ret;
+}
+
+static const struct ath10k_hif_ops ath10k_ahb_hif_ops = {
+        .tx_sg                  = ath10k_pci_hif_tx_sg,
+        .diag_read              = ath10k_pci_hif_diag_read,
+        .diag_write             = ath10k_pci_diag_write_mem,
+        .exchange_bmi_msg       = ath10k_pci_hif_exchange_bmi_msg,
+        .start                  = ath10k_ahb_hif_start,
+        .stop                   = ath10k_ahb_hif_stop,
+        .map_service_to_pipe    = ath10k_pci_hif_map_service_to_pipe,
+        .get_default_pipe       = ath10k_pci_hif_get_default_pipe,
+        .send_complete_check    = ath10k_pci_hif_send_complete_check,
+        .get_free_queue_number  = ath10k_pci_hif_get_free_queue_number,
+        .power_up               = ath10k_ahb_hif_power_up,
+        .power_down             = ath10k_pci_hif_power_down,
+        .read32                 = ath10k_ahb_read32,
+        .write32                = ath10k_ahb_write32,
+};
+
+static const struct ath10k_bus_ops ath10k_ahb_bus_ops = {
+        .read32         = ath10k_ahb_read32,
+        .write32        = ath10k_ahb_write32,
+        .get_num_banks  = ath10k_ahb_get_num_banks,
+};
+
+static int ath10k_ahb_probe(struct platform_device *pdev)
+{
+        struct ath10k *ar;
+        struct ath10k_ahb *ar_ahb;
+        struct ath10k_pci *ar_pci;
+        const struct of_device_id *of_id;
+        enum ath10k_hw_rev hw_rev;
+        size_t size;
+        int ret;
+        u32 chip_id;
+
+        of_id = of_match_device(ath10k_ahb_of_match, &pdev->dev);
+        if (!of_id) {
+                dev_err(&pdev->dev, "failed to find matching device tree id\n");
+                return -EINVAL;
+        }
+
+        hw_rev = (enum ath10k_hw_rev)of_id->data;
+
+        size = sizeof(*ar_pci) + sizeof(*ar_ahb);
+        ar = ath10k_core_create(size, &pdev->dev, ATH10K_BUS_AHB,
+                                hw_rev, &ath10k_ahb_hif_ops);
+        if (!ar) {
+                dev_err(&pdev->dev, "failed to allocate core\n");
+                return -ENOMEM;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "ahb probe\n");
+
+        ar_pci = ath10k_pci_priv(ar);
+        ar_ahb = ath10k_ahb_priv(ar);
+
+        ar_ahb->pdev = pdev;
+        platform_set_drvdata(pdev, ar);
+
+        ret = ath10k_ahb_resource_init(ar);
+        if (ret)
+                goto err_core_destroy;
+
+        ar->dev_id = 0;
+        ar_pci->mem = ar_ahb->mem;
+        ar_pci->mem_len = ar_ahb->mem_len;
+        ar_pci->ar = ar;
+        ar_pci->bus_ops = &ath10k_ahb_bus_ops;
+
+        ret = ath10k_pci_setup_resource(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to setup resource: %d\n", ret);
+                goto err_resource_deinit;
+        }
+
+        ath10k_pci_init_irq_tasklets(ar);
+
+        ret = ath10k_ahb_request_irq_legacy(ar);
+        if (ret)
+                goto err_free_pipes;
+
+        ret = ath10k_ahb_prepare_device(ar);
+        if (ret)
+                goto err_free_irq;
+
+        ath10k_pci_ce_deinit(ar);
+
+        chip_id = ath10k_ahb_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
+        if (chip_id == 0xffffffff) {
+                ath10k_err(ar, "failed to get chip id\n");
+                goto err_halt_device;
+        }
+
+        ret = ath10k_core_register(ar, chip_id);
+        if (ret) {
+                ath10k_err(ar, "failed to register driver core: %d\n", ret);
+                goto err_halt_device;
+        }
+
+        return 0;
+
+err_halt_device:
+        ath10k_ahb_halt_chip(ar);
+        ath10k_ahb_clock_disable(ar);
+
+err_free_irq:
+        ath10k_ahb_release_irq_legacy(ar);
+
+err_free_pipes:
+        ath10k_pci_free_pipes(ar);
+
+err_resource_deinit:
+        ath10k_ahb_resource_deinit(ar);
+
+err_core_destroy:
+        ath10k_core_destroy(ar);
+        platform_set_drvdata(pdev, NULL);
+
+        return ret;
+}
+
+static int ath10k_ahb_remove(struct platform_device *pdev)
+{
+        struct ath10k *ar = platform_get_drvdata(pdev);
+        struct ath10k_ahb *ar_ahb;
+
+        if (!ar)
+                return -EINVAL;
+
+        ar_ahb = ath10k_ahb_priv(ar);
+
+        if (!ar_ahb)
+                return -EINVAL;
+
+        ath10k_dbg(ar, ATH10K_DBG_AHB, "ahb remove\n");
+
+        ath10k_core_unregister(ar);
+        ath10k_ahb_irq_disable(ar);
+        ath10k_ahb_release_irq_legacy(ar);
+        ath10k_pci_release_resource(ar);
+        ath10k_ahb_halt_chip(ar);
+        ath10k_ahb_clock_disable(ar);
+        ath10k_ahb_resource_deinit(ar);
+        ath10k_core_destroy(ar);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+static struct platform_driver ath10k_ahb_driver = {
+        .driver         = {
+                .name   = "ath10k_ahb",
+                .of_match_table = ath10k_ahb_of_match,
+        },
+        .probe  = ath10k_ahb_probe,
+        .remove = ath10k_ahb_remove,
+};
+
+int ath10k_ahb_init(void)
+{
+        int ret;
+
+        printk(KERN_ERR "AHB support is still work in progress\n");
+
+        ret = platform_driver_register(&ath10k_ahb_driver);
+        if (ret)
+                printk(KERN_ERR "failed to register ath10k ahb driver: %d\n",
+                       ret);
+        return ret;
+}
+
+void ath10k_ahb_exit(void)
+{
+        platform_driver_unregister(&ath10k_ahb_driver);
+}
diff --git a/drivers/net/wireless/ath/ath10k/ahb.h b/drivers/net/wireless/ath/ath10k/ahb.h
new file mode 100644
index 000000000000..d43e375215c8
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/ahb.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2016 Qualcomm Atheros, Inc. All rights reserved.
+ * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _AHB_H_
+#define _AHB_H_
+
+#include <linux/platform_device.h>
+
+struct ath10k_ahb {
+        struct platform_device *pdev;
+        void __iomem *mem;
+        unsigned long mem_len;
+        void __iomem *gcc_mem;
+        void __iomem *tcsr_mem;
+
+        int irq;
+
+        struct clk *cmd_clk;
+        struct clk *ref_clk;
+        struct clk *rtc_clk;
+
+        struct reset_control *core_cold_rst;
+        struct reset_control *radio_cold_rst;
+        struct reset_control *radio_warm_rst;
+        struct reset_control *radio_srif_rst;
+        struct reset_control *cpu_init_rst;
+};
+
+#ifdef CONFIG_ATH10K_AHB
+
+#define ATH10K_GCC_REG_BASE                  0x1800000
+#define ATH10K_GCC_REG_SIZE                  0x60000
+
+#define ATH10K_TCSR_REG_BASE                 0x1900000
+#define ATH10K_TCSR_REG_SIZE                 0x80000
+
+#define ATH10K_AHB_GCC_FEPLL_PLL_DIV         0x2f020
+#define ATH10K_AHB_WIFI_SCRATCH_5_REG        0x4f014
+
+#define ATH10K_AHB_WLAN_CORE_ID_REG          0x82030
+
+#define ATH10K_AHB_TCSR_WIFI0_GLB_CFG        0x49000
+#define ATH10K_AHB_TCSR_WIFI1_GLB_CFG        0x49004
+#define TCSR_WIFIX_GLB_CFG_DISABLE_CORE_CLK  BIT(25)
+
+#define ATH10K_AHB_TCSR_WCSS0_HALTREQ        0x52000
+#define ATH10K_AHB_TCSR_WCSS1_HALTREQ        0x52010
+#define ATH10K_AHB_TCSR_WCSS0_HALTACK        0x52004
+#define ATH10K_AHB_TCSR_WCSS1_HALTACK        0x52014
+
+#define ATH10K_AHB_AXI_BUS_HALT_TIMEOUT      10 /* msec */
+#define AHB_AXI_BUS_HALT_REQ                 1
+#define AHB_AXI_BUS_HALT_ACK                 1
+
+#define ATH10K_AHB_CORE_CTRL_CPU_INTR_MASK   1
+
+int ath10k_ahb_init(void);
+void ath10k_ahb_exit(void);
+
+#else /* CONFIG_ATH10K_AHB */
+
+static inline int ath10k_ahb_init(void)
+{
+        return 0;
+}
+
+static inline void ath10k_ahb_exit(void)
+{
+}
+
+#endif /* CONFIG_ATH10K_AHB */
+
+#endif /* _AHB_H_ */
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index b41eb3f4ee56..c84c2d30ef1f 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -156,6 +156,11 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .channel_counters_freq_hz = 150000,
                 .max_probe_resp_desc_thres = 24,
                 .hw_4addr_pad = ATH10K_HW_4ADDR_PAD_BEFORE,
+                .num_msdu_desc = 1424,
+                .qcache_active_peers = 50,
+                .tx_chain_mask = 0xf,
+                .rx_chain_mask = 0xf,
+                .max_spatial_stream = 4,
                 .fw = {
                         .dir = QCA99X0_HW_2_0_FW_DIR,
                         .fw = QCA99X0_HW_2_0_FW_FILE,
@@ -201,6 +206,31 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                         .board_ext_size = QCA9377_BOARD_EXT_DATA_SZ,
                 },
         },
+        {
+                .id = QCA4019_HW_1_0_DEV_VERSION,
+                .dev_id = 0,
+                .name = "qca4019 hw1.0",
+                .patch_load_addr = QCA4019_HW_1_0_PATCH_LOAD_ADDR,
+                .uart_pin = 7,
+                .otp_exe_param = 0x0010000,
+                .continuous_frag_desc = true,
+                .channel_counters_freq_hz = 125000,
+                .max_probe_resp_desc_thres = 24,
+                .hw_4addr_pad = ATH10K_HW_4ADDR_PAD_BEFORE,
+                .num_msdu_desc = 2500,
+                .qcache_active_peers = 35,
+                .tx_chain_mask = 0x3,
+                .rx_chain_mask = 0x3,
+                .max_spatial_stream = 2,
+                .fw = {
+                        .dir = QCA4019_HW_1_0_FW_DIR,
+                        .fw = QCA4019_HW_1_0_FW_FILE,
+                        .otp = QCA4019_HW_1_0_OTP_FILE,
+                        .board = QCA4019_HW_1_0_BOARD_DATA_FILE,
+                        .board_size = QCA4019_BOARD_DATA_SZ,
+                        .board_ext_size = QCA4019_BOARD_EXT_DATA_SZ,
+                },
+        },
 };
 
 static const char *const ath10k_core_fw_feature_str[] = {
@@ -217,6 +247,7 @@ static const char *const ath10k_core_fw_feature_str[] = {
         [ATH10K_FW_FEATURE_RAW_MODE_SUPPORT] = "raw-mode",
         [ATH10K_FW_FEATURE_SUPPORTS_ADAPTIVE_CCA] = "adaptive-cca",
         [ATH10K_FW_FEATURE_MFP_SUPPORT] = "mfp",
+        [ATH10K_FW_FEATURE_PEER_FLOW_CONTROL] = "peer-flow-ctrl",
 };
 
 static unsigned int ath10k_core_get_fw_feature_str(char *buf,
@@ -1478,8 +1509,13 @@ static int ath10k_core_init_firmware_features(struct ath10k *ar)
         case ATH10K_FW_WMI_OP_VERSION_10_1:
         case ATH10K_FW_WMI_OP_VERSION_10_2:
         case ATH10K_FW_WMI_OP_VERSION_10_2_4:
-                ar->max_num_peers = TARGET_10X_NUM_PEERS;
-                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
+                if (test_bit(WMI_SERVICE_PEER_STATS, ar->wmi.svc_map)) {
+                        ar->max_num_peers = TARGET_10X_TX_STATS_NUM_PEERS;
+                        ar->max_num_stations = TARGET_10X_TX_STATS_NUM_STATIONS;
+                } else {
+                        ar->max_num_peers = TARGET_10X_NUM_PEERS;
+                        ar->max_num_stations = TARGET_10X_NUM_STATIONS;
+                }
                 ar->max_num_vdevs = TARGET_10X_NUM_VDEVS;
                 ar->htt.max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
                 ar->fw_stats_req_mask = WMI_STAT_PEER;
@@ -1502,9 +1538,9 @@ static int ath10k_core_init_firmware_features(struct ath10k *ar)
                 ar->num_active_peers = TARGET_10_4_ACTIVE_PEERS;
                 ar->max_num_vdevs = TARGET_10_4_NUM_VDEVS;
                 ar->num_tids = TARGET_10_4_TGT_NUM_TIDS;
-                ar->htt.max_num_pending_tx = TARGET_10_4_NUM_MSDU_DESC;
+                ar->htt.max_num_pending_tx = ar->hw_params.num_msdu_desc;
                 ar->fw_stats_req_mask = WMI_STAT_PEER;
-                ar->max_spatial_stream = WMI_10_4_MAX_SPATIAL_STREAM;
+                ar->max_spatial_stream = ar->hw_params.max_spatial_stream;
                 break;
         case ATH10K_FW_WMI_OP_VERSION_UNSET:
         case ATH10K_FW_WMI_OP_VERSION_MAX:
@@ -1979,6 +2015,10 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                 ar->regs = &qca99x0_regs;
                 ar->hw_values = &qca99x0_values;
                 break;
+        case ATH10K_HW_QCA4019:
+                ar->regs = &qca4019_regs;
+                ar->hw_values = &qca4019_values;
+                break;
         default:
                 ath10k_err(ar, "unsupported core hardware revision %d\n",
                            hw_rev);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 7840cf3ef7a6..a62b62a62266 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -69,6 +69,7 @@ struct ath10k;
 
 enum ath10k_bus {
         ATH10K_BUS_PCI,
+        ATH10K_BUS_AHB,
 };
 
 static inline const char *ath10k_bus_str(enum ath10k_bus bus)
@@ -76,6 +77,8 @@ static inline const char *ath10k_bus_str(enum ath10k_bus bus)
         switch (bus) {
         case ATH10K_BUS_PCI:
                 return "pci";
+        case ATH10K_BUS_AHB:
+                return "ahb";
         }
 
         return "unknown";
@@ -159,6 +162,7 @@ struct ath10k_fw_stats_peer {
         u32 peer_rssi;
         u32 peer_tx_rate;
         u32 peer_rx_rate; /* 10x only */
+        u32 rx_duration;
 };
 
 struct ath10k_fw_stats_vdev {
@@ -315,6 +319,7 @@ struct ath10k_sta {
 #ifdef CONFIG_MAC80211_DEBUGFS
         /* protected by conf_mutex */
         bool aggr_mode;
+        u64 rx_duration;
 #endif
 };
 
@@ -510,6 +515,15 @@ enum ath10k_fw_features {
         /* Firmware supports management frame protection */
         ATH10K_FW_FEATURE_MFP_SUPPORT = 12,
 
+        /* Firmware supports pull-push model where host shares it's software
+         * queue state with firmware and firmware generates fetch requests
+         * telling host which queues to dequeue tx from.
+         *
+         * Primary function of this is improved MU-MIMO performance with
+         * multiple clients.
+         */
+        ATH10K_FW_FEATURE_PEER_FLOW_CONTROL = 13,
+
         /* keep last */
         ATH10K_FW_FEATURE_COUNT,
 };
@@ -666,6 +680,12 @@ struct ath10k {
                 /* The padding bytes's location is different on various chips */
                 enum ath10k_hw_4addr_pad hw_4addr_pad;
 
+                u32 num_msdu_desc;
+                u32 qcache_active_peers;
+                u32 tx_chain_mask;
+                u32 rx_chain_mask;
+                u32 max_spatial_stream;
+
                 struct ath10k_hw_params_fw {
                         const char *dir;
                         const char *fw;
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 2bdf5408b0d9..076d29b53ddf 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -276,7 +276,7 @@ static const struct file_operations fops_wmi_services = {
         .llseek = default_llseek,
 };
 
-static void ath10k_debug_fw_stats_pdevs_free(struct list_head *head)
+static void ath10k_fw_stats_pdevs_free(struct list_head *head)
 {
         struct ath10k_fw_stats_pdev *i, *tmp;
 
@@ -286,7 +286,7 @@ static void ath10k_debug_fw_stats_pdevs_free(struct list_head *head)
         }
 }
 
-static void ath10k_debug_fw_stats_vdevs_free(struct list_head *head)
+static void ath10k_fw_stats_vdevs_free(struct list_head *head)
 {
         struct ath10k_fw_stats_vdev *i, *tmp;
 
@@ -296,7 +296,7 @@ static void ath10k_debug_fw_stats_vdevs_free(struct list_head *head)
         }
 }
 
-static void ath10k_debug_fw_stats_peers_free(struct list_head *head)
+static void ath10k_fw_stats_peers_free(struct list_head *head)
 {
         struct ath10k_fw_stats_peer *i, *tmp;
 
@@ -310,16 +310,16 @@ static void ath10k_debug_fw_stats_reset(struct ath10k *ar)
 {
         spin_lock_bh(&ar->data_lock);
         ar->debug.fw_stats_done = false;
-        ath10k_debug_fw_stats_pdevs_free(&ar->debug.fw_stats.pdevs);
-        ath10k_debug_fw_stats_vdevs_free(&ar->debug.fw_stats.vdevs);
-        ath10k_debug_fw_stats_peers_free(&ar->debug.fw_stats.peers);
+        ath10k_fw_stats_pdevs_free(&ar->debug.fw_stats.pdevs);
+        ath10k_fw_stats_vdevs_free(&ar->debug.fw_stats.vdevs);
+        ath10k_fw_stats_peers_free(&ar->debug.fw_stats.peers);
         spin_unlock_bh(&ar->data_lock);
 }
 
 void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_fw_stats stats = {};
-        bool is_start, is_started, is_end;
+        bool is_start, is_started, is_end, peer_stats_svc;
         size_t num_peers;
         size_t num_vdevs;
         int ret;
@@ -347,8 +347,14 @@ void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb)
          *     delivered which is treated as end-of-data and is itself discarded
          */
 
+        peer_stats_svc = test_bit(WMI_SERVICE_PEER_STATS, ar->wmi.svc_map);
+        if (peer_stats_svc)
+                ath10k_sta_update_rx_duration(ar, &stats.peers);
+
         if (ar->debug.fw_stats_done) {
-                ath10k_warn(ar, "received unsolicited stats update event\n");
+                if (!peer_stats_svc)
+                        ath10k_warn(ar, "received unsolicited stats update event\n");
+
                 goto free;
         }
 
@@ -372,11 +378,13 @@ void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb)
                         /* Although this is unlikely impose a sane limit to
                          * prevent firmware from DoS-ing the host.
                          */
+                        ath10k_fw_stats_peers_free(&ar->debug.fw_stats.peers);
                         ath10k_warn(ar, "dropping fw peer stats\n");
                         goto free;
                 }
 
                 if (num_vdevs >= BITS_PER_LONG) {
+                        ath10k_fw_stats_vdevs_free(&ar->debug.fw_stats.vdevs);
                         ath10k_warn(ar, "dropping fw vdev stats\n");
                         goto free;
                 }
@@ -391,9 +399,9 @@ free:
         /* In some cases lists have been spliced and cleared. Free up
          * resources if that is not the case.
          */
-        ath10k_debug_fw_stats_pdevs_free(&stats.pdevs);
-        ath10k_debug_fw_stats_vdevs_free(&stats.vdevs);
-        ath10k_debug_fw_stats_peers_free(&stats.peers);
+        ath10k_fw_stats_pdevs_free(&stats.pdevs);
+        ath10k_fw_stats_vdevs_free(&stats.vdevs);
+        ath10k_fw_stats_peers_free(&stats.peers);
 
         spin_unlock_bh(&ar->data_lock);
 }
@@ -2106,6 +2114,7 @@ static ssize_t ath10k_write_btcoex(struct file *file,
         struct ath10k *ar = file->private_data;
         char buf[32];
         size_t buf_size;
+        int ret = 0;
         bool val;
 
         buf_size = min(count, (sizeof(buf) - 1));
@@ -2119,6 +2128,12 @@ static ssize_t ath10k_write_btcoex(struct file *file,
 
         mutex_lock(&ar->conf_mutex);
 
+        if (ar->state != ATH10K_STATE_ON &&
+            ar->state != ATH10K_STATE_RESTARTED) {
+                ret = -ENETDOWN;
+                goto exit;
+        }
+
         if (!(test_bit(ATH10K_FLAG_BTCOEX, &ar->dev_flags) ^ val))
                 goto exit;
 
@@ -2127,17 +2142,15 @@ static ssize_t ath10k_write_btcoex(struct file *file,
         else
                 clear_bit(ATH10K_FLAG_BTCOEX, &ar->dev_flags);
 
-        if (ar->state != ATH10K_STATE_ON)
-                goto exit;
-
         ath10k_info(ar, "restarting firmware due to btcoex change");
 
         queue_work(ar->workqueue, &ar->restart_work);
+        ret = count;
 
 exit:
         mutex_unlock(&ar->conf_mutex);
 
-        return count;
+        return ret;
 }
 
 static ssize_t ath10k_read_btcoex(struct file *file, char __user *ubuf,
@@ -2176,9 +2189,6 @@ static ssize_t ath10k_debug_fw_checksums_read(struct file *file,
 
         mutex_lock(&ar->conf_mutex);
 
-        if (len > buf_len)
-                len = buf_len;
-
         len += scnprintf(buf + len, buf_len - len,
                          "firmware-N.bin\t\t%08x\n",
                          crc32_le(0, ar->firmware->data, ar->firmware->size));
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 814719cf4f22..6206edd7c49f 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -37,6 +37,7 @@ enum ath10k_debug_mask {
         ATH10K_DBG_TESTMODE     = 0x00001000,
         ATH10K_DBG_WMI_PRINT    = 0x00002000,
         ATH10K_DBG_PCI_PS       = 0x00004000,
+        ATH10K_DBG_AHB          = 0x00008000,
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
@@ -153,6 +154,12 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, struct dentry *dir);
+void ath10k_sta_update_rx_duration(struct ath10k *ar, struct list_head *peer);
+#else
+static inline void ath10k_sta_update_rx_duration(struct ath10k *ar,
+                                                 struct list_head *peer)
+{
+}
 #endif /* CONFIG_MAC80211_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
index 95b5c49374e0..67ef75b60567 100644
--- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c
+++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
@@ -18,6 +18,23 @@
 #include "wmi-ops.h"
 #include "debug.h"
 
+void ath10k_sta_update_rx_duration(struct ath10k *ar, struct list_head *head)
+{       struct ieee80211_sta *sta;
+        struct ath10k_fw_stats_peer *peer;
+        struct ath10k_sta *arsta;
+
+        rcu_read_lock();
+        list_for_each_entry(peer, head, list) {
+                sta = ieee80211_find_sta_by_ifaddr(ar->hw, peer->peer_macaddr,
+                                                   NULL);
+                if (!sta)
+                        continue;
+                arsta = (struct ath10k_sta *)sta->drv_priv;
+                arsta->rx_duration += (u64)peer->rx_duration;
+        }
+        rcu_read_unlock();
+}
+
 static ssize_t ath10k_dbg_sta_read_aggr_mode(struct file *file,
                                              char __user *user_buf,
                                              size_t count, loff_t *ppos)
@@ -232,6 +249,28 @@ static const struct file_operations fops_delba = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_dbg_sta_read_rx_duration(struct file *file,
+                                               char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        char buf[100];
+        int len = 0;
+
+        len = scnprintf(buf, sizeof(buf),
+                        "%llu usecs\n", arsta->rx_duration);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_rx_duration = {
+        .read = ath10k_dbg_sta_read_rx_duration,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, struct dentry *dir)
 {
@@ -240,4 +279,6 @@ void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         debugfs_create_file("addba", S_IWUSR, dir, sta, &fops_addba);
         debugfs_create_file("addba_resp", S_IWUSR, dir, sta, &fops_addba_resp);
         debugfs_create_file("delba", S_IWUSR, dir, sta, &fops_delba);
+        debugfs_create_file("rx_duration", S_IRUGO, dir, sta,
+                            &fops_rx_duration);
 }
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 3e6ba63dfdff..7561f22f10f9 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -131,12 +131,12 @@ static const enum htt_t2h_msg_type htt_10_4_t2h_msg_types[] = {
         [HTT_10_4_T2H_MSG_TYPE_AGGR_CONF] = HTT_T2H_MSG_TYPE_AGGR_CONF,
         [HTT_10_4_T2H_MSG_TYPE_TX_FETCH_IND] =
                                 HTT_T2H_MSG_TYPE_TX_FETCH_IND,
-        [HTT_10_4_T2H_MSG_TYPE_TX_FETCH_CONF] =
-                                HTT_T2H_MSG_TYPE_TX_FETCH_CONF,
+        [HTT_10_4_T2H_MSG_TYPE_TX_FETCH_CONFIRM] =
+                                HTT_T2H_MSG_TYPE_TX_FETCH_CONFIRM,
         [HTT_10_4_T2H_MSG_TYPE_STATS_NOUPLOAD] =
                                 HTT_T2H_MSG_TYPE_STATS_NOUPLOAD,
-        [HTT_10_4_T2H_MSG_TYPE_TX_LOW_LATENCY_IND] =
-                                HTT_T2H_MSG_TYPE_TX_LOW_LATENCY_IND,
+        [HTT_10_4_T2H_MSG_TYPE_TX_MODE_SWITCH_IND] =
+                                HTT_T2H_MSG_TYPE_TX_MODE_SWITCH_IND,
 };
 
 int ath10k_htt_connect(struct ath10k_htt *htt)
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 47ca048feaf0..13391ea4422d 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -52,6 +52,7 @@ enum htt_h2t_msg_type { /* host-to-target */
         /* This command is used for sending management frames in HTT < 3.0.
          * HTT >= 3.0 uses TX_FRM for everything. */
         HTT_H2T_MSG_TYPE_MGMT_TX            = 7,
+        HTT_H2T_MSG_TYPE_TX_FETCH_RESP      = 11,
 
         HTT_H2T_NUM_MSGS /* keep this last */
 };
@@ -413,10 +414,10 @@ enum htt_10_4_t2h_msg_type {
         HTT_10_4_T2H_MSG_TYPE_EN_STATS               = 0x14,
         HTT_10_4_T2H_MSG_TYPE_AGGR_CONF              = 0x15,
         HTT_10_4_T2H_MSG_TYPE_TX_FETCH_IND           = 0x16,
-        HTT_10_4_T2H_MSG_TYPE_TX_FETCH_CONF          = 0x17,
+        HTT_10_4_T2H_MSG_TYPE_TX_FETCH_CONFIRM       = 0x17,
         HTT_10_4_T2H_MSG_TYPE_STATS_NOUPLOAD         = 0x18,
         /* 0x19 to 0x2f are reserved */
-        HTT_10_4_T2H_MSG_TYPE_TX_LOW_LATENCY_IND     = 0x30,
+        HTT_10_4_T2H_MSG_TYPE_TX_MODE_SWITCH_IND     = 0x30,
         /* keep this last */
         HTT_10_4_T2H_NUM_MSGS
 };
@@ -449,8 +450,8 @@ enum htt_t2h_msg_type {
         HTT_T2H_MSG_TYPE_TEST,
         HTT_T2H_MSG_TYPE_EN_STATS,
         HTT_T2H_MSG_TYPE_TX_FETCH_IND,
-        HTT_T2H_MSG_TYPE_TX_FETCH_CONF,
-        HTT_T2H_MSG_TYPE_TX_LOW_LATENCY_IND,
+        HTT_T2H_MSG_TYPE_TX_FETCH_CONFIRM,
+        HTT_T2H_MSG_TYPE_TX_MODE_SWITCH_IND,
         /* keep this last */
         HTT_T2H_NUM_MSGS
 };
@@ -1306,9 +1307,43 @@ struct htt_frag_desc_bank_id {
  * so we use a conservatively safe value for now */
 #define HTT_FRAG_DESC_BANK_MAX 4
 
-#define HTT_FRAG_DESC_BANK_CFG_INFO_PDEV_ID_MASK 0x03
-#define HTT_FRAG_DESC_BANK_CFG_INFO_PDEV_ID_LSB  0
-#define HTT_FRAG_DESC_BANK_CFG_INFO_SWAP         (1 << 2)
+#define HTT_FRAG_DESC_BANK_CFG_INFO_PDEV_ID_MASK                0x03
+#define HTT_FRAG_DESC_BANK_CFG_INFO_PDEV_ID_LSB                 0
+#define HTT_FRAG_DESC_BANK_CFG_INFO_SWAP                        BIT(2)
+#define HTT_FRAG_DESC_BANK_CFG_INFO_Q_STATE_VALID               BIT(3)
+#define HTT_FRAG_DESC_BANK_CFG_INFO_Q_STATE_DEPTH_TYPE_MASK     BIT(4)
+#define HTT_FRAG_DESC_BANK_CFG_INFO_Q_STATE_DEPTH_TYPE_LSB      4
+
+enum htt_q_depth_type {
+        HTT_Q_DEPTH_TYPE_BYTES = 0,
+        HTT_Q_DEPTH_TYPE_MSDUS = 1,
+};
+
+#define HTT_TX_Q_STATE_NUM_PEERS                (TARGET_10_4_NUM_QCACHE_PEERS_MAX + \
+                                                 TARGET_10_4_NUM_VDEVS)
+#define HTT_TX_Q_STATE_NUM_TIDS                 8
+#define HTT_TX_Q_STATE_ENTRY_SIZE               1
+#define HTT_TX_Q_STATE_ENTRY_MULTIPLIER         0
+
+/**
+ * htt_q_state_conf - part of htt_frag_desc_bank_cfg for host q state config
+ *
+ * Defines host q state format and behavior. See htt_q_state.
+ *
+ * @record_size: Defines the size of each host q entry in bytes. In practice
+ *      however firmware (at least 10.4.3-00191) ignores this host
+ *      configuration value and uses hardcoded value of 1.
+ * @record_multiplier: This is valid only when q depth type is MSDUs. It
+ *      defines the exponent for the power of 2 multiplication.
+ */
+struct htt_q_state_conf {
+        __le32 paddr;
+        __le16 num_peers;
+        __le16 num_tids;
+        u8 record_size;
+        u8 record_multiplier;
+        u8 pad[2];
+} __packed;
 
 struct htt_frag_desc_bank_cfg {
         u8 info; /* HTT_FRAG_DESC_BANK_CFG_INFO_ */
@@ -1316,6 +1351,114 @@ struct htt_frag_desc_bank_cfg {
         u8 desc_size;
         __le32 bank_base_addrs[HTT_FRAG_DESC_BANK_MAX];
         struct htt_frag_desc_bank_id bank_id[HTT_FRAG_DESC_BANK_MAX];
+        struct htt_q_state_conf q_state;
+} __packed;
+
+#define HTT_TX_Q_STATE_ENTRY_COEFFICIENT        128
+#define HTT_TX_Q_STATE_ENTRY_FACTOR_MASK        0x3f
+#define HTT_TX_Q_STATE_ENTRY_FACTOR_LSB         0
+#define HTT_TX_Q_STATE_ENTRY_EXP_MASK           0xc0
+#define HTT_TX_Q_STATE_ENTRY_EXP_LSB            6
+
+/**
+ * htt_q_state - shared between host and firmware via DMA
+ *
+ * This structure is used for the host to expose it's software queue state to
+ * firmware so that its rate control can schedule fetch requests for optimized
+ * performance. This is most notably used for MU-MIMO aggregation when multiple
+ * MU clients are connected.
+ *
+ * @count: Each element defines the host queue depth. When q depth type was
+ *      configured as HTT_Q_DEPTH_TYPE_BYTES then each entry is defined as:
+ *      FACTOR * 128 * 8^EXP (see HTT_TX_Q_STATE_ENTRY_FACTOR_MASK and
+ *      HTT_TX_Q_STATE_ENTRY_EXP_MASK). When q depth type was configured as
+ *      HTT_Q_DEPTH_TYPE_MSDUS the number of packets is scaled by 2 **
+ *      record_multiplier (see htt_q_state_conf).
+ * @map: Used by firmware to quickly check which host queues are not empty. It
+ *      is a bitmap simply saying.
+ * @seq: Used by firmware to quickly check if the host queues were updated
+ *      since it last checked.
+ *
+ * FIXME: Is the q_state map[] size calculation really correct?
+ */
+struct htt_q_state {
+        u8 count[HTT_TX_Q_STATE_NUM_TIDS][HTT_TX_Q_STATE_NUM_PEERS];
+        u32 map[HTT_TX_Q_STATE_NUM_TIDS][(HTT_TX_Q_STATE_NUM_PEERS + 31) / 32];
+        __le32 seq;
+} __packed;
+
+#define HTT_TX_FETCH_RECORD_INFO_PEER_ID_MASK   0x0fff
+#define HTT_TX_FETCH_RECORD_INFO_PEER_ID_LSB    0
+#define HTT_TX_FETCH_RECORD_INFO_TID_MASK       0xf000
+#define HTT_TX_FETCH_RECORD_INFO_TID_LSB        12
+
+struct htt_tx_fetch_record {
+        __le16 info; /* HTT_TX_FETCH_IND_RECORD_INFO_ */
+        __le16 num_msdus;
+        __le32 num_bytes;
+} __packed;
+
+struct htt_tx_fetch_ind {
+        u8 pad0;
+        __le16 fetch_seq_num;
+        __le32 token;
+        __le16 num_resp_ids;
+        __le16 num_records;
+        struct htt_tx_fetch_record records[0];
+        __le32 resp_ids[0]; /* ath10k_htt_get_tx_fetch_ind_resp_ids() */
+} __packed;
+
+static inline void *
+ath10k_htt_get_tx_fetch_ind_resp_ids(struct htt_tx_fetch_ind *ind)
+{
+        return (void *)&ind->records[le16_to_cpu(ind->num_records)];
+}
+
+struct htt_tx_fetch_resp {
+        u8 pad0;
+        __le16 resp_id;
+        __le16 fetch_seq_num;
+        __le16 num_records;
+        __le32 token;
+        struct htt_tx_fetch_record records[0];
+} __packed;
+
+struct htt_tx_fetch_confirm {
+        u8 pad0;
+        __le16 num_resp_ids;
+        __le32 resp_ids[0];
+} __packed;
+
+enum htt_tx_mode_switch_mode {
+        HTT_TX_MODE_SWITCH_PUSH = 0,
+        HTT_TX_MODE_SWITCH_PUSH_PULL = 1,
+};
+
+#define HTT_TX_MODE_SWITCH_IND_INFO0_ENABLE             BIT(0)
+#define HTT_TX_MODE_SWITCH_IND_INFO0_NUM_RECORDS_MASK   0xfffe
+#define HTT_TX_MODE_SWITCH_IND_INFO0_NUM_RECORDS_LSB    1
+
+#define HTT_TX_MODE_SWITCH_IND_INFO1_MODE_MASK          0x0003
+#define HTT_TX_MODE_SWITCH_IND_INFO1_MODE_LSB           0
+#define HTT_TX_MODE_SWITCH_IND_INFO1_THRESHOLD_MASK     0xfffc
+#define HTT_TX_MODE_SWITCH_IND_INFO1_THRESHOLD_LSB      2
+
+#define HTT_TX_MODE_SWITCH_RECORD_INFO0_PEER_ID_MASK    0x0fff
+#define HTT_TX_MODE_SWITCH_RECORD_INFO0_PEER_ID_LSB     0
+#define HTT_TX_MODE_SWITCH_RECORD_INFO0_TID_MASK        0xf000
+#define HTT_TX_MODE_SWITCH_RECORD_INFO0_TID_LSB         12
+
+struct htt_tx_mode_switch_record {
+        __le16 info0; /* HTT_TX_MODE_SWITCH_RECORD_INFO0_ */
+        __le16 num_max_msdus;
+} __packed;
+
+struct htt_tx_mode_switch_ind {
+        u8 pad0;
+        __le16 info0; /* HTT_TX_MODE_SWITCH_IND_INFO0_ */
+        __le16 info1; /* HTT_TX_MODE_SWITCH_IND_INFO1_ */
+        u8 pad1[2];
+        struct htt_tx_mode_switch_record records[0];
 } __packed;
 
 union htt_rx_pn_t {
@@ -1340,6 +1483,7 @@ struct htt_cmd {
                 struct htt_oob_sync_req oob_sync_req;
                 struct htt_aggr_conf aggr_conf;
                 struct htt_frag_desc_bank_cfg frag_desc_bank_cfg;
+                struct htt_tx_fetch_resp tx_fetch_resp;
         };
 } __packed;
 
@@ -1364,6 +1508,9 @@ struct htt_resp {
                 struct htt_rx_pn_ind rx_pn_ind;
                 struct htt_rx_offload_ind rx_offload_ind;
                 struct htt_rx_in_ord_ind rx_in_ord_ind;
+                struct htt_tx_fetch_ind tx_fetch_ind;
+                struct htt_tx_fetch_confirm tx_fetch_confirm;
+                struct htt_tx_mode_switch_ind tx_mode_switch_ind;
         };
 } __packed;
 
@@ -1518,6 +1665,14 @@ struct ath10k_htt {
                 dma_addr_t paddr;
                 struct ath10k_htt_txbuf *vaddr;
         } txbuf;
+
+        struct {
+                struct htt_q_state *vaddr;
+                dma_addr_t paddr;
+                u16 num_peers;
+                u16 num_tids;
+                enum htt_q_depth_type type;
+        } tx_q_state;
 };
 
 #define RX_HTT_HDR_STATUS_LEN 64
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 91afa3ae414c..ae9b686a4e91 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2011,9 +2011,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 break;
         }
         case HTT_T2H_MSG_TYPE_RX_IND:
-                spin_lock_bh(&htt->rx_ring.lock);
-                __skb_queue_tail(&htt->rx_compl_q, skb);
-                spin_unlock_bh(&htt->rx_ring.lock);
+                skb_queue_tail(&htt->rx_compl_q, skb);
                 tasklet_schedule(&htt->txrx_compl_task);
                 return;
         case HTT_T2H_MSG_TYPE_PEER_MAP: {
@@ -2111,9 +2109,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 break;
         }
         case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
-                spin_lock_bh(&htt->rx_ring.lock);
-                __skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
-                spin_unlock_bh(&htt->rx_ring.lock);
+                skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
                 tasklet_schedule(&htt->txrx_compl_task);
                 return;
         }
@@ -2123,10 +2119,12 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case HTT_T2H_MSG_TYPE_AGGR_CONF:
                 break;
-        case HTT_T2H_MSG_TYPE_EN_STATS:
         case HTT_T2H_MSG_TYPE_TX_FETCH_IND:
-        case HTT_T2H_MSG_TYPE_TX_FETCH_CONF:
-        case HTT_T2H_MSG_TYPE_TX_LOW_LATENCY_IND:
+        case HTT_T2H_MSG_TYPE_TX_FETCH_CONFIRM:
+        case HTT_T2H_MSG_TYPE_TX_MODE_SWITCH_IND:
+                /* TODO: Implement pull-push logic */
+                break;
+        case HTT_T2H_MSG_TYPE_EN_STATS:
         default:
                 ath10k_warn(ar, "htt event (%d) not handled\n",
                             resp->hdr.msg_type);
@@ -2143,11 +2141,7 @@ EXPORT_SYMBOL(ath10k_htt_t2h_msg_handler);
 void ath10k_htt_rx_pktlog_completion_handler(struct ath10k *ar,
                                              struct sk_buff *skb)
 {
-        struct ath10k_pktlog_10_4_hdr *hdr =
-                (struct ath10k_pktlog_10_4_hdr *)skb->data;
-
-        trace_ath10k_htt_pktlog(ar, hdr->payload,
-                                sizeof(*hdr) + __le16_to_cpu(hdr->size));
+        trace_ath10k_htt_pktlog(ar, skb->data, skb->len);
         dev_kfree_skb_any(skb);
 }
 EXPORT_SYMBOL(ath10k_htt_rx_pktlog_completion_handler);
@@ -2156,24 +2150,46 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr)
 {
         struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
         struct ath10k *ar = htt->ar;
+        struct sk_buff_head tx_q;
+        struct sk_buff_head rx_q;
+        struct sk_buff_head rx_ind_q;
         struct htt_resp *resp;
         struct sk_buff *skb;
+        unsigned long flags;
+
+        __skb_queue_head_init(&tx_q);
+        __skb_queue_head_init(&rx_q);
+        __skb_queue_head_init(&rx_ind_q);
 
-        while ((skb = skb_dequeue(&htt->tx_compl_q))) {
+        spin_lock_irqsave(&htt->tx_compl_q.lock, flags);
+        skb_queue_splice_init(&htt->tx_compl_q, &tx_q);
+        spin_unlock_irqrestore(&htt->tx_compl_q.lock, flags);
+
+        spin_lock_irqsave(&htt->rx_compl_q.lock, flags);
+        skb_queue_splice_init(&htt->rx_compl_q, &rx_q);
+        spin_unlock_irqrestore(&htt->rx_compl_q.lock, flags);
+
+        spin_lock_irqsave(&htt->rx_in_ord_compl_q.lock, flags);
+        skb_queue_splice_init(&htt->rx_in_ord_compl_q, &rx_ind_q);
+        spin_unlock_irqrestore(&htt->rx_in_ord_compl_q.lock, flags);
+
+        while ((skb = __skb_dequeue(&tx_q))) {
                 ath10k_htt_rx_frm_tx_compl(htt->ar, skb);
                 dev_kfree_skb_any(skb);
         }
 
-        spin_lock_bh(&htt->rx_ring.lock);
-        while ((skb = __skb_dequeue(&htt->rx_compl_q))) {
+        while ((skb = __skb_dequeue(&rx_q))) {
                 resp = (struct htt_resp *)skb->data;
+                spin_lock_bh(&htt->rx_ring.lock);
                 ath10k_htt_rx_handler(htt, &resp->rx_ind);
+                spin_unlock_bh(&htt->rx_ring.lock);
                 dev_kfree_skb_any(skb);
         }
 
-        while ((skb = __skb_dequeue(&htt->rx_in_ord_compl_q))) {
+        while ((skb = __skb_dequeue(&rx_ind_q))) {
+                spin_lock_bh(&htt->rx_ring.lock);
                 ath10k_htt_rx_in_ord_ind(ar, skb);
+                spin_unlock_bh(&htt->rx_ring.lock);
                 dev_kfree_skb_any(skb);
         }
-        spin_unlock_bh(&htt->rx_ring.lock);
 }
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index b3adadb5f824..95acb727c068 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -97,6 +97,85 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
         idr_remove(&htt->pending_tx, msdu_id);
 }
 
+static void ath10k_htt_tx_free_cont_frag_desc(struct ath10k_htt *htt)
+{
+        size_t size;
+
+        if (!htt->frag_desc.vaddr)
+                return;
+
+        size = htt->max_num_pending_tx * sizeof(struct htt_msdu_ext_desc);
+
+        dma_free_coherent(htt->ar->dev,
+                          size,
+                          htt->frag_desc.vaddr,
+                          htt->frag_desc.paddr);
+}
+
+static int ath10k_htt_tx_alloc_cont_frag_desc(struct ath10k_htt *htt)
+{
+        struct ath10k *ar = htt->ar;
+        size_t size;
+
+        if (!ar->hw_params.continuous_frag_desc)
+                return 0;
+
+        size = htt->max_num_pending_tx * sizeof(struct htt_msdu_ext_desc);
+        htt->frag_desc.vaddr = dma_alloc_coherent(ar->dev, size,
+                                                  &htt->frag_desc.paddr,
+                                                  GFP_KERNEL);
+        if (!htt->frag_desc.vaddr) {
+                ath10k_err(ar, "failed to alloc fragment desc memory\n");
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static void ath10k_htt_tx_free_txq(struct ath10k_htt *htt)
+{
+        struct ath10k *ar = htt->ar;
+        size_t size;
+
+        if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL, ar->fw_features))
+                return;
+
+        size = sizeof(*htt->tx_q_state.vaddr);
+
+        dma_unmap_single(ar->dev, htt->tx_q_state.paddr, size, DMA_TO_DEVICE);
+        kfree(htt->tx_q_state.vaddr);
+}
+
+static int ath10k_htt_tx_alloc_txq(struct ath10k_htt *htt)
+{
+        struct ath10k *ar = htt->ar;
+        size_t size;
+        int ret;
+
+        if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL, ar->fw_features))
+                return 0;
+
+        htt->tx_q_state.num_peers = HTT_TX_Q_STATE_NUM_PEERS;
+        htt->tx_q_state.num_tids = HTT_TX_Q_STATE_NUM_TIDS;
+        htt->tx_q_state.type = HTT_Q_DEPTH_TYPE_BYTES;
+
+        size = sizeof(*htt->tx_q_state.vaddr);
+        htt->tx_q_state.vaddr = kzalloc(size, GFP_KERNEL);
+        if (!htt->tx_q_state.vaddr)
+                return -ENOMEM;
+
+        htt->tx_q_state.paddr = dma_map_single(ar->dev, htt->tx_q_state.vaddr,
+                                               size, DMA_TO_DEVICE);
+        ret = dma_mapping_error(ar->dev, htt->tx_q_state.paddr);
+        if (ret) {
+                ath10k_warn(ar, "failed to dma map tx_q_state: %d\n", ret);
+                kfree(htt->tx_q_state.vaddr);
+                return -EIO;
+        }
+
+        return 0;
+}
+
 int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
@@ -118,29 +197,32 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
                 goto free_idr_pending_tx;
         }
 
-        if (!ar->hw_params.continuous_frag_desc)
-                goto skip_frag_desc_alloc;
-
-        size = htt->max_num_pending_tx * sizeof(struct htt_msdu_ext_desc);
-        htt->frag_desc.vaddr = dma_alloc_coherent(ar->dev, size,
-                                                  &htt->frag_desc.paddr,
-                                                  GFP_KERNEL);
-        if (!htt->frag_desc.vaddr) {
-                ath10k_warn(ar, "failed to alloc fragment desc memory\n");
-                ret = -ENOMEM;
+        ret = ath10k_htt_tx_alloc_cont_frag_desc(htt);
+        if (ret) {
+                ath10k_err(ar, "failed to alloc cont frag desc: %d\n", ret);
                 goto free_txbuf;
         }
 
-skip_frag_desc_alloc:
+        ret = ath10k_htt_tx_alloc_txq(htt);
+        if (ret) {
+                ath10k_err(ar, "failed to alloc txq: %d\n", ret);
+                goto free_frag_desc;
+        }
+
         return 0;
 
+free_frag_desc:
+        ath10k_htt_tx_free_cont_frag_desc(htt);
+
 free_txbuf:
         size = htt->max_num_pending_tx *
                           sizeof(struct ath10k_htt_txbuf);
         dma_free_coherent(htt->ar->dev, size, htt->txbuf.vaddr,
                           htt->txbuf.paddr);
+
 free_idr_pending_tx:
         idr_destroy(&htt->pending_tx);
+
         return ret;
 }
 
@@ -174,12 +256,8 @@ void ath10k_htt_tx_free(struct ath10k_htt *htt)
                                   htt->txbuf.paddr);
         }
 
-        if (htt->frag_desc.vaddr) {
-                size = htt->max_num_pending_tx *
-                                  sizeof(struct htt_msdu_ext_desc);
-                dma_free_coherent(htt->ar->dev, size, htt->frag_desc.vaddr,
-                                  htt->frag_desc.paddr);
-        }
+        ath10k_htt_tx_free_txq(htt);
+        ath10k_htt_tx_free_cont_frag_desc(htt);
 }
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
@@ -268,7 +346,9 @@ int ath10k_htt_send_frag_desc_bank_cfg(struct ath10k_htt *htt)
         struct ath10k *ar = htt->ar;
         struct sk_buff *skb;
         struct htt_cmd *cmd;
+        struct htt_frag_desc_bank_cfg *cfg;
         int ret, size;
+        u8 info;
 
         if (!ar->hw_params.continuous_frag_desc)
                 return 0;
@@ -286,14 +366,30 @@ int ath10k_htt_send_frag_desc_bank_cfg(struct ath10k_htt *htt)
         skb_put(skb, size);
         cmd = (struct htt_cmd *)skb->data;
         cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_FRAG_DESC_BANK_CFG;
-        cmd->frag_desc_bank_cfg.info = 0;
-        cmd->frag_desc_bank_cfg.num_banks = 1;
-        cmd->frag_desc_bank_cfg.desc_size = sizeof(struct htt_msdu_ext_desc);
-        cmd->frag_desc_bank_cfg.bank_base_addrs[0] =
-                                __cpu_to_le32(htt->frag_desc.paddr);
-        cmd->frag_desc_bank_cfg.bank_id[0].bank_min_id = 0;
-        cmd->frag_desc_bank_cfg.bank_id[0].bank_max_id =
-                                __cpu_to_le16(htt->max_num_pending_tx - 1);
+
+        info = 0;
+        info |= SM(htt->tx_q_state.type,
+                   HTT_FRAG_DESC_BANK_CFG_INFO_Q_STATE_DEPTH_TYPE);
+
+        if (test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL, ar->fw_features))
+                info |= HTT_FRAG_DESC_BANK_CFG_INFO_Q_STATE_VALID;
+
+        cfg = &cmd->frag_desc_bank_cfg;
+        cfg->info = info;
+        cfg->num_banks = 1;
+        cfg->desc_size = sizeof(struct htt_msdu_ext_desc);
+        cfg->bank_base_addrs[0] = __cpu_to_le32(htt->frag_desc.paddr);
+        cfg->bank_id[0].bank_min_id = 0;
+        cfg->bank_id[0].bank_max_id = __cpu_to_le16(htt->max_num_pending_tx -
+                                                    1);
+
+        cfg->q_state.paddr = cpu_to_le32(htt->tx_q_state.paddr);
+        cfg->q_state.num_peers = cpu_to_le16(htt->tx_q_state.num_peers);
+        cfg->q_state.num_tids = cpu_to_le16(htt->tx_q_state.num_tids);
+        cfg->q_state.record_size = HTT_TX_Q_STATE_ENTRY_SIZE;
+        cfg->q_state.record_multiplier = HTT_TX_Q_STATE_ENTRY_MULTIPLIER;
+
+        ath10k_dbg(ar, ATH10K_DBG_HTT, "htt frag desc bank cmd\n");
 
         ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 7b84d08a5154..f544d48518c3 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -109,6 +109,38 @@ const struct ath10k_hw_regs qca99x0_regs = {
         .pcie_intr_clr_address                  = 0x00000010,
 };
 
+const struct ath10k_hw_regs qca4019_regs = {
+        .rtc_soc_base_address                   = 0x00080000,
+        .soc_core_base_address                  = 0x00082000,
+        .ce_wrapper_base_address                = 0x0004d000,
+        .ce0_base_address                       = 0x0004a000,
+        .ce1_base_address                       = 0x0004a400,
+        .ce2_base_address                       = 0x0004a800,
+        .ce3_base_address                       = 0x0004ac00,
+        .ce4_base_address                       = 0x0004b000,
+        .ce5_base_address                       = 0x0004b400,
+        .ce6_base_address                       = 0x0004b800,
+        .ce7_base_address                       = 0x0004bc00,
+        /* qca4019 supports upto 12 copy engines. Since base address
+         * of ce8 to ce11 are not directly referred in the code,
+         * no need have them in separate members in this table.
+         *      Copy Engine             Address
+         *      CE8                     0x0004c000
+         *      CE9                     0x0004c400
+         *      CE10                    0x0004c800
+         *      CE11                    0x0004cc00
+         */
+        .soc_reset_control_si0_rst_mask         = 0x00000001,
+        .soc_reset_control_ce_rst_mask          = 0x00000100,
+        .soc_chip_id_address                    = 0x000000ec,
+        .fw_indicator_address                   = 0x0004f00c,
+        .ce_wrap_intr_sum_host_msi_lsb          = 0x0000000c,
+        .ce_wrap_intr_sum_host_msi_mask         = 0x00fff000,
+        .pcie_intr_fw_mask                      = 0x00100000,
+        .pcie_intr_ce_mask_all                  = 0x000fff00,
+        .pcie_intr_clr_address                  = 0x00000010,
+};
+
 const struct ath10k_hw_values qca988x_values = {
         .rtc_state_val_on               = 3,
         .ce_count                       = 8,
@@ -136,6 +168,13 @@ const struct ath10k_hw_values qca99x0_values = {
         .ce_desc_meta_data_lsb          = 4,
 };
 
+const struct ath10k_hw_values qca4019_values = {
+        .ce_count                       = 12,
+        .num_target_ce_config_wlan      = 10,
+        .ce_desc_meta_data_mask         = 0xFFF0,
+        .ce_desc_meta_data_lsb          = 4,
+};
+
 void ath10k_hw_fill_survey_time(struct ath10k *ar, struct survey_info *survey,
                                 u32 cc, u32 rcc, u32 cc_prev, u32 rcc_prev)
 {
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 0678831e8671..f0cfbc745c97 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -106,6 +106,14 @@ enum qca9377_chip_id_rev {
 #define QCA9377_HW_1_0_BOARD_DATA_FILE "board.bin"
 #define QCA9377_HW_1_0_PATCH_LOAD_ADDR  0x1234
 
+/* QCA4019 1.0 definitions */
+#define QCA4019_HW_1_0_DEV_VERSION     0x01000000
+#define QCA4019_HW_1_0_FW_DIR          ATH10K_FW_DIR "/QCA4019/hw1.0"
+#define QCA4019_HW_1_0_FW_FILE         "firmware.bin"
+#define QCA4019_HW_1_0_OTP_FILE        "otp.bin"
+#define QCA4019_HW_1_0_BOARD_DATA_FILE "board.bin"
+#define QCA4019_HW_1_0_PATCH_LOAD_ADDR  0x1234
+
 #define ATH10K_FW_API2_FILE             "firmware-2.bin"
 #define ATH10K_FW_API3_FILE             "firmware-3.bin"
 
@@ -200,6 +208,7 @@ enum ath10k_hw_rev {
         ATH10K_HW_QCA6174,
         ATH10K_HW_QCA99X0,
         ATH10K_HW_QCA9377,
+        ATH10K_HW_QCA4019,
 };
 
 struct ath10k_hw_regs {
@@ -232,6 +241,7 @@ struct ath10k_hw_regs {
 extern const struct ath10k_hw_regs qca988x_regs;
 extern const struct ath10k_hw_regs qca6174_regs;
 extern const struct ath10k_hw_regs qca99x0_regs;
+extern const struct ath10k_hw_regs qca4019_regs;
 
 struct ath10k_hw_values {
         u32 rtc_state_val_on;
@@ -245,6 +255,7 @@ struct ath10k_hw_values {
 extern const struct ath10k_hw_values qca988x_values;
 extern const struct ath10k_hw_values qca6174_values;
 extern const struct ath10k_hw_values qca99x0_values;
+extern const struct ath10k_hw_values qca4019_values;
 
 void ath10k_hw_fill_survey_time(struct ath10k *ar, struct survey_info *survey,
                                 u32 cc, u32 rcc, u32 cc_prev, u32 rcc_prev);
@@ -253,6 +264,7 @@ void ath10k_hw_fill_survey_time(struct ath10k *ar, struct survey_info *survey,
 #define QCA_REV_6174(ar) ((ar)->hw_rev == ATH10K_HW_QCA6174)
 #define QCA_REV_99X0(ar) ((ar)->hw_rev == ATH10K_HW_QCA99X0)
 #define QCA_REV_9377(ar) ((ar)->hw_rev == ATH10K_HW_QCA9377)
+#define QCA_REV_40XX(ar) ((ar)->hw_rev == ATH10K_HW_QCA4019)
 
 /* Known pecularities:
  *  - raw appears in nwifi decap, raw and nwifi appear in ethernet decap
@@ -363,14 +375,19 @@ enum ath10k_hw_4addr_pad {
 #define TARGET_10X_MAC_AGGR_DELIM               0
 #define TARGET_10X_AST_SKID_LIMIT               128
 #define TARGET_10X_NUM_STATIONS                 128
+#define TARGET_10X_TX_STATS_NUM_STATIONS        118
 #define TARGET_10X_NUM_PEERS                    ((TARGET_10X_NUM_STATIONS) + \
                                                  (TARGET_10X_NUM_VDEVS))
+#define TARGET_10X_TX_STATS_NUM_PEERS           ((TARGET_10X_TX_STATS_NUM_STATIONS) + \
+                                                 (TARGET_10X_NUM_VDEVS))
 #define TARGET_10X_NUM_OFFLOAD_PEERS            0
 #define TARGET_10X_NUM_OFFLOAD_REORDER_BUFS     0
 #define TARGET_10X_NUM_PEER_KEYS                2
 #define TARGET_10X_NUM_TIDS_MAX                 256
 #define TARGET_10X_NUM_TIDS                     min((TARGET_10X_NUM_TIDS_MAX), \
                                                     (TARGET_10X_NUM_PEERS) * 2)
+#define TARGET_10X_TX_STATS_NUM_TIDS            min((TARGET_10X_NUM_TIDS_MAX), \
+                                                    (TARGET_10X_TX_STATS_NUM_PEERS) * 2)
 #define TARGET_10X_TX_CHAIN_MASK                (BIT(0) | BIT(1) | BIT(2))
 #define TARGET_10X_RX_CHAIN_MASK                (BIT(0) | BIT(1) | BIT(2))
 #define TARGET_10X_RX_TIMEOUT_LO_PRI            100
@@ -414,16 +431,11 @@ enum ath10k_hw_4addr_pad {
 #define TARGET_10_4_ACTIVE_PEERS                0
 
 #define TARGET_10_4_NUM_QCACHE_PEERS_MAX        512
-#define TARGET_10_4_QCACHE_ACTIVE_PEERS         50
 #define TARGET_10_4_NUM_OFFLOAD_PEERS           0
 #define TARGET_10_4_NUM_OFFLOAD_REORDER_BUFFS   0
 #define TARGET_10_4_NUM_PEER_KEYS               2
 #define TARGET_10_4_TGT_NUM_TIDS                ((TARGET_10_4_NUM_PEERS) * 2)
 #define TARGET_10_4_AST_SKID_LIMIT              32
-#define TARGET_10_4_TX_CHAIN_MASK               (BIT(0) | BIT(1) | \
-                                                 BIT(2) | BIT(3))
-#define TARGET_10_4_RX_CHAIN_MASK               (BIT(0) | BIT(1) | \
-                                                 BIT(2) | BIT(3))
 
 /* 100 ms for video, best-effort, and background */
 #define TARGET_10_4_RX_TIMEOUT_LO_PRI           100
@@ -449,7 +461,6 @@ enum ath10k_hw_4addr_pad {
 #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
 #define TARGET_10_4_VOW_CONFIG                  0
 #define TARGET_10_4_GTK_OFFLOAD_MAX_VDEV        3
-#define TARGET_10_4_NUM_MSDU_DESC               (1024 + 400)
 #define TARGET_10_4_11AC_TX_MAX_FRAGS           2
 #define TARGET_10_4_MAX_PEER_EXT_STATS          16
 #define TARGET_10_4_SMART_ANT_CAP               0
@@ -601,6 +612,7 @@ enum ath10k_hw_4addr_pad {
 #define FW_INDICATOR_ADDRESS                    ar->regs->fw_indicator_address
 #define FW_IND_EVENT_PENDING                    1
 #define FW_IND_INITIALIZED                      2
+#define FW_IND_HOST_READY                       0x80000000
 
 /* HOST_REG interrupt from firmware */
 #define PCIE_INTR_FIRMWARE_MASK                 ar->regs->pcie_intr_fw_mask
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 368de5e5a04f..78999c9de23b 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1358,10 +1358,7 @@ static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
         const u8 *p2p_ie;
         int ret;
 
-        if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
-                return 0;
-
-        if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+        if (arvif->vif->type != NL80211_IFTYPE_AP || !arvif->vif->p2p)
                 return 0;
 
         mgmt = (void *)bcn->data;
@@ -3259,8 +3256,7 @@ static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
 
         /* This is case only for P2P_GO */
-        if (arvif->vdev_type != WMI_VDEV_TYPE_AP ||
-            arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+        if (vif->type != NL80211_IFTYPE_AP || !vif->p2p)
                 return;
 
         if (unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
@@ -3988,7 +3984,7 @@ static int ath10k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
 static int ath10k_start(struct ieee80211_hw *hw)
 {
         struct ath10k *ar = hw->priv;
-        u32 burst_enable;
+        u32 param;
         int ret = 0;
 
         /*
@@ -4031,13 +4027,15 @@ static int ath10k_start(struct ieee80211_hw *hw)
                 goto err_power_down;
         }
 
-        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->pmf_qos, 1);
+        param = ar->wmi.pdev_param->pmf_qos;
+        ret = ath10k_wmi_pdev_set_param(ar, param, 1);
         if (ret) {
                 ath10k_warn(ar, "failed to enable PMF QOS: %d\n", ret);
                 goto err_core_stop;
         }
 
-        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 1);
+        param = ar->wmi.pdev_param->dynamic_bw;
+        ret = ath10k_wmi_pdev_set_param(ar, param, 1);
         if (ret) {
                 ath10k_warn(ar, "failed to enable dynamic BW: %d\n", ret);
                 goto err_core_stop;
@@ -4053,8 +4051,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
         }
 
         if (test_bit(WMI_SERVICE_BURST, ar->wmi.svc_map)) {
-                burst_enable = ar->wmi.pdev_param->burst_enable;
-                ret = ath10k_wmi_pdev_set_param(ar, burst_enable, 0);
+                param = ar->wmi.pdev_param->burst_enable;
+                ret = ath10k_wmi_pdev_set_param(ar, param, 0);
                 if (ret) {
                         ath10k_warn(ar, "failed to disable burst: %d\n", ret);
                         goto err_core_stop;
@@ -4072,8 +4070,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
          * this problem.
          */
 
-        ret = ath10k_wmi_pdev_set_param(ar,
-                                        ar->wmi.pdev_param->arp_ac_override, 0);
+        param = ar->wmi.pdev_param->arp_ac_override;
+        ret = ath10k_wmi_pdev_set_param(ar, param, 0);
         if (ret) {
                 ath10k_warn(ar, "failed to set arp ac override parameter: %d\n",
                             ret);
@@ -4092,8 +4090,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
                 }
         }
 
-        ret = ath10k_wmi_pdev_set_param(ar,
-                                        ar->wmi.pdev_param->ani_enable, 1);
+        param = ar->wmi.pdev_param->ani_enable;
+        ret = ath10k_wmi_pdev_set_param(ar, param, 1);
         if (ret) {
                 ath10k_warn(ar, "failed to enable ani by default: %d\n",
                             ret);
@@ -4102,6 +4100,18 @@ static int ath10k_start(struct ieee80211_hw *hw)
 
         ar->ani_enabled = true;
 
+        if (test_bit(WMI_SERVICE_PEER_STATS, ar->wmi.svc_map)) {
+                param = ar->wmi.pdev_param->peer_stats_update_period;
+                ret = ath10k_wmi_pdev_set_param(ar, param,
+                                                PEER_DEFAULT_STATS_UPDATE_PERIOD);
+                if (ret) {
+                        ath10k_warn(ar,
+                                    "failed to set peer stats period : %d\n",
+                                    ret);
+                        goto err_core_stop;
+                }
+        }
+
         ar->num_started_vdevs = 0;
         ath10k_regd_update(ar);
 
@@ -4349,25 +4359,29 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                    bit, ar->free_vdev_map);
 
         arvif->vdev_id = bit;
-        arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
+        arvif->vdev_subtype =
+                ath10k_wmi_get_vdev_subtype(ar, WMI_VDEV_SUBTYPE_NONE);
 
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
                 arvif->vdev_type = WMI_VDEV_TYPE_STA;
-                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
+                arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                        (ar, WMI_VDEV_SUBTYPE_P2P_DEVICE);
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
                 arvif->vdev_type = WMI_VDEV_TYPE_STA;
                 if (vif->p2p)
-                        arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_CLIENT;
+                        arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                        (ar, WMI_VDEV_SUBTYPE_P2P_CLIENT);
                 break;
         case NL80211_IFTYPE_ADHOC:
                 arvif->vdev_type = WMI_VDEV_TYPE_IBSS;
                 break;
         case NL80211_IFTYPE_MESH_POINT:
-                if (test_bit(WMI_SERVICE_MESH, ar->wmi.svc_map)) {
-                        arvif->vdev_subtype = WMI_VDEV_SUBTYPE_MESH;
+                if (test_bit(WMI_SERVICE_MESH_11S, ar->wmi.svc_map)) {
+                        arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                                (ar, WMI_VDEV_SUBTYPE_MESH_11S);
                 } else if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
                         ret = -EINVAL;
                         ath10k_warn(ar, "must load driver with rawmode=1 to add mesh interfaces\n");
@@ -4379,7 +4393,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 arvif->vdev_type = WMI_VDEV_TYPE_AP;
 
                 if (vif->p2p)
-                        arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
+                        arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                                (ar, WMI_VDEV_SUBTYPE_P2P_GO);
                 break;
         case NL80211_IFTYPE_MONITOR:
                 arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index ee925c618535..b3cff1d3364a 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -94,7 +94,6 @@ static const struct ath10k_pci_supp_chip ath10k_pci_supp_chips[] = {
 static void ath10k_pci_buffer_cleanup(struct ath10k *ar);
 static int ath10k_pci_cold_reset(struct ath10k *ar);
 static int ath10k_pci_safe_chip_reset(struct ath10k *ar);
-static int ath10k_pci_wait_for_target_init(struct ath10k *ar);
 static int ath10k_pci_init_irq(struct ath10k *ar);
 static int ath10k_pci_deinit_irq(struct ath10k *ar);
 static int ath10k_pci_request_irq(struct ath10k *ar);
@@ -620,7 +619,7 @@ static void ath10k_pci_sleep_sync(struct ath10k *ar)
         spin_unlock_irqrestore(&ar_pci->ps_lock, flags);
 }
 
-void ath10k_pci_write32(struct ath10k *ar, u32 offset, u32 value)
+static void ath10k_bus_pci_write32(struct ath10k *ar, u32 offset, u32 value)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret;
@@ -642,7 +641,7 @@ void ath10k_pci_write32(struct ath10k *ar, u32 offset, u32 value)
         ath10k_pci_sleep(ar);
 }
 
-u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
+static u32 ath10k_bus_pci_read32(struct ath10k *ar, u32 offset)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         u32 val;
@@ -667,6 +666,20 @@ u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
         return val;
 }
 
+inline void ath10k_pci_write32(struct ath10k *ar, u32 offset, u32 value)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        ar_pci->bus_ops->write32(ar, offset, value);
+}
+
+inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        return ar_pci->bus_ops->read32(ar, offset);
+}
+
 u32 ath10k_pci_soc_read32(struct ath10k *ar, u32 addr)
 {
         return ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS + addr);
@@ -687,7 +700,7 @@ void ath10k_pci_reg_write32(struct ath10k *ar, u32 addr, u32 val)
         ath10k_pci_write32(ar, PCIE_LOCAL_BASE_ADDRESS + addr, val);
 }
 
-static bool ath10k_pci_irq_pending(struct ath10k *ar)
+bool ath10k_pci_irq_pending(struct ath10k *ar)
 {
         u32 cause;
 
@@ -700,7 +713,7 @@ static bool ath10k_pci_irq_pending(struct ath10k *ar)
         return false;
 }
 
-static void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar)
+void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar)
 {
         /* IMPORTANT: INTR_CLR register has to be set after
          * INTR_ENABLE is set to 0, otherwise interrupt can not be
@@ -716,7 +729,7 @@ static void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar)
                                 PCIE_INTR_ENABLE_ADDRESS);
 }
 
-static void ath10k_pci_enable_legacy_irq(struct ath10k *ar)
+void ath10k_pci_enable_legacy_irq(struct ath10k *ar)
 {
         ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
                            PCIE_INTR_ENABLE_ADDRESS,
@@ -809,7 +822,7 @@ static void ath10k_pci_rx_post_pipe(struct ath10k_pci_pipe *pipe)
         }
 }
 
-static void ath10k_pci_rx_post(struct ath10k *ar)
+void ath10k_pci_rx_post(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int i;
@@ -818,7 +831,7 @@ static void ath10k_pci_rx_post(struct ath10k *ar)
                 ath10k_pci_rx_post_pipe(&ar_pci->pipe_info[i]);
 }
 
-static void ath10k_pci_rx_replenish_retry(unsigned long ptr)
+void ath10k_pci_rx_replenish_retry(unsigned long ptr)
 {
         struct ath10k *ar = (void *)ptr;
 
@@ -838,6 +851,7 @@ static u32 ath10k_pci_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
                        0x7ff) << 21;
                 break;
         case ATH10K_HW_QCA99X0:
+        case ATH10K_HW_QCA4019:
                 val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS);
                 break;
         }
@@ -1007,8 +1021,8 @@ static int __ath10k_pci_diag_read_hi(struct ath10k *ar, void *dest,
 #define ath10k_pci_diag_read_hi(ar, dest, src, len)             \
         __ath10k_pci_diag_read_hi(ar, dest, HI_ITEM(src), len)
 
-static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
-                                     const void *data, int nbytes)
+int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+                              const void *data, int nbytes)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret = 0;
@@ -1263,8 +1277,8 @@ static void ath10k_pci_htt_rx_cb(struct ath10k_ce_pipe *ce_state)
         ath10k_pci_process_rx_cb(ce_state, ath10k_pci_htt_rx_deliver);
 }
 
-static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
-                                struct ath10k_hif_sg_item *items, int n_items)
+int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
+                         struct ath10k_hif_sg_item *items, int n_items)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_pipe *pci_pipe = &ar_pci->pipe_info[pipe_id];
@@ -1332,13 +1346,13 @@ err:
         return err;
 }
 
-static int ath10k_pci_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
-                                    size_t buf_len)
+int ath10k_pci_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                             size_t buf_len)
 {
         return ath10k_pci_diag_read_mem(ar, address, buf, buf_len);
 }
 
-static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
+u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
@@ -1406,8 +1420,8 @@ static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
         queue_work(ar->workqueue, &ar->restart_work);
 }
 
-static void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
-                                               int force)
+void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
+                                        int force)
 {
         ath10k_dbg(ar, ATH10K_DBG_PCI, "pci hif send complete check\n");
 
@@ -1432,7 +1446,7 @@ static void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
         ath10k_ce_per_engine_service(ar, pipe);
 }
 
-static void ath10k_pci_kill_tasklet(struct ath10k *ar)
+void ath10k_pci_kill_tasklet(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int i;
@@ -1446,8 +1460,8 @@ static void ath10k_pci_kill_tasklet(struct ath10k *ar)
         del_timer_sync(&ar_pci->rx_post_retry);
 }
 
-static int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar, u16 service_id,
-                                              u8 *ul_pipe, u8 *dl_pipe)
+int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar, u16 service_id,
+                                       u8 *ul_pipe, u8 *dl_pipe)
 {
         const struct service_to_pipe *entry;
         bool ul_set = false, dl_set = false;
@@ -1491,8 +1505,8 @@ static int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar, u16 service_id,
         return 0;
 }
 
-static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
-                                            u8 *ul_pipe, u8 *dl_pipe)
+void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
+                                     u8 *ul_pipe, u8 *dl_pipe)
 {
         ath10k_dbg(ar, ATH10K_DBG_PCI, "pci hif get default pipe\n");
 
@@ -1516,6 +1530,7 @@ static void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar)
                                    CORE_CTRL_ADDRESS, val);
                 break;
         case ATH10K_HW_QCA99X0:
+        case ATH10K_HW_QCA4019:
                 /* TODO: Find appropriate register configuration for QCA99X0
                  *  to mask irq/MSI.
                  */
@@ -1538,6 +1553,7 @@ static void ath10k_pci_irq_msi_fw_unmask(struct ath10k *ar)
                                    CORE_CTRL_ADDRESS, val);
                 break;
         case ATH10K_HW_QCA99X0:
+        case ATH10K_HW_QCA4019:
                 /* TODO: Find appropriate register configuration for QCA99X0
                  *  to unmask irq/MSI.
                  */
@@ -1668,7 +1684,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
         }
 }
 
-static void ath10k_pci_ce_deinit(struct ath10k *ar)
+void ath10k_pci_ce_deinit(struct ath10k *ar)
 {
         int i;
 
@@ -1676,7 +1692,7 @@ static void ath10k_pci_ce_deinit(struct ath10k *ar)
                 ath10k_ce_deinit_pipe(ar, i);
 }
 
-static void ath10k_pci_flush(struct ath10k *ar)
+void ath10k_pci_flush(struct ath10k *ar)
 {
         ath10k_pci_kill_tasklet(ar);
         ath10k_pci_buffer_cleanup(ar);
@@ -1711,9 +1727,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         spin_unlock_irqrestore(&ar_pci->ps_lock, flags);
 }
 
-static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
-                                           void *req, u32 req_len,
-                                           void *resp, u32 *resp_len)
+int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
+                                    void *req, u32 req_len,
+                                    void *resp, u32 *resp_len)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_pipe *pci_tx = &ar_pci->pipe_info[BMI_CE_NUM_TO_TARG];
@@ -1756,7 +1772,7 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
                                             DMA_FROM_DEVICE);
                 ret = dma_mapping_error(ar->dev, resp_paddr);
                 if (ret) {
-                        ret = EIO;
+                        ret = -EIO;
                         goto err_req;
                 }
 
@@ -1907,7 +1923,14 @@ static int ath10k_pci_get_num_banks(struct ath10k *ar)
         return 1;
 }
 
-static int ath10k_pci_init_config(struct ath10k *ar)
+static int ath10k_bus_get_num_banks(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        return ar_pci->bus_ops->get_num_banks(ar);
+}
+
+int ath10k_pci_init_config(struct ath10k *ar)
 {
         u32 interconnect_targ_addr;
         u32 pcie_state_targ_addr = 0;
@@ -2018,7 +2041,7 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         /* first bank is switched to IRAM */
         ealloc_value |= ((HI_EARLY_ALLOC_MAGIC << HI_EARLY_ALLOC_MAGIC_SHIFT) &
                          HI_EARLY_ALLOC_MAGIC_MASK);
-        ealloc_value |= ((ath10k_pci_get_num_banks(ar) <<
+        ealloc_value |= ((ath10k_bus_get_num_banks(ar) <<
                           HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) &
                          HI_EARLY_ALLOC_IRAM_BANKS_MASK);
 
@@ -2071,7 +2094,7 @@ static void ath10k_pci_override_ce_config(struct ath10k *ar)
         target_service_to_ce_map_wlan[15].pipenum = __cpu_to_le32(1);
 }
 
-static int ath10k_pci_alloc_pipes(struct ath10k *ar)
+int ath10k_pci_alloc_pipes(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_pipe *pipe;
@@ -2102,7 +2125,7 @@ static int ath10k_pci_alloc_pipes(struct ath10k *ar)
         return 0;
 }
 
-static void ath10k_pci_free_pipes(struct ath10k *ar)
+void ath10k_pci_free_pipes(struct ath10k *ar)
 {
         int i;
 
@@ -2110,7 +2133,7 @@ static void ath10k_pci_free_pipes(struct ath10k *ar)
                 ath10k_ce_free_pipe(ar, i);
 }
 
-static int ath10k_pci_init_pipes(struct ath10k *ar)
+int ath10k_pci_init_pipes(struct ath10k *ar)
 {
         int i, ret;
 
@@ -2453,7 +2476,7 @@ err_sleep:
         return ret;
 }
 
-static void ath10k_pci_hif_power_down(struct ath10k *ar)
+void ath10k_pci_hif_power_down(struct ath10k *ar)
 {
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif power down\n");
 
@@ -2722,7 +2745,7 @@ static void ath10k_pci_free_irq(struct ath10k *ar)
                 free_irq(ar_pci->pdev->irq + i, ar);
 }
 
-static void ath10k_pci_init_irq_tasklets(struct ath10k *ar)
+void ath10k_pci_init_irq_tasklets(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int i;
@@ -2808,7 +2831,7 @@ static int ath10k_pci_deinit_irq(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
+int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         unsigned long timeout;
@@ -2989,6 +3012,43 @@ static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)
         return false;
 }
 
+int ath10k_pci_setup_resource(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int ret;
+
+        spin_lock_init(&ar_pci->ce_lock);
+        spin_lock_init(&ar_pci->ps_lock);
+
+        setup_timer(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry,
+                    (unsigned long)ar);
+
+        if (QCA_REV_6174(ar))
+                ath10k_pci_override_ce_config(ar);
+
+        ret = ath10k_pci_alloc_pipes(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
+                           ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+void ath10k_pci_release_resource(struct ath10k *ar)
+{
+        ath10k_pci_kill_tasklet(ar);
+        ath10k_pci_ce_deinit(ar);
+        ath10k_pci_free_pipes(ar);
+}
+
+static const struct ath10k_bus_ops ath10k_pci_bus_ops = {
+        .read32         = ath10k_bus_pci_read32,
+        .write32        = ath10k_bus_pci_write32,
+        .get_num_banks  = ath10k_pci_get_num_banks,
+};
+
 static int ath10k_pci_probe(struct pci_dev *pdev,
                             const struct pci_device_id *pci_dev)
 {
@@ -3039,40 +3099,32 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         ar_pci->ar = ar;
         ar->dev_id = pci_dev->device;
         ar_pci->pci_ps = pci_ps;
+        ar_pci->bus_ops = &ath10k_pci_bus_ops;
 
         ar->id.vendor = pdev->vendor;
         ar->id.device = pdev->device;
         ar->id.subsystem_vendor = pdev->subsystem_vendor;
         ar->id.subsystem_device = pdev->subsystem_device;
 
-        spin_lock_init(&ar_pci->ce_lock);
-        spin_lock_init(&ar_pci->ps_lock);
-
-        setup_timer(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry,
-                    (unsigned long)ar);
         setup_timer(&ar_pci->ps_timer, ath10k_pci_ps_timer,
                     (unsigned long)ar);
 
-        ret = ath10k_pci_claim(ar);
+        ret = ath10k_pci_setup_resource(ar);
         if (ret) {
-                ath10k_err(ar, "failed to claim device: %d\n", ret);
+                ath10k_err(ar, "failed to setup resource: %d\n", ret);
                 goto err_core_destroy;
         }
 
-        if (QCA_REV_6174(ar))
-                ath10k_pci_override_ce_config(ar);
-
-        ret = ath10k_pci_alloc_pipes(ar);
+        ret = ath10k_pci_claim(ar);
         if (ret) {
-                ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
-                           ret);
-                goto err_sleep;
+                ath10k_err(ar, "failed to claim device: %d\n", ret);
+                goto err_free_pipes;
         }
 
         ret = ath10k_pci_force_wake(ar);
         if (ret) {
                 ath10k_warn(ar, "failed to wake up device : %d\n", ret);
-                goto err_free_pipes;
+                goto err_sleep;
         }
 
         ath10k_pci_ce_deinit(ar);
@@ -3081,7 +3133,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         ret = ath10k_pci_init_irq(ar);
         if (ret) {
                 ath10k_err(ar, "failed to init irqs: %d\n", ret);
-                goto err_free_pipes;
+                goto err_sleep;
         }
 
         ath10k_info(ar, "pci irq %s interrupts %d irq_mode %d reset_mode %d\n",
@@ -3127,13 +3179,13 @@ err_free_irq:
 err_deinit_irq:
         ath10k_pci_deinit_irq(ar);
 
-err_free_pipes:
-        ath10k_pci_free_pipes(ar);
-
 err_sleep:
         ath10k_pci_sleep_sync(ar);
         ath10k_pci_release(ar);
 
+err_free_pipes:
+        ath10k_pci_free_pipes(ar);
+
 err_core_destroy:
         ath10k_core_destroy(ar);
 
@@ -3157,10 +3209,8 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
         ath10k_core_unregister(ar);
         ath10k_pci_free_irq(ar);
-        ath10k_pci_kill_tasklet(ar);
         ath10k_pci_deinit_irq(ar);
-        ath10k_pci_ce_deinit(ar);
-        ath10k_pci_free_pipes(ar);
+        ath10k_pci_release_resource(ar);
         ath10k_pci_sleep_sync(ar);
         ath10k_pci_release(ar);
         ath10k_core_destroy(ar);
@@ -3184,6 +3234,10 @@ static int __init ath10k_pci_init(void)
                 printk(KERN_ERR "failed to register ath10k pci driver: %d\n",
                        ret);
 
+        ret = ath10k_ahb_init();
+        if (ret)
+                printk(KERN_ERR "ahb init failed: %d\n", ret);
+
         return ret;
 }
 module_init(ath10k_pci_init);
@@ -3191,6 +3245,7 @@ module_init(ath10k_pci_init);
 static void __exit ath10k_pci_exit(void)
 {
         pci_unregister_driver(&ath10k_pci_driver);
+        ath10k_ahb_exit();
 }
 
 module_exit(ath10k_pci_exit);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index f91bf333cb75..249c73a69800 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -22,6 +22,7 @@
 
 #include "hw.h"
 #include "ce.h"
+#include "ahb.h"
 
 /*
  * maximum number of bytes that can be handled atomically by DiagRead/DiagWrite
@@ -157,6 +158,12 @@ struct ath10k_pci_supp_chip {
         u32 rev_id;
 };
 
+struct ath10k_bus_ops {
+        u32 (*read32)(struct ath10k *ar, u32 offset);
+        void (*write32)(struct ath10k *ar, u32 offset, u32 value);
+        int (*get_num_banks)(struct ath10k *ar);
+};
+
 struct ath10k_pci {
         struct pci_dev *pdev;
         struct device *dev;
@@ -225,6 +232,14 @@ struct ath10k_pci {
          * on MMIO read/write.
          */
         bool pci_ps;
+
+        const struct ath10k_bus_ops *bus_ops;
+
+        /* Keep this entry in the last, memory for struct ath10k_ahb is
+         * allocated (ahb support enabled case) in the continuation of
+         * this struct.
+         */
+        struct ath10k_ahb ahb[0];
 };
 
 static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
@@ -253,6 +268,40 @@ u32 ath10k_pci_read32(struct ath10k *ar, u32 offset);
 u32 ath10k_pci_soc_read32(struct ath10k *ar, u32 addr);
 u32 ath10k_pci_reg_read32(struct ath10k *ar, u32 addr);
 
+int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
+                         struct ath10k_hif_sg_item *items, int n_items);
+int ath10k_pci_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                             size_t buf_len);
+int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+                              const void *data, int nbytes);
+int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar, void *req, u32 req_len,
+                                    void *resp, u32 *resp_len);
+int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar, u16 service_id,
+                                       u8 *ul_pipe, u8 *dl_pipe);
+void ath10k_pci_hif_get_default_pipe(struct ath10k *ar, u8 *ul_pipe,
+                                     u8 *dl_pipe);
+void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
+                                        int force);
+u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe);
+void ath10k_pci_hif_power_down(struct ath10k *ar);
+int ath10k_pci_alloc_pipes(struct ath10k *ar);
+void ath10k_pci_free_pipes(struct ath10k *ar);
+void ath10k_pci_free_pipes(struct ath10k *ar);
+void ath10k_pci_rx_replenish_retry(unsigned long ptr);
+void ath10k_pci_ce_deinit(struct ath10k *ar);
+void ath10k_pci_init_irq_tasklets(struct ath10k *ar);
+void ath10k_pci_kill_tasklet(struct ath10k *ar);
+int ath10k_pci_init_pipes(struct ath10k *ar);
+int ath10k_pci_init_config(struct ath10k *ar);
+void ath10k_pci_rx_post(struct ath10k *ar);
+void ath10k_pci_flush(struct ath10k *ar);
+void ath10k_pci_enable_legacy_irq(struct ath10k *ar);
+bool ath10k_pci_irq_pending(struct ath10k *ar);
+void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar);
+int ath10k_pci_wait_for_target_init(struct ath10k *ar);
+int ath10k_pci_setup_resource(struct ath10k *ar);
+void ath10k_pci_release_resource(struct ath10k *ar);
+
 /* QCA6174 is known to have Tx/Rx issues when SOC_WAKE register is poked too
  * frequently. To avoid this put SoC to sleep after a very conservative grace
  * period. Adjust with great care.
diff --git a/drivers/net/wireless/ath/ath10k/targaddrs.h b/drivers/net/wireless/ath/ath10k/targaddrs.h
index 05a421bc322a..361f143b019c 100644
--- a/drivers/net/wireless/ath/ath10k/targaddrs.h
+++ b/drivers/net/wireless/ath/ath10k/targaddrs.h
@@ -456,4 +456,7 @@ Fw Mode/SubMode Mask
 #define QCA99X0_BOARD_DATA_SZ     12288
 #define QCA99X0_BOARD_EXT_DATA_SZ 0
 
+#define QCA4019_BOARD_DATA_SZ     12064
+#define QCA4019_BOARD_EXT_DATA_SZ 0
+
 #endif /* __TARGADDRS_H__ */
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 71bdb368813d..e0d00cef0bd8 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -250,6 +250,7 @@ TRACE_EVENT(ath10k_wmi_dbglog,
         TP_STRUCT__entry(
                 __string(device, dev_name(ar->dev))
                 __string(driver, dev_driver_string(ar->dev))
+                __field(u8, hw_type);
                 __field(size_t, buf_len)
                 __dynamic_array(u8, buf, buf_len)
         ),
@@ -257,14 +258,16 @@ TRACE_EVENT(ath10k_wmi_dbglog,
         TP_fast_assign(
                 __assign_str(device, dev_name(ar->dev));
                 __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->hw_type = ar->hw_rev;
                 __entry->buf_len = buf_len;
                 memcpy(__get_dynamic_array(buf), buf, buf_len);
         ),
 
         TP_printk(
-                "%s %s len %zu",
+                "%s %s %d len %zu",
                 __get_str(driver),
                 __get_str(device),
+                __entry->hw_type,
                 __entry->buf_len
         )
 );
@@ -277,6 +280,7 @@ TRACE_EVENT(ath10k_htt_pktlog,
         TP_STRUCT__entry(
                 __string(device, dev_name(ar->dev))
                 __string(driver, dev_driver_string(ar->dev))
+                __field(u8, hw_type);
                 __field(u16, buf_len)
                 __dynamic_array(u8, pktlog, buf_len)
         ),
@@ -284,14 +288,16 @@ TRACE_EVENT(ath10k_htt_pktlog,
         TP_fast_assign(
                 __assign_str(device, dev_name(ar->dev));
                 __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->hw_type = ar->hw_rev;
                 __entry->buf_len = buf_len;
                 memcpy(__get_dynamic_array(pktlog), buf, buf_len);
         ),
 
         TP_printk(
-                "%s %s size %hu",
+                "%s %s %d size %hu",
                 __get_str(driver),
                 __get_str(device),
+                __entry->hw_type,
                 __entry->buf_len
          )
 );
@@ -440,6 +446,7 @@ TRACE_EVENT(ath10k_htt_rx_desc,
         TP_STRUCT__entry(
                 __string(device, dev_name(ar->dev))
                 __string(driver, dev_driver_string(ar->dev))
+                __field(u8, hw_type);
                 __field(u16, len)
                 __dynamic_array(u8, rxdesc, len)
         ),
@@ -447,14 +454,16 @@ TRACE_EVENT(ath10k_htt_rx_desc,
         TP_fast_assign(
                 __assign_str(device, dev_name(ar->dev));
                 __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->hw_type = ar->hw_rev;
                 __entry->len = len;
                 memcpy(__get_dynamic_array(rxdesc), data, len);
         ),
 
         TP_printk(
-                "%s %s rxdesc len %d",
+                "%s %s %d rxdesc len %d",
                 __get_str(driver),
                 __get_str(device),
+                __entry->hw_type,
                 __entry->len
          )
 );
diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
index 8f4f6a892581..32ab34edceb5 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
@@ -186,6 +186,8 @@ struct wmi_ops {
                                                         u8 enable,
                                                         u32 detect_level,
                                                         u32 detect_margin);
+        int (*get_vdev_subtype)(struct ath10k *ar,
+                                enum wmi_vdev_subtype subtype);
 };
 
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
@@ -1327,4 +1329,13 @@ ath10k_wmi_pdev_enable_adaptive_cca(struct ath10k *ar, u8 enable,
                                    ar->wmi.cmd->pdev_enable_adaptive_cca_cmdid);
 }
 
+static inline int
+ath10k_wmi_get_vdev_subtype(struct ath10k *ar, enum wmi_vdev_subtype subtype)
+{
+        if (!ar->wmi.ops->get_vdev_subtype)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->get_vdev_subtype(ar, subtype);
+}
+
 #endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 3b3a27b859f3..108593202052 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -3483,6 +3483,7 @@ static const struct wmi_ops wmi_tlv_ops = {
         .gen_tdls_peer_update = ath10k_wmi_tlv_op_gen_tdls_peer_update,
         .gen_adaptive_qcs = ath10k_wmi_tlv_op_gen_adaptive_qcs,
         .fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
+        .get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
 };
 
 static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index a7c3d299639b..70261387d1a5 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -2862,11 +2862,20 @@ static int ath10k_wmi_10_2_4_op_pull_fw_stats(struct ath10k *ar,
         /* fw doesn't implement vdev stats */
 
         for (i = 0; i < num_peer_stats; i++) {
-                const struct wmi_10_2_4_peer_stats *src;
+                const struct wmi_10_2_4_ext_peer_stats *src;
                 struct ath10k_fw_stats_peer *dst;
+                int stats_len;
+                bool ext_peer_stats_support;
+
+                ext_peer_stats_support = test_bit(WMI_SERVICE_PEER_STATS,
+                                                  ar->wmi.svc_map);
+                if (ext_peer_stats_support)
+                        stats_len = sizeof(struct wmi_10_2_4_ext_peer_stats);
+                else
+                        stats_len = sizeof(struct wmi_10_2_4_peer_stats);
 
                 src = (void *)skb->data;
-                if (!skb_pull(skb, sizeof(*src)))
+                if (!skb_pull(skb, stats_len))
                         return -EPROTO;
 
                 dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
@@ -2876,6 +2885,9 @@ static int ath10k_wmi_10_2_4_op_pull_fw_stats(struct ath10k *ar,
                 ath10k_wmi_pull_peer_stats(&src->common.old, dst);
 
                 dst->peer_rx_rate = __le32_to_cpu(src->common.peer_rx_rate);
+
+                if (ext_peer_stats_support)
+                        dst->rx_duration = __le32_to_cpu(src->rx_duration);
                 /* FIXME: expose 10.2 specific values */
 
                 list_add_tail(&dst->list, &stats->peers);
@@ -3184,7 +3196,7 @@ static void ath10k_wmi_update_noa(struct ath10k *ar, struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
                                   const struct wmi_p2p_noa_info *noa)
 {
-        if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+        if (!arvif->vif->p2p)
                 return;
 
         ath10k_dbg(ar, ATH10K_DBG_MGMT, "noa changed: %d\n", noa->changed);
@@ -3244,6 +3256,50 @@ static int ath10k_wmi_op_pull_swba_ev(struct ath10k *ar, struct sk_buff *skb,
         return 0;
 }
 
+static int ath10k_wmi_10_2_4_op_pull_swba_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_swba_ev_arg *arg)
+{
+        struct wmi_10_2_4_host_swba_event *ev = (void *)skb->data;
+        u32 map;
+        size_t i;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_map = ev->vdev_map;
+
+        for (i = 0, map = __le32_to_cpu(ev->vdev_map); map; map >>= 1) {
+                if (!(map & BIT(0)))
+                        continue;
+
+                /* If this happens there were some changes in firmware and
+                 * ath10k should update the max size of tim_info array.
+                 */
+                if (WARN_ON_ONCE(i == ARRAY_SIZE(arg->tim_info)))
+                        break;
+
+                if (__le32_to_cpu(ev->bcn_info[i].tim_info.tim_len) >
+                     sizeof(ev->bcn_info[i].tim_info.tim_bitmap)) {
+                        ath10k_warn(ar, "refusing to parse invalid swba structure\n");
+                        return -EPROTO;
+                }
+
+                arg->tim_info[i].tim_len = ev->bcn_info[i].tim_info.tim_len;
+                arg->tim_info[i].tim_mcast = ev->bcn_info[i].tim_info.tim_mcast;
+                arg->tim_info[i].tim_bitmap =
+                                ev->bcn_info[i].tim_info.tim_bitmap;
+                arg->tim_info[i].tim_changed =
+                                ev->bcn_info[i].tim_info.tim_changed;
+                arg->tim_info[i].tim_num_ps_pending =
+                                ev->bcn_info[i].tim_info.tim_num_ps_pending;
+                i++;
+        }
+
+        return 0;
+}
+
 static int ath10k_wmi_10_4_op_pull_swba_ev(struct ath10k *ar,
                                            struct sk_buff *skb,
                                            struct wmi_swba_ev_arg *arg)
@@ -4562,9 +4618,9 @@ static void ath10k_wmi_event_service_ready_work(struct work_struct *work)
 
         if (test_bit(WMI_SERVICE_PEER_CACHING, ar->wmi.svc_map)) {
                 ar->max_num_peers = TARGET_10_4_NUM_QCACHE_PEERS_MAX +
-                                    TARGET_10_4_NUM_VDEVS;
-                ar->num_active_peers = TARGET_10_4_QCACHE_ACTIVE_PEERS +
-                                       TARGET_10_4_NUM_VDEVS;
+                                    ar->max_num_vdevs;
+                ar->num_active_peers = ar->hw_params.qcache_active_peers +
+                                       ar->max_num_vdevs;
                 ar->num_tids = ar->num_active_peers * 2;
                 ar->max_num_stations = TARGET_10_4_NUM_QCACHE_PEERS_MAX;
         }
@@ -5460,9 +5516,15 @@ static struct sk_buff *ath10k_wmi_10_2_op_gen_init(struct ath10k *ar)
         u32 len, val, features;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
-        config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
         config.num_peer_keys = __cpu_to_le32(TARGET_10X_NUM_PEER_KEYS);
-        config.num_tids = __cpu_to_le32(TARGET_10X_NUM_TIDS);
+        if (test_bit(WMI_SERVICE_PEER_STATS, ar->wmi.svc_map)) {
+                config.num_peers = __cpu_to_le32(TARGET_10X_TX_STATS_NUM_PEERS);
+                config.num_tids = __cpu_to_le32(TARGET_10X_TX_STATS_NUM_TIDS);
+        } else {
+                config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
+                config.num_tids = __cpu_to_le32(TARGET_10X_NUM_TIDS);
+        }
+
         config.ast_skid_limit = __cpu_to_le32(TARGET_10X_AST_SKID_LIMIT);
         config.tx_chain_mask = __cpu_to_le32(TARGET_10X_TX_CHAIN_MASK);
         config.rx_chain_mask = __cpu_to_le32(TARGET_10X_RX_CHAIN_MASK);
@@ -5517,6 +5579,9 @@ static struct sk_buff *ath10k_wmi_10_2_op_gen_init(struct ath10k *ar)
             test_bit(WMI_SERVICE_COEX_GPIO, ar->wmi.svc_map))
                 features |= WMI_10_2_COEX_GPIO;
 
+        if (test_bit(WMI_SERVICE_PEER_STATS, ar->wmi.svc_map))
+                features |= WMI_10_2_PEER_STATS;
+
         cmd->resource_config.feature_mask = __cpu_to_le32(features);
 
         memcpy(&cmd->resource_config.common, &config, sizeof(config));
@@ -5543,8 +5608,8 @@ static struct sk_buff *ath10k_wmi_10_4_op_gen_init(struct ath10k *ar)
                         __cpu_to_le32(TARGET_10_4_NUM_OFFLOAD_REORDER_BUFFS);
         config.num_peer_keys  = __cpu_to_le32(TARGET_10_4_NUM_PEER_KEYS);
         config.ast_skid_limit = __cpu_to_le32(TARGET_10_4_AST_SKID_LIMIT);
-        config.tx_chain_mask  = __cpu_to_le32(TARGET_10_4_TX_CHAIN_MASK);
-        config.rx_chain_mask  = __cpu_to_le32(TARGET_10_4_RX_CHAIN_MASK);
+        config.tx_chain_mask  = __cpu_to_le32(ar->hw_params.tx_chain_mask);
+        config.rx_chain_mask  = __cpu_to_le32(ar->hw_params.rx_chain_mask);
 
         config.rx_timeout_pri[0] = __cpu_to_le32(TARGET_10_4_RX_TIMEOUT_LO_PRI);
         config.rx_timeout_pri[1] = __cpu_to_le32(TARGET_10_4_RX_TIMEOUT_LO_PRI);
@@ -5575,7 +5640,7 @@ static struct sk_buff *ath10k_wmi_10_4_op_gen_init(struct ath10k *ar)
         config.vow_config = __cpu_to_le32(TARGET_10_4_VOW_CONFIG);
         config.gtk_offload_max_vdev =
                         __cpu_to_le32(TARGET_10_4_GTK_OFFLOAD_MAX_VDEV);
-        config.num_msdu_desc = __cpu_to_le32(TARGET_10_4_NUM_MSDU_DESC);
+        config.num_msdu_desc = __cpu_to_le32(ar->htt.max_num_pending_tx);
         config.max_frag_entries = __cpu_to_le32(TARGET_10_4_11AC_TX_MAX_FRAGS);
         config.max_peer_ext_stats =
                         __cpu_to_le32(TARGET_10_4_MAX_PEER_EXT_STATS);
@@ -7126,6 +7191,9 @@ ath10k_wmi_fw_peer_stats_fill(const struct ath10k_fw_stats_peer *peer,
                         "Peer TX rate", peer->peer_tx_rate);
         len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
                         "Peer RX rate", peer->peer_rx_rate);
+        len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
+                        "Peer RX duration", peer->rx_duration);
+
         len += scnprintf(buf + len, buf_len - len, "\n");
         *length = len;
 }
@@ -7351,6 +7419,71 @@ unlock:
                 buf[len] = 0;
 }
 
+int ath10k_wmi_op_get_vdev_subtype(struct ath10k *ar,
+                                   enum wmi_vdev_subtype subtype)
+{
+        switch (subtype) {
+        case WMI_VDEV_SUBTYPE_NONE:
+                return WMI_VDEV_SUBTYPE_LEGACY_NONE;
+        case WMI_VDEV_SUBTYPE_P2P_DEVICE:
+                return WMI_VDEV_SUBTYPE_LEGACY_P2P_DEV;
+        case WMI_VDEV_SUBTYPE_P2P_CLIENT:
+                return WMI_VDEV_SUBTYPE_LEGACY_P2P_CLI;
+        case WMI_VDEV_SUBTYPE_P2P_GO:
+                return WMI_VDEV_SUBTYPE_LEGACY_P2P_GO;
+        case WMI_VDEV_SUBTYPE_PROXY_STA:
+                return WMI_VDEV_SUBTYPE_LEGACY_PROXY_STA;
+        case WMI_VDEV_SUBTYPE_MESH_11S:
+        case WMI_VDEV_SUBTYPE_MESH_NON_11S:
+                return -ENOTSUPP;
+        }
+        return -ENOTSUPP;
+}
+
+static int ath10k_wmi_10_2_4_op_get_vdev_subtype(struct ath10k *ar,
+                                                 enum wmi_vdev_subtype subtype)
+{
+        switch (subtype) {
+        case WMI_VDEV_SUBTYPE_NONE:
+                return WMI_VDEV_SUBTYPE_10_2_4_NONE;
+        case WMI_VDEV_SUBTYPE_P2P_DEVICE:
+                return WMI_VDEV_SUBTYPE_10_2_4_P2P_DEV;
+        case WMI_VDEV_SUBTYPE_P2P_CLIENT:
+                return WMI_VDEV_SUBTYPE_10_2_4_P2P_CLI;
+        case WMI_VDEV_SUBTYPE_P2P_GO:
+                return WMI_VDEV_SUBTYPE_10_2_4_P2P_GO;
+        case WMI_VDEV_SUBTYPE_PROXY_STA:
+                return WMI_VDEV_SUBTYPE_10_2_4_PROXY_STA;
+        case WMI_VDEV_SUBTYPE_MESH_11S:
+                return WMI_VDEV_SUBTYPE_10_2_4_MESH_11S;
+        case WMI_VDEV_SUBTYPE_MESH_NON_11S:
+                return -ENOTSUPP;
+        }
+        return -ENOTSUPP;
+}
+
+static int ath10k_wmi_10_4_op_get_vdev_subtype(struct ath10k *ar,
+                                               enum wmi_vdev_subtype subtype)
+{
+        switch (subtype) {
+        case WMI_VDEV_SUBTYPE_NONE:
+                return WMI_VDEV_SUBTYPE_10_4_NONE;
+        case WMI_VDEV_SUBTYPE_P2P_DEVICE:
+                return WMI_VDEV_SUBTYPE_10_4_P2P_DEV;
+        case WMI_VDEV_SUBTYPE_P2P_CLIENT:
+                return WMI_VDEV_SUBTYPE_10_4_P2P_CLI;
+        case WMI_VDEV_SUBTYPE_P2P_GO:
+                return WMI_VDEV_SUBTYPE_10_4_P2P_GO;
+        case WMI_VDEV_SUBTYPE_PROXY_STA:
+                return WMI_VDEV_SUBTYPE_10_4_PROXY_STA;
+        case WMI_VDEV_SUBTYPE_MESH_11S:
+                return WMI_VDEV_SUBTYPE_10_4_MESH_11S;
+        case WMI_VDEV_SUBTYPE_MESH_NON_11S:
+                return WMI_VDEV_SUBTYPE_10_4_MESH_NON_11S;
+        }
+        return -ENOTSUPP;
+}
+
 static const struct wmi_ops wmi_ops = {
         .rx = ath10k_wmi_op_rx,
         .map_svc = wmi_main_svc_map,
@@ -7410,6 +7543,7 @@ static const struct wmi_ops wmi_ops = {
         .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
         .gen_delba_send = ath10k_wmi_op_gen_delba_send,
         .fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
+        .get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
         /* .gen_bcn_tmpl not implemented */
         /* .gen_prb_tmpl not implemented */
         /* .gen_p2p_go_bcn_ie not implemented */
@@ -7477,6 +7611,7 @@ static const struct wmi_ops wmi_10_1_ops = {
         .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
         .gen_delba_send = ath10k_wmi_op_gen_delba_send,
         .fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
+        .get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
         /* .gen_bcn_tmpl not implemented */
         /* .gen_prb_tmpl not implemented */
         /* .gen_p2p_go_bcn_ie not implemented */
@@ -7545,6 +7680,7 @@ static const struct wmi_ops wmi_10_2_ops = {
         .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
         .gen_delba_send = ath10k_wmi_op_gen_delba_send,
         .fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
+        .get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
         /* .gen_pdev_enable_adaptive_cca not implemented */
 };
 
@@ -7566,7 +7702,7 @@ static const struct wmi_ops wmi_10_2_4_ops = {
         .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
         .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
         .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
-        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_swba = ath10k_wmi_10_2_4_op_pull_swba_ev,
         .pull_phyerr_hdr = ath10k_wmi_op_pull_phyerr_ev_hdr,
         .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
         .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
@@ -7611,6 +7747,7 @@ static const struct wmi_ops wmi_10_2_4_ops = {
         .fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
         .gen_pdev_enable_adaptive_cca =
                 ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
+        .get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
         /* .gen_bcn_tmpl not implemented */
         /* .gen_prb_tmpl not implemented */
         /* .gen_p2p_go_bcn_ie not implemented */
@@ -7677,6 +7814,7 @@ static const struct wmi_ops wmi_10_4_ops = {
         /* shared with 10.2 */
         .gen_request_stats = ath10k_wmi_op_gen_request_stats,
         .gen_pdev_get_temperature = ath10k_wmi_10_2_op_gen_pdev_get_temperature,
+        .get_vdev_subtype = ath10k_wmi_10_4_op_get_vdev_subtype,
 };
 
 int ath10k_wmi_attach(struct ath10k *ar)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index d85ad7855d20..4d3cbc44fcd2 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -176,7 +176,10 @@ enum wmi_service {
         WMI_SERVICE_AUX_CHAN_LOAD_INTF,
         WMI_SERVICE_BSS_CHANNEL_INFO_64,
         WMI_SERVICE_EXT_RES_CFG_SUPPORT,
-        WMI_SERVICE_MESH,
+        WMI_SERVICE_MESH_11S,
+        WMI_SERVICE_MESH_NON_11S,
+        WMI_SERVICE_PEER_STATS,
+        WMI_SERVICE_RESTRT_CHNL_SUPPORT,
 
         /* keep last */
         WMI_SERVICE_MAX,
@@ -213,6 +216,7 @@ enum wmi_10x_service {
         WMI_10X_SERVICE_BSS_CHANNEL_INFO_64,
         WMI_10X_SERVICE_MESH,
         WMI_10X_SERVICE_EXT_RES_CFG_SUPPORT,
+        WMI_10X_SERVICE_PEER_STATS,
 };
 
 enum wmi_main_service {
@@ -294,7 +298,10 @@ enum wmi_10_4_service {
         WMI_10_4_SERVICE_AUX_CHAN_LOAD_INTF,
         WMI_10_4_SERVICE_BSS_CHANNEL_INFO_64,
         WMI_10_4_SERVICE_EXT_RES_CFG_SUPPORT,
-        WMI_10_4_SERVICE_MESH,
+        WMI_10_4_SERVICE_MESH_NON_11S,
+        WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
+        WMI_10_4_SERVICE_PEER_STATS,
+        WMI_10_4_SERVICE_MESH_11S,
 };
 
 static inline char *wmi_service_name(int service_id)
@@ -385,7 +392,10 @@ static inline char *wmi_service_name(int service_id)
         SVCSTR(WMI_SERVICE_AUX_CHAN_LOAD_INTF);
         SVCSTR(WMI_SERVICE_BSS_CHANNEL_INFO_64);
         SVCSTR(WMI_SERVICE_EXT_RES_CFG_SUPPORT);
-        SVCSTR(WMI_SERVICE_MESH);
+        SVCSTR(WMI_SERVICE_MESH_11S);
+        SVCSTR(WMI_SERVICE_MESH_NON_11S);
+        SVCSTR(WMI_SERVICE_PEER_STATS);
+        SVCSTR(WMI_SERVICE_RESTRT_CHNL_SUPPORT);
         default:
                 return NULL;
         }
@@ -460,9 +470,11 @@ static inline void wmi_10x_svc_map(const __le32 *in, unsigned long *out,
         SVCMAP(WMI_10X_SERVICE_BSS_CHANNEL_INFO_64,
                WMI_SERVICE_BSS_CHANNEL_INFO_64, len);
         SVCMAP(WMI_10X_SERVICE_MESH,
-               WMI_SERVICE_MESH, len);
+               WMI_SERVICE_MESH_11S, len);
         SVCMAP(WMI_10X_SERVICE_EXT_RES_CFG_SUPPORT,
                WMI_SERVICE_EXT_RES_CFG_SUPPORT, len);
+        SVCMAP(WMI_10X_SERVICE_PEER_STATS,
+               WMI_SERVICE_PEER_STATS, len);
 }
 
 static inline void wmi_main_svc_map(const __le32 *in, unsigned long *out,
@@ -623,8 +635,14 @@ static inline void wmi_10_4_svc_map(const __le32 *in, unsigned long *out,
                WMI_SERVICE_BSS_CHANNEL_INFO_64, len);
         SVCMAP(WMI_10_4_SERVICE_EXT_RES_CFG_SUPPORT,
                WMI_SERVICE_EXT_RES_CFG_SUPPORT, len);
-        SVCMAP(WMI_10_4_SERVICE_MESH,
-               WMI_SERVICE_MESH, len);
+        SVCMAP(WMI_10_4_SERVICE_MESH_NON_11S,
+               WMI_SERVICE_MESH_NON_11S, len);
+        SVCMAP(WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
+               WMI_SERVICE_RESTRT_CHNL_SUPPORT, len);
+        SVCMAP(WMI_10_4_SERVICE_PEER_STATS,
+               WMI_SERVICE_PEER_STATS, len);
+        SVCMAP(WMI_10_4_SERVICE_MESH_11S,
+               WMI_SERVICE_MESH_11S, len);
 }
 
 #undef SVCMAP
@@ -1800,7 +1818,6 @@ enum wmi_channel_change_cause {
 #define WMI_CHANNEL_CHANGE_CAUSE_CSA (1 << 13)
 
 #define WMI_MAX_SPATIAL_STREAM        3 /* default max ss */
-#define WMI_10_4_MAX_SPATIAL_STREAM   4
 
 /* HT Capabilities*/
 #define WMI_HT_CAP_ENABLED                0x0001   /* HT Enabled/ disabled */
@@ -2417,6 +2434,7 @@ enum wmi_10_2_feature_mask {
         WMI_10_2_RX_BATCH_MODE = BIT(0),
         WMI_10_2_ATF_CONFIG    = BIT(1),
         WMI_10_2_COEX_GPIO     = BIT(3),
+        WMI_10_2_PEER_STATS    = BIT(7),
 };
 
 struct wmi_resource_config_10_2 {
@@ -4227,7 +4245,13 @@ struct wmi_10_2_peer_stats {
 
 struct wmi_10_2_4_peer_stats {
         struct wmi_10_2_peer_stats common;
-        __le32 unknown_value; /* FIXME: what is this word? */
+        __le32 peer_rssi_changed;
+} __packed;
+
+struct wmi_10_2_4_ext_peer_stats {
+        struct wmi_10_2_peer_stats common;
+        __le32 peer_rssi_changed;
+        __le32 rx_duration;
 } __packed;
 
 struct wmi_10_4_peer_stats {
@@ -4270,12 +4294,40 @@ enum wmi_vdev_type {
 };
 
 enum wmi_vdev_subtype {
-        WMI_VDEV_SUBTYPE_NONE       = 0,
-        WMI_VDEV_SUBTYPE_P2P_DEVICE = 1,
-        WMI_VDEV_SUBTYPE_P2P_CLIENT = 2,
-        WMI_VDEV_SUBTYPE_P2P_GO     = 3,
-        WMI_VDEV_SUBTYPE_PROXY_STA      = 4,
-        WMI_VDEV_SUBTYPE_MESH           = 5,
+        WMI_VDEV_SUBTYPE_NONE,
+        WMI_VDEV_SUBTYPE_P2P_DEVICE,
+        WMI_VDEV_SUBTYPE_P2P_CLIENT,
+        WMI_VDEV_SUBTYPE_P2P_GO,
+        WMI_VDEV_SUBTYPE_PROXY_STA,
+        WMI_VDEV_SUBTYPE_MESH_11S,
+        WMI_VDEV_SUBTYPE_MESH_NON_11S,
+};
+
+enum wmi_vdev_subtype_legacy {
+        WMI_VDEV_SUBTYPE_LEGACY_NONE      = 0,
+        WMI_VDEV_SUBTYPE_LEGACY_P2P_DEV   = 1,
+        WMI_VDEV_SUBTYPE_LEGACY_P2P_CLI   = 2,
+        WMI_VDEV_SUBTYPE_LEGACY_P2P_GO    = 3,
+        WMI_VDEV_SUBTYPE_LEGACY_PROXY_STA = 4,
+};
+
+enum wmi_vdev_subtype_10_2_4 {
+        WMI_VDEV_SUBTYPE_10_2_4_NONE      = 0,
+        WMI_VDEV_SUBTYPE_10_2_4_P2P_DEV   = 1,
+        WMI_VDEV_SUBTYPE_10_2_4_P2P_CLI   = 2,
+        WMI_VDEV_SUBTYPE_10_2_4_P2P_GO    = 3,
+        WMI_VDEV_SUBTYPE_10_2_4_PROXY_STA = 4,
+        WMI_VDEV_SUBTYPE_10_2_4_MESH_11S  = 5,
+};
+
+enum wmi_vdev_subtype_10_4 {
+        WMI_VDEV_SUBTYPE_10_4_NONE         = 0,
+        WMI_VDEV_SUBTYPE_10_4_P2P_DEV      = 1,
+        WMI_VDEV_SUBTYPE_10_4_P2P_CLI      = 2,
+        WMI_VDEV_SUBTYPE_10_4_P2P_GO       = 3,
+        WMI_VDEV_SUBTYPE_10_4_PROXY_STA    = 4,
+        WMI_VDEV_SUBTYPE_10_4_MESH_NON_11S = 5,
+        WMI_VDEV_SUBTYPE_10_4_MESH_11S     = 6,
 };
 
 /* values for vdev_subtype */
@@ -5442,6 +5494,16 @@ struct wmi_host_swba_event {
         struct wmi_bcn_info bcn_info[0];
 } __packed;
 
+struct wmi_10_2_4_bcn_info {
+        struct wmi_tim_info tim_info;
+        /* The 10.2.4 FW doesn't have p2p NOA info */
+} __packed;
+
+struct wmi_10_2_4_host_swba_event {
+        __le32 vdev_map;
+        struct wmi_10_2_4_bcn_info bcn_info[0];
+} __packed;
+
 /* 16 words = 512 client + 1 word = for guard */
 #define WMI_10_4_TIM_BITMAP_ARRAY_SIZE 17
 
@@ -6436,5 +6498,7 @@ size_t ath10k_wmi_fw_stats_num_vdevs(struct list_head *head);
 void ath10k_wmi_10_4_op_fw_stats_fill(struct ath10k *ar,
                                       struct ath10k_fw_stats *fw_stats,
                                       char *buf);
+int ath10k_wmi_op_get_vdev_subtype(struct ath10k *ar,
+                                   enum wmi_vdev_subtype subtype);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 25e45e4d1a60..815efe9fd208 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -126,12 +126,8 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
 
 static void ath9k_ani_restart(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
-
-        if (!ah->curchan)
-                return;
+        struct ar5416AniState *aniState = &ah->ani;
 
-        aniState = &ah->ani;
         aniState->listenTime = 0;
 
         ENABLE_REGWRITE_BUFFER(ah);
@@ -221,12 +217,7 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
 
 static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
-
-        if (!ah->curchan)
-                return;
-
-        aniState = &ah->ani;
+        struct ar5416AniState *aniState = &ah->ani;
 
         if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
                 ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
@@ -281,12 +272,7 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
 
 static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
-
-        if (!ah->curchan)
-                return;
-
-        aniState = &ah->ani;
+        struct ar5416AniState *aniState = &ah->ani;
 
         if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
                 ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
@@ -299,9 +285,7 @@ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
  */
 static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
 {
-        struct ar5416AniState *aniState;
-
-        aniState = &ah->ani;
+        struct ar5416AniState *aniState = &ah->ani;
 
         /* lower OFDM noise immunity */
         if (aniState->ofdmNoiseImmunityLevel > 0 &&
@@ -329,7 +313,7 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
         struct ath_common *common = ath9k_hw_common(ah);
         int ofdm_nil, cck_nil;
 
-        if (!ah->curchan)
+        if (!chan)
                 return;
 
         BUG_ON(aniState == NULL);
@@ -416,14 +400,10 @@ static bool ath9k_hw_ani_read_counters(struct ath_hw *ah)
 
 void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        struct ar5416AniState *aniState;
+        struct ar5416AniState *aniState = &ah->ani;
         struct ath_common *common = ath9k_hw_common(ah);
         u32 ofdmPhyErrRate, cckPhyErrRate;
 
-        if (!ah->curchan)
-                return;
-
-        aniState = &ah->ani;
         if (!ath9k_hw_ani_read_counters(ah))
                 return;
 
@@ -450,7 +430,9 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
                 } else if (cckPhyErrRate > ah->config.cck_trig_high) {
                         ath9k_hw_ani_cck_err_trigger(ah);
                         aniState->ofdmsTurn = true;
-                }
+                } else
+                        return;
+                        
                 ath9k_ani_restart(ah);
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_aic.c b/drivers/net/wireless/ath/ath9k/ar9003_aic.c
index 1db119d77783..547cd46da260 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_aic.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_aic.c
@@ -53,19 +53,19 @@ static bool ar9003_hw_is_aic_enabled(struct ath_hw *ah)
         return true;
 }
 
-static int16_t ar9003_aic_find_valid(struct ath_aic_sram_info *cal_sram,
+static int16_t ar9003_aic_find_valid(bool *cal_sram_valid,
                                      bool dir, u8 index)
 {
         int16_t i;
 
         if (dir) {
                 for (i = index + 1; i < ATH_AIC_MAX_BT_CHANNEL; i++) {
-                        if (cal_sram[i].valid)
+                        if (cal_sram_valid[i])
                                 break;
                 }
         } else {
                 for (i = index - 1; i >= 0; i--) {
-                        if (cal_sram[i].valid)
+                        if (cal_sram_valid[i])
                                 break;
                 }
         }
@@ -264,7 +264,7 @@ static u8 ar9003_aic_cal_start(struct ath_hw *ah, u8 min_valid_count)
 static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
 {
         struct ath9k_hw_aic *aic = &ah->btcoex_hw.aic;
-        struct ath_aic_sram_info cal_sram[ATH_AIC_MAX_BT_CHANNEL];
+        bool cal_sram_valid[ATH_AIC_MAX_BT_CHANNEL];
         struct ath_aic_out_info aic_sram[ATH_AIC_MAX_BT_CHANNEL];
         u32 dir_path_gain_idx, quad_path_gain_idx, value;
         u32 fixed_com_att_db;
@@ -272,33 +272,34 @@ static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
         int16_t i;
         bool ret = true;
 
-        memset(&cal_sram, 0, sizeof(cal_sram));
+        memset(&cal_sram_valid, 0, sizeof(cal_sram_valid));
         memset(&aic_sram, 0, sizeof(aic_sram));
 
         for (i = 0; i < ATH_AIC_MAX_BT_CHANNEL; i++) {
+                struct ath_aic_sram_info sram;
                 value = aic->aic_sram[i];
 
-                cal_sram[i].valid =
+                cal_sram_valid[i] = sram.valid =
                         MS(value, AR_PHY_AIC_SRAM_VALID);
-                cal_sram[i].rot_quad_att_db =
+                sram.rot_quad_att_db =
                         MS(value, AR_PHY_AIC_SRAM_ROT_QUAD_ATT_DB);
-                cal_sram[i].vga_quad_sign =
+                sram.vga_quad_sign =
                         MS(value, AR_PHY_AIC_SRAM_VGA_QUAD_SIGN);
-                cal_sram[i].rot_dir_att_db =
+                sram.rot_dir_att_db =
                         MS(value, AR_PHY_AIC_SRAM_ROT_DIR_ATT_DB);
-                cal_sram[i].vga_dir_sign =
+                sram.vga_dir_sign =
                         MS(value, AR_PHY_AIC_SRAM_VGA_DIR_SIGN);
-                cal_sram[i].com_att_6db =
+                sram.com_att_6db =
                         MS(value, AR_PHY_AIC_SRAM_COM_ATT_6DB);
 
-                if (cal_sram[i].valid) {
-                        dir_path_gain_idx = cal_sram[i].rot_dir_att_db +
-                                com_att_db_table[cal_sram[i].com_att_6db];
-                        quad_path_gain_idx = cal_sram[i].rot_quad_att_db +
-                                com_att_db_table[cal_sram[i].com_att_6db];
+                if (sram.valid) {
+                        dir_path_gain_idx = sram.rot_dir_att_db +
+                                com_att_db_table[sram.com_att_6db];
+                        quad_path_gain_idx = sram.rot_quad_att_db +
+                                com_att_db_table[sram.com_att_6db];
 
-                        dir_path_sign = (cal_sram[i].vga_dir_sign) ? 1 : -1;
-                        quad_path_sign = (cal_sram[i].vga_quad_sign) ? 1 : -1;
+                        dir_path_sign = (sram.vga_dir_sign) ? 1 : -1;
+                        quad_path_sign = (sram.vga_quad_sign) ? 1 : -1;
 
                         aic_sram[i].dir_path_gain_lin = dir_path_sign *
                                 aic_lin_table[dir_path_gain_idx];
@@ -310,16 +311,16 @@ static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
         for (i = 0; i < ATH_AIC_MAX_BT_CHANNEL; i++) {
                 int16_t start_idx, end_idx;
 
-                if (cal_sram[i].valid)
+                if (cal_sram_valid[i])
                         continue;
 
-                start_idx = ar9003_aic_find_valid(cal_sram, 0, i);
-                end_idx = ar9003_aic_find_valid(cal_sram, 1, i);
+                start_idx = ar9003_aic_find_valid(cal_sram_valid, 0, i);
+                end_idx = ar9003_aic_find_valid(cal_sram_valid, 1, i);
 
                 if (start_idx < 0) {
                         /* extrapolation */
                         start_idx = end_idx;
-                        end_idx = ar9003_aic_find_valid(cal_sram, 1, start_idx);
+                        end_idx = ar9003_aic_find_valid(cal_sram_valid, 1, start_idx);
 
                         if (end_idx < 0) {
                                 ret = false;
@@ -342,7 +343,7 @@ static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
 
                 if (end_idx < 0) {
                         /* extrapolation */
-                        end_idx = ar9003_aic_find_valid(cal_sram, 0, start_idx);
+                        end_idx = ar9003_aic_find_valid(cal_sram_valid, 0, start_idx);
 
                         if (end_idx < 0) {
                                 ret = false;
@@ -378,19 +379,21 @@ static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
         }
 
         /* From dir/quad_path_gain_lin to sram. */
-        i = ar9003_aic_find_valid(cal_sram, 1, 0);
+        i = ar9003_aic_find_valid(cal_sram_valid, 1, 0);
         if (i < 0) {
                 i = 0;
                 ret = false;
         }
-        fixed_com_att_db = com_att_db_table[cal_sram[i].com_att_6db];
+        fixed_com_att_db = com_att_db_table[MS(aic->aic_sram[i],
+                                            AR_PHY_AIC_SRAM_COM_ATT_6DB)];
 
         for (i = 0; i < ATH_AIC_MAX_BT_CHANNEL; i++) {
                 int16_t rot_dir_path_att_db, rot_quad_path_att_db;
+                struct ath_aic_sram_info sram;
 
-                aic_sram[i].sram.vga_dir_sign =
+                sram.vga_dir_sign =
                         (aic_sram[i].dir_path_gain_lin >= 0) ? 1 : 0;
-                aic_sram[i].sram.vga_quad_sign=
+                sram.vga_quad_sign =
                         (aic_sram[i].quad_path_gain_lin >= 0) ? 1 : 0;
 
                 rot_dir_path_att_db =
@@ -400,33 +403,31 @@ static bool ar9003_aic_cal_post_process(struct ath_hw *ah)
                         ar9003_aic_find_index(0, abs(aic_sram[i].quad_path_gain_lin)) -
                         fixed_com_att_db;
 
-                aic_sram[i].sram.com_att_6db =
+                sram.com_att_6db =
                         ar9003_aic_find_index(1, fixed_com_att_db);
 
-                aic_sram[i].sram.valid = 1;
+                sram.valid = 1;
 
-                aic_sram[i].sram.rot_dir_att_db =
+                sram.rot_dir_att_db =
                         min(max(rot_dir_path_att_db,
                                 (int16_t)ATH_AIC_MIN_ROT_DIR_ATT_DB),
                             ATH_AIC_MAX_ROT_DIR_ATT_DB);
-                aic_sram[i].sram.rot_quad_att_db =
+                sram.rot_quad_att_db =
                         min(max(rot_quad_path_att_db,
                                 (int16_t)ATH_AIC_MIN_ROT_QUAD_ATT_DB),
                             ATH_AIC_MAX_ROT_QUAD_ATT_DB);
-        }
 
-        for (i = 0; i < ATH_AIC_MAX_BT_CHANNEL; i++) {
-                aic->aic_sram[i] = (SM(aic_sram[i].sram.vga_dir_sign,
+                aic->aic_sram[i] = (SM(sram.vga_dir_sign,
                                        AR_PHY_AIC_SRAM_VGA_DIR_SIGN) |
-                                    SM(aic_sram[i].sram.vga_quad_sign,
+                                    SM(sram.vga_quad_sign,
                                        AR_PHY_AIC_SRAM_VGA_QUAD_SIGN) |
-                                    SM(aic_sram[i].sram.com_att_6db,
+                                    SM(sram.com_att_6db,
                                        AR_PHY_AIC_SRAM_COM_ATT_6DB) |
-                                    SM(aic_sram[i].sram.valid,
+                                    SM(sram.valid,
                                        AR_PHY_AIC_SRAM_VALID) |
-                                    SM(aic_sram[i].sram.rot_dir_att_db,
+                                    SM(sram.rot_dir_att_db,
                                        AR_PHY_AIC_SRAM_ROT_DIR_ATT_DB) |
-                                    SM(aic_sram[i].sram.rot_quad_att_db,
+                                    SM(sram.rot_quad_att_db,
                                        AR_PHY_AIC_SRAM_ROT_QUAD_ATT_DB));
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_aic.h b/drivers/net/wireless/ath/ath9k/ar9003_aic.h
index 86f40644be43..9512c63799f2 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_aic.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_aic.h
@@ -50,7 +50,6 @@ struct ath_aic_sram_info {
 struct ath_aic_out_info {
         int16_t dir_path_gain_lin;
         int16_t quad_path_gain_lin;
-        struct ath_aic_sram_info sram;
 };
 
 u8 ar9003_aic_calibration(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 8b4561e8ce1a..54ed2f72d35e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -5485,11 +5485,11 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah,
                           AR9300_PAPRD_SCALE_1);
         else {
                 if (chan->channel >= 5700)
-                return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
-                          AR9300_PAPRD_SCALE_1);
+                        return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
+                                  AR9300_PAPRD_SCALE_1);
                 else if (chan->channel >= 5400)
                         return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
-                                   AR9300_PAPRD_SCALE_2);
+                                  AR9300_PAPRD_SCALE_2);
                 else
                         return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
                                   AR9300_PAPRD_SCALE_1);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 8b238c15916d..2fe12b0de5b4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -698,6 +698,9 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_low_ob_db_tx_gain_table_1p0);
+        else if (AR_SREV_9531_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca953x_1p1_modes_no_xpa_low_power_tx_gain_table);
         else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_low_ob_db_tx_gain_1_1);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 201425e7f9cb..06c1ca6e8290 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -976,9 +976,14 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         /*
          * JAPAN regulatory.
          */
-        if (chan->channel == 2484)
+        if (chan->channel == 2484) {
                 ar9003_hw_prog_ini(ah, &ah->iniCckfirJapan2484, 1);
 
+                if (AR_SREV_9531(ah))
+                        REG_RMW_FIELD(ah, AR_PHY_FCAL_2_0,
+                                      AR_PHY_FLC_PWR_THRESH, 0);
+        }
+
         ah->modes_index = modesIndex;
         ar9003_hw_override_ini(ah);
         ar9003_hw_set_channel_regs(ah, chan);
@@ -2071,7 +2076,8 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  *             to be disabled.
  *
  * 0x04000409: Packet stuck on receive.
- *             Full chip reset is required for all chips except AR9340.
+ *             Full chip reset is required for all chips except
+ *             AR9340, AR9531 and AR9561.
  */
 
 /*
@@ -2100,7 +2106,7 @@ bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah)
         case 0x04000b09:
                 return true;
         case 0x04000409:
-                if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
+                if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         return false;
                 else
                         return true;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index c5f8bc4b5595..566da789f97e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -487,6 +487,9 @@
 #define AR_PHY_ADDAC_PARA_CTL    (AR_SM_BASE + 0x150)
 #define AR_PHY_XPA_CFG           (AR_SM_BASE + 0x158)
 
+#define AR_PHY_FLC_PWR_THRESH           7
+#define AR_PHY_FLC_PWR_THRESH_S         0
+
 #define AR_PHY_FRAME_CTL_CF_OVERLAP_WINDOW  3
 #define AR_PHY_FRAME_CTL_CF_OVERLAP_WINDOW_S    0
 
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 6fc0d07e5ec6..c0b90daa3e3d 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -757,6 +757,71 @@ static const u32 qca953x_1p1_modes_xpa_tx_gain_table[][2] = {
         {0x00016448, 0x6c927a70},
 };
 
+static const u32 qca953x_1p1_modes_no_xpa_low_power_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xfff55592},
+        {0x0000a2e0, 0xfff99924},
+        {0x0000a2e4, 0xfffe1e00},
+        {0x0000a2e8, 0xffffe000},
+        {0x0000a410, 0x000050d6},
+        {0x0000a500, 0x00000069},
+        {0x0000a504, 0x0400006b},
+        {0x0000a508, 0x0800006d},
+        {0x0000a50c, 0x0c000269},
+        {0x0000a510, 0x1000026b},
+        {0x0000a514, 0x1400026d},
+        {0x0000a518, 0x18000669},
+        {0x0000a51c, 0x1c00066b},
+        {0x0000a520, 0x1d000a68},
+        {0x0000a524, 0x21000a6a},
+        {0x0000a528, 0x25000a6c},
+        {0x0000a52c, 0x29000a6e},
+        {0x0000a530, 0x2d0012a9},
+        {0x0000a534, 0x310012ab},
+        {0x0000a538, 0x350012ad},
+        {0x0000a53c, 0x39001b0a},
+        {0x0000a540, 0x3d001b0c},
+        {0x0000a544, 0x41001b0e},
+        {0x0000a548, 0x43001bae},
+        {0x0000a54c, 0x45001914},
+        {0x0000a550, 0x47001916},
+        {0x0000a554, 0x49001b96},
+        {0x0000a558, 0x49001b96},
+        {0x0000a55c, 0x49001b96},
+        {0x0000a560, 0x49001b96},
+        {0x0000a564, 0x49001b96},
+        {0x0000a568, 0x49001b96},
+        {0x0000a56c, 0x49001b96},
+        {0x0000a570, 0x49001b96},
+        {0x0000a574, 0x49001b96},
+        {0x0000a578, 0x49001b96},
+        {0x0000a57c, 0x49001b96},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00000000},
+        {0x0000a610, 0x00000000},
+        {0x0000a614, 0x00000000},
+        {0x0000a618, 0x00804201},
+        {0x0000a61c, 0x01408201},
+        {0x0000a620, 0x01408502},
+        {0x0000a624, 0x01408502},
+        {0x0000a628, 0x01408502},
+        {0x0000a62c, 0x01408502},
+        {0x0000a630, 0x01408502},
+        {0x0000a634, 0x01408502},
+        {0x0000a638, 0x01408502},
+        {0x0000a63c, 0x01408502},
+        {0x0000b2dc, 0xfff55592},
+        {0x0000b2e0, 0xfff99924},
+        {0x0000b2e4, 0xfffe1e00},
+        {0x0000b2e8, 0xffffe000},
+        {0x00016044, 0x044922db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x044922db},
+        {0x00016448, 0x6c927a70},
+};
+
 static const u32 qca953x_2p0_baseband_core[][2] = {
         /* Addr      allmodes  */
         {0x00009800, 0xafe68e30},
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 3e2e24e4843f..37f6d66d1671 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -241,6 +241,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
         struct ath_common *common = ath9k_hw_common(ah);
         s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
+        u32 bb_agc_ctl = REG_READ(ah, AR_PHY_AGC_CONTROL);
 
         if (ah->caldata)
                 h = ah->caldata->nfCalHist;
@@ -264,6 +265,16 @@ int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         /*
+         * stop NF cal if ongoing to ensure NF load completes immediately
+         * (or after end rx/tx frame if ongoing)
+         */
+        if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
+                REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+                REG_RMW_BUFFER_FLUSH(ah);
+                ENABLE_REG_RMW_BUFFER(ah);
+        }
+
+        /*
          * Load software filtered NF value into baseband internal minCCApwr
          * variable.
          */
@@ -276,18 +287,33 @@ int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
 
         /*
          * Wait for load to complete, should be fast, a few 10s of us.
-         * The max delay was changed from an original 250us to 10000us
-         * since 250us often results in NF load timeout and causes deaf
-         * condition during stress testing 12/12/2009
+         * The max delay was changed from an original 250us to 22.2 msec.
+         * This would increase timeout to the longest possible frame
+         * (11n max length 22.1 msec)
          */
-        for (j = 0; j < 10000; j++) {
+        for (j = 0; j < 22200; j++) {
                 if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
-                     AR_PHY_AGC_CONTROL_NF) == 0)
+                              AR_PHY_AGC_CONTROL_NF) == 0)
                         break;
                 udelay(10);
         }
 
         /*
+         * Restart NF so it can continue.
+         */
+        if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
+                ENABLE_REG_RMW_BUFFER(ah);
+                if (bb_agc_ctl & AR_PHY_AGC_CONTROL_ENABLE_NF)
+                        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+                                    AR_PHY_AGC_CONTROL_ENABLE_NF);
+                if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NO_UPDATE_NF)
+                        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+                                    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+                REG_RMW_BUFFER_FLUSH(ah);
+        }
+
+        /*
          * We timed out waiting for the noisefloor to load, probably due to an
          * in-progress rx. Simply return here and allow the load plenty of time
          * to complete before the next calibration interval.  We need to avoid
@@ -296,7 +322,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
          * here, the baseband nf cal will just be capped by our present
          * noisefloor until the next calibration timer.
          */
-        if (j == 10000) {
+        if (j == 22200) {
                 ath_dbg(common, ANY,
                         "Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
                         REG_READ(ah, AR_PHY_AGC_CONTROL));
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 50e614b915f1..319cb5f25f58 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -226,7 +226,7 @@ static const char *chanctx_state_string(enum ath_chanctx_state state)
         }
 }
 
-static const u32 chanctx_event_delta(struct ath_softc *sc)
+static u32 chanctx_event_delta(struct ath_softc *sc)
 {
         u64 ms;
         struct timespec ts, *old;
@@ -1454,7 +1454,7 @@ static void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
         if (!sc->p2p_ps_timer)
                 return;
 
-        if (vif->type != NL80211_IFTYPE_STATION || !vif->p2p)
+        if (vif->type != NL80211_IFTYPE_STATION)
                 return;
 
         sc->p2p_ps_vif = avp;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 165dd202c365..8cbf4904db7b 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -55,6 +55,8 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
           .driver_info = AR9280_USB },  /* Buffalo WLI-UV-AG300P */
         { USB_DEVICE(0x04da, 0x3904),
           .driver_info = AR9280_USB },
+        { USB_DEVICE(0x0930, 0x0a08),
+          .driver_info = AR9280_USB },  /* Toshiba WLM-20U2 and GN-1080 */
 
         { USB_DEVICE(0x0cf3, 0x20ff),
           .driver_info = STORAGE_DEVICE },
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 257f46ed4a04..e7a31016f370 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1368,6 +1368,16 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_check_gpm_offset(ah);
 
+        /* DMA HALT added to resolve ar9300 and ar9580 bus error during
+         * RTC_RC reg read
+         */
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah)) {
+                REG_SET_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+                ath9k_hw_wait(ah, AR_CFG, AR_CFG_HALT_ACK, AR_CFG_HALT_ACK,
+                              20 * AH_WAIT_TIMEOUT);
+                REG_CLR_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+        }
+
         REG_WRITE(ah, AR_RTC_RC, rst_flags);
 
         REGWRITE_BUFFER_FLUSH(ah);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index ab7a1ac37849..d4e0ac946c3a 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -751,14 +751,6 @@ static const struct ieee80211_iface_combination if_comb_multi[] = {
 
 #endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
 
-static const struct ieee80211_iface_limit if_dfs_limits[] = {
-        { .max = 1,     .types = BIT(NL80211_IFTYPE_AP) |
-#ifdef CONFIG_MAC80211_MESH
-                                 BIT(NL80211_IFTYPE_MESH_POINT) |
-#endif
-                                 BIT(NL80211_IFTYPE_ADHOC) },
-};
-
 static const struct ieee80211_iface_combination if_comb[] = {
         {
                 .limits = if_limits,
@@ -766,6 +758,11 @@ static const struct ieee80211_iface_combination if_comb[] = {
                 .max_interfaces = 2048,
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
+#ifdef CONFIG_ATH9K_DFS_CERTIFIED
+                .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                        BIT(NL80211_CHAN_WIDTH_20) |
+                                        BIT(NL80211_CHAN_WIDTH_40),
+#endif
         },
         {
                 .limits = wds_limits,
@@ -774,18 +771,6 @@ static const struct ieee80211_iface_combination if_comb[] = {
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
         },
-#ifdef CONFIG_ATH9K_DFS_CERTIFIED
-        {
-                .limits = if_dfs_limits,
-                .n_limits = ARRAY_SIZE(if_dfs_limits),
-                .max_interfaces = 1,
-                .num_different_channels = 1,
-                .beacon_int_infra_match = true,
-                .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-                                        BIT(NL80211_CHAN_WIDTH_20) |
-                                        BIT(NL80211_CHAN_WIDTH_40),
-        }
-#endif
 };
 
 #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index cf58a304e9f0..3aed43a63f94 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -978,7 +978,7 @@ static void ath9k_update_bssid_mask(struct ath_softc *sc,
                 if (ctx->nvifs_assigned != 1)
                         continue;
 
-                if (!avp->vif->p2p || !iter_data->has_hw_macaddr)
+                if (!iter_data->has_hw_macaddr)
                         continue;
 
                 ether_addr_copy(common->curbssid, avp->bssid);
@@ -1255,6 +1255,9 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->cur_chan->nvifs++;
 
+        if (vif->type == NL80211_IFTYPE_STATION && ath9k_is_chanctx_enabled())
+                vif->driver_flags |= IEEE80211_VIF_GET_NOA_UPDATE;
+
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_assign_slot(sc, vif);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index caba54ddad25..c8d35febaf0f 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -34,8 +34,10 @@
 #define AR_CFG_SWRG          0x00000010
 #define AR_CFG_AP_ADHOC_INDICATION 0x00000020
 #define AR_CFG_PHOK          0x00000100
-#define AR_CFG_CLK_GATE_DIS  0x00000400
 #define AR_CFG_EEBS          0x00000200
+#define AR_CFG_CLK_GATE_DIS  0x00000400
+#define AR_CFG_HALT_REQ      0x00000800
+#define AR_CFG_HALT_ACK      0x00001000
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
 
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
index 9111d4ffc1b3..ea1d80f9a50e 100644
--- a/drivers/net/wireless/ath/carl9170/fwcmd.h
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -56,6 +56,7 @@ enum carl9170_cmd_oids {
         CARL9170_CMD_RX_FILTER          = 0x07,
         CARL9170_CMD_WOL                = 0x08,
         CARL9170_CMD_TALLY              = 0x09,
+        CARL9170_CMD_WREGB              = 0x0a,
 
         /* CAM */
         CARL9170_CMD_EKEY               = 0x10,
@@ -123,6 +124,12 @@ struct carl9170_write_reg {
         } regs[0] __packed;
 } __packed;
 
+struct carl9170_write_reg_byte {
+        __le32  addr;
+        __le32  count;
+        u8      val[0];
+} __packed;
+
 #define CARL9170FW_PHY_HT_ENABLE                0x4
 #define CARL9170FW_PHY_HT_DYN2040               0x8
 #define CARL9170FW_PHY_HT_EXT_CHAN_OFF          0x3
@@ -226,6 +233,7 @@ struct carl9170_cmd {
                 struct carl9170_u32_list        echo;
                 struct carl9170_reg_list        rreg;
                 struct carl9170_write_reg       wreg;
+                struct carl9170_write_reg_byte  wregb;
                 struct carl9170_rf_init         rf_init;
                 struct carl9170_psm             psm;
                 struct carl9170_wol_cmd         wol;
diff --git a/drivers/net/wireless/ath/carl9170/fwdesc.h b/drivers/net/wireless/ath/carl9170/fwdesc.h
index 66848d47c88e..0533f79cb998 100644
--- a/drivers/net/wireless/ath/carl9170/fwdesc.h
+++ b/drivers/net/wireless/ath/carl9170/fwdesc.h
@@ -81,6 +81,12 @@ enum carl9170fw_feature_list {
         /* Firmware will pass BA when BARs are queued */
         CARL9170FW_RX_BA_FILTER,
 
+        /* Firmware has support to write a byte at a time */
+        CARL9170FW_HAS_WREGB_CMD,
+
+        /* Pattern generator */
+        CARL9170FW_PATTERN_GENERATOR,
+
         /* KEEP LAST */
         __CARL9170FW_FEATURE_NUM
 };
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
index 0db874abde50..08e0ae9c5836 100644
--- a/drivers/net/wireless/ath/carl9170/hw.h
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -453,9 +453,74 @@
 #define AR9170_MC_REG_BASE                      0x1d1000
 
 #define AR9170_MC_REG_FLASH_WAIT_STATE          (AR9170_MC_REG_BASE + 0x000)
-#define AR9170_MC_REG_SEEPROM_WP0               (AR9170_MC_REG_BASE + 0x400)
-#define AR9170_MC_REG_SEEPROM_WP1               (AR9170_MC_REG_BASE + 0x404)
-#define AR9170_MC_REG_SEEPROM_WP2               (AR9170_MC_REG_BASE + 0x408)
+
+#define AR9170_SPI_REG_BASE                     (AR9170_MC_REG_BASE + 0x200)
+#define AR9170_SPI_REG_CONTROL0                 (AR9170_SPI_REG_BASE + 0x000)
+#define         AR9170_SPI_CONTROL0_BUSY                BIT(0)
+#define         AR9170_SPI_CONTROL0_CMD_GO              BIT(1)
+#define         AR9170_SPI_CONTROL0_PAGE_WR             BIT(2)
+#define         AR9170_SPI_CONTROL0_SEQ_RD              BIT(3)
+#define         AR9170_SPI_CONTROL0_CMD_ABORT           BIT(4)
+#define         AR9170_SPI_CONTROL0_CMD_LEN_S           8
+#define         AR9170_SPI_CONTROL0_CMD_LEN             0x00000f00
+#define         AR9170_SPI_CONTROL0_RD_LEN_S            12
+#define         AR9170_SPI_CONTROL0_RD_LEN              0x00007000
+
+#define AR9170_SPI_REG_CONTROL1                 (AR9170_SPI_REG_BASE + 0x004)
+#define         AR9170_SPI_CONTROL1_SCK_RATE            BIT(0)
+#define         AR9170_SPI_CONTROL1_DRIVE_SDO           BIT(1)
+#define         AR9170_SPI_CONTROL1_MODE_SEL_S          2
+#define         AR9170_SPI_CONTROL1_MODE_SEL            0x000000c0
+#define         AR9170_SPI_CONTROL1_WRITE_PROTECT       BIT(4)
+
+#define AR9170_SPI_REG_COMMAND_PORT0            (AR9170_SPI_REG_BASE + 0x008)
+#define         AR9170_SPI_COMMAND_PORT0_CMD0_S         0
+#define         AR9170_SPI_COMMAND_PORT0_CMD0           0x000000ff
+#define         AR9170_SPI_COMMAND_PORT0_CMD1_S         8
+#define         AR9170_SPI_COMMAND_PORT0_CMD1           0x0000ff00
+#define         AR9170_SPI_COMMAND_PORT0_CMD2_S         16
+#define         AR9170_SPI_COMMAND_PORT0_CMD2           0x00ff0000
+#define         AR9170_SPI_COMMAND_PORT0_CMD3_S         24
+#define         AR9170_SPI_COMMAND_PORT0_CMD3           0xff000000
+
+#define AR9170_SPI_REG_COMMAND_PORT1            (AR9170_SPI_REG_BASE + 0x00C)
+#define         AR9170_SPI_COMMAND_PORT1_CMD4_S         0
+#define         AR9170_SPI_COMMAND_PORT1_CMD4           0x000000ff
+#define         AR9170_SPI_COMMAND_PORT1_CMD5_S         8
+#define         AR9170_SPI_COMMAND_PORT1_CMD5           0x0000ff00
+#define         AR9170_SPI_COMMAND_PORT1_CMD6_S         16
+#define         AR9170_SPI_COMMAND_PORT1_CMD6           0x00ff0000
+#define         AR9170_SPI_COMMAND_PORT1_CMD7_S         24
+#define         AR9170_SPI_COMMAND_PORT1_CMD7           0xff000000
+
+#define AR9170_SPI_REG_DATA_PORT                (AR9170_SPI_REG_BASE + 0x010)
+#define AR9170_SPI_REG_PAGE_WRITE_LEN           (AR9170_SPI_REG_BASE + 0x014)
+
+#define AR9170_EEPROM_REG_BASE                  (AR9170_MC_REG_BASE + 0x400)
+#define AR9170_EEPROM_REG_WP_MAGIC1             (AR9170_EEPROM_REG_BASE + 0x000)
+#define         AR9170_EEPROM_WP_MAGIC1                 0x12345678
+
+#define AR9170_EEPROM_REG_WP_MAGIC2             (AR9170_EEPROM_REG_BASE + 0x004)
+#define         AR9170_EEPROM_WP_MAGIC2                 0x55aa00ff
+
+#define AR9170_EEPROM_REG_WP_MAGIC3             (AR9170_EEPROM_REG_BASE + 0x008)
+#define         AR9170_EEPROM_WP_MAGIC3                 0x13579ace
+
+#define AR9170_EEPROM_REG_CLOCK_DIV             (AR9170_EEPROM_REG_BASE + 0x00C)
+#define         AR9170_EEPROM_CLOCK_DIV_FAC_S           0
+#define         AR9170_EEPROM_CLOCK_DIV_FAC             0x000001ff
+#define         AR9170_EEPROM_CLOCK_DIV_FAC_39KHZ       0xff
+#define         AR9170_EEPROM_CLOCK_DIV_FAC_78KHZ       0x7f
+#define         AR9170_EEPROM_CLOCK_DIV_FAC_312KHZ      0x1f
+#define         AR9170_EEPROM_CLOCK_DIV_FAC_10MHZ       0x0
+#define AR9170_EEPROM_CLOCK_DIV_SOFT_RST                BIT(9)
+
+#define AR9170_EEPROM_REG_MODE                  (AR9170_EEPROM_REG_BASE + 0x010)
+#define AR9170_EEPROM_MODE_EEPROM_SIZE_16K_PLUS         BIT(31)
+
+#define AR9170_EEPROM_REG_WRITE_PROTECT         (AR9170_EEPROM_REG_BASE + 0x014)
+#define         AR9170_EEPROM_WRITE_PROTECT_WP_STATUS   BIT(0)
+#define         AR9170_EEPROM_WRITE_PROTECT_WP_SET      BIT(8)
 
 /* Interrupt Controller */
 #define AR9170_MAX_INT_SRC                      9
@@ -589,11 +654,13 @@
 #define AR9170_USB_REG_EP10_MAP                 (AR9170_USB_REG_BASE + 0x039)
 
 #define AR9170_USB_REG_EP_IN_MAX_SIZE_HIGH      (AR9170_USB_REG_BASE + 0x03f)
+#define         AR9170_USB_EP_IN_STALL                  0x8
 #define         AR9170_USB_EP_IN_TOGGLE                 0x10
 
 #define AR9170_USB_REG_EP_IN_MAX_SIZE_LOW       (AR9170_USB_REG_BASE + 0x03e)
 
 #define AR9170_USB_REG_EP_OUT_MAX_SIZE_HIGH     (AR9170_USB_REG_BASE + 0x05f)
+#define         AR9170_USB_EP_OUT_STALL                 0x8
 #define         AR9170_USB_EP_OUT_TOGGLE                0x10
 
 #define AR9170_USB_REG_EP_OUT_MAX_SIZE_LOW      (AR9170_USB_REG_BASE + 0x05e)
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
index 2282847d4bb8..a0410fe8c03a 100644
--- a/drivers/net/wireless/ath/carl9170/version.h
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -1,7 +1,7 @@
 #ifndef __CARL9170_SHARED_VERSION_H
 #define __CARL9170_SHARED_VERSION_H
-#define CARL9170FW_VERSION_YEAR 12
-#define CARL9170FW_VERSION_MONTH 12
+#define CARL9170FW_VERSION_YEAR 16
+#define CARL9170FW_VERSION_MONTH 2
 #define CARL9170FW_VERSION_DAY 15
-#define CARL9170FW_VERSION_GIT "1.9.7"
+#define CARL9170FW_VERSION_GIT "1.9.9"
 #endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 1f231cd08138..11f1bb8dfebe 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -540,7 +540,18 @@ static int wil_cfg80211_disconnect(struct wiphy *wiphy,
 
         wil_dbg_misc(wil, "%s(reason=%d)\n", __func__, reason_code);
 
-        rc = wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
+        if (!(test_bit(wil_status_fwconnecting, wil->status) ||
+              test_bit(wil_status_fwconnected, wil->status))) {
+                wil_err(wil, "%s: Disconnect was called while disconnected\n",
+                        __func__);
+                return 0;
+        }
+
+        rc = wmi_call(wil, WMI_DISCONNECT_CMDID, NULL, 0,
+                      WMI_DISCONNECT_EVENTID, NULL, 0,
+                      WIL6210_DISCONNECT_TO_MS);
+        if (rc)
+                wil_err(wil, "%s: disconnect error %d\n", __func__, rc);
 
         return rc;
 }
@@ -701,6 +712,79 @@ static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
         return rc;
 }
 
+/**
+ * find a specific IE in a list of IEs
+ * return a pointer to the beginning of IE in the list
+ * or NULL if not found
+ */
+static const u8 *_wil_cfg80211_find_ie(const u8 *ies, u16 ies_len, const u8 *ie,
+                                       u16 ie_len)
+{
+        struct ieee80211_vendor_ie *vie;
+        u32 oui;
+
+        /* IE tag at offset 0, length at offset 1 */
+        if (ie_len < 2 || 2 + ie[1] > ie_len)
+                return NULL;
+
+        if (ie[0] != WLAN_EID_VENDOR_SPECIFIC)
+                return cfg80211_find_ie(ie[0], ies, ies_len);
+
+        /* make sure there is room for 3 bytes OUI + 1 byte OUI type */
+        if (ie[1] < 4)
+                return NULL;
+        vie = (struct ieee80211_vendor_ie *)ie;
+        oui = vie->oui[0] << 16 | vie->oui[1] << 8 | vie->oui[2];
+        return cfg80211_find_vendor_ie(oui, vie->oui_type, ies,
+                                       ies_len);
+}
+
+/**
+ * merge the IEs in two lists into a single list.
+ * do not include IEs from the second list which exist in the first list.
+ * add only vendor specific IEs from second list to keep
+ * the merged list sorted (since vendor-specific IE has the
+ * highest tag number)
+ * caller must free the allocated memory for merged IEs
+ */
+static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
+                                         const u8 *ies2, u16 ies2_len,
+                                         u8 **merged_ies, u16 *merged_len)
+{
+        u8 *buf, *dpos;
+        const u8 *spos;
+
+        if (ies1_len == 0 && ies2_len == 0) {
+                *merged_ies = NULL;
+                *merged_len = 0;
+                return 0;
+        }
+
+        buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        memcpy(buf, ies1, ies1_len);
+        dpos = buf + ies1_len;
+        spos = ies2;
+        while (spos + 1 < ies2 + ies2_len) {
+                /* IE tag at offset 0, length at offset 1 */
+                u16 ielen = 2 + spos[1];
+
+                if (spos + ielen > ies2 + ies2_len)
+                        break;
+                if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
+                    !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
+                        memcpy(dpos, spos, ielen);
+                        dpos += ielen;
+                }
+                spos += ielen;
+        }
+
+        *merged_ies = buf;
+        *merged_len = dpos - buf;
+        return 0;
+}
+
 static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
 {
         print_hex_dump_bytes("head     ", DUMP_PREFIX_OFFSET,
@@ -717,49 +801,49 @@ static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
                              b->assocresp_ies, b->assocresp_ies_len);
 }
 
-static int wil_fix_bcon(struct wil6210_priv *wil,
-                        struct cfg80211_beacon_data *bcon)
-{
-        struct ieee80211_mgmt *f = (struct ieee80211_mgmt *)bcon->probe_resp;
-        size_t hlen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
-
-        if (bcon->probe_resp_len <= hlen)
-                return 0;
-
-/* always use IE's from full probe frame, they has more info
- * notable RSN
- */
-        bcon->proberesp_ies = f->u.probe_resp.variable;
-        bcon->proberesp_ies_len = bcon->probe_resp_len - hlen;
-        if (!bcon->assocresp_ies) {
-                bcon->assocresp_ies = bcon->proberesp_ies;
-                bcon->assocresp_ies_len = bcon->proberesp_ies_len;
-        }
-
-        return 1;
-}
-
 /* internal functions for device reset and starting AP */
 static int _wil_cfg80211_set_ies(struct wiphy *wiphy,
                                  struct cfg80211_beacon_data *bcon)
 {
         int rc;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        u16 len = 0, proberesp_len = 0;
+        u8 *ies = NULL, *proberesp = NULL;
+
+        if (bcon->probe_resp) {
+                struct ieee80211_mgmt *f =
+                        (struct ieee80211_mgmt *)bcon->probe_resp;
+                size_t hlen = offsetof(struct ieee80211_mgmt,
+                                       u.probe_resp.variable);
+                proberesp = f->u.probe_resp.variable;
+                proberesp_len = bcon->probe_resp_len - hlen;
+        }
+        rc = _wil_cfg80211_merge_extra_ies(proberesp,
+                                           proberesp_len,
+                                           bcon->proberesp_ies,
+                                           bcon->proberesp_ies_len,
+                                           &ies, &len);
 
-        rc = wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
-                        bcon->proberesp_ies);
         if (rc)
-                return rc;
+                goto out;
 
-        rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
-                        bcon->assocresp_ies);
+        rc = wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, len, ies);
+        if (rc)
+                goto out;
+
+        if (bcon->assocresp_ies)
+                rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP,
+                                bcon->assocresp_ies_len, bcon->assocresp_ies);
+        else
+                rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, len, ies);
 #if 0 /* to use beacon IE's, remove this #if 0 */
         if (rc)
-                return rc;
+                goto out;
 
         rc = wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->tail_len, bcon->tail);
 #endif
-
+out:
+        kfree(ies);
         return rc;
 }
 
@@ -828,14 +912,9 @@ static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
         wil_dbg_misc(wil, "%s()\n", __func__);
         wil_print_bcon_data(bcon);
 
-        if (wil_fix_bcon(wil, bcon)) {
-                wil_dbg_misc(wil, "Fixed bcon\n");
-                wil_print_bcon_data(bcon);
-        }
-
-        if (bcon->proberesp_ies &&
-            cfg80211_find_ie(WLAN_EID_RSN, bcon->proberesp_ies,
-                             bcon->proberesp_ies_len))
+        if (bcon->tail &&
+            cfg80211_find_ie(WLAN_EID_RSN, bcon->tail,
+                             bcon->tail_len))
                 privacy = 1;
 
         /* in case privacy has changed, need to restart the AP */
@@ -910,11 +989,6 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         wil_print_bcon_data(bcon);
         wil_print_crypto(wil, crypto);
 
-        if (wil_fix_bcon(wil, bcon)) {
-                wil_dbg_misc(wil, "Fixed bcon\n");
-                wil_print_bcon_data(bcon);
-        }
-
         rc = _wil_cfg80211_start_ap(wiphy, ndev,
                                     info->ssid, info->ssid_len, info->privacy,
                                     info->beacon_interval, channel->hw_value,
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index a1d10b85989f..3bbe73b6d05a 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -68,13 +68,13 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
                 seq_puts(s, "???\n");
         }
 
-        if (vring->va && (vring->size < 1025)) {
+        if (vring->va && (vring->size <= (1 << WIL_RING_SIZE_ORDER_MAX))) {
                 uint i;
 
                 for (i = 0; i < vring->size; i++) {
                         volatile struct vring_tx_desc *d = &vring->va[i].tx;
 
-                        if ((i % 64) == 0 && (i != 0))
+                        if ((i % 128) == 0 && (i != 0))
                                 seq_puts(s, "\n");
                         seq_printf(s, "%c", (d->dma.status & BIT(0)) ?
                                         _s : (vring->ctx[i].skb ? _h : 'h'));
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index b39f0bfc591e..78ba6e04c944 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,9 +23,6 @@
 #include "wmi.h"
 #include "boot_loader.h"
 
-#define WAIT_FOR_DISCONNECT_TIMEOUT_MS 2000
-#define WAIT_FOR_DISCONNECT_INTERVAL_MS 10
-
 bool debug_fw; /* = false; */
 module_param(debug_fw, bool, S_IRUGO);
 MODULE_PARM_DESC(debug_fw, " do not perform card reset. For FW debug");
@@ -155,7 +152,7 @@ __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 
         if (sta->status != wil_sta_unused) {
                 if (!from_event)
-                        wmi_disconnect_sta(wil, sta->addr, reason_code);
+                        wmi_disconnect_sta(wil, sta->addr, reason_code, true);
 
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_AP:
@@ -195,8 +192,8 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
         struct wireless_dev *wdev = wil->wdev;
 
         might_sleep();
-        wil_dbg_misc(wil, "%s(bssid=%pM, reason=%d, ev%s)\n", __func__, bssid,
-                     reason_code, from_event ? "+" : "-");
+        wil_info(wil, "%s(bssid=%pM, reason=%d, ev%s)\n", __func__, bssid,
+                 reason_code, from_event ? "+" : "-");
 
         /* Cases are:
          * - disconnect single STA, still connected
@@ -258,13 +255,16 @@ static void wil_disconnect_worker(struct work_struct *work)
 static void wil_connect_timer_fn(ulong x)
 {
         struct wil6210_priv *wil = (void *)x;
+        bool q;
 
-        wil_dbg_misc(wil, "Connect timeout\n");
+        wil_err(wil, "Connect timeout detected, disconnect station\n");
 
         /* reschedule to thread context - disconnect won't
-         * run from atomic context
+         * run from atomic context.
+         * queue on wmi_wq to prevent race with connect event.
          */
-        schedule_work(&wil->disconnect_worker);
+        q = queue_work(wil->wmi_wq, &wil->disconnect_worker);
+        wil_dbg_wmi(wil, "queue_work of disconnect_worker -> %d\n", q);
 }
 
 static void wil_scan_timer_fn(ulong x)
@@ -369,6 +369,32 @@ static int wil_find_free_vring(struct wil6210_priv *wil)
         return -EINVAL;
 }
 
+int wil_tx_init(struct wil6210_priv *wil, int cid)
+{
+        int rc = -EINVAL, ringid;
+
+        if (cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                goto out;
+        }
+        ringid = wil_find_free_vring(wil);
+        if (ringid < 0) {
+                wil_err(wil, "No free vring found\n");
+                goto out;
+        }
+
+        wil_dbg_wmi(wil, "Configure for connection CID %d vring %d\n",
+                    cid, ringid);
+
+        rc = wil_vring_init_tx(wil, ringid, 1 << tx_ring_order, cid, 0);
+        if (rc)
+                wil_err(wil, "wil_vring_init_tx for CID %d vring %d failed\n",
+                        cid, ringid);
+
+out:
+        return rc;
+}
+
 int wil_bcast_init(struct wil6210_priv *wil)
 {
         int ri = wil->bcast_vring, rc;
@@ -399,41 +425,6 @@ void wil_bcast_fini(struct wil6210_priv *wil)
         wil_vring_fini_tx(wil, ri);
 }
 
-static void wil_connect_worker(struct work_struct *work)
-{
-        int rc, cid, ringid;
-        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
-                                                connect_worker);
-        struct net_device *ndev = wil_to_ndev(wil);
-
-        mutex_lock(&wil->mutex);
-
-        cid = wil->pending_connect_cid;
-        if (cid < 0) {
-                wil_err(wil, "No connection pending\n");
-                goto out;
-        }
-        ringid = wil_find_free_vring(wil);
-        if (ringid < 0) {
-                wil_err(wil, "No free vring found\n");
-                goto out;
-        }
-
-        wil_dbg_wmi(wil, "Configure for connection CID %d vring %d\n",
-                    cid, ringid);
-
-        rc = wil_vring_init_tx(wil, ringid, 1 << tx_ring_order, cid, 0);
-        wil->pending_connect_cid = -1;
-        if (rc == 0) {
-                wil->sta[cid].status = wil_sta_connected;
-                netif_tx_wake_all_queues(ndev);
-        } else {
-                wil_disconnect_cid(wil, cid, WLAN_REASON_UNSPECIFIED, true);
-        }
-out:
-        mutex_unlock(&wil->mutex);
-}
-
 int wil_priv_init(struct wil6210_priv *wil)
 {
         uint i;
@@ -444,6 +435,9 @@ int wil_priv_init(struct wil6210_priv *wil)
         for (i = 0; i < WIL6210_MAX_CID; i++)
                 spin_lock_init(&wil->sta[i].tid_rx_lock);
 
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++)
+                spin_lock_init(&wil->vring_tx_data[i].lock);
+
         mutex_init(&wil->mutex);
         mutex_init(&wil->wmi_mutex);
         mutex_init(&wil->back_rx_mutex);
@@ -453,12 +447,10 @@ int wil_priv_init(struct wil6210_priv *wil)
         init_completion(&wil->wmi_ready);
         init_completion(&wil->wmi_call);
 
-        wil->pending_connect_cid = -1;
         wil->bcast_vring = -1;
         setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
         setup_timer(&wil->scan_timer, wil_scan_timer_fn, (ulong)wil);
 
-        INIT_WORK(&wil->connect_worker, wil_connect_worker);
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
         INIT_WORK(&wil->fw_error_worker, wil_fw_error_worker);
@@ -844,7 +836,6 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw)
         }
 
         /* init after reset */
-        wil->pending_connect_cid = -1;
         wil->ap_isolate = 0;
         reinit_completion(&wil->wmi_ready);
         reinit_completion(&wil->wmi_call);
@@ -948,8 +939,7 @@ int wil_up(struct wil6210_priv *wil)
 
 int __wil_down(struct wil6210_priv *wil)
 {
-        int iter = WAIT_FOR_DISCONNECT_TIMEOUT_MS /
-                        WAIT_FOR_DISCONNECT_INTERVAL_MS;
+        int rc;
 
         WARN_ON(!mutex_is_locked(&wil->mutex));
 
@@ -973,22 +963,16 @@ int __wil_down(struct wil6210_priv *wil)
         }
 
         if (test_bit(wil_status_fwconnected, wil->status) ||
-            test_bit(wil_status_fwconnecting, wil->status))
-                wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
+            test_bit(wil_status_fwconnecting, wil->status)) {
 
-        /* make sure wil is idle (not connected) */
-        mutex_unlock(&wil->mutex);
-        while (iter--) {
-                int idle = !test_bit(wil_status_fwconnected, wil->status) &&
-                           !test_bit(wil_status_fwconnecting, wil->status);
-                if (idle)
-                        break;
-                msleep(WAIT_FOR_DISCONNECT_INTERVAL_MS);
+                mutex_unlock(&wil->mutex);
+                rc = wmi_call(wil, WMI_DISCONNECT_CMDID, NULL, 0,
+                              WMI_DISCONNECT_EVENTID, NULL, 0,
+                              WIL6210_DISCONNECT_TO_MS);
+                mutex_lock(&wil->mutex);
+                if (rc)
+                        wil_err(wil, "timeout waiting for disconnect\n");
         }
-        mutex_lock(&wil->mutex);
-
-        if (iter < 0)
-                wil_err(wil, "timeout waiting for idle FW/HW\n");
 
         wil_reset(wil, false);
 
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 56aaa2d4fb0e..ecc3c1bdae4b 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -108,8 +108,9 @@ static int wil6210_netdev_poll_tx(struct napi_struct *napi, int budget)
         /* always process ALL Tx complete, regardless budget - it is fast */
         for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
                 struct vring *vring = &wil->vring_tx[i];
+                struct vring_tx_data *txdata = &wil->vring_tx_data[i];
 
-                if (!vring->va)
+                if (!vring->va || !txdata->enabled)
                         continue;
 
                 tx_done += wil_tx_complete(wil, i);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 7887e6cfd817..6af20903cf89 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -717,6 +717,21 @@ void wil_rx_fini(struct wil6210_priv *wil)
                 wil_vring_free(wil, vring, 0);
 }
 
+static inline void wil_tx_data_init(struct vring_tx_data *txdata)
+{
+        spin_lock_bh(&txdata->lock);
+        txdata->dot1x_open = 0;
+        txdata->enabled = 0;
+        txdata->idle = 0;
+        txdata->last_idle = 0;
+        txdata->begin = 0;
+        txdata->agg_wsize = 0;
+        txdata->agg_timeout = 0;
+        txdata->agg_amsdu = 0;
+        txdata->addba_in_progress = false;
+        spin_unlock_bh(&txdata->lock);
+}
+
 int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                       int cid, int tid)
 {
@@ -758,8 +773,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 goto out;
         }
 
-        memset(txdata, 0, sizeof(*txdata));
-        spin_lock_init(&txdata->lock);
+        wil_tx_data_init(txdata);
         vring->size = size;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -791,9 +805,14 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
 
         return 0;
  out_free:
+        spin_lock_bh(&txdata->lock);
         txdata->dot1x_open = false;
         txdata->enabled = 0;
+        spin_unlock_bh(&txdata->lock);
         wil_vring_free(wil, vring, 1);
+        wil->vring2cid_tid[id][0] = WIL6210_MAX_CID;
+        wil->vring2cid_tid[id][1] = 0;
+
  out:
 
         return rc;
@@ -831,8 +850,7 @@ int wil_vring_init_bcast(struct wil6210_priv *wil, int id, int size)
                 goto out;
         }
 
-        memset(txdata, 0, sizeof(*txdata));
-        spin_lock_init(&txdata->lock);
+        wil_tx_data_init(txdata);
         vring->size = size;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -862,8 +880,10 @@ int wil_vring_init_bcast(struct wil6210_priv *wil, int id, int size)
 
         return 0;
  out_free:
+        spin_lock_bh(&txdata->lock);
         txdata->enabled = 0;
         txdata->dot1x_open = false;
+        spin_unlock_bh(&txdata->lock);
         wil_vring_free(wil, vring, 1);
  out:
 
@@ -891,7 +911,6 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
                 napi_synchronize(&wil->napi_tx);
 
         wil_vring_free(wil, vring, 1);
-        memset(txdata, 0, sizeof(*txdata));
 }
 
 static struct vring *wil_find_tx_ucast(struct wil6210_priv *wil,
@@ -911,10 +930,11 @@ static struct vring *wil_find_tx_ucast(struct wil6210_priv *wil,
                         continue;
                 if (wil->vring2cid_tid[i][0] == cid) {
                         struct vring *v = &wil->vring_tx[i];
+                        struct vring_tx_data *txdata = &wil->vring_tx_data[i];
 
                         wil_dbg_txrx(wil, "%s(%pM) -> [%d]\n",
                                      __func__, eth->h_dest, i);
-                        if (v->va) {
+                        if (v->va && txdata->enabled) {
                                 return v;
                         } else {
                                 wil_dbg_txrx(wil, "vring[%d] not valid\n", i);
@@ -935,6 +955,7 @@ static struct vring *wil_find_tx_vring_sta(struct wil6210_priv *wil,
         struct vring *v;
         int i;
         u8 cid;
+        struct vring_tx_data *txdata;
 
         /* In the STA mode, it is expected to have only 1 VRING
          * for the AP we connected to.
@@ -942,7 +963,8 @@ static struct vring *wil_find_tx_vring_sta(struct wil6210_priv *wil,
          */
         for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
                 v = &wil->vring_tx[i];
-                if (!v->va)
+                txdata = &wil->vring_tx_data[i];
+                if (!v->va || !txdata->enabled)
                         continue;
 
                 cid = wil->vring2cid_tid[i][0];
@@ -978,12 +1000,14 @@ static struct vring *wil_find_tx_bcast_1(struct wil6210_priv *wil,
                                          struct sk_buff *skb)
 {
         struct vring *v;
+        struct vring_tx_data *txdata;
         int i = wil->bcast_vring;
 
         if (i < 0)
                 return NULL;
         v = &wil->vring_tx[i];
-        if (!v->va)
+        txdata = &wil->vring_tx_data[i];
+        if (!v->va || !txdata->enabled)
                 return NULL;
         if (!wil->vring_tx_data[i].dot1x_open &&
             (skb->protocol != cpu_to_be16(ETH_P_PAE)))
@@ -1010,11 +1034,13 @@ static struct vring *wil_find_tx_bcast_2(struct wil6210_priv *wil,
         u8 cid;
         struct ethhdr *eth = (void *)skb->data;
         char *src = eth->h_source;
+        struct vring_tx_data *txdata;
 
         /* find 1-st vring eligible for data */
         for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
                 v = &wil->vring_tx[i];
-                if (!v->va)
+                txdata = &wil->vring_tx_data[i];
+                if (!v->va || !txdata->enabled)
                         continue;
 
                 cid = wil->vring2cid_tid[i][0];
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 235e205ce2bc..8427d68b6fa8 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -51,7 +51,7 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 
 #define WIL_TX_Q_LEN_DEFAULT            (4000)
 #define WIL_RX_RING_SIZE_ORDER_DEFAULT  (10)
-#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (10)
+#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (12)
 #define WIL_BCAST_RING_SIZE_ORDER_DEFAULT       (7)
 #define WIL_BCAST_MCS0_LIMIT            (1024) /* limit for MCS0 frame size */
 /* limit ring size in range [32..32k] */
@@ -92,6 +92,7 @@ static inline u32 wil_mtu2macbuf(u32 mtu)
 #define WIL6210_FW_RECOVERY_RETRIES     (5) /* try to recover this many times */
 #define WIL6210_FW_RECOVERY_TO  msecs_to_jiffies(5000)
 #define WIL6210_SCAN_TO         msecs_to_jiffies(10000)
+#define WIL6210_DISCONNECT_TO_MS (2000)
 #define WIL6210_RX_HIGH_TRSH_INIT               (0)
 #define WIL6210_RX_HIGH_TRSH_DEFAULT \
                                 (1 << (WIL_RX_RING_SIZE_ORDER_DEFAULT - 3))
@@ -581,12 +582,10 @@ struct wil6210_priv {
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
         struct workqueue_struct *wq_service;
-        struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct work_struct fw_error_worker;     /* for FW error recovery */
         struct timer_list connect_timer;
         struct timer_list scan_timer; /* detect scan timeout */
-        int pending_connect_cid;
         struct list_head pending_wmi_ev;
         /*
          * protect pending_wmi_ev
@@ -756,7 +755,8 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring);
 int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
 int wmi_rxon(struct wil6210_priv *wil, bool on);
 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
-int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason);
+int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason,
+                       bool full_disconnect);
 int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout);
 int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason);
 int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason);
@@ -807,6 +807,7 @@ void wil_rx_fini(struct wil6210_priv *wil);
 int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                       int cid, int tid);
 void wil_vring_fini_tx(struct wil6210_priv *wil, int id);
+int wil_tx_init(struct wil6210_priv *wil, int cid);
 int wil_vring_init_bcast(struct wil6210_priv *wil, int id, int size);
 int wil_bcast_init(struct wil6210_priv *wil);
 void wil_bcast_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index e3ea74cdd4aa..493e721c4fa7 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -426,6 +426,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         const size_t assoc_req_ie_offset = sizeof(u16) * 2;
         /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
         const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
+        int rc;
 
         if (len < sizeof(*evt)) {
                 wil_err(wil, "Connect event too short : %d bytes\n", len);
@@ -445,8 +446,8 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         }
 
         ch = evt->channel + 1;
-        wil_dbg_wmi(wil, "Connect %pM channel [%d] cid %d\n",
-                    evt->bssid, ch, evt->cid);
+        wil_info(wil, "Connect %pM channel [%d] cid %d\n",
+                 evt->bssid, ch, evt->cid);
         wil_hex_dump_wmi("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
                          evt->assoc_info, len - sizeof(*evt), true);
 
@@ -468,20 +469,67 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
                 assoc_resp_ielen = 0;
         }
 
+        mutex_lock(&wil->mutex);
+        if (test_bit(wil_status_resetting, wil->status) ||
+            !test_bit(wil_status_fwready, wil->status)) {
+                wil_err(wil, "status_resetting, cancel connect event, CID %d\n",
+                        evt->cid);
+                mutex_unlock(&wil->mutex);
+                /* no need for cleanup, wil_reset will do that */
+                return;
+        }
+
         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
                 if (!test_bit(wil_status_fwconnecting, wil->status)) {
                         wil_err(wil, "Not in connecting state\n");
+                        mutex_unlock(&wil->mutex);
                         return;
                 }
                 del_timer_sync(&wil->connect_timer);
-                cfg80211_connect_result(ndev, evt->bssid,
-                                        assoc_req_ie, assoc_req_ielen,
-                                        assoc_resp_ie, assoc_resp_ielen,
-                                        WLAN_STATUS_SUCCESS, GFP_KERNEL);
+        }
+
+        /* FIXME FW can transmit only ucast frames to peer */
+        /* FIXME real ring_id instead of hard coded 0 */
+        ether_addr_copy(wil->sta[evt->cid].addr, evt->bssid);
+        wil->sta[evt->cid].status = wil_sta_conn_pending;
 
+        rc = wil_tx_init(wil, evt->cid);
+        if (rc) {
+                wil_err(wil, "%s: config tx vring failed for CID %d, rc (%d)\n",
+                        __func__, evt->cid, rc);
+                wmi_disconnect_sta(wil, wil->sta[evt->cid].addr,
+                                   WLAN_REASON_UNSPECIFIED, false);
+        } else {
+                wil_info(wil, "%s: successful connection to CID %d\n",
+                         __func__, evt->cid);
+        }
+
+        if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
+            (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
+                if (rc) {
+                        netif_tx_stop_all_queues(ndev);
+                        netif_carrier_off(ndev);
+                        wil_err(wil,
+                                "%s: cfg80211_connect_result with failure\n",
+                                __func__);
+                        cfg80211_connect_result(ndev, evt->bssid, NULL, 0,
+                                                NULL, 0,
+                                                WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                                GFP_KERNEL);
+                        goto out;
+                } else {
+                        cfg80211_connect_result(ndev, evt->bssid,
+                                                assoc_req_ie, assoc_req_ielen,
+                                                assoc_resp_ie, assoc_resp_ielen,
+                                                WLAN_STATUS_SUCCESS,
+                                                GFP_KERNEL);
+                }
         } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
                    (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
+                if (rc)
+                        goto out;
+
                 memset(&sinfo, 0, sizeof(sinfo));
 
                 sinfo.generation = wil->sinfo_gen++;
@@ -492,17 +540,21 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
                 }
 
                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
+        } else {
+                wil_err(wil, "%s: unhandled iftype %d for CID %d\n",
+                        __func__, wdev->iftype, evt->cid);
+                goto out;
         }
-        clear_bit(wil_status_fwconnecting, wil->status);
-        set_bit(wil_status_fwconnected, wil->status);
 
-        /* FIXME FW can transmit only ucast frames to peer */
-        /* FIXME real ring_id instead of hard coded 0 */
-        ether_addr_copy(wil->sta[evt->cid].addr, evt->bssid);
-        wil->sta[evt->cid].status = wil_sta_conn_pending;
+        wil->sta[evt->cid].status = wil_sta_connected;
+        set_bit(wil_status_fwconnected, wil->status);
+        netif_tx_wake_all_queues(ndev);
 
-        wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wq_service, &wil->connect_worker);
+out:
+        if (rc)
+                wil->sta[evt->cid].status = wil_sta_unused;
+        clear_bit(wil_status_fwconnecting, wil->status);
+        mutex_unlock(&wil->mutex);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -511,8 +563,8 @@ static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
         struct wmi_disconnect_event *evt = d;
         u16 reason_code = le16_to_cpu(evt->protocol_reason_status);
 
-        wil_dbg_wmi(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
-                    evt->bssid, reason_code, evt->disconnect_reason);
+        wil_info(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
+                 evt->bssid, reason_code, evt->disconnect_reason);
 
         wil->sinfo_gen++;
 
@@ -727,6 +779,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         void __iomem *src;
         ulong flags;
         unsigned n;
+        unsigned int num_immed_reply = 0;
 
         if (!test_bit(wil_status_mbox_ready, wil->status)) {
                 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
@@ -736,6 +789,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         for (n = 0;; n++) {
                 u16 len;
                 bool q;
+                bool immed_reply = false;
 
                 r->head = wil_r(wil, RGF_MBOX +
                                 offsetof(struct wil6210_mbox_ctl, rx.head));
@@ -784,6 +838,15 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                         struct wil6210_mbox_hdr_wmi *wmi = &evt->event.wmi;
                         u16 id = le16_to_cpu(wmi->id);
                         u32 tstamp = le32_to_cpu(wmi->timestamp);
+                        spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+                        if (wil->reply_id && wil->reply_id == id) {
+                                if (wil->reply_buf) {
+                                        memcpy(wil->reply_buf, wmi,
+                                               min(len, wil->reply_size));
+                                        immed_reply = true;
+                                }
+                        }
+                        spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
 
                         wil_dbg_wmi(wil, "WMI event 0x%04x MID %d @%d msec\n",
                                     id, wmi->mid, tstamp);
@@ -799,15 +862,24 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                 wil_w(wil, RGF_MBOX +
                       offsetof(struct wil6210_mbox_ctl, rx.tail), r->tail);
 
-                /* add to the pending list */
-                spin_lock_irqsave(&wil->wmi_ev_lock, flags);
-                list_add_tail(&evt->list, &wil->pending_wmi_ev);
-                spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
-                q = queue_work(wil->wmi_wq, &wil->wmi_event_worker);
-                wil_dbg_wmi(wil, "queue_work -> %d\n", q);
+                if (immed_reply) {
+                        wil_dbg_wmi(wil, "%s: Complete WMI 0x%04x\n",
+                                    __func__, wil->reply_id);
+                        kfree(evt);
+                        num_immed_reply++;
+                        complete(&wil->wmi_call);
+                } else {
+                        /* add to the pending list */
+                        spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+                        list_add_tail(&evt->list, &wil->pending_wmi_ev);
+                        spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+                        q = queue_work(wil->wmi_wq, &wil->wmi_event_worker);
+                        wil_dbg_wmi(wil, "queue_work -> %d\n", q);
+                }
         }
         /* normally, 1 event per IRQ should be processed */
-        wil_dbg_wmi(wil, "%s -> %d events queued\n", __func__, n);
+        wil_dbg_wmi(wil, "%s -> %d events queued, %d completed\n", __func__,
+                    n - num_immed_reply, num_immed_reply);
 }
 
 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
@@ -818,13 +890,16 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
 
         mutex_lock(&wil->wmi_mutex);
 
+        spin_lock(&wil->wmi_ev_lock);
+        wil->reply_id = reply_id;
+        wil->reply_buf = reply;
+        wil->reply_size = reply_size;
+        spin_unlock(&wil->wmi_ev_lock);
+
         rc = __wmi_send(wil, cmdid, buf, len);
         if (rc)
                 goto out;
 
-        wil->reply_id = reply_id;
-        wil->reply_buf = reply;
-        wil->reply_size = reply_size;
         remain = wait_for_completion_timeout(&wil->wmi_call,
                                              msecs_to_jiffies(to_msec));
         if (0 == remain) {
@@ -837,10 +912,14 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
                             cmdid, reply_id,
                             to_msec - jiffies_to_msecs(remain));
         }
+
+out:
+        spin_lock(&wil->wmi_ev_lock);
         wil->reply_id = 0;
         wil->reply_buf = NULL;
         wil->reply_size = 0;
- out:
+        spin_unlock(&wil->wmi_ev_lock);
+
         mutex_unlock(&wil->wmi_mutex);
 
         return rc;
@@ -1184,7 +1263,8 @@ int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_bb, u32 *t_rf)
         return 0;
 }
 
-int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason)
+int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason,
+                       bool full_disconnect)
 {
         int rc;
         u16 reason_code;
@@ -1208,19 +1288,20 @@ int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason)
                 return rc;
         }
 
-        /* call event handler manually after processing wmi_call,
-         * to avoid deadlock - disconnect event handler acquires wil->mutex
-         * while it is already held here
-         */
-        reason_code = le16_to_cpu(reply.evt.protocol_reason_status);
-
-        wil_dbg_wmi(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
-                    reply.evt.bssid, reason_code,
-                    reply.evt.disconnect_reason);
+        if (full_disconnect) {
+                /* call event handler manually after processing wmi_call,
+                 * to avoid deadlock - disconnect event handler acquires
+                 * wil->mutex while it is already held here
+                 */
+                reason_code = le16_to_cpu(reply.evt.protocol_reason_status);
 
-        wil->sinfo_gen++;
-        wil6210_disconnect(wil, reply.evt.bssid, reason_code, true);
+                wil_dbg_wmi(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
+                            reply.evt.bssid, reason_code,
+                            reply.evt.disconnect_reason);
 
+                wil->sinfo_gen++;
+                wil6210_disconnect(wil, reply.evt.bssid, reason_code, true);
+        }
         return 0;
 }
 
@@ -1348,14 +1429,11 @@ static void wmi_event_handle(struct wil6210_priv *wil,
                             id, wil->reply_id);
                 /* check if someone waits for this event */
                 if (wil->reply_id && wil->reply_id == id) {
-                        if (wil->reply_buf) {
-                                memcpy(wil->reply_buf, wmi,
-                                       min(len, wil->reply_size));
-                        } else {
-                                wmi_evt_call_handler(wil, id, evt_data,
-                                                     len - sizeof(*wmi));
-                        }
-                        wil_dbg_wmi(wil, "Complete WMI 0x%04x\n", id);
+                        WARN_ON(wil->reply_buf);
+                        wmi_evt_call_handler(wil, id, evt_data,
+                                             len - sizeof(*wmi));
+                        wil_dbg_wmi(wil, "%s: Complete WMI 0x%04x\n",
+                                    __func__, id);
                         complete(&wil->wmi_call);
                         return;
                 }
diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
index dab25136214a..1efb1d66e0b7 100644
--- a/drivers/net/wireless/atmel/at76c50x-usb.c
+++ b/drivers/net/wireless/atmel/at76c50x-usb.c
@@ -2481,9 +2481,7 @@ static int at76_probe(struct usb_interface *interface,
                         dev_err(&interface->dev,
                                 "error %d downloading internal firmware\n",
                                 ret);
-                        goto exit;
                 }
-                usb_put_dev(udev);
                 goto exit;
         }
 
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index c279211e49f9..72380af9dc52 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -4375,12 +4375,10 @@ redo:
         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
         orig_dev = dev;
         mutex_unlock(&wl->mutex);
-        if (b43_bus_host_is_sdio(dev->dev)) {
+        if (b43_bus_host_is_sdio(dev->dev))
                 b43_sdio_free_irq(dev);
-        } else {
-                synchronize_irq(dev->dev->irq);
+        else
                 free_irq(dev->dev->irq, dev);
-        }
         mutex_lock(&wl->mutex);
         dev = wl->current_dev;
         if (!dev)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index b98db8a0a069..da0cdd313880 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -27,8 +27,6 @@
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>
-#include <linux/platform_device.h>
-#include <linux/platform_data/brcmfmac-sdio.h>
 #include <linux/pm_runtime.h>
 #include <linux/suspend.h>
 #include <linux/errno.h>
@@ -46,7 +44,6 @@
 #include "bus.h"
 #include "debug.h"
 #include "sdio.h"
-#include "of.h"
 #include "core.h"
 #include "common.h"
 
@@ -106,18 +103,18 @@ static void brcmf_sdiod_dummy_irqhandler(struct sdio_func *func)
 
 int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
+        struct brcmfmac_sdio_pd *pdata;
         int ret = 0;
         u8 data;
         u32 addr, gpiocontrol;
         unsigned long flags;
 
-        if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
+        pdata = &sdiodev->settings->bus.sdio;
+        if (pdata->oob_irq_supported) {
                 brcmf_dbg(SDIO, "Enter, register OOB IRQ %d\n",
-                          sdiodev->pdata->oob_irq_nr);
-                ret = request_irq(sdiodev->pdata->oob_irq_nr,
-                                  brcmf_sdiod_oob_irqhandler,
-                                  sdiodev->pdata->oob_irq_flags,
-                                  "brcmf_oob_intr",
+                          pdata->oob_irq_nr);
+                ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
+                                  pdata->oob_irq_flags, "brcmf_oob_intr",
                                   &sdiodev->func[1]->dev);
                 if (ret != 0) {
                         brcmf_err("request_irq failed %d\n", ret);
@@ -129,7 +126,7 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
                 sdiodev->irq_en = true;
                 spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
 
-                ret = enable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                ret = enable_irq_wake(pdata->oob_irq_nr);
                 if (ret != 0) {
                         brcmf_err("enable_irq_wake failed %d\n", ret);
                         return ret;
@@ -158,7 +155,7 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 
                 /* redirect, configure and enable io for interrupt signal */
                 data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-                if (sdiodev->pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+                if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
                         data |= SDIO_SEPINT_ACT_HI;
                 brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
 
@@ -176,9 +173,12 @@ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 
 int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev)
 {
+        struct brcmfmac_sdio_pd *pdata;
+
         brcmf_dbg(SDIO, "Entering\n");
 
-        if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
+        pdata = &sdiodev->settings->bus.sdio;
+        if (pdata->oob_irq_supported) {
                 sdio_claim_host(sdiodev->func[1]);
                 brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
                 brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
@@ -187,11 +187,10 @@ int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev)
                 if (sdiodev->oob_irq_requested) {
                         sdiodev->oob_irq_requested = false;
                         if (sdiodev->irq_wake) {
-                                disable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                                disable_irq_wake(pdata->oob_irq_nr);
                                 sdiodev->irq_wake = false;
                         }
-                        free_irq(sdiodev->pdata->oob_irq_nr,
-                                 &sdiodev->func[1]->dev);
+                        free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
                         sdiodev->irq_en = false;
                 }
         } else {
@@ -523,7 +522,7 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
         target_list = pktlist;
         /* for host with broken sg support, prepare a page aligned list */
         __skb_queue_head_init(&local_list);
-        if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
+        if (!write && sdiodev->settings->bus.sdio.broken_sg_support) {
                 req_sz = 0;
                 skb_queue_walk(pktlist, pkt_next)
                         req_sz += pkt_next->len;
@@ -630,7 +629,7 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 }
         }
 
-        if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
+        if (!write && sdiodev->settings->bus.sdio.broken_sg_support) {
                 local_pkt_next = local_list.next;
                 orig_offset = 0;
                 skb_queue_walk(pktlist, pkt_next) {
@@ -901,7 +900,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
                 return;
 
         nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE,
-                      sdiodev->bus_if->drvr->settings->sdiod_txglomsz);
+                      sdiodev->settings->bus.sdio.txglomsz);
         nents += (nents >> 4) + 1;
 
         WARN_ON(nents > sdiodev->max_segment_count);
@@ -913,7 +912,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
                 sdiodev->sg_support = false;
         }
 
-        sdiodev->txglomsz = sdiodev->bus_if->drvr->settings->sdiod_txglomsz;
+        sdiodev->txglomsz = sdiodev->settings->bus.sdio.txglomsz;
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -1103,8 +1102,6 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
 
-static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
-
 
 static void brcmf_sdiod_acpi_set_power_manageable(struct device *dev,
                                                   int val)
@@ -1167,20 +1164,6 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         dev_set_drvdata(&func->dev, bus_if);
         dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
         sdiodev->dev = &sdiodev->func[1]->dev;
-        sdiodev->pdata = brcmfmac_sdio_pdata;
-
-        if (!sdiodev->pdata)
-                brcmf_of_probe(sdiodev);
-
-#ifdef CONFIG_PM_SLEEP
-        /* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
-         * is true or when platform data OOB irq is true).
-         */
-        if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
-            ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
-             (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)))
-                bus_if->wowl_supported = true;
-#endif
 
         brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
 
@@ -1263,8 +1246,8 @@ static int brcmf_ops_sdio_suspend(struct device *dev)
 
         sdio_flags = MMC_PM_KEEP_POWER;
         if (sdiodev->wowl_enabled) {
-                if (sdiodev->pdata->oob_irq_supported)
-                        enable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                if (sdiodev->settings->bus.sdio.oob_irq_supported)
+                        enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
                 else
                         sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
         }
@@ -1296,7 +1279,7 @@ static const struct dev_pm_ops brcmf_sdio_pm_ops = {
 static struct sdio_driver brcmf_sdmmc_driver = {
         .probe = brcmf_ops_sdio_probe,
         .remove = brcmf_ops_sdio_remove,
-        .name = BRCMFMAC_SDIO_PDATA_NAME,
+        .name = KBUILD_MODNAME,
         .id_table = brcmf_sdmmc_ids,
         .drv = {
                 .owner = THIS_MODULE,
@@ -1306,37 +1289,6 @@ static struct sdio_driver brcmf_sdmmc_driver = {
         },
 };
 
-static int __init brcmf_sdio_pd_probe(struct platform_device *pdev)
-{
-        brcmf_dbg(SDIO, "Enter\n");
-
-        brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
-
-        if (brcmfmac_sdio_pdata->power_on)
-                brcmfmac_sdio_pdata->power_on();
-
-        return 0;
-}
-
-static int brcmf_sdio_pd_remove(struct platform_device *pdev)
-{
-        brcmf_dbg(SDIO, "Enter\n");
-
-        if (brcmfmac_sdio_pdata->power_off)
-                brcmfmac_sdio_pdata->power_off();
-
-        sdio_unregister_driver(&brcmf_sdmmc_driver);
-
-        return 0;
-}
-
-static struct platform_driver brcmf_sdio_pd = {
-        .remove         = brcmf_sdio_pd_remove,
-        .driver         = {
-                .name   = BRCMFMAC_SDIO_PDATA_NAME,
-        }
-};
-
 void brcmf_sdio_register(void)
 {
         int ret;
@@ -1350,19 +1302,6 @@ void brcmf_sdio_exit(void)
 {
         brcmf_dbg(SDIO, "Enter\n");
 
-        if (brcmfmac_sdio_pdata)
-                platform_driver_unregister(&brcmf_sdio_pd);
-        else
-                sdio_unregister_driver(&brcmf_sdmmc_driver);
+        sdio_unregister_driver(&brcmf_sdmmc_driver);
 }
 
-void __init brcmf_sdio_init(void)
-{
-        int ret;
-
-        brcmf_dbg(SDIO, "Enter\n");
-
-        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
-        if (ret == -ENODEV)
-                brcmf_dbg(SDIO, "No platform data available.\n");
-}
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
index 36093f93bfbe..8e02a478e889 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
@@ -43,6 +43,8 @@ enum brcmf_bus_protocol_type {
         BRCMF_PROTO_MSGBUF
 };
 
+struct brcmf_mp_device;
+
 struct brcmf_bus_dcmd {
         char *name;
         char *param;
@@ -217,7 +219,7 @@ bool brcmf_c_prec_enq(struct device *dev, struct pktq *q, struct sk_buff *pkt,
 void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
-int brcmf_attach(struct device *dev);
+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings);
 /* Indication from bus module regarding removal/absence of dongle */
 void brcmf_detach(struct device *dev);
 /* Indication from bus module that dongle should be reset */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d00c5c1d58bf..d5c2a27573b4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -72,8 +72,13 @@
 #define RSN_AKM_NONE                    0       /* None (IBSS) */
 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
+#define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
+#define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
-#define RSN_CAP_PTK_REPLAY_CNTR_MASK    0x000C
+#define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
+#define RSN_CAP_MFPR_MASK               BIT(6)
+#define RSN_CAP_MFPC_MASK               BIT(7)
+#define RSN_PMKID_COUNT_LEN             2
 
 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
                                                  * string :"add", "del" (+ NUL)
@@ -211,12 +216,19 @@ static const struct ieee80211_regdomain brcmf_regdom = {
                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 };
 
-static const u32 __wl_cipher_suites[] = {
+/* Note: brcmf_cipher_suites is an array of int defining which cipher suites
+ * are supported. A pointer to this array and the number of entries is passed
+ * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
+ * So the cipher suite AES_CMAC has to be the last one in the array, and when
+ * device does not support MFP then the number of suites will be decreased by 1
+ */
+static const u32 brcmf_cipher_suites[] = {
         WLAN_CIPHER_SUITE_WEP40,
         WLAN_CIPHER_SUITE_WEP104,
         WLAN_CIPHER_SUITE_TKIP,
         WLAN_CIPHER_SUITE_CCMP,
-        WLAN_CIPHER_SUITE_AES_CMAC,
+        /* Keep as last entry: */
+        WLAN_CIPHER_SUITE_AES_CMAC
 };
 
 /* Vendor specific ie. id = 221, oui and type defines exact ie */
@@ -456,7 +468,7 @@ send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 }
 
 static s32
-brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
+brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 {
         s32 err;
         u32 mode;
@@ -484,6 +496,15 @@ brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
                                   enable, mode);
         }
 
+        err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
+        if (err) {
+                brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
+                          enable, err);
+                err = 0;
+        } else
+                brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
+                          enable, mode);
+
         return err;
 }
 
@@ -564,8 +585,8 @@ struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
         }
 
         /* wait for firmware event */
-        err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
-                                                    BRCMF_VIF_EVENT_TIMEOUT);
+        err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
+                                            BRCMF_VIF_EVENT_TIMEOUT);
         brcmf_cfg80211_arm_vif_event(cfg, NULL);
         if (!err) {
                 brcmf_err("timeout occurred\n");
@@ -1125,7 +1146,7 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
 
         /* Arm scan timeout timer */
         mod_timer(&cfg->escan_timeout, jiffies +
-                        WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
+                        BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
 
         return 0;
 
@@ -1524,7 +1545,7 @@ static s32 brcmf_set_auth_type(struct net_device *ndev,
 
 static s32
 brcmf_set_wsec_mode(struct net_device *ndev,
-                     struct cfg80211_connect_params *sme, bool mfp)
+                    struct cfg80211_connect_params *sme)
 {
         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
         struct brcmf_cfg80211_security *sec;
@@ -1583,10 +1604,7 @@ brcmf_set_wsec_mode(struct net_device *ndev,
             sme->privacy)
                 pval = AES_ENABLED;
 
-        if (mfp)
-                wsec = pval | gval | MFP_CAPABLE;
-        else
-                wsec = pval | gval;
+        wsec = pval | gval;
         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
         if (err) {
                 brcmf_err("error (%d)\n", err);
@@ -1603,56 +1621,100 @@ brcmf_set_wsec_mode(struct net_device *ndev,
 static s32
 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
 {
-        struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
-        struct brcmf_cfg80211_security *sec;
-        s32 val = 0;
-        s32 err = 0;
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 val;
+        s32 err;
+        const struct brcmf_tlv *rsn_ie;
+        const u8 *ie;
+        u32 ie_len;
+        u32 offset;
+        u16 rsn_cap;
+        u32 mfp;
+        u16 count;
 
-        if (sme->crypto.n_akm_suites) {
-                err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
-                                               "wpa_auth", &val);
-                if (err) {
-                        brcmf_err("could not get wpa_auth (%d)\n", err);
-                        return err;
+        if (!sme->crypto.n_akm_suites)
+                return 0;
+
+        err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
+        if (err) {
+                brcmf_err("could not get wpa_auth (%d)\n", err);
+                return err;
+        }
+        if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+                switch (sme->crypto.akm_suites[0]) {
+                case WLAN_AKM_SUITE_8021X:
+                        val = WPA_AUTH_UNSPECIFIED;
+                        break;
+                case WLAN_AKM_SUITE_PSK:
+                        val = WPA_AUTH_PSK;
+                        break;
+                default:
+                        brcmf_err("invalid cipher group (%d)\n",
+                                  sme->crypto.cipher_group);
+                        return -EINVAL;
                 }
-                if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
-                        switch (sme->crypto.akm_suites[0]) {
-                        case WLAN_AKM_SUITE_8021X:
-                                val = WPA_AUTH_UNSPECIFIED;
-                                break;
-                        case WLAN_AKM_SUITE_PSK:
-                                val = WPA_AUTH_PSK;
-                                break;
-                        default:
-                                brcmf_err("invalid cipher group (%d)\n",
-                                          sme->crypto.cipher_group);
-                                return -EINVAL;
-                        }
-                } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
-                        switch (sme->crypto.akm_suites[0]) {
-                        case WLAN_AKM_SUITE_8021X:
-                                val = WPA2_AUTH_UNSPECIFIED;
-                                break;
-                        case WLAN_AKM_SUITE_PSK:
-                                val = WPA2_AUTH_PSK;
-                                break;
-                        default:
-                                brcmf_err("invalid cipher group (%d)\n",
-                                          sme->crypto.cipher_group);
-                                return -EINVAL;
-                        }
+        } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+                switch (sme->crypto.akm_suites[0]) {
+                case WLAN_AKM_SUITE_8021X:
+                        val = WPA2_AUTH_UNSPECIFIED;
+                        break;
+                case WLAN_AKM_SUITE_8021X_SHA256:
+                        val = WPA2_AUTH_1X_SHA256;
+                        break;
+                case WLAN_AKM_SUITE_PSK_SHA256:
+                        val = WPA2_AUTH_PSK_SHA256;
+                        break;
+                case WLAN_AKM_SUITE_PSK:
+                        val = WPA2_AUTH_PSK;
+                        break;
+                default:
+                        brcmf_err("invalid cipher group (%d)\n",
+                                  sme->crypto.cipher_group);
+                        return -EINVAL;
                 }
+        }
 
-                brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
-                err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
-                                               "wpa_auth", val);
-                if (err) {
-                        brcmf_err("could not set wpa_auth (%d)\n", err);
-                        return err;
-                }
+        if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
+                goto skip_mfp_config;
+        /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
+         * IE will not be verified, just a quick search for MFP config
+         */
+        rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
+                                  WLAN_EID_RSN);
+        if (!rsn_ie)
+                goto skip_mfp_config;
+        ie = (const u8 *)rsn_ie;
+        ie_len = rsn_ie->len + TLV_HDR_LEN;
+        /* Skip unicast suite */
+        offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
+        if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
+                goto skip_mfp_config;
+        /* Skip multicast suite */
+        count = ie[offset] + (ie[offset + 1] << 8);
+        offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
+        if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
+                goto skip_mfp_config;
+        /* Skip auth key management suite(s) */
+        count = ie[offset] + (ie[offset + 1] << 8);
+        offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
+        if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
+                goto skip_mfp_config;
+        /* Ready to read capabilities */
+        mfp = BRCMF_MFP_NONE;
+        rsn_cap = ie[offset] + (ie[offset + 1] << 8);
+        if (rsn_cap & RSN_CAP_MFPR_MASK)
+                mfp = BRCMF_MFP_REQUIRED;
+        else if (rsn_cap & RSN_CAP_MFPC_MASK)
+                mfp = BRCMF_MFP_CAPABLE;
+        brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
+
+skip_mfp_config:
+        brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
+        err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
+        if (err) {
+                brcmf_err("could not set wpa_auth (%d)\n", err);
+                return err;
         }
-        sec = &profile->sec;
-        sec->wpa_auth = sme->crypto.akm_suites[0];
 
         return err;
 }
@@ -1818,7 +1880,7 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
-        err = brcmf_set_wsec_mode(ndev, sme, sme->mfp == NL80211_MFP_REQUIRED);
+        err = brcmf_set_wsec_mode(ndev, sme);
         if (err) {
                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
                 goto done;
@@ -2064,98 +2126,54 @@ done:
 }
 
 static s32
-brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
-              u8 key_idx, const u8 *mac_addr, struct key_params *params)
+brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
+                       u8 key_idx, bool pairwise, const u8 *mac_addr)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_wsec_key key;
-        s32 err = 0;
-        u8 keybuf[8];
+        struct brcmf_wsec_key *key;
+        s32 err;
 
-        memset(&key, 0, sizeof(key));
-        key.index = (u32) key_idx;
-        /* Instead of bcast for ea address for default wep keys,
-                 driver needs it to be Null */
-        if (!is_multicast_ether_addr(mac_addr))
-                memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
-        key.len = (u32) params->key_len;
-        /* check for key index change */
-        if (key.len == 0) {
-                /* key delete */
-                err = send_key_to_dongle(ifp, &key);
-                if (err)
-                        brcmf_err("key delete error (%d)\n", err);
-        } else {
-                if (key.len > sizeof(key.data)) {
-                        brcmf_err("Invalid key length (%d)\n", key.len);
-                        return -EINVAL;
-                }
+        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CONN, "key index (%d)\n", key_idx);
 
-                brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
-                memcpy(key.data, params->key, key.len);
+        if (!check_vif_up(ifp->vif))
+                return -EIO;
 
-                if (!brcmf_is_apmode(ifp->vif) &&
-                    (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
-                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
-                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
-                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
-                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
-                }
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+                /* we ignore this key index in this case */
+                return -EINVAL;
+        }
 
-                /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
-                if (params->seq && params->seq_len == 6) {
-                        /* rx iv */
-                        u8 *ivptr;
-                        ivptr = (u8 *) params->seq;
-                        key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
-                            (ivptr[3] << 8) | ivptr[2];
-                        key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
-                        key.iv_initialized = true;
-                }
+        key = &ifp->vif->profile.key[key_idx];
 
-                switch (params->cipher) {
-                case WLAN_CIPHER_SUITE_WEP40:
-                        key.algo = CRYPTO_ALGO_WEP1;
-                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
-                        break;
-                case WLAN_CIPHER_SUITE_WEP104:
-                        key.algo = CRYPTO_ALGO_WEP128;
-                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
-                        break;
-                case WLAN_CIPHER_SUITE_TKIP:
-                        key.algo = CRYPTO_ALGO_TKIP;
-                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
-                        break;
-                case WLAN_CIPHER_SUITE_AES_CMAC:
-                        key.algo = CRYPTO_ALGO_AES_CCM;
-                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
-                        break;
-                case WLAN_CIPHER_SUITE_CCMP:
-                        key.algo = CRYPTO_ALGO_AES_CCM;
-                        brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
-                        break;
-                default:
-                        brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
-                        return -EINVAL;
-                }
-                err = send_key_to_dongle(ifp, &key);
-                if (err)
-                        brcmf_err("wsec_key error (%d)\n", err);
+        if (key->algo == CRYPTO_ALGO_OFF) {
+                brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
+                return -EINVAL;
         }
+
+        memset(key, 0, sizeof(*key));
+        key->index = (u32)key_idx;
+        key->flags = BRCMF_PRIMARY_KEY;
+
+        /* Clear the key/index */
+        err = send_key_to_dongle(ifp, key);
+
+        brcmf_dbg(TRACE, "Exit\n");
         return err;
 }
 
 static s32
 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
-                    u8 key_idx, bool pairwise, const u8 *mac_addr,
-                    struct key_params *params)
+                       u8 key_idx, bool pairwise, const u8 *mac_addr,
+                       struct key_params *params)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_wsec_key *key;
         s32 val;
         s32 wsec;
-        s32 err = 0;
+        s32 err;
         u8 keybuf[8];
+        bool ext_key;
 
         brcmf_dbg(TRACE, "Enter\n");
         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
@@ -2168,27 +2186,32 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 return -EINVAL;
         }
 
-        if (mac_addr &&
-                (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
-                (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
-                brcmf_dbg(TRACE, "Exit");
-                return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
-        }
-
-        key = &ifp->vif->profile.key[key_idx];
-        memset(key, 0, sizeof(*key));
+        if (params->key_len == 0)
+                return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
+                                              mac_addr);
 
         if (params->key_len > sizeof(key->data)) {
                 brcmf_err("Too long key length (%u)\n", params->key_len);
-                err = -EINVAL;
-                goto done;
+                return -EINVAL;
+        }
+
+        ext_key = false;
+        if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
+            (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
+                brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
+                ext_key = true;
         }
+
+        key = &ifp->vif->profile.key[key_idx];
+        memset(key, 0, sizeof(*key));
+        if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
+                memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
         key->len = params->key_len;
         key->index = key_idx;
-
         memcpy(key->data, params->key, key->len);
+        if (!ext_key)
+                key->flags = BRCMF_PRIMARY_KEY;
 
-        key->flags = BRCMF_PRIMARY_KEY;
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
                 key->algo = CRYPTO_ALGO_WEP1;
@@ -2228,7 +2251,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         err = send_key_to_dongle(ifp, key);
-        if (err)
+        if (ext_key || err)
                 goto done;
 
         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
@@ -2249,41 +2272,10 @@ done:
 }
 
 static s32
-brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
-                    u8 key_idx, bool pairwise, const u8 *mac_addr)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_wsec_key key;
-        s32 err = 0;
-
-        brcmf_dbg(TRACE, "Enter\n");
-        if (!check_vif_up(ifp->vif))
-                return -EIO;
-
-        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
-                /* we ignore this key index in this case */
-                return -EINVAL;
-        }
-
-        memset(&key, 0, sizeof(key));
-
-        key.index = (u32) key_idx;
-        key.flags = BRCMF_PRIMARY_KEY;
-        key.algo = CRYPTO_ALGO_OFF;
-
-        brcmf_dbg(CONN, "key index (%d)\n", key_idx);
-
-        /* Set the new key/index */
-        err = send_key_to_dongle(ifp, &key);
-
-        brcmf_dbg(TRACE, "Exit\n");
-        return err;
-}
-
-static s32
-brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
-                    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
-                    void (*callback) (void *cookie, struct key_params * params))
+brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
+                       bool pairwise, const u8 *mac_addr, void *cookie,
+                       void (*callback)(void *cookie,
+                                        struct key_params *params))
 {
         struct key_params params;
         struct brcmf_if *ifp = netdev_priv(ndev);
@@ -2335,8 +2327,15 @@ done:
 
 static s32
 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
-                                    struct net_device *ndev, u8 key_idx)
+                                       struct net_device *ndev, u8 key_idx)
 {
+        struct brcmf_if *ifp = netdev_priv(ndev);
+
+        brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
+
+        if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
+                return 0;
+
         brcmf_dbg(INFO, "Not supported\n");
 
         return -EOPNOTSUPP;
@@ -3020,7 +3019,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
                 list = (struct brcmf_scan_results *)
                                 cfg->escan_info.escan_buf;
-                if (bi_length > WL_ESCAN_BUF_SIZE - list->buflen) {
+                if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
                         brcmf_err("Buffer is too small: ignoring\n");
                         goto exit;
                 }
@@ -3033,8 +3032,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                                                           bss_info_le))
                                 goto exit;
                 }
-                memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
-                        bss_info_le, bi_length);
+                memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
+                       bi_length);
                 list->version = le32_to_cpu(bss_info_le->version);
                 list->buflen += bi_length;
                 list->count++;
@@ -3092,6 +3091,11 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
 
         brcmf_dbg(SCAN, "Enter\n");
 
+        if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
+                brcmf_dbg(SCAN, "Event data to small. Ignore\n");
+                return 0;
+        }
+
         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
                 return 0;
@@ -3415,6 +3419,11 @@ brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
 
         brcmf_dbg(SCAN, "Enter\n");
 
+        if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
+                brcmf_dbg(SCAN, "Event data to small. Ignore\n");
+                return 0;
+        }
+
         pfn_result = (struct brcmf_pno_scanresults_le *)data;
 
         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
@@ -3507,6 +3516,10 @@ static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
                         else
                                 wakeup_data.net_detect = cfg->wowl.nd_info;
                 }
+                if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
+                        brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
+                        wakeup_data.gtk_rekey_failure = true;
+                }
         } else {
                 wakeup = NULL;
         }
@@ -3533,7 +3546,8 @@ static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
                 brcmf_report_wowl_wakeind(wiphy, ifp);
                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
-                brcmf_configure_arp_offload(ifp, true);
+                if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
+                        brcmf_configure_arp_nd_offload(ifp, true);
                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
                                       cfg->wowl.pre_pmmode);
                 cfg->wowl.active = false;
@@ -3557,7 +3571,8 @@ static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
 
         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
 
-        brcmf_configure_arp_offload(ifp, false);
+        if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
+                brcmf_configure_arp_nd_offload(ifp, false);
         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
 
@@ -3588,6 +3603,8 @@ static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
                                     brcmf_wowl_nd_results);
         }
+        if (wowl->gtk_rekey_failure)
+                wowl_config |= BRCMF_WOWL_GTK_FAILURE;
         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
                 wowl_config |= BRCMF_WOWL_UNASSOC;
 
@@ -3818,7 +3835,7 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
         u32 auth = 0; /* d11 open authentication */
         u16 count;
         s32 err = 0;
-        s32 len = 0;
+        s32 len;
         u32 i;
         u32 wsec;
         u32 pval = 0;
@@ -3828,6 +3845,7 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
         u8 *data;
         u16 rsn_cap;
         u32 wme_bss_disable;
+        u32 mfp;
 
         brcmf_dbg(TRACE, "Enter\n");
         if (wpa_ie == NULL)
@@ -3942,19 +3960,53 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
                                     (wpa_auth |= WPA_AUTH_PSK);
                         break;
+                case RSN_AKM_SHA256_PSK:
+                        brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
+                        wpa_auth |= WPA2_AUTH_PSK_SHA256;
+                        break;
+                case RSN_AKM_SHA256_1X:
+                        brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
+                        wpa_auth |= WPA2_AUTH_1X_SHA256;
+                        break;
                 default:
                         brcmf_err("Ivalid key mgmt info\n");
                 }
                 offset++;
         }
 
+        mfp = BRCMF_MFP_NONE;
         if (is_rsn_ie) {
                 wme_bss_disable = 1;
                 if ((offset + RSN_CAP_LEN) <= len) {
                         rsn_cap = data[offset] + (data[offset + 1] << 8);
                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
                                 wme_bss_disable = 0;
+                        if (rsn_cap & RSN_CAP_MFPR_MASK) {
+                                brcmf_dbg(TRACE, "MFP Required\n");
+                                mfp = BRCMF_MFP_REQUIRED;
+                                /* Firmware only supports mfp required in
+                                 * combination with WPA2_AUTH_PSK_SHA256 or
+                                 * WPA2_AUTH_1X_SHA256.
+                                 */
+                                if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
+                                                  WPA2_AUTH_1X_SHA256))) {
+                                        err = -EINVAL;
+                                        goto exit;
+                                }
+                                /* Firmware has requirement that WPA2_AUTH_PSK/
+                                 * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
+                                 * is to be included in the rsn ie.
+                                 */
+                                if (wpa_auth & WPA2_AUTH_PSK_SHA256)
+                                        wpa_auth |= WPA2_AUTH_PSK;
+                                else if (wpa_auth & WPA2_AUTH_1X_SHA256)
+                                        wpa_auth |= WPA2_AUTH_UNSPECIFIED;
+                        } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
+                                brcmf_dbg(TRACE, "MFP Capable\n");
+                                mfp = BRCMF_MFP_CAPABLE;
+                        }
                 }
+                offset += RSN_CAP_LEN;
                 /* set wme_bss_disable to sync RSN Capabilities */
                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
                                                wme_bss_disable);
@@ -3962,6 +4014,21 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
                         brcmf_err("wme_bss_disable error %d\n", err);
                         goto exit;
                 }
+
+                /* Skip PMKID cnt as it is know to be 0 for AP. */
+                offset += RSN_PMKID_COUNT_LEN;
+
+                /* See if there is BIP wpa suite left for MFP */
+                if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
+                    ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
+                        err = brcmf_fil_bsscfg_data_set(ifp, "bip",
+                                                        &data[offset],
+                                                        WPA_IE_MIN_OUI_LEN);
+                        if (err < 0) {
+                                brcmf_err("bip error %d\n", err);
+                                goto exit;
+                        }
+                }
         }
         /* FOR WPS , set SES_OW_ENABLED */
         wsec = (pval | gval | SES_OW_ENABLED);
@@ -3978,6 +4045,16 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
                 brcmf_err("wsec error %d\n", err);
                 goto exit;
         }
+        /* Configure MFP, this needs to go after wsec otherwise the wsec command
+         * will overwrite the values set by MFP
+         */
+        if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
+                err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
+                if (err < 0) {
+                        brcmf_err("mfp error %d\n", err);
+                        goto exit;
+                }
+        }
         /* set upper-layer auth */
         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
         if (err < 0) {
@@ -4326,7 +4403,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 
         if (!mbss) {
                 brcmf_set_mpc(ifp, 0);
-                brcmf_configure_arp_offload(ifp, false);
+                brcmf_configure_arp_nd_offload(ifp, false);
         }
 
         /* find the RSN_IE */
@@ -4472,7 +4549,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 exit:
         if ((err) && (!mbss)) {
                 brcmf_set_mpc(ifp, 1);
-                brcmf_configure_arp_offload(ifp, true);
+                brcmf_configure_arp_nd_offload(ifp, true);
         }
         return err;
 }
@@ -4530,7 +4607,7 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                         brcmf_err("bss_enable config failed %d\n", err);
         }
         brcmf_set_mpc(ifp, 1);
-        brcmf_configure_arp_offload(ifp, true);
+        brcmf_configure_arp_nd_offload(ifp, true);
         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
         brcmf_net_setcarrier(ifp, false);
 
@@ -4855,7 +4932,32 @@ static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
         return ret;
 }
 
-static struct cfg80211_ops wl_cfg80211_ops = {
+#ifdef CONFIG_PM
+static int
+brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
+                              struct cfg80211_gtk_rekey_data *gtk)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        struct brcmf_gtk_keyinfo_le gtk_le;
+        int ret;
+
+        brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
+
+        memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
+        memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
+        memcpy(gtk_le.replay_counter, gtk->replay_ctr,
+               sizeof(gtk_le.replay_counter));
+
+        ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
+                                       sizeof(gtk_le));
+        if (ret < 0)
+                brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
+
+        return ret;
+}
+#endif
+
+static struct cfg80211_ops brcmf_cfg80211_ops = {
         .add_virtual_intf = brcmf_cfg80211_add_iface,
         .del_virtual_intf = brcmf_cfg80211_del_iface,
         .change_virtual_intf = brcmf_cfg80211_change_iface,
@@ -5402,14 +5504,14 @@ static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
 {
         kfree(cfg->conf);
         cfg->conf = NULL;
-        kfree(cfg->escan_ioctl_buf);
-        cfg->escan_ioctl_buf = NULL;
         kfree(cfg->extra_buf);
         cfg->extra_buf = NULL;
         kfree(cfg->wowl.nd);
         cfg->wowl.nd = NULL;
         kfree(cfg->wowl.nd_info);
         cfg->wowl.nd_info = NULL;
+        kfree(cfg->escan_info.escan_buf);
+        cfg->escan_info.escan_buf = NULL;
 }
 
 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
@@ -5417,9 +5519,6 @@ static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
         if (!cfg->conf)
                 goto init_priv_mem_out;
-        cfg->escan_ioctl_buf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
-        if (!cfg->escan_ioctl_buf)
-                goto init_priv_mem_out;
         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
         if (!cfg->extra_buf)
                 goto init_priv_mem_out;
@@ -5431,6 +5530,9 @@ static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
                                     GFP_KERNEL);
         if (!cfg->wowl.nd_info)
                 goto init_priv_mem_out;
+        cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
+        if (!cfg->escan_info.escan_buf)
+                goto init_priv_mem_out;
 
         return 0;
 
@@ -6120,19 +6222,18 @@ static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
 {
 #ifdef CONFIG_PM
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-        s32 err;
-        u32 wowl_cap;
 
         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
-                err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
-                if (!err) {
-                        if (wowl_cap & BRCMF_WOWL_PFN_FOUND) {
-                                brcmf_wowlan_support.flags |=
-                                                        WIPHY_WOWLAN_NET_DETECT;
-                                init_waitqueue_head(&cfg->wowl.nd_data_wait);
-                        }
+                if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
+                        brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
+                        init_waitqueue_head(&cfg->wowl.nd_data_wait);
                 }
         }
+        if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
+                brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
+                brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
+        }
+
         wiphy->wowlan = &brcmf_wowlan_support;
 #endif
 }
@@ -6174,8 +6275,10 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
         wiphy->n_addresses = i;
 
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-        wiphy->cipher_suites = __wl_cipher_suites;
-        wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+        wiphy->cipher_suites = brcmf_cipher_suites;
+        wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
+        if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
+                wiphy->n_cipher_suites--;
         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
                         WIPHY_FLAG_OFFCHAN_TX |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
@@ -6277,7 +6380,7 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
         if (err)
                 goto default_conf_out;
 
-        brcmf_configure_arp_offload(ifp, true);
+        brcmf_configure_arp_nd_offload(ifp, true);
 
         cfg->dongle_up = true;
 default_conf_out:
@@ -6395,8 +6498,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
 
         return armed;
 }
-int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
-                                          u8 action, ulong timeout)
+
+int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
+                                  u8 action, ulong timeout)
 {
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
 
@@ -6404,28 +6508,85 @@ int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
                                   vif_event_equals(event, action), timeout);
 }
 
+static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
+                                        struct brcmf_fil_country_le *ccreq)
+{
+        struct brcmfmac_pd_cc *country_codes;
+        struct brcmfmac_pd_cc_entry *cc;
+        s32 found_index;
+        int i;
+
+        country_codes = drvr->settings->country_codes;
+        if (!country_codes) {
+                brcmf_dbg(TRACE, "No country codes configured for device\n");
+                return -EINVAL;
+        }
+
+        if ((alpha2[0] == ccreq->country_abbrev[0]) &&
+            (alpha2[1] == ccreq->country_abbrev[1])) {
+                brcmf_dbg(TRACE, "Country code already set\n");
+                return -EAGAIN;
+        }
+
+        found_index = -1;
+        for (i = 0; i < country_codes->table_size; i++) {
+                cc = &country_codes->table[i];
+                if ((cc->iso3166[0] == '\0') && (found_index == -1))
+                        found_index = i;
+                if ((cc->iso3166[0] == alpha2[0]) &&
+                    (cc->iso3166[1] == alpha2[1])) {
+                        found_index = i;
+                        break;
+                }
+        }
+        if (found_index == -1) {
+                brcmf_dbg(TRACE, "No country code match found\n");
+                return -EINVAL;
+        }
+        memset(ccreq, 0, sizeof(*ccreq));
+        ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
+        memcpy(ccreq->ccode, country_codes->table[found_index].cc,
+               BRCMF_COUNTRY_BUF_SZ);
+        ccreq->country_abbrev[0] = alpha2[0];
+        ccreq->country_abbrev[1] = alpha2[1];
+        ccreq->country_abbrev[2] = 0;
+
+        return 0;
+}
+
 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
                                         struct regulatory_request *req)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct brcmf_fil_country_le ccreq;
+        s32 err;
         int i;
 
-        brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
-                  req->alpha2[0], req->alpha2[1]);
-
         /* ignore non-ISO3166 country codes */
         for (i = 0; i < sizeof(req->alpha2); i++)
                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
-                        brcmf_err("not a ISO3166 code\n");
+                        brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
+                                  req->alpha2[0], req->alpha2[1]);
                         return;
                 }
-        memset(&ccreq, 0, sizeof(ccreq));
-        ccreq.rev = cpu_to_le32(-1);
-        memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
-        if (brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq))) {
-                brcmf_err("firmware rejected country setting\n");
+
+        brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
+                  req->alpha2[0], req->alpha2[1]);
+
+        err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
+        if (err) {
+                brcmf_err("Country code iovar returned err = %d\n", err);
+                return;
+        }
+
+        err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
+        if (err)
+                return;
+
+        err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+        if (err) {
+                brcmf_err("Firmware rejected country setting\n");
                 return;
         }
         brcmf_setup_wiphybands(wiphy);
@@ -6461,6 +6622,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
         struct brcmf_cfg80211_info *cfg;
         struct wiphy *wiphy;
+        struct cfg80211_ops *ops;
         struct brcmf_cfg80211_vif *vif;
         struct brcmf_if *ifp;
         s32 err = 0;
@@ -6472,8 +6634,17 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 return NULL;
         }
 
+        ops = kzalloc(sizeof(*ops), GFP_KERNEL);
+        if (!ops)
+                return NULL;
+
+        memcpy(ops, &brcmf_cfg80211_ops, sizeof(*ops));
         ifp = netdev_priv(ndev);
-        wiphy = wiphy_new(&wl_cfg80211_ops, sizeof(struct brcmf_cfg80211_info));
+#ifdef CONFIG_PM
+        if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
+                ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
+#endif
+        wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
         if (!wiphy) {
                 brcmf_err("Could not allocate wiphy device\n");
                 return NULL;
@@ -6483,6 +6654,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
 
         cfg = wiphy_priv(wiphy);
         cfg->wiphy = wiphy;
+        cfg->ops = ops;
         cfg->pub = drvr;
         init_vif_event(&cfg->vif_event);
         INIT_LIST_HEAD(&cfg->vif_list);
@@ -6593,7 +6765,8 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
 #ifdef CONFIG_PM
-                if (wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
+                if (wiphy->wowlan &&
+                    wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 #endif
         }
@@ -6608,6 +6781,7 @@ priv_out:
         ifp->vif = NULL;
 wiphy_out:
         brcmf_free_wiphy(wiphy);
+        kfree(ops);
         return NULL;
 }
 
@@ -6618,6 +6792,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 
         brcmf_btcoex_detach(cfg);
         wiphy_unregister(cfg->wiphy);
+        kfree(cfg->ops);
         wl_deinit_priv(cfg);
         brcmf_free_wiphy(cfg->wiphy);
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 40efb539ac26..95e35bcc16ce 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -28,8 +28,11 @@
 #define WL_ROAM_TRIGGER_LEVEL           -75
 #define WL_ROAM_DELTA                   20
 
-#define WL_ESCAN_BUF_SIZE               (1024 * 64)
-#define WL_ESCAN_TIMER_INTERVAL_MS      10000 /* E-Scan timeout */
+/* Keep BRCMF_ESCAN_BUF_SIZE below 64K (65536). Allocing over 64K can be
+ * problematic on some systems and should be avoided.
+ */
+#define BRCMF_ESCAN_BUF_SIZE            65000
+#define BRCMF_ESCAN_TIMER_INTERVAL_MS   10000   /* E-Scan timeout */
 
 #define WL_ESCAN_ACTION_START           1
 #define WL_ESCAN_ACTION_CONTINUE        2
@@ -69,7 +72,7 @@
 
 #define BRCMF_VNDR_IE_P2PAF_SHIFT       12
 
-#define BRCMF_MAX_DEFAULT_KEYS          4
+#define BRCMF_MAX_DEFAULT_KEYS          6
 
 /* beacon loss timeout defaults */
 #define BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON       2
@@ -104,7 +107,6 @@ struct brcmf_cfg80211_security {
         u32 auth_type;
         u32 cipher_pairwise;
         u32 cipher_group;
-        u32 wpa_auth;
 };
 
 /**
@@ -205,7 +207,7 @@ enum wl_escan_state {
 
 struct escan_info {
         u32 escan_state;
-        u8 escan_buf[WL_ESCAN_BUF_SIZE];
+        u8 *escan_buf;
         struct wiphy *wiphy;
         struct brcmf_if *ifp;
         s32 (*run)(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
@@ -253,6 +255,7 @@ struct brcmf_cfg80211_wowl {
  * struct brcmf_cfg80211_info - dongle private data of cfg80211 interface
  *
  * @wiphy: wiphy object for cfg80211 interface.
+ * @ops: pointer to copy of ops as registered with wiphy object.
  * @conf: dongle configuration.
  * @p2p: peer-to-peer specific information.
  * @btcoex: Bluetooth coexistence information.
@@ -278,7 +281,6 @@ struct brcmf_cfg80211_wowl {
  * @escan_info: escan information.
  * @escan_timeout: Timer for catch scan timeout.
  * @escan_timeout_work: scan timeout worker.
- * @escan_ioctl_buf: dongle command buffer for escan commands.
  * @vif_list: linked list of vif instances.
  * @vif_cnt: number of vif instances.
  * @vif_event: vif event signalling.
@@ -286,6 +288,7 @@ struct brcmf_cfg80211_wowl {
  */
 struct brcmf_cfg80211_info {
         struct wiphy *wiphy;
+        struct cfg80211_ops *ops;
         struct brcmf_cfg80211_conf *conf;
         struct brcmf_p2p_info p2p;
         struct brcmf_btcoex_info *btcoex;
@@ -309,7 +312,6 @@ struct brcmf_cfg80211_info {
         struct escan_info escan_info;
         struct timer_list escan_timeout;
         struct work_struct escan_timeout_work;
-        u8 *escan_ioctl_buf;
         struct list_head vif_list;
         struct brcmf_cfg80211_vif_event vif_event;
         struct completion vif_disabled;
@@ -402,8 +404,8 @@ bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
                                   struct brcmf_cfg80211_vif *vif);
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
-int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
-                                          u8 action, ulong timeout);
+int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
+                                  u8 action, ulong timeout);
 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                                 struct brcmf_if *ifp, bool aborted,
                                 bool fw_abort);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index cfee477a6eb1..9e909e3c2f0c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -27,6 +27,11 @@
 #include "fwil_types.h"
 #include "tracepoint.h"
 #include "common.h"
+#include "of.h"
+
+MODULE_AUTHOR("Broadcom Corporation");
+MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+MODULE_LICENSE("Dual BSD/GPL");
 
 const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
@@ -75,6 +80,7 @@ module_param_named(ignore_probe_fail, brcmf_ignore_probe_fail, int, 0);
 MODULE_PARM_DESC(ignore_probe_fail, "always succeed probe for debugging");
 #endif
 
+static struct brcmfmac_platform_data *brcmfmac_pdata;
 struct brcmf_mp_global_t brcmf_mp_global;
 
 int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
@@ -221,33 +227,147 @@ void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
 }
 #endif
 
-void brcmf_mp_attach(void)
+static void brcmf_mp_attach(void)
 {
+        /* If module param firmware path is set then this will always be used,
+         * if not set then if available use the platform data version. To make
+         * sure it gets initialized at all, always copy the module param version
+         */
         strlcpy(brcmf_mp_global.firmware_path, brcmf_firmware_path,
                 BRCMF_FW_ALTPATH_LEN);
+        if ((brcmfmac_pdata) && (brcmfmac_pdata->fw_alternative_path) &&
+            (brcmf_mp_global.firmware_path[0] == '\0')) {
+                strlcpy(brcmf_mp_global.firmware_path,
+                        brcmfmac_pdata->fw_alternative_path,
+                        BRCMF_FW_ALTPATH_LEN);
+        }
 }
 
-int brcmf_mp_device_attach(struct brcmf_pub *drvr)
+struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,
+                                               enum brcmf_bus_type bus_type,
+                                               u32 chip, u32 chiprev)
 {
-        drvr->settings = kzalloc(sizeof(*drvr->settings), GFP_ATOMIC);
-        if (!drvr->settings) {
-                brcmf_err("Failed to alloca storage space for settings\n");
-                return -ENOMEM;
-        }
-
-        drvr->settings->sdiod_txglomsz = brcmf_sdiod_txglomsz;
-        drvr->settings->p2p_enable = !!brcmf_p2p_enable;
-        drvr->settings->feature_disable = brcmf_feature_disable;
-        drvr->settings->fcmode = brcmf_fcmode;
-        drvr->settings->roamoff = !!brcmf_roamoff;
+        struct brcmf_mp_device *settings;
+        struct brcmfmac_pd_device *device_pd;
+        bool found;
+        int i;
+
+        brcmf_dbg(INFO, "Enter, bus=%d, chip=%d, rev=%d\n", bus_type, chip,
+                  chiprev);
+        settings = kzalloc(sizeof(*settings), GFP_ATOMIC);
+        if (!settings)
+                return NULL;
+
+        /* start by using the module paramaters */
+        settings->p2p_enable = !!brcmf_p2p_enable;
+        settings->feature_disable = brcmf_feature_disable;
+        settings->fcmode = brcmf_fcmode;
+        settings->roamoff = !!brcmf_roamoff;
 #ifdef DEBUG
-        drvr->settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
+        settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
 #endif
+
+        if (bus_type == BRCMF_BUSTYPE_SDIO)
+                settings->bus.sdio.txglomsz = brcmf_sdiod_txglomsz;
+
+        /* See if there is any device specific platform data configured */
+        found = false;
+        if (brcmfmac_pdata) {
+                for (i = 0; i < brcmfmac_pdata->device_count; i++) {
+                        device_pd = &brcmfmac_pdata->devices[i];
+                        if ((device_pd->bus_type == bus_type) &&
+                            (device_pd->id == chip) &&
+                            ((device_pd->rev == chiprev) ||
+                             (device_pd->rev == -1))) {
+                                brcmf_dbg(INFO, "Platform data for device found\n");
+                                settings->country_codes =
+                                                device_pd->country_codes;
+                                if (device_pd->bus_type == BRCMF_BUSTYPE_SDIO)
+                                        memcpy(&settings->bus.sdio,
+                                               &device_pd->bus.sdio,
+                                               sizeof(settings->bus.sdio));
+                                found = true;
+                                break;
+                        }
+                }
+        }
+        if ((bus_type == BRCMF_BUSTYPE_SDIO) && (!found)) {
+                /* No platform data for this device. In case of SDIO try OF
+                 * (Open Firwmare) Device Tree.
+                 */
+                brcmf_of_probe(dev, &settings->bus.sdio);
+        }
+        return settings;
+}
+
+void brcmf_release_module_param(struct brcmf_mp_device *module_param)
+{
+        kfree(module_param);
+}
+
+static int __init brcmf_common_pd_probe(struct platform_device *pdev)
+{
+        brcmf_dbg(INFO, "Enter\n");
+
+        brcmfmac_pdata = dev_get_platdata(&pdev->dev);
+
+        if (brcmfmac_pdata->power_on)
+                brcmfmac_pdata->power_on();
+
+        return 0;
+}
+
+static int brcmf_common_pd_remove(struct platform_device *pdev)
+{
+        brcmf_dbg(INFO, "Enter\n");
+
+        if (brcmfmac_pdata->power_off)
+                brcmfmac_pdata->power_off();
+
         return 0;
 }
 
-void brcmf_mp_device_detach(struct brcmf_pub *drvr)
+static struct platform_driver brcmf_pd = {
+        .remove         = brcmf_common_pd_remove,
+        .driver         = {
+                .name   = BRCMFMAC_PDATA_NAME,
+        }
+};
+
+static int __init brcmfmac_module_init(void)
+{
+        int err;
+
+        /* Initialize debug system first */
+        brcmf_debugfs_init();
+
+        /* Get the platform data (if available) for our devices */
+        err = platform_driver_probe(&brcmf_pd, brcmf_common_pd_probe);
+        if (err == -ENODEV)
+                brcmf_dbg(INFO, "No platform data available.\n");
+
+        /* Initialize global module paramaters */
+        brcmf_mp_attach();
+
+        /* Continue the initialization by registering the different busses */
+        err = brcmf_core_init();
+        if (err) {
+                brcmf_debugfs_exit();
+                if (brcmfmac_pdata)
+                        platform_driver_unregister(&brcmf_pd);
+        }
+
+        return err;
+}
+
+static void __exit brcmfmac_module_exit(void)
 {
-        kfree(drvr->settings);
+        brcmf_core_exit();
+        if (brcmfmac_pdata)
+                platform_driver_unregister(&brcmf_pd);
+        brcmf_debugfs_exit();
 }
 
+module_init(brcmfmac_module_init);
+module_exit(brcmfmac_module_exit);
+
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
index 3b0a63b98e99..bd095abca393 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
@@ -15,6 +15,10 @@
 #ifndef BRCMFMAC_COMMON_H
 #define BRCMFMAC_COMMON_H
 
+#include <linux/platform_device.h>
+#include <linux/platform_data/brcmfmac.h>
+#include "fwil_types.h"
+
 extern const u8 ALLFFMAC[ETH_ALEN];
 
 #define BRCMF_FW_ALTPATH_LEN                    256
@@ -41,37 +45,30 @@ extern struct brcmf_mp_global_t brcmf_mp_global;
 /**
  * struct brcmf_mp_device - Device module paramaters.
  *
- * @sdiod_txglomsz: SDIO txglom size.
- * @joinboost_5g_rssi: 5g rssi booost for preferred join selection.
  * @p2p_enable: Legacy P2P0 enable (old wpa_supplicant).
  * @feature_disable: Feature_disable bitmask.
  * @fcmode: FWS flow control.
  * @roamoff: Firmware roaming off?
+ * @ignore_probe_fail: Ignore probe failure.
+ * @country_codes: If available, pointer to struct for translating country codes
+ * @bus: Bus specific platform data. Only SDIO at the mmoment.
  */
 struct brcmf_mp_device {
-        int     sdiod_txglomsz;
-        int     joinboost_5g_rssi;
-        bool    p2p_enable;
-        int     feature_disable;
-        int     fcmode;
-        bool    roamoff;
-        bool    ignore_probe_fail;
+        bool            p2p_enable;
+        unsigned int    feature_disable;
+        int             fcmode;
+        bool            roamoff;
+        bool            ignore_probe_fail;
+        struct brcmfmac_pd_cc *country_codes;
+        union {
+                struct brcmfmac_sdio_pd sdio;
+        } bus;
 };
 
-void brcmf_mp_attach(void);
-int brcmf_mp_device_attach(struct brcmf_pub *drvr);
-void brcmf_mp_device_detach(struct brcmf_pub *drvr);
-#ifdef DEBUG
-static inline bool brcmf_ignoring_probe_fail(struct brcmf_pub *drvr)
-{
-        return drvr->settings->ignore_probe_fail;
-}
-#else
-static inline bool brcmf_ignoring_probe_fail(struct brcmf_pub *drvr)
-{
-        return false;
-}
-#endif
+struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,
+                                               enum brcmf_bus_type bus_type,
+                                               u32 chip, u32 chiprev);
+void brcmf_release_module_param(struct brcmf_mp_device *module_param);
 
 /* Sets dongle media info (drv_version, mac address). */
 int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index ed9998b69709..ff825cd7739e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -20,6 +20,8 @@
 #include <linux/inetdevice.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
@@ -36,11 +38,7 @@
 #include "pcie.h"
 #include "common.h"
 
-MODULE_AUTHOR("Broadcom Corporation");
-MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-MODULE_LICENSE("Dual BSD/GPL");
-
-#define MAX_WAIT_FOR_8021X_TX                   msecs_to_jiffies(50)
+#define MAX_WAIT_FOR_8021X_TX                   msecs_to_jiffies(950)
 
 /* AMPDU rx reordering definitions */
 #define BRCMF_RXREORDER_FLOWID_OFFSET           0
@@ -172,6 +170,35 @@ _brcmf_set_mac_address(struct work_struct *work)
         }
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
+static void _brcmf_update_ndtable(struct work_struct *work)
+{
+        struct brcmf_if *ifp;
+        int i, ret;
+
+        ifp = container_of(work, struct brcmf_if, ndoffload_work);
+
+        /* clear the table in firmware */
+        ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip_clear", NULL, 0);
+        if (ret) {
+                brcmf_dbg(TRACE, "fail to clear nd ip table err:%d\n", ret);
+                return;
+        }
+
+        for (i = 0; i < ifp->ipv6addr_idx; i++) {
+                ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip",
+                                               &ifp->ipv6_addr_tbl[i],
+                                               sizeof(struct in6_addr));
+                if (ret)
+                        brcmf_err("add nd ip err %d\n", ret);
+        }
+}
+#else
+static void _brcmf_update_ndtable(struct work_struct *work)
+{
+}
+#endif
+
 static int brcmf_netdev_set_mac_address(struct net_device *ndev, void *addr)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
@@ -685,6 +712,7 @@ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
 
         INIT_WORK(&ifp->setmacaddr_work, _brcmf_set_mac_address);
         INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
+        INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);
 
         if (rtnl_locked)
                 err = register_netdevice(ndev);
@@ -884,6 +912,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx)
                 if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
                         cancel_work_sync(&ifp->setmacaddr_work);
                         cancel_work_sync(&ifp->multicast_work);
+                        cancel_work_sync(&ifp->ndoffload_work);
                 }
                 brcmf_net_detach(ifp->ndev);
         } else {
@@ -1006,14 +1035,14 @@ static int brcmf_inetaddr_changed(struct notifier_block *nb,
                                 return NOTIFY_OK;
                         }
                         for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
-                                if (addr_table[i] != 0) {
-                                        brcmf_fil_iovar_data_set(ifp,
-                                                "arp_hostip", &addr_table[i],
-                                                sizeof(addr_table[i]));
-                                        if (ret)
-                                                brcmf_err("add arp ip err %d\n",
-                                                          ret);
-                                }
+                                if (addr_table[i] == 0)
+                                        continue;
+                                ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
+                                                               &addr_table[i],
+                                                               sizeof(addr_table[i]));
+                                if (ret)
+                                        brcmf_err("add arp ip err %d\n",
+                                                  ret);
                         }
                 }
                 break;
@@ -1025,7 +1054,57 @@ static int brcmf_inetaddr_changed(struct notifier_block *nb,
 }
 #endif
 
-int brcmf_attach(struct device *dev)
+#if IS_ENABLED(CONFIG_IPV6)
+static int brcmf_inet6addr_changed(struct notifier_block *nb,
+                                   unsigned long action, void *data)
+{
+        struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
+                                              inet6addr_notifier);
+        struct inet6_ifaddr *ifa = data;
+        struct brcmf_if *ifp;
+        int i;
+        struct in6_addr *table;
+
+        /* Only handle primary interface */
+        ifp = drvr->iflist[0];
+        if (!ifp)
+                return NOTIFY_DONE;
+        if (ifp->ndev != ifa->idev->dev)
+                return NOTIFY_DONE;
+
+        table = ifp->ipv6_addr_tbl;
+        for (i = 0; i < NDOL_MAX_ENTRIES; i++)
+                if (ipv6_addr_equal(&ifa->addr, &table[i]))
+                        break;
+
+        switch (action) {
+        case NETDEV_UP:
+                if (i == NDOL_MAX_ENTRIES) {
+                        if (ifp->ipv6addr_idx < NDOL_MAX_ENTRIES) {
+                                table[ifp->ipv6addr_idx++] = ifa->addr;
+                        } else {
+                                for (i = 0; i < NDOL_MAX_ENTRIES - 1; i++)
+                                        table[i] = table[i + 1];
+                                table[NDOL_MAX_ENTRIES - 1] = ifa->addr;
+                        }
+                }
+                break;
+        case NETDEV_DOWN:
+                if (i < NDOL_MAX_ENTRIES)
+                        for (; i < ifp->ipv6addr_idx; i++)
+                                table[i] = table[i + 1];
+                break;
+        default:
+                break;
+        }
+
+        schedule_work(&ifp->ndoffload_work);
+
+        return NOTIFY_OK;
+}
+#endif
+
+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
 {
         struct brcmf_pub *drvr = NULL;
         int ret = 0;
@@ -1047,10 +1126,7 @@ int brcmf_attach(struct device *dev)
         drvr->hdrlen = 0;
         drvr->bus_if = dev_get_drvdata(dev);
         drvr->bus_if->drvr = drvr;
-
-        /* Initialize device specific settings */
-        if (brcmf_mp_device_attach(drvr))
-                goto fail;
+        drvr->settings = settings;
 
         /* attach debug facilities */
         brcmf_debug_attach(drvr);
@@ -1164,30 +1240,41 @@ int brcmf_bus_start(struct device *dev)
 #ifdef CONFIG_INET
         drvr->inetaddr_notifier.notifier_call = brcmf_inetaddr_changed;
         ret = register_inetaddr_notifier(&drvr->inetaddr_notifier);
+        if (ret)
+                goto fail;
+
+#if IS_ENABLED(CONFIG_IPV6)
+        drvr->inet6addr_notifier.notifier_call = brcmf_inet6addr_changed;
+        ret = register_inet6addr_notifier(&drvr->inet6addr_notifier);
+        if (ret) {
+                unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
+                goto fail;
+        }
 #endif
+#endif /* CONFIG_INET */
+
+        return 0;
 
 fail:
-        if (ret < 0) {
-                brcmf_err("failed: %d\n", ret);
-                if (drvr->config) {
-                        brcmf_cfg80211_detach(drvr->config);
-                        drvr->config = NULL;
-                }
-                if (drvr->fws) {
-                        brcmf_fws_del_interface(ifp);
-                        brcmf_fws_deinit(drvr);
-                }
-                if (ifp)
-                        brcmf_net_detach(ifp->ndev);
-                if (p2p_ifp)
-                        brcmf_net_detach(p2p_ifp->ndev);
-                drvr->iflist[0] = NULL;
-                drvr->iflist[1] = NULL;
-                if (brcmf_ignoring_probe_fail(drvr))
-                        ret = 0;
-                return ret;
+        brcmf_err("failed: %d\n", ret);
+        if (drvr->config) {
+                brcmf_cfg80211_detach(drvr->config);
+                drvr->config = NULL;
         }
-        return 0;
+        if (drvr->fws) {
+                brcmf_fws_del_interface(ifp);
+                brcmf_fws_deinit(drvr);
+        }
+        if (ifp)
+                brcmf_net_detach(ifp->ndev);
+        if (p2p_ifp)
+                brcmf_net_detach(p2p_ifp->ndev);
+        drvr->iflist[0] = NULL;
+        drvr->iflist[1] = NULL;
+        if (drvr->settings->ignore_probe_fail)
+                ret = 0;
+
+        return ret;
 }
 
 void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
@@ -1237,6 +1324,10 @@ void brcmf_detach(struct device *dev)
         unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+        unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
+#endif
+
         /* stop firmware event handling */
         brcmf_fweh_detach(drvr);
         if (drvr->config)
@@ -1256,8 +1347,6 @@ void brcmf_detach(struct device *dev)
 
         brcmf_proto_detach(drvr);
 
-        brcmf_mp_device_detach(drvr);
-
         brcmf_debug_detach(drvr);
         bus_if->drvr = NULL;
         kfree(drvr);
@@ -1324,19 +1413,15 @@ static void brcmf_driver_register(struct work_struct *work)
 }
 static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
 
-static int __init brcmfmac_module_init(void)
+int __init brcmf_core_init(void)
 {
-        brcmf_debugfs_init();
-#ifdef CONFIG_BRCMFMAC_SDIO
-        brcmf_sdio_init();
-#endif
         if (!schedule_work(&brcmf_driver_work))
                 return -EBUSY;
 
         return 0;
 }
 
-static void __exit brcmfmac_module_exit(void)
+void __exit brcmf_core_exit(void)
 {
         cancel_work_sync(&brcmf_driver_work);
 
@@ -1349,8 +1434,5 @@ static void __exit brcmfmac_module_exit(void)
 #ifdef CONFIG_BRCMFMAC_PCIE
         brcmf_pcie_exit();
 #endif
-        brcmf_debugfs_exit();
 }
 
-module_init(brcmfmac_module_init);
-module_exit(brcmfmac_module_exit);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
index 8f39435f976f..7bdb6fef99c3 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
@@ -48,6 +48,8 @@
  */
 #define BRCMF_DRIVER_FIRMWARE_VERSION_LEN       32
 
+#define NDOL_MAX_ENTRIES        8
+
 /**
  * struct brcmf_ampdu_rx_reorder - AMPDU receive reorder info
  *
@@ -143,6 +145,7 @@ struct brcmf_pub {
 #endif
 
         struct notifier_block inetaddr_notifier;
+        struct notifier_block inet6addr_notifier;
         struct brcmf_mp_device *settings;
 };
 
@@ -175,6 +178,7 @@ enum brcmf_netif_stop_reason {
  * @stats: interface specific network statistics.
  * @setmacaddr_work: worker object for setting mac address.
  * @multicast_work: worker object for multicast provisioning.
+ * @ndoffload_work: worker object for neighbor discovery offload configuration.
  * @fws_desc: interface specific firmware-signalling descriptor.
  * @ifidx: interface index in device firmware.
  * @bsscfgidx: index of bss associated with this interface.
@@ -191,6 +195,7 @@ struct brcmf_if {
         struct net_device_stats stats;
         struct work_struct setmacaddr_work;
         struct work_struct multicast_work;
+        struct work_struct ndoffload_work;
         struct brcmf_fws_mac_descriptor *fws_desc;
         int ifidx;
         s32 bsscfgidx;
@@ -199,6 +204,8 @@ struct brcmf_if {
         spinlock_t netif_stop_lock;
         atomic_t pend_8021x_cnt;
         wait_queue_head_t pend_8021x_wait;
+        struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
+        u8 ipv6addr_idx;
 };
 
 struct brcmf_skb_reorder_data {
@@ -220,5 +227,7 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp,
 void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
 void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
 void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
+int __init brcmf_core_init(void);
+void __exit brcmf_core_exit(void);
 
 #endif /* BRCMFMAC_CORE_H */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index 1ffa95f1b8d2..62985f2c0853 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -136,6 +136,7 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
 {
         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
         struct brcmf_pno_macaddr_le pfn_mac;
+        u32 wowl_cap;
         s32 err;
 
         brcmf_feat_firmware_capabilities(ifp);
@@ -143,11 +144,24 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
         if (drvr->bus_if->wowl_supported)
                 brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
+        if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL)) {
+                err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
+                if (!err) {
+                        ifp->drvr->feat_flags |= BIT(BRCMF_FEAT_WOWL_ARP_ND);
+                        if (wowl_cap & BRCMF_WOWL_PFN_FOUND)
+                                ifp->drvr->feat_flags |=
+                                        BIT(BRCMF_FEAT_WOWL_ND);
+                        if (wowl_cap & BRCMF_WOWL_GTK_FAILURE)
+                                ifp->drvr->feat_flags |=
+                                        BIT(BRCMF_FEAT_WOWL_GTK);
+                }
+        }
         /* MBSS does not work for 43362 */
         if (drvr->bus_if->chip == BRCM_CC_43362_CHIP_ID)
                 ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_MBSS);
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_RSDB, "rsdb_mode");
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_TDLS, "tdls_enable");
+        brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MFP, "mfp");
 
         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
         err = brcmf_fil_iovar_data_get(ifp, "pfn_macaddr", &pfn_mac,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
index 2e2479d41337..db4733a95e28 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
@@ -27,6 +27,10 @@
  * RSDB: Real Simultaneous Dual Band
  * TDLS: Tunneled Direct Link Setup
  * SCAN_RANDOM_MAC: Random MAC during (net detect) scheduled scan.
+ * WOWL_ND: WOWL net detect (PNO)
+ * WOWL_GTK: (WOWL) GTK rekeying offload
+ * WOWL_ARP_ND: ARP and Neighbor Discovery offload support during WOWL.
+ * MFP: 802.11w Management Frame Protection.
  */
 #define BRCMF_FEAT_LIST \
         BRCMF_FEAT_DEF(MBSS) \
@@ -36,7 +40,11 @@
         BRCMF_FEAT_DEF(P2P) \
         BRCMF_FEAT_DEF(RSDB) \
         BRCMF_FEAT_DEF(TDLS) \
-        BRCMF_FEAT_DEF(SCAN_RANDOM_MAC)
+        BRCMF_FEAT_DEF(SCAN_RANDOM_MAC) \
+        BRCMF_FEAT_DEF(WOWL_ND) \
+        BRCMF_FEAT_DEF(WOWL_GTK) \
+        BRCMF_FEAT_DEF(WOWL_ARP_ND) \
+        BRCMF_FEAT_DEF(MFP)
 
 /*
  * Quirks:
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
index 2ca783fa50cf..7e269f9aa607 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
@@ -32,7 +32,7 @@
 #define BRCMF_FLOWRING_LOW              (BRCMF_FLOWRING_HIGH - 256)
 #define BRCMF_FLOWRING_INVALID_IFIDX    0xff
 
-#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
+#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16)
 #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
 
 static const u8 brcmf_flowring_prio2fifo[] = {
@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
                           u8 prio, u8 ifidx)
 {
         struct brcmf_flowring_hash *hash;
-        u8 hash_idx;
+        u16 hash_idx;
         u32 i;
         bool found;
         bool sta;
@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
         }
         hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
                           BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+        hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
         found = false;
         hash = flow->hash;
         for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
                         break;
                 }
                 hash_idx++;
+                hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
         }
         if (found)
                 return hash[hash_idx].flowid;
@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 {
         struct brcmf_flowring_ring *ring;
         struct brcmf_flowring_hash *hash;
-        u8 hash_idx;
+        u16 hash_idx;
         u32 i;
         bool found;
         u8 fifo;
@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
         }
         hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
                           BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+        hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
         found = false;
         hash = flow->hash;
         for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
                         break;
                 }
                 hash_idx++;
+                hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
         }
         if (found) {
                 for (i = 0; i < flow->nrofrings; i++) {
@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 }
 
 
-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
 
@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
+static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
                                  bool blocked)
 {
         struct brcmf_flowring_ring *ring;
@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
-        u8 hash_idx;
+        u16 hash_idx;
         struct sk_buff *skb;
 
         ring = flow->rings[flowid];
@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
                            struct sk_buff *skb)
 {
         struct brcmf_flowring_ring *ring;
@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
         struct sk_buff *skb;
@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
                              struct sk_buff *skb)
 {
         struct brcmf_flowring_ring *ring;
@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
 
@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
 
@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid)
+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid)
 {
         struct brcmf_flowring_ring *ring;
-        u8 hash_idx;
+        u16 hash_idx;
 
         ring = flow->rings[flowid];
         hash_idx = ring->hash_id;
@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_flowring *flow)
         struct brcmf_pub *drvr = bus_if->drvr;
         struct brcmf_flowring_tdls_entry *search;
         struct brcmf_flowring_tdls_entry *remove;
-        u8 flowid;
+        u16 flowid;
 
         for (flowid = 0; flowid < flow->nrofrings; flowid++) {
                 if (flow->rings[flowid])
@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
         struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         u32 i;
-        u8 flowid;
+        u16 flowid;
 
         if (flow->addr_mode[ifidx] != addr_mode) {
                 for (i = 0; i < ARRAY_SIZE(flow->hash); i++) {
@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct brcmf_flowring *flow, int ifidx,
         struct brcmf_flowring_tdls_entry *prev;
         struct brcmf_flowring_tdls_entry *search;
         u32 i;
-        u8 flowid;
+        u16 flowid;
         bool sta;
 
         sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
index 95fd1c9675d1..068e68d94999 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
@@ -16,7 +16,7 @@
 #define BRCMFMAC_FLOWRING_H
 
 
-#define BRCMF_FLOWRING_HASHSIZE         256
+#define BRCMF_FLOWRING_HASHSIZE         512             /* has to be 2^x */
 #define BRCMF_FLOWRING_INVALID_ID       0xFFFFFFFF
 
 
@@ -24,7 +24,7 @@ struct brcmf_flowring_hash {
         u8 mac[ETH_ALEN];
         u8 fifo;
         u8 ifidx;
-        u8 flowid;
+        u16 flowid;
 };
 
 enum ring_status {
@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
                           u8 prio, u8 ifidx);
 u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
                           u8 prio, u8 ifidx);
-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid);
+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid);
+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid);
+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
                            struct sk_buff *skb);
-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid);
+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
                              struct sk_buff *skb);
-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid);
-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid);
+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid);
+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid);
 struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings);
 void brcmf_flowring_detach(struct brcmf_flowring *flow);
 void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index 7b26fb1b437c..d414fbbcc814 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -26,50 +26,6 @@
 #include "fwil.h"
 
 /**
- * struct brcm_ethhdr - broadcom specific ether header.
- *
- * @subtype: subtype for this packet.
- * @length: TODO: length of appended data.
- * @version: version indication.
- * @oui: OUI of this packet.
- * @usr_subtype: subtype for this OUI.
- */
-struct brcm_ethhdr {
-        __be16 subtype;
-        __be16 length;
-        u8 version;
-        u8 oui[3];
-        __be16 usr_subtype;
-} __packed;
-
-struct brcmf_event_msg_be {
-        __be16 version;
-        __be16 flags;
-        __be32 event_type;
-        __be32 status;
-        __be32 reason;
-        __be32 auth_type;
-        __be32 datalen;
-        u8 addr[ETH_ALEN];
-        char ifname[IFNAMSIZ];
-        u8 ifidx;
-        u8 bsscfgidx;
-} __packed;
-
-/**
- * struct brcmf_event - contents of broadcom event packet.
- *
- * @eth: standard ether header.
- * @hdr: broadcom specific ether header.
- * @msg: common part of the actual event message.
- */
-struct brcmf_event {
-        struct ethhdr eth;
-        struct brcm_ethhdr hdr;
-        struct brcmf_event_msg_be msg;
-} __packed;
-
-/**
  * struct brcmf_fweh_queue_item - event item on event queue.
  *
  * @q: list element for queuing.
@@ -85,6 +41,7 @@ struct brcmf_fweh_queue_item {
         u8 ifidx;
         u8 ifaddr[ETH_ALEN];
         struct brcmf_event_msg_be emsg;
+        u32 datalen;
         u8 data[0];
 };
 
@@ -294,6 +251,11 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
                 brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data,
                                    min_t(u32, emsg.datalen, 64),
                                    "event payload, len=%d\n", emsg.datalen);
+                if (emsg.datalen > event->datalen) {
+                        brcmf_err("event invalid length header=%d, msg=%d\n",
+                                  event->datalen, emsg.datalen);
+                        goto event_free;
+                }
 
                 /* special handling of interface event */
                 if (event->code == BRCMF_E_IF) {
@@ -439,7 +401,8 @@ int brcmf_fweh_activate_events(struct brcmf_if *ifp)
  * dispatch the event to a registered handler (using worker).
  */
 void brcmf_fweh_process_event(struct brcmf_pub *drvr,
-                              struct brcmf_event *event_packet)
+                              struct brcmf_event *event_packet,
+                              u32 packet_len)
 {
         enum brcmf_fweh_event_code code;
         struct brcmf_fweh_info *fweh = &drvr->fweh;
@@ -459,6 +422,9 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
         if (code != BRCMF_E_IF && !fweh->evt_handler[code])
                 return;
 
+        if (datalen > BRCMF_DCMD_MAXLEN)
+                return;
+
         if (in_interrupt())
                 alloc_flag = GFP_ATOMIC;
 
@@ -472,6 +438,7 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
         /* use memcpy to get aligned event message */
         memcpy(&event->emsg, &event_packet->msg, sizeof(event->emsg));
         memcpy(event->data, data, datalen);
+        event->datalen = datalen;
         memcpy(event->ifaddr, event_packet->eth.h_dest, ETH_ALEN);
 
         brcmf_fweh_queue_event(fweh, event);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
index 5e39e2a9e388..26ff5a9648f3 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
@@ -27,7 +27,6 @@
 struct brcmf_pub;
 struct brcmf_if;
 struct brcmf_cfg80211_info;
-struct brcmf_event;
 
 /* list of firmware events */
 #define BRCMF_FWEH_EVENT_ENUM_DEFLIST \
@@ -180,13 +179,55 @@ enum brcmf_fweh_event_code {
 /**
  * definitions for event packet validation.
  */
-#define BRCMF_EVENT_OUI_OFFSET          19
-#define BRCM_OUI                        "\x00\x10\x18"
-#define DOT11_OUI_LEN                   3
-#define BCMILCP_BCM_SUBTYPE_EVENT       1
+#define BRCM_OUI                                "\x00\x10\x18"
+#define BCMILCP_BCM_SUBTYPE_EVENT               1
 
 
 /**
+ * struct brcm_ethhdr - broadcom specific ether header.
+ *
+ * @subtype: subtype for this packet.
+ * @length: TODO: length of appended data.
+ * @version: version indication.
+ * @oui: OUI of this packet.
+ * @usr_subtype: subtype for this OUI.
+ */
+struct brcm_ethhdr {
+        __be16 subtype;
+        __be16 length;
+        u8 version;
+        u8 oui[3];
+        __be16 usr_subtype;
+} __packed;
+
+struct brcmf_event_msg_be {
+        __be16 version;
+        __be16 flags;
+        __be32 event_type;
+        __be32 status;
+        __be32 reason;
+        __be32 auth_type;
+        __be32 datalen;
+        u8 addr[ETH_ALEN];
+        char ifname[IFNAMSIZ];
+        u8 ifidx;
+        u8 bsscfgidx;
+} __packed;
+
+/**
+ * struct brcmf_event - contents of broadcom event packet.
+ *
+ * @eth: standard ether header.
+ * @hdr: broadcom specific ether header.
+ * @msg: common part of the actual event message.
+ */
+struct brcmf_event {
+        struct ethhdr eth;
+        struct brcm_ethhdr hdr;
+        struct brcmf_event_msg_be msg;
+} __packed;
+
+/**
  * struct brcmf_event_msg - firmware event message.
  *
  * @version: version information.
@@ -256,34 +297,35 @@ void brcmf_fweh_unregister(struct brcmf_pub *drvr,
                            enum brcmf_fweh_event_code code);
 int brcmf_fweh_activate_events(struct brcmf_if *ifp);
 void brcmf_fweh_process_event(struct brcmf_pub *drvr,
-                              struct brcmf_event *event_packet);
+                              struct brcmf_event *event_packet,
+                              u32 packet_len);
 void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);
 
 static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
                                           struct sk_buff *skb)
 {
         struct brcmf_event *event_packet;
-        u8 *data;
         u16 usr_stype;
 
         /* only process events when protocol matches */
         if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL))
                 return;
 
+        if ((skb->len + ETH_HLEN) < sizeof(*event_packet))
+                return;
+
         /* check for BRCM oui match */
         event_packet = (struct brcmf_event *)skb_mac_header(skb);
-        data = (u8 *)event_packet;
-        data += BRCMF_EVENT_OUI_OFFSET;
-        if (memcmp(BRCM_OUI, data, DOT11_OUI_LEN))
+        if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0],
+                   sizeof(event_packet->hdr.oui)))
                 return;
 
         /* final match on usr_subtype */
-        data += DOT11_OUI_LEN;
-        usr_stype = get_unaligned_be16(data);
+        usr_stype = get_unaligned_be16(&event_packet->hdr.usr_subtype);
         if (usr_stype != BCMILCP_BCM_SUBTYPE_EVENT)
                 return;
 
-        brcmf_fweh_process_event(drvr, event_packet);
+        brcmf_fweh_process_event(drvr, event_packet, skb->len + ETH_HLEN);
 }
 
 #endif /* FWEH_H_ */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 1afc2ad83b6c..a4118c0ef6ca 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -111,7 +111,9 @@
 /* Wakeup if received matched secured pattern: */
 #define BRCMF_WOWL_SECURE               (1 << 25)
 /* Wakeup on finding preferred network */
-#define BRCMF_WOWL_PFN_FOUND            (1 << 26)
+#define BRCMF_WOWL_PFN_FOUND            (1 << 27)
+/* Wakeup on receiving pairwise key EAP packets: */
+#define WIPHY_WOWL_EAP_PK               (1 << 28)
 /* Link Down indication in WoWL mode: */
 #define BRCMF_WOWL_LINKDOWN             (1 << 31)
 
@@ -134,6 +136,16 @@
 #define BRCMF_PFN_MAC_OUI_ONLY          BIT(0)
 #define BRCMF_PFN_SET_MAC_UNASSOC       BIT(1)
 
+#define BRCMF_MCSSET_LEN                16
+
+#define BRCMF_RSN_KCK_LENGTH            16
+#define BRCMF_RSN_KEK_LENGTH            16
+#define BRCMF_RSN_REPLAY_LEN            8
+
+#define BRCMF_MFP_NONE                  0
+#define BRCMF_MFP_CAPABLE               1
+#define BRCMF_MFP_REQUIRED              2
+
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
         BRCMF_JOIN_PREF_RSSI = 1,
@@ -279,7 +291,7 @@ struct brcmf_bss_info_le {
         __le32 reserved32[1];   /* Reserved for expansion of BSS properties */
         u8 flags;               /* flags */
         u8 reserved[3]; /* Reserved for expansion of BSS properties */
-        u8 basic_mcs[MCSSET_LEN];       /* 802.11N BSS required MCS set */
+        u8 basic_mcs[BRCMF_MCSSET_LEN]; /* 802.11N BSS required MCS set */
 
         __le16 ie_offset;       /* offset at which IEs start, from beginning */
         __le32 ie_length;       /* byte length of Information Elements */
@@ -787,4 +799,17 @@ struct brcmf_pktcnt_le {
         __le32 rx_ocast_good_pkt;
 };
 
+/**
+ * struct brcmf_gtk_keyinfo_le - GTP rekey data
+ *
+ * @kck: key confirmation key.
+ * @kek: key encryption key.
+ * @replay_counter: replay counter.
+ */
+struct brcmf_gtk_keyinfo_le {
+        u8 kck[BRCMF_RSN_KCK_LENGTH];
+        u8 kek[BRCMF_RSN_KEK_LENGTH];
+        u8 replay_counter[BRCMF_RSN_REPLAY_LEN];
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index c2bdb91746cf..922966734a7f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 }
 
 
-static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
+static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
 {
         struct brcmf_flowring *flow = msgbuf->flow;
         struct brcmf_commonring *commonring;
@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
 }
 
 
-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
 {
         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
         struct msgbuf_tx_flowring_delete_req *delete;
@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
         u32 count;
 
         if_msgbuf = drvr->bus_if->msgbuf;
+
+        if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
+                brcmf_err("driver not configured for this many flowrings %d\n",
+                          if_msgbuf->nrof_flowrings);
+                if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
+        }
+
         msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
         if (!msgbuf)
                 goto fail;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
index 3d513e407e3d..ee6906a3c3f6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
@@ -33,7 +33,7 @@
 
 
 int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid);
+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr);
 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr);
 #else
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
index 03f35e0c52ca..425c41dc0a59 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
@@ -16,17 +16,15 @@
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
-#include <linux/mmc/card.h>
-#include <linux/platform_data/brcmfmac-sdio.h>
-#include <linux/mmc/sdio_func.h>
 
 #include <defs.h>
 #include "debug.h"
-#include "sdio.h"
+#include "core.h"
+#include "common.h"
+#include "of.h"
 
-void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
+void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio)
 {
-        struct device *dev = sdiodev->dev;
         struct device_node *np = dev->of_node;
         int irq;
         u32 irqf;
@@ -35,12 +33,8 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
         if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
                 return;
 
-        sdiodev->pdata = devm_kzalloc(dev, sizeof(*sdiodev->pdata), GFP_KERNEL);
-        if (!sdiodev->pdata)
-                return;
-
         if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
-                sdiodev->pdata->drive_strength = val;
+                sdio->drive_strength = val;
 
         /* make sure there are interrupts defined in the node */
         if (!of_find_property(np, "interrupts", NULL))
@@ -53,7 +47,7 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
         }
         irqf = irqd_get_trigger_type(irq_get_irq_data(irq));
 
-        sdiodev->pdata->oob_irq_supported = true;
-        sdiodev->pdata->oob_irq_nr = irq;
-        sdiodev->pdata->oob_irq_flags = irqf;
+        sdio->oob_irq_supported = true;
+        sdio->oob_irq_nr = irq;
+        sdio->oob_irq_flags = irqf;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
index 5f7c3550deda..a9d94c15d0f5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
@@ -14,9 +14,9 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #ifdef CONFIG_OF
-void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev);
+void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio);
 #else
-static void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
+static void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio)
 {
 }
 #endif /* CONFIG_OF */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 821b6494f9d1..b5a49e564f25 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1361,6 +1361,11 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
         u16 mgmt_type;
         u8 action;
 
+        if (e->datalen < sizeof(*rxframe)) {
+                brcmf_dbg(SCAN, "Event data to small. Ignore\n");
+                return 0;
+        }
+
         ch.chspec = be16_to_cpu(rxframe->chanspec);
         cfg->d11inf.decchspec(&ch);
         /* Check if wpa_supplicant has registered for this frame */
@@ -1858,6 +1863,11 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
         brcmf_dbg(INFO, "Enter: event %d reason %d\n", e->event_code,
                   e->reason);
 
+        if (e->datalen < sizeof(*rxframe)) {
+                brcmf_dbg(SCAN, "Event data to small. Ignore\n");
+                return 0;
+        }
+
         ch.chspec = be16_to_cpu(rxframe->chanspec);
         cfg->d11inf.decchspec(&ch);
 
@@ -1988,8 +1998,8 @@ int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
                 return err;
         }
-        err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_CHANGE,
-                                                    BRCMF_VIF_EVENT_TIMEOUT);
+        err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_CHANGE,
+                                            BRCMF_VIF_EVENT_TIMEOUT);
         brcmf_cfg80211_arm_vif_event(cfg, NULL);
         if (!err)  {
                 brcmf_err("No BRCMF_E_IF_CHANGE event received\n");
@@ -2090,8 +2100,8 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
         }
 
         /* wait for firmware event */
-        err = brcmf_cfg80211_wait_vif_event_timeout(p2p->cfg, BRCMF_E_IF_ADD,
-                                                    BRCMF_VIF_EVENT_TIMEOUT);
+        err = brcmf_cfg80211_wait_vif_event(p2p->cfg, BRCMF_E_IF_ADD,
+                                            BRCMF_VIF_EVENT_TIMEOUT);
         brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
         brcmf_fweh_p2pdev_setup(pri_ifp, false);
         if (!err) {
@@ -2180,8 +2190,8 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
         }
 
         /* wait for firmware event */
-        err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
-                                                    BRCMF_VIF_EVENT_TIMEOUT);
+        err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
+                                            BRCMF_VIF_EVENT_TIMEOUT);
         brcmf_cfg80211_arm_vif_event(cfg, NULL);
         if (!err) {
                 brcmf_err("timeout occurred\n");
@@ -2272,8 +2282,8 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         }
         if (!err) {
                 /* wait for firmware event */
-                err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_DEL,
-                                                        BRCMF_VIF_EVENT_TIMEOUT);
+                err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
+                                                    BRCMF_VIF_EVENT_TIMEOUT);
                 if (!err)
                         err = -EIO;
                 else
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index d5f9ef470447..52fef5e1d615 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -37,6 +37,8 @@
 #include "pcie.h"
 #include "firmware.h"
 #include "chip.h"
+#include "core.h"
+#include "common.h"
 
 
 enum brcmf_pcie_state {
@@ -53,6 +55,7 @@ BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
 BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
 BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
 BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
+BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
 BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
 
 static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
@@ -66,13 +69,13 @@ static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
         BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
         BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
         BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFFF, 4365B),
-        BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFFF, 4366B),
+        BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
+        BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
         BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
 };
 
 #define BRCMF_PCIE_FW_UP_TIMEOUT                2000 /* msec */
 
-#define BRCMF_PCIE_TCM_MAP_SIZE                 (4096 * 1024)
 #define BRCMF_PCIE_REG_MAP_SIZE                 (32 * 1024)
 
 /* backplane addres space accessed by BAR0 */
@@ -99,9 +102,6 @@ static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
 #define BRCMF_PCIE_PCIE2REG_CONFIGDATA          0x124
 #define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX         0x140
 
-#define BRCMF_PCIE_GENREV1                      1
-#define BRCMF_PCIE_GENREV2                      2
-
 #define BRCMF_PCIE2_INTA                        0x01
 #define BRCMF_PCIE2_INTB                        0x02
 
@@ -207,6 +207,10 @@ static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
 #define BRCMF_PCIE_CFGREG_REG_BAR3_CONFIG       0x4F4
 #define BRCMF_PCIE_LINK_STATUS_CTRL_ASPM_ENAB   3
 
+/* Magic number at a magic location to find RAM size */
+#define BRCMF_RAMSIZE_MAGIC                     0x534d4152      /* SMAR */
+#define BRCMF_RAMSIZE_OFFSET                    0x6c
+
 
 struct brcmf_pcie_console {
         u32 base_addr;
@@ -248,14 +252,11 @@ struct brcmf_pciedev_info {
         char nvram_name[BRCMF_FW_NAME_LEN];
         void __iomem *regs;
         void __iomem *tcm;
-        u32 tcm_size;
         u32 ram_base;
         u32 ram_size;
         struct brcmf_chip *ci;
         u32 coreid;
-        u32 generic_corerev;
         struct brcmf_pcie_shared_info shared;
-        void (*ringbell)(struct brcmf_pciedev_info *devinfo);
         wait_queue_head_t mbdata_resp_wait;
         bool mbdata_completed;
         bool irq_allocated;
@@ -267,6 +268,7 @@ struct brcmf_pciedev_info {
         u16 (*read_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset);
         void (*write_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
                           u16 value);
+        struct brcmf_mp_device *settings;
 };
 
 struct brcmf_pcie_ringbuf {
@@ -742,68 +744,22 @@ static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
 }
 
 
-static __used void brcmf_pcie_ringbell_v1(struct brcmf_pciedev_info *devinfo)
-{
-        u32 reg_value;
-
-        brcmf_dbg(PCIE, "RING !\n");
-        reg_value = brcmf_pcie_read_reg32(devinfo,
-                                          BRCMF_PCIE_PCIE2REG_MAILBOXINT);
-        reg_value |= BRCMF_PCIE2_INTB;
-        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
-                               reg_value);
-}
-
-
-static void brcmf_pcie_ringbell_v2(struct brcmf_pciedev_info *devinfo)
-{
-        brcmf_dbg(PCIE, "RING !\n");
-        /* Any arbitrary value will do, lets use 1 */
-        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
-}
-
-
 static void brcmf_pcie_intr_disable(struct brcmf_pciedev_info *devinfo)
 {
-        if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1)
-                pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTMASK,
-                                       0);
-        else
-                brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
-                                       0);
+        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK, 0);
 }
 
 
 static void brcmf_pcie_intr_enable(struct brcmf_pciedev_info *devinfo)
 {
-        if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1)
-                pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTMASK,
-                                       BRCMF_PCIE_INT_DEF);
-        else
-                brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
-                                       BRCMF_PCIE_MB_INT_D2H_DB |
-                                       BRCMF_PCIE_MB_INT_FN0_0 |
-                                       BRCMF_PCIE_MB_INT_FN0_1);
-}
-
-
-static irqreturn_t brcmf_pcie_quick_check_isr_v1(int irq, void *arg)
-{
-        struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
-        u32 status;
-
-        status = 0;
-        pci_read_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
-        if (status) {
-                brcmf_pcie_intr_disable(devinfo);
-                brcmf_dbg(PCIE, "Enter\n");
-                return IRQ_WAKE_THREAD;
-        }
-        return IRQ_NONE;
+        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
+                               BRCMF_PCIE_MB_INT_D2H_DB |
+                               BRCMF_PCIE_MB_INT_FN0_0 |
+                               BRCMF_PCIE_MB_INT_FN0_1);
 }
 
 
-static irqreturn_t brcmf_pcie_quick_check_isr_v2(int irq, void *arg)
+static irqreturn_t brcmf_pcie_quick_check_isr(int irq, void *arg)
 {
         struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
 
@@ -816,29 +772,7 @@ static irqreturn_t brcmf_pcie_quick_check_isr_v2(int irq, void *arg)
 }
 
 
-static irqreturn_t brcmf_pcie_isr_thread_v1(int irq, void *arg)
-{
-        struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
-        const struct pci_dev *pdev = devinfo->pdev;
-        u32 status;
-
-        devinfo->in_irq = true;
-        status = 0;
-        pci_read_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
-        brcmf_dbg(PCIE, "Enter %x\n", status);
-        if (status) {
-                pci_write_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, status);
-                if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
-                        brcmf_proto_msgbuf_rx_trigger(&devinfo->pdev->dev);
-        }
-        if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
-                brcmf_pcie_intr_enable(devinfo);
-        devinfo->in_irq = false;
-        return IRQ_HANDLED;
-}
-
-
-static irqreturn_t brcmf_pcie_isr_thread_v2(int irq, void *arg)
+static irqreturn_t brcmf_pcie_isr_thread(int irq, void *arg)
 {
         struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
         u32 status;
@@ -875,28 +809,14 @@ static int brcmf_pcie_request_irq(struct brcmf_pciedev_info *devinfo)
         brcmf_pcie_intr_disable(devinfo);
 
         brcmf_dbg(PCIE, "Enter\n");
-        /* is it a v1 or v2 implementation */
+
         pci_enable_msi(pdev);
-        if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1) {
-                if (request_threaded_irq(pdev->irq,
-                                         brcmf_pcie_quick_check_isr_v1,
-                                         brcmf_pcie_isr_thread_v1,
-                                         IRQF_SHARED, "brcmf_pcie_intr",
-                                         devinfo)) {
-                        pci_disable_msi(pdev);
-                        brcmf_err("Failed to request IRQ %d\n", pdev->irq);
-                        return -EIO;
-                }
-        } else {
-                if (request_threaded_irq(pdev->irq,
-                                         brcmf_pcie_quick_check_isr_v2,
-                                         brcmf_pcie_isr_thread_v2,
-                                         IRQF_SHARED, "brcmf_pcie_intr",
-                                         devinfo)) {
-                        pci_disable_msi(pdev);
-                        brcmf_err("Failed to request IRQ %d\n", pdev->irq);
-                        return -EIO;
-                }
+        if (request_threaded_irq(pdev->irq, brcmf_pcie_quick_check_isr,
+                                 brcmf_pcie_isr_thread, IRQF_SHARED,
+                                 "brcmf_pcie_intr", devinfo)) {
+                pci_disable_msi(pdev);
+                brcmf_err("Failed to request IRQ %d\n", pdev->irq);
+                return -EIO;
         }
         devinfo->irq_allocated = true;
         return 0;
@@ -927,16 +847,9 @@ static void brcmf_pcie_release_irq(struct brcmf_pciedev_info *devinfo)
         if (devinfo->in_irq)
                 brcmf_err("Still in IRQ (processing) !!!\n");
 
-        if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1) {
-                status = 0;
-                pci_read_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
-                pci_write_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, status);
-        } else {
-                status = brcmf_pcie_read_reg32(devinfo,
-                                               BRCMF_PCIE_PCIE2REG_MAILBOXINT);
-                brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
-                                       status);
-        }
+        status = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
+        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT, status);
+
         devinfo->irq_allocated = false;
 }
 
@@ -985,7 +898,9 @@ static int brcmf_pcie_ring_mb_ring_bell(void *ctx)
         if (devinfo->state != BRCMFMAC_PCIE_STATE_UP)
                 return -EIO;
 
-        devinfo->ringbell(devinfo);
+        brcmf_dbg(PCIE, "RING !\n");
+        /* Any arbitrary value will do, lets use 1 */
+        brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
 
         return 0;
 }
@@ -1412,6 +1327,28 @@ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
 };
 
 
+static void
+brcmf_pcie_adjust_ramsize(struct brcmf_pciedev_info *devinfo, u8 *data,
+                          u32 data_len)
+{
+        __le32 *field;
+        u32 newsize;
+
+        if (data_len < BRCMF_RAMSIZE_OFFSET + 8)
+                return;
+
+        field = (__le32 *)&data[BRCMF_RAMSIZE_OFFSET];
+        if (le32_to_cpup(field) != BRCMF_RAMSIZE_MAGIC)
+                return;
+        field++;
+        newsize = le32_to_cpup(field);
+
+        brcmf_dbg(PCIE, "Found ramsize info in FW, adjusting to 0x%x\n",
+                  newsize);
+        devinfo->ci->ramsize = newsize;
+}
+
+
 static int
 brcmf_pcie_init_share_ram_info(struct brcmf_pciedev_info *devinfo,
                                u32 sharedram_addr)
@@ -1477,9 +1414,6 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
         u32 address;
         u32 resetintr;
 
-        devinfo->ringbell = brcmf_pcie_ringbell_v2;
-        devinfo->generic_corerev = BRCMF_PCIE_GENREV2;
-
         brcmf_dbg(PCIE, "Halt ARM.\n");
         err = brcmf_pcie_enter_download_state(devinfo);
         if (err)
@@ -1566,8 +1500,7 @@ static int brcmf_pcie_get_resource(struct brcmf_pciedev_info *devinfo)
         }
 
         devinfo->regs = ioremap_nocache(bar0_addr, BRCMF_PCIE_REG_MAP_SIZE);
-        devinfo->tcm = ioremap_nocache(bar1_addr, BRCMF_PCIE_TCM_MAP_SIZE);
-        devinfo->tcm_size = BRCMF_PCIE_TCM_MAP_SIZE;
+        devinfo->tcm = ioremap_nocache(bar1_addr, bar1_size);
 
         if (!devinfo->regs || !devinfo->tcm) {
                 brcmf_err("ioremap() failed (%p,%p)\n", devinfo->regs,
@@ -1576,8 +1509,9 @@ static int brcmf_pcie_get_resource(struct brcmf_pciedev_info *devinfo)
         }
         brcmf_dbg(PCIE, "Phys addr : reg space = %p base addr %#016llx\n",
                   devinfo->regs, (unsigned long long)bar0_addr);
-        brcmf_dbg(PCIE, "Phys addr : mem space = %p base addr %#016llx\n",
-                  devinfo->tcm, (unsigned long long)bar1_addr);
+        brcmf_dbg(PCIE, "Phys addr : mem space = %p base addr %#016llx size 0x%x\n",
+                  devinfo->tcm, (unsigned long long)bar1_addr,
+                  (unsigned int)bar1_size);
 
         return 0;
 }
@@ -1594,16 +1528,16 @@ static void brcmf_pcie_release_resource(struct brcmf_pciedev_info *devinfo)
 }
 
 
-static int brcmf_pcie_attach_bus(struct device *dev)
+static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
 {
         int ret;
 
         /* Attach to the common driver interface */
-        ret = brcmf_attach(dev);
+        ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
         if (ret) {
                 brcmf_err("brcmf_attach failed\n");
         } else {
-                ret = brcmf_bus_start(dev);
+                ret = brcmf_bus_start(&devinfo->pdev->dev);
                 if (ret)
                         brcmf_err("dongle is not responding\n");
         }
@@ -1694,6 +1628,13 @@ static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
 
         brcmf_pcie_attach(devinfo);
 
+        /* Some of the firmwares have the size of the memory of the device
+         * defined inside the firmware. This is because part of the memory in
+         * the device is shared and the devision is determined by FW. Parse
+         * the firmware and adjust the chip memory size now.
+         */
+        brcmf_pcie_adjust_ramsize(devinfo, (u8 *)fw->data, fw->size);
+
         ret = brcmf_pcie_download_fw_nvram(devinfo, fw, nvram, nvram_len);
         if (ret)
                 goto fail;
@@ -1734,7 +1675,7 @@ static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
         init_waitqueue_head(&devinfo->mbdata_resp_wait);
 
         brcmf_pcie_intr_enable(devinfo);
-        if (brcmf_pcie_attach_bus(bus->dev) == 0)
+        if (brcmf_pcie_attach_bus(devinfo) == 0)
                 return;
 
         brcmf_pcie_bus_console_read(devinfo);
@@ -1778,6 +1719,15 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto fail;
         }
 
+        devinfo->settings = brcmf_get_module_param(&devinfo->pdev->dev,
+                                                   BRCMF_BUSTYPE_PCIE,
+                                                   devinfo->ci->chip,
+                                                   devinfo->ci->chiprev);
+        if (!devinfo->settings) {
+                ret = -ENOMEM;
+                goto fail;
+        }
+
         bus = kzalloc(sizeof(*bus), GFP_KERNEL);
         if (!bus) {
                 ret = -ENOMEM;
@@ -1822,6 +1772,8 @@ fail:
         brcmf_pcie_release_resource(devinfo);
         if (devinfo->ci)
                 brcmf_chip_detach(devinfo->ci);
+        if (devinfo->settings)
+                brcmf_release_module_param(devinfo->settings);
         kfree(pcie_bus_dev);
         kfree(devinfo);
         return ret;
@@ -1861,6 +1813,8 @@ brcmf_pcie_remove(struct pci_dev *pdev)
 
         if (devinfo->ci)
                 brcmf_chip_detach(devinfo->ci);
+        if (devinfo->settings)
+                brcmf_release_module_param(devinfo->settings);
 
         kfree(devinfo);
         dev_set_drvdata(&pdev->dev, NULL);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index c790fa89db05..43fd3f402eba 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -33,8 +33,6 @@
 #include <linux/bcma/bcma.h>
 #include <linux/debugfs.h>
 #include <linux/vmalloc.h>
-#include <linux/platform_data/brcmfmac-sdio.h>
-#include <linux/moduleparam.h>
 #include <asm/unaligned.h>
 #include <defs.h>
 #include <brcmu_wifi.h>
@@ -44,6 +42,8 @@
 #include "sdio.h"
 #include "chip.h"
 #include "firmware.h"
+#include "core.h"
+#include "common.h"
 
 #define DCMD_RESP_TIMEOUT       msecs_to_jiffies(2500)
 #define CTL_DONE_TIMEOUT        msecs_to_jiffies(2500)
@@ -2442,15 +2442,17 @@ static void brcmf_sdio_bus_stop(struct device *dev)
 
 static inline void brcmf_sdio_clrintr(struct brcmf_sdio *bus)
 {
+        struct brcmf_sdio_dev *sdiodev;
         unsigned long flags;
 
-        if (bus->sdiodev->oob_irq_requested) {
-                spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
-                if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
-                        enable_irq(bus->sdiodev->pdata->oob_irq_nr);
-                        bus->sdiodev->irq_en = true;
+        sdiodev = bus->sdiodev;
+        if (sdiodev->oob_irq_requested) {
+                spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
+                if (!sdiodev->irq_en && !atomic_read(&bus->ipend)) {
+                        enable_irq(sdiodev->settings->bus.sdio.oob_irq_nr);
+                        sdiodev->irq_en = true;
                 }
-                spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
+                spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
         }
 }
 
@@ -3394,9 +3396,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                                            sizeof(u32));
         } else {
                 /* otherwise, set txglomalign */
-                value = 4;
-                if (sdiodev->pdata)
-                        value = sdiodev->pdata->sd_sgentry_align;
+                value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                 /* SDIO ADMA requires at least 32 bit alignment */
                 value = max_t(u32, value, 4);
                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
@@ -3775,26 +3775,28 @@ static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
 static bool
 brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
 {
+        struct brcmf_sdio_dev *sdiodev;
         u8 clkctl = 0;
         int err = 0;
         int reg_addr;
         u32 reg_val;
         u32 drivestrength;
 
-        sdio_claim_host(bus->sdiodev->func[1]);
+        sdiodev = bus->sdiodev;
+        sdio_claim_host(sdiodev->func[1]);
 
         pr_debug("F1 signature read @0x18000000=0x%4x\n",
-                 brcmf_sdiod_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
+                 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
 
         /*
          * Force PLL off until brcmf_chip_attach()
          * programs PLL control regs
          */
 
-        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
                           BRCMF_INIT_CLKCTL1, &err);
         if (!err)
-                clkctl = brcmf_sdiod_regrb(bus->sdiodev,
+                clkctl = brcmf_sdiod_regrb(sdiodev,
                                            SBSDIO_FUNC1_CHIPCLKCSR, &err);
 
         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
@@ -3803,50 +3805,81 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
                 goto fail;
         }
 
-        bus->ci = brcmf_chip_attach(bus->sdiodev, &brcmf_sdio_buscore_ops);
+        bus->ci = brcmf_chip_attach(sdiodev, &brcmf_sdio_buscore_ops);
         if (IS_ERR(bus->ci)) {
                 brcmf_err("brcmf_chip_attach failed!\n");
                 bus->ci = NULL;
                 goto fail;
         }
+        sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
+                                                   BRCMF_BUSTYPE_SDIO,
+                                                   bus->ci->chip,
+                                                   bus->ci->chiprev);
+        if (!sdiodev->settings) {
+                brcmf_err("Failed to get device parameters\n");
+                goto fail;
+        }
+        /* platform specific configuration:
+         *   alignments must be at least 4 bytes for ADMA
+         */
+        bus->head_align = ALIGNMENT;
+        bus->sgentry_align = ALIGNMENT;
+        if (sdiodev->settings->bus.sdio.sd_head_align > ALIGNMENT)
+                bus->head_align = sdiodev->settings->bus.sdio.sd_head_align;
+        if (sdiodev->settings->bus.sdio.sd_sgentry_align > ALIGNMENT)
+                bus->sgentry_align =
+                                sdiodev->settings->bus.sdio.sd_sgentry_align;
+
+        /* allocate scatter-gather table. sg support
+         * will be disabled upon allocation failure.
+         */
+        brcmf_sdiod_sgtable_alloc(sdiodev);
+
+#ifdef CONFIG_PM_SLEEP
+        /* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+         * is true or when platform data OOB irq is true).
+         */
+        if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+            ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
+             (sdiodev->settings->bus.sdio.oob_irq_supported)))
+                sdiodev->bus_if->wowl_supported = true;
+#endif
 
         if (brcmf_sdio_kso_init(bus)) {
                 brcmf_err("error enabling KSO\n");
                 goto fail;
         }
 
-        if ((bus->sdiodev->pdata) && (bus->sdiodev->pdata->drive_strength))
-                drivestrength = bus->sdiodev->pdata->drive_strength;
+        if (sdiodev->settings->bus.sdio.drive_strength)
+                drivestrength = sdiodev->settings->bus.sdio.drive_strength;
         else
                 drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
-        brcmf_sdio_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
+        brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
 
         /* Set card control so an SDIO card reset does a WLAN backplane reset */
-        reg_val = brcmf_sdiod_regrb(bus->sdiodev,
-                                    SDIO_CCCR_BRCM_CARDCTRL, &err);
+        reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
         if (err)
                 goto fail;
 
         reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
 
-        brcmf_sdiod_regwb(bus->sdiodev,
-                          SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
+        brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
         if (err)
                 goto fail;
 
         /* set PMUControl so a backplane reset does PMU state reload */
         reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
-        reg_val = brcmf_sdiod_regrl(bus->sdiodev, reg_addr, &err);
+        reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
         if (err)
                 goto fail;
 
         reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
 
-        brcmf_sdiod_regwl(bus->sdiodev, reg_addr, reg_val, &err);
+        brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
         if (err)
                 goto fail;
 
-        sdio_release_host(bus->sdiodev->func[1]);
+        sdio_release_host(sdiodev->func[1]);
 
         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
 
@@ -3867,7 +3900,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
         return true;
 
 fail:
-        sdio_release_host(bus->sdiodev->func[1]);
+        sdio_release_host(sdiodev->func[1]);
         return false;
 }
 
@@ -4045,18 +4078,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         bus->txminmax = BRCMF_TXMINMAX;
         bus->tx_seq = SDPCM_SEQ_WRAP - 1;
 
-        /* platform specific configuration:
-         *   alignments must be at least 4 bytes for ADMA
-         */
-        bus->head_align = ALIGNMENT;
-        bus->sgentry_align = ALIGNMENT;
-        if (sdiodev->pdata) {
-                if (sdiodev->pdata->sd_head_align > ALIGNMENT)
-                        bus->head_align = sdiodev->pdata->sd_head_align;
-                if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
-                        bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
-        }
-
         /* single-threaded workqueue */
         wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
                                      dev_name(&sdiodev->func[1]->dev));
@@ -4107,7 +4128,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
 
         /* Attach to the common layer, reserve hdr space */
-        ret = brcmf_attach(bus->sdiodev->dev);
+        ret = brcmf_attach(bus->sdiodev->dev, bus->sdiodev->settings);
         if (ret != 0) {
                 brcmf_err("brcmf_attach failed\n");
                 goto fail;
@@ -4211,6 +4232,8 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         }
                         brcmf_chip_detach(bus->ci);
                 }
+                if (bus->sdiodev->settings)
+                        brcmf_release_module_param(bus->sdiodev->settings);
 
                 kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
index 23f223150cef..dcf0ce8cd2c1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
@@ -184,7 +184,7 @@ struct brcmf_sdio_dev {
         struct brcmf_sdio *bus;
         struct device *dev;
         struct brcmf_bus *bus_if;
-        struct brcmfmac_sdio_platform_data *pdata;
+        struct brcmf_mp_device *settings;
         bool oob_irq_requested;
         bool irq_en;                    /* irq enable flags */
         spinlock_t irq_en_lock;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index c72b7b352a77..869eb82db8b1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -27,6 +27,8 @@
 #include "debug.h"
 #include "firmware.h"
 #include "usb.h"
+#include "core.h"
+#include "common.h"
 
 
 #define IOCTL_RESP_TIMEOUT              msecs_to_jiffies(2000)
@@ -171,6 +173,7 @@ struct brcmf_usbdev_info {
         struct urb *bulk_urb; /* used for FW download */
 
         bool wowl_enabled;
+        struct brcmf_mp_device *settings;
 };
 
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
@@ -1027,6 +1030,9 @@ static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
 
         kfree(devinfo->tx_reqs);
         kfree(devinfo->rx_reqs);
+
+        if (devinfo->settings)
+                brcmf_release_module_param(devinfo->settings);
 }
 
 
@@ -1136,7 +1142,7 @@ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
         int ret;
 
         /* Attach to the common driver interface */
-        ret = brcmf_attach(devinfo->dev);
+        ret = brcmf_attach(devinfo->dev, devinfo->settings);
         if (ret) {
                 brcmf_err("brcmf_attach failed\n");
                 return ret;
@@ -1223,6 +1229,14 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->wowl_supported = true;
 #endif
 
+        devinfo->settings = brcmf_get_module_param(bus->dev, BRCMF_BUSTYPE_USB,
+                                                   bus_pub->devid,
+                                                   bus_pub->chiprev);
+        if (!devinfo->settings) {
+                ret = -ENOMEM;
+                goto fail;
+        }
+
         if (!brcmf_usb_dlneeded(devinfo)) {
                 ret = brcmf_usb_bus_setup(devinfo);
                 if (ret)
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
index 3f68dd5ecd11..7b9a77981df1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
@@ -236,6 +236,8 @@ static inline bool ac_bitmap_tst(u8 bitmap, int prec)
 #define WPA2_AUTH_RESERVED3     0x0200
 #define WPA2_AUTH_RESERVED4     0x0400
 #define WPA2_AUTH_RESERVED5     0x0800
+#define WPA2_AUTH_1X_SHA256     0x1000  /* 1X with SHA256 key derivation */
+#define WPA2_AUTH_PSK_SHA256    0x8000  /* PSK with SHA256 key derivation */
 
 #define DOT11_DEFAULT_RTS_LEN           2347
 #define DOT11_DEFAULT_FRAG_LEN          2346
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index fa41a5e1c890..fc475ce59b47 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -73,8 +73,8 @@
 /* Highest firmware API version supported */
 #define IWL7260_UCODE_API_MAX   17
 #define IWL7265_UCODE_API_MAX   17
-#define IWL7265D_UCODE_API_MAX  20
-#define IWL3168_UCODE_API_MAX   20
+#define IWL7265D_UCODE_API_MAX  21
+#define IWL3168_UCODE_API_MAX   21
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    13
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index bce9b3420a13..97be104d1203 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -70,8 +70,8 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL8000_UCODE_API_MAX   20
-#define IWL8265_UCODE_API_MAX   20
+#define IWL8000_UCODE_API_MAX   21
+#define IWL8265_UCODE_API_MAX   21
 
 /* Oldest version we won't warn about */
 #define IWL8000_UCODE_API_OK    13
@@ -217,6 +217,7 @@ const struct iwl_cfg iwl8265_2ac_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .vht_mu_mimo_supported = true,
 };
 
 const struct iwl_cfg iwl4165_2ac_cfg = {
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-9000.c b/drivers/net/wireless/intel/iwlwifi/iwl-9000.c
index 4b93404f46a7..8e32a57dda0f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-9000.c
@@ -55,7 +55,7 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL9000_UCODE_API_MAX   20
+#define IWL9000_UCODE_API_MAX   21
 
 /* Oldest version we won't warn about */
 #define IWL9000_UCODE_API_OK    13
@@ -139,7 +139,8 @@ static const struct iwl_tt_params iwl9000_tt_params = {
         .smem_len = IWL9000_SMEM_LEN,                                   \
         .thermal_params = &iwl9000_tt_params,                           \
         .apmg_not_supported = true,                                     \
-        .mq_rx_supported = true
+        .mq_rx_supported = true,                                        \
+        .vht_mu_mimo_supported = true
 
 const struct iwl_cfg iwl9260_2ac_cfg = {
                 .name = "Intel(R) Dual Band Wireless AC 9260",
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index dad5570d6cc8..4f2b57e8bbc7 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -312,6 +312,7 @@ struct iwl_pwr_tx_backoff {
  * @smem_offset: offset from which the SMEM begins
  * @smem_len: the length of SMEM
  * @mq_rx_supported: multi-queue rx support
+ * @vht_mu_mimo_supported: VHT MU-MIMO support
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -364,6 +365,7 @@ struct iwl_cfg {
         const struct iwl_tt_params *thermal_params;
         bool apmg_not_supported;
         bool mq_rx_supported;
+        bool vht_mu_mimo_supported;
 };
 
 /*
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index 163b21bc20cb..a79c4f61a851 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016        Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -549,4 +550,52 @@ enum dtd_diode_reg {
         DTS_DIODE_REG_FLAGS_PASS_ONCE           = 0x00000080, /* bits [7:7] */
 };
 
+/*****************************************************************************
+ *                        MSIX related registers                             *
+ *****************************************************************************/
+
+#define CSR_MSIX_BASE                   (0x2000)
+#define CSR_MSIX_FH_INT_CAUSES_AD       (CSR_MSIX_BASE + 0x800)
+#define CSR_MSIX_FH_INT_MASK_AD         (CSR_MSIX_BASE + 0x804)
+#define CSR_MSIX_HW_INT_CAUSES_AD       (CSR_MSIX_BASE + 0x808)
+#define CSR_MSIX_HW_INT_MASK_AD         (CSR_MSIX_BASE + 0x80C)
+#define CSR_MSIX_AUTOMASK_ST_AD         (CSR_MSIX_BASE + 0x810)
+#define CSR_MSIX_RX_IVAR_AD_REG         (CSR_MSIX_BASE + 0x880)
+#define CSR_MSIX_IVAR_AD_REG            (CSR_MSIX_BASE + 0x890)
+#define CSR_MSIX_PENDING_PBA_AD         (CSR_MSIX_BASE + 0x1000)
+#define CSR_MSIX_RX_IVAR(cause)         (CSR_MSIX_RX_IVAR_AD_REG + (cause))
+#define CSR_MSIX_IVAR(cause)            (CSR_MSIX_IVAR_AD_REG + (cause))
+
+#define MSIX_FH_INT_CAUSES_Q(q)         (q)
+
+/*
+ * Causes for the FH register interrupts
+ */
+enum msix_fh_int_causes {
+        MSIX_FH_INT_CAUSES_D2S_CH0_NUM          = BIT(16),
+        MSIX_FH_INT_CAUSES_D2S_CH1_NUM          = BIT(17),
+        MSIX_FH_INT_CAUSES_S2D                  = BIT(19),
+        MSIX_FH_INT_CAUSES_FH_ERR               = BIT(21),
+};
+
+/*
+ * Causes for the HW register interrupts
+ */
+enum msix_hw_int_causes {
+        MSIX_HW_INT_CAUSES_REG_ALIVE            = BIT(0),
+        MSIX_HW_INT_CAUSES_REG_WAKEUP           = BIT(1),
+        MSIX_HW_INT_CAUSES_REG_CT_KILL          = BIT(6),
+        MSIX_HW_INT_CAUSES_REG_RF_KILL          = BIT(7),
+        MSIX_HW_INT_CAUSES_REG_PERIODIC         = BIT(8),
+        MSIX_HW_INT_CAUSES_REG_SW_ERR           = BIT(25),
+        MSIX_HW_INT_CAUSES_REG_SCD              = BIT(26),
+        MSIX_HW_INT_CAUSES_REG_FH_TX            = BIT(27),
+        MSIX_HW_INT_CAUSES_REG_HW_ERR           = BIT(29),
+        MSIX_HW_INT_CAUSES_REG_HAP              = BIT(30),
+};
+
+#define MSIX_MIN_INTERRUPT_VECTORS              2
+#define MSIX_AUTO_CLEAR_CAUSE                   0
+#define MSIX_NON_AUTO_CLEAR_CAUSE               BIT(7)
+
 #endif /* !__iwl_csr_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-devtrace-iwlwifi.h b/drivers/net/wireless/intel/iwlwifi/iwl-devtrace-iwlwifi.h
index 22786d7dc00a..2a0703fcec56 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-devtrace-iwlwifi.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-devtrace-iwlwifi.h
@@ -73,12 +73,12 @@ TRACE_EVENT(iwlwifi_dev_rx,
         TP_ARGS(dev, trans, pkt, len),
         TP_STRUCT__entry(
                 DEV_ENTRY
-                __field(u8, cmd)
+                __field(u16, cmd)
                 __dynamic_array(u8, rxbuf, iwl_rx_trace_len(trans, pkt, len))
         ),
         TP_fast_assign(
                 DEV_ASSIGN;
-                __entry->cmd = pkt->hdr.cmd;
+                __entry->cmd = WIDE_ID(pkt->hdr.group_id, pkt->hdr.cmd);
                 memcpy(__get_dynamic_array(rxbuf), pkt,
                        iwl_rx_trace_len(trans, pkt, len));
         ),
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index ab4c2a0470b2..184c0fef37c0 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -1033,7 +1033,8 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                 }
         }
 
-        if (usniffer_req && !*usniffer_images) {
+        if (!fw_has_capa(capa, IWL_UCODE_TLV_CAPA_USNIFFER_UNIFIED) &&
+            usniffer_req && !*usniffer_images) {
                 IWL_ERR(drv,
                         "user selected to work with usniffer but usniffer image isn't available in ucode package\n");
                 return -EINVAL;
@@ -1718,3 +1719,7 @@ MODULE_PARM_DESC(fw_monitor,
 module_param_named(d0i3_timeout, iwlwifi_mod_params.d0i3_entry_delay,
                    uint, S_IRUGO);
 MODULE_PARM_DESC(d0i3_timeout, "Timeout to D0i3 entry when idle (ms)");
+
+module_param_named(disable_11ac, iwlwifi_mod_params.disable_11ac, bool,
+                   S_IRUGO);
+MODULE_PARM_DESC(disable_11ac, "Disable VHT capabilities");
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-fh.h b/drivers/net/wireless/intel/iwlwifi/iwl-fh.h
index 4ab6682ea53e..8af818b10e71 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-fh.h
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -368,20 +368,24 @@ static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
 #define RFH_RXF_DMA_RBDCB_SIZE_512      (0x9 << RFH_RXF_DMA_RBDCB_SIZE_POS)
 #define RFH_RXF_DMA_RBDCB_SIZE_1024     (0xA << RFH_RXF_DMA_RBDCB_SIZE_POS)
 #define RFH_RXF_DMA_RBDCB_SIZE_2048     (0xB << RFH_RXF_DMA_RBDCB_SIZE_POS)
-#define RFH_RXF_DMA_MIN_RB_SIZE_MASK (0x03000000) /* bit 24-25 */
+#define RFH_RXF_DMA_MIN_RB_SIZE_MASK    (0x03000000) /* bit 24-25 */
 #define RFH_RXF_DMA_MIN_RB_SIZE_POS     24
-#define RFH_RXF_DMA_MIN_RB_4_8  (3 << RFH_RXF_DMA_MIN_RB_SIZE_POS)
-#define RFH_RXF_DMA_SINGLE_FRAME_MASK (0x20000000) /* bit 29 */
-#define RFH_DMA_EN_MASK (0xC0000000) /* bits 30-31*/
-#define RFH_DMA_EN_ENABLE_VAL BIT(31)
+#define RFH_RXF_DMA_MIN_RB_4_8          (3 << RFH_RXF_DMA_MIN_RB_SIZE_POS)
+#define RFH_RXF_DMA_DROP_TOO_LARGE_MASK (0x04000000) /* bit 26 */
+#define RFH_RXF_DMA_SINGLE_FRAME_MASK   (0x20000000) /* bit 29 */
+#define RFH_DMA_EN_MASK                 (0xC0000000) /* bits 30-31*/
+#define RFH_DMA_EN_ENABLE_VAL           BIT(31)
 
 #define RFH_RXF_RXQ_ACTIVE 0xA0980C
 
 #define RFH_GEN_CFG     0xA09800
+#define RFH_GEN_CFG_SERVICE_DMA_SNOOP   BIT(0)
+#define RFH_GEN_CFG_RFH_DMA_SNOOP       BIT(1)
+#define RFH_GEN_CFG_RB_CHUNK_SIZE       BIT(4) /* 0 - 64B, 1- 128B */
 #define RFH_GEN_CFG_DEFAULT_RXQ_NUM_MASK 0xF00
-#define RFH_GEN_CFG_SERVICE_DMA_SNOOP BIT(0)
-#define RFH_GEN_CFG_RFH_DMA_SNOOP BIT(1)
-#define DEFAULT_RXQ_NUM 8
+#define RFH_GEN_CFG_DEFAULT_RXQ_NUM_POS 8
+
+#define DEFAULT_RXQ_NUM                 0
 
 /* end of 9000 rx series registers */
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/intel/iwlwifi/iwl-fw-file.h
index e2dbc67a367b..5f69bf5e04c7 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-fw-file.h
@@ -318,6 +318,12 @@ typedef unsigned int __bitwise__ iwl_ucode_tlv_capa_t;
  * @IWL_UCODE_TLV_CAPA_BEACON_STORING: firmware will store the latest beacon
  *      from AP and will send it upon d0i3 exit.
  * @IWL_UCODE_TLV_CAPA_LAR_SUPPORT_V2: support LAR API V2
+ * @IWL_UCODE_TLV_CAPA_CT_KILL_BY_FW: firmware responsible for CT-kill
+ * @IWL_UCODE_TLV_CAPA_TEMP_THS_REPORT_SUPPORT: supports temperature
+ *      thresholds reporting
+ * @IWL_UCODE_TLV_CAPA_CTDP_SUPPORT: supports cTDP command
+ * @IWL_UCODE_TLV_CAPA_USNIFFER_UNIFIED: supports usniffer enabled in
+ *      regular image.
  *
  * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
  */
@@ -351,6 +357,10 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_BEACON_ANT_SELECTION         = (__force iwl_ucode_tlv_capa_t)71,
         IWL_UCODE_TLV_CAPA_BEACON_STORING               = (__force iwl_ucode_tlv_capa_t)72,
         IWL_UCODE_TLV_CAPA_LAR_SUPPORT_V2               = (__force iwl_ucode_tlv_capa_t)73,
+        IWL_UCODE_TLV_CAPA_CT_KILL_BY_FW                = (__force iwl_ucode_tlv_capa_t)74,
+        IWL_UCODE_TLV_CAPA_TEMP_THS_REPORT_SUPPORT      = (__force iwl_ucode_tlv_capa_t)75,
+        IWL_UCODE_TLV_CAPA_CTDP_SUPPORT                 = (__force iwl_ucode_tlv_capa_t)76,
+        IWL_UCODE_TLV_CAPA_USNIFFER_UNIFIED             = (__force iwl_ucode_tlv_capa_t)77,
 
         NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-modparams.h b/drivers/net/wireless/intel/iwlwifi/iwl-modparams.h
index b88ecc7892a9..d1a5dd1602f5 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-modparams.h
@@ -115,6 +115,7 @@ enum iwl_amsdu_size {
  *      entering D0i3 (in msecs)
  * @lar_disable: disable LAR (regulatory), default = 0
  * @fw_monitor: allow to use firmware monitor
+ * @disable_11ac: disable VHT capabilities, default = false.
  */
 struct iwl_mod_params {
         int sw_crypto;
@@ -135,6 +136,7 @@ struct iwl_mod_params {
         unsigned int d0i3_entry_delay;
         bool lar_disable;
         bool fw_monitor;
+        bool disable_11ac;
 };
 
 #endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 50f4cc60cf3e..348135792f3e 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -366,6 +366,9 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                        max_ampdu_exponent <<
                        IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
 
+        if (cfg->vht_mu_mimo_supported)
+                vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
+
         if (cfg->ht_params->ldpc)
                 vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
 
@@ -449,7 +452,7 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
                                           IEEE80211_BAND_5GHZ);
         iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ,
                              tx_chains, rx_chains);
-        if (data->sku_cap_11ac_enable)
+        if (data->sku_cap_11ac_enable && !iwlwifi_mod_params.disable_11ac)
                 iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap,
                                       tx_chains, rx_chains);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 5bde23a472b4..c46e596e12b1 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -404,4 +404,6 @@ enum {
         LMPM_PAGE_PASS_NOTIF_POS = BIT(20),
 };
 
+#define UREG_CHICK              (0xA05C00)
+#define UREG_CHICK_MSIX_ENABLE  BIT(25)
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index 0ca0f13b69b0..91d74b3f666b 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -836,6 +836,7 @@ struct iwl_trans {
 
         enum iwl_plat_pm_mode system_pm_mode;
         enum iwl_plat_pm_mode runtime_pm_mode;
+        bool suspending;
 
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 5214482a0403..c1a313149eed 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -816,8 +816,7 @@ static int iwl_mvm_switch_to_d3(struct iwl_mvm *mvm)
 {
         iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
 
-        iwl_trans_stop_device(mvm->trans);
-
+        iwl_mvm_stop_device(mvm);
         /*
          * Set the HW restart bit -- this is mostly true as we're
          * going to load new firmware and reprogram that, though
@@ -856,8 +855,7 @@ iwl_mvm_get_wowlan_config(struct iwl_mvm *mvm,
         wowlan_config_cmd->is_11n_connection =
                                         ap_sta->ht_cap.ht_supported;
         wowlan_config_cmd->flags = ENABLE_L3_FILTERING |
-                ENABLE_NBNS_FILTERING | ENABLE_DHCP_FILTERING |
-                ENABLE_STORE_BEACON;
+                ENABLE_NBNS_FILTERING | ENABLE_DHCP_FILTERING;
 
         /* Query the last used seqno and set it */
         ret = iwl_mvm_get_last_nonqos_seq(mvm, vif);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index c529e5355803..56e6b0b8b9cc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -64,6 +64,7 @@
  *
  *****************************************************************************/
 #include <linux/vmalloc.h>
+#include <linux/ieee80211.h>
 
 #include "mvm.h"
 #include "fw-dbg.h"
@@ -976,7 +977,7 @@ static ssize_t iwl_dbgfs_indirection_tbl_write(struct iwl_mvm *mvm,
         memcpy(&cmd.indirection_table[i * nbytes], cmd.indirection_table,
                ARRAY_SIZE(cmd.indirection_table) % nbytes);
 
-        memcpy(cmd.secret_key, mvm->secret_key, ARRAY_SIZE(cmd.secret_key));
+        memcpy(cmd.secret_key, mvm->secret_key, sizeof(cmd.secret_key));
 
         mutex_lock(&mvm->mutex);
         ret = iwl_mvm_send_cmd_pdu(mvm, RSS_CONFIG_CMD, 0, sizeof(cmd), &cmd);
@@ -1080,6 +1081,22 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
         return count;
 }
 
+static ssize_t iwl_dbgfs_max_amsdu_len_write(struct iwl_mvm *mvm,
+                                             char *buf, size_t count,
+                                             loff_t *ppos)
+{
+        unsigned int max_amsdu_len;
+        int ret;
+
+        ret = kstrtouint(buf, 0, &max_amsdu_len);
+
+        if (max_amsdu_len > IEEE80211_MAX_MPDU_LEN_VHT_11454)
+                return -EINVAL;
+        mvm->max_amsdu_len = max_amsdu_len;
+
+        return count;
+}
+
 #define ADD_TEXT(...) pos += scnprintf(buf + pos, bufsz - pos, __VA_ARGS__)
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 static ssize_t iwl_dbgfs_bcast_filters_read(struct file *file,
@@ -1497,7 +1514,9 @@ MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(fw_dbg_conf, 8);
 MVM_DEBUGFS_WRITE_FILE_OPS(fw_dbg_collect, 64);
 MVM_DEBUGFS_WRITE_FILE_OPS(cont_recording, 8);
-MVM_DEBUGFS_WRITE_FILE_OPS(indirection_tbl, 16);
+MVM_DEBUGFS_WRITE_FILE_OPS(max_amsdu_len, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(indirection_tbl,
+                           (IWL_RSS_INDIRECTION_TABLE_SIZE * 2));
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
@@ -1540,6 +1559,7 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(d0i3_refs, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_dbg_conf, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_dbg_collect, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(max_amsdu_len, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(send_echo_cmd, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(cont_recording, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(indirection_tbl, mvm->debugfs_dir, S_IWUSR);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rx.h
index df939f51d9b9..eb9b87038e1f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rx.h
@@ -391,4 +391,56 @@ struct iwl_rss_config_cmd {
         u8 indirection_table[IWL_RSS_INDIRECTION_TABLE_SIZE];
 } __packed; /* RSS_CONFIG_CMD_API_S_VER_1 */
 
+#define IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE 128
+#define IWL_MULTI_QUEUE_SYNC_SENDER_POS 0
+#define IWL_MULTI_QUEUE_SYNC_SENDER_MSK 0xf
+
+/**
+ * struct iwl_rxq_sync_cmd - RXQ notification trigger
+ *
+ * @flags: flags of the notification. bit 0:3 are the sender queue
+ * @rxq_mask: rx queues to send the notification on
+ * @count: number of bytes in payload, should be DWORD aligned
+ * @payload: data to send to rx queues
+ */
+struct iwl_rxq_sync_cmd {
+        __le32 flags;
+        __le32 rxq_mask;
+        __le32 count;
+        u8 payload[];
+} __packed; /* MULTI_QUEUE_DRV_SYNC_HDR_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_rxq_sync_notification - Notification triggered by RXQ
+ * sync command
+ *
+ * @count: number of bytes in payload
+ * @payload: data to send to rx queues
+ */
+struct iwl_rxq_sync_notification {
+        __le32 count;
+        u8 payload[];
+} __packed; /* MULTI_QUEUE_DRV_SYNC_HDR_CMD_API_S_VER_1 */
+
+/**
+* Internal message identifier
+*
+* @IWL_MVM_RXQ_NOTIF_DEL_BA: notify RSS queues of delBA
+*/
+enum iwl_mvm_rxq_notif_type {
+        IWL_MVM_RXQ_NOTIF_DEL_BA,
+};
+
+/**
+* struct iwl_mvm_internal_rxq_notif - Internal representation of the data sent
+* in &iwl_rxq_sync_cmd. Should be DWORD aligned.
+*
+* @type: value from &iwl_mvm_rxq_notif_type
+* @data: payload
+*/
+struct iwl_mvm_internal_rxq_notif {
+        u32 type;
+        u8 data[];
+} __packed;
+
 #endif /* __fw_api_rx_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api.h
index f332497e29d1..4a0fc47c81f2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api.h
@@ -119,6 +119,8 @@ enum {
         SCAN_ABORT_UMAC = 0xe,
         SCAN_COMPLETE_UMAC = 0xf,
 
+        BA_WINDOW_STATUS_NOTIFICATION_ID = 0x13,
+
         /* station table */
         ADD_STA_KEY = 0x17,
         ADD_STA = 0x18,
@@ -279,9 +281,19 @@ enum {
  */
 enum iwl_phy_ops_subcmd_ids {
         CMD_DTS_MEASUREMENT_TRIGGER_WIDE = 0x0,
+        CTDP_CONFIG_CMD = 0x03,
+        TEMP_REPORTING_THRESHOLDS_CMD = 0x04,
+        CT_KILL_NOTIFICATION = 0xFE,
         DTS_MEASUREMENT_NOTIF_WIDE = 0xFF,
 };
 
+enum iwl_data_path_subcmd_ids {
+        UPDATE_MU_GROUPS_CMD = 0x1,
+        TRIGGER_RX_QUEUES_NOTIF_CMD = 0x2,
+        MU_GROUP_MGMT_NOTIF = 0xFE,
+        RX_QUEUES_NOTIFICATION = 0xFF,
+};
+
 enum iwl_prot_offload_subcmd_ids {
         STORED_BEACON_NTF = 0xFF,
 };
@@ -291,6 +303,7 @@ enum {
         LEGACY_GROUP = 0x0,
         LONG_GROUP = 0x1,
         PHY_OPS_GROUP = 0x4,
+        DATA_PATH_GROUP = 0x5,
         PROT_OFFLOAD_GROUP = 0xb,
 };
 
@@ -1278,6 +1291,26 @@ struct iwl_fw_bcast_filter {
         struct iwl_fw_bcast_filter_attr attrs[MAX_BCAST_FILTER_ATTRS];
 } __packed; /* BCAST_FILTER_S_VER_1 */
 
+#define BA_WINDOW_STREAMS_MAX           16
+#define BA_WINDOW_STATUS_TID_MSK        0x000F
+#define BA_WINDOW_STATUS_STA_ID_POS     4
+#define BA_WINDOW_STATUS_STA_ID_MSK     0x01F0
+#define BA_WINDOW_STATUS_VALID_MSK      BIT(9)
+
+/**
+ * struct iwl_ba_window_status_notif - reordering window's status notification
+ * @bitmap: bitmap of received frames [start_seq_num + 0]..[start_seq_num + 63]
+ * @ra_tid: bit 3:0 - TID, bit 8:4 - STA_ID, bit 9 - valid
+ * @start_seq_num: the start sequence number of the bitmap
+ * @mpdu_rx_count: the number of received MPDUs since entering D0i3
+ */
+struct iwl_ba_window_status_notif {
+        __le64 bitmap[BA_WINDOW_STREAMS_MAX];
+        __le16 ra_tid[BA_WINDOW_STREAMS_MAX];
+        __le32 start_seq_num[BA_WINDOW_STREAMS_MAX];
+        __le16 mpdu_rx_count[BA_WINDOW_STREAMS_MAX];
+} __packed; /* BA_WINDOW_STATUS_NTFY_API_S_VER_1 */
+
 /**
  * struct iwl_fw_bcast_mac - per-mac broadcast filtering configuration.
  * @default_discard: default action for this mac (discard (1) / pass (0)).
@@ -1675,15 +1708,77 @@ struct iwl_ext_dts_measurement_cmd {
 } __packed; /* XVT_FW_DTS_CONTROL_MEASUREMENT_REQUEST_API_S */
 
 /**
- * iwl_dts_measurement_notif - notification received with the measurements
+ * struct iwl_dts_measurement_notif_v1 - measurements notification
  *
  * @temp: the measured temperature
  * @voltage: the measured voltage
  */
-struct iwl_dts_measurement_notif {
+struct iwl_dts_measurement_notif_v1 {
         __le32 temp;
         __le32 voltage;
-} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S */
+} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S_VER_1*/
+
+/**
+ * struct iwl_dts_measurement_notif_v2 - measurements notification
+ *
+ * @temp: the measured temperature
+ * @voltage: the measured voltage
+ * @threshold_idx: the trip index that was crossed
+ */
+struct iwl_dts_measurement_notif_v2 {
+        __le32 temp;
+        __le32 voltage;
+        __le32 threshold_idx;
+} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S_VER_2 */
+
+/**
+ * struct ct_kill_notif - CT-kill entry notification
+ *
+ * @temperature: the current temperature in celsius
+ * @reserved: reserved
+ */
+struct ct_kill_notif {
+        __le16 temperature;
+        __le16 reserved;
+} __packed; /* GRP_PHY_CT_KILL_NTF */
+
+/**
+* enum ctdp_cmd_operation - CTDP command operations
+* @CTDP_CMD_OPERATION_START: update the current budget
+* @CTDP_CMD_OPERATION_STOP: stop ctdp
+* @CTDP_CMD_OPERATION_REPORT: get the avgerage budget
+*/
+enum iwl_mvm_ctdp_cmd_operation {
+        CTDP_CMD_OPERATION_START        = 0x1,
+        CTDP_CMD_OPERATION_STOP         = 0x2,
+        CTDP_CMD_OPERATION_REPORT       = 0x4,
+};/* CTDP_CMD_OPERATION_TYPE_E */
+
+/**
+ * struct iwl_mvm_ctdp_cmd - track and manage the FW power consumption budget
+ *
+ * @operation: see &enum iwl_mvm_ctdp_cmd_operation
+ * @budget: the budget in milliwatt
+ * @window_size: defined in API but not used
+ */
+struct iwl_mvm_ctdp_cmd {
+        __le32 operation;
+        __le32 budget;
+        __le32 window_size;
+} __packed;
+
+#define IWL_MAX_DTS_TRIPS       8
+
+/**
+ * struct iwl_temp_report_ths_cmd - set temperature thresholds
+ *
+ * @num_temps: number of temperature thresholds passed
+ * @thresholds: array with the thresholds to be configured
+ */
+struct temp_report_ths_cmd {
+        __le32 num_temps;
+        __le16 thresholds[IWL_MAX_DTS_TRIPS];
+} __packed; /* GRP_PHY_TEMP_REPORTING_THRESHOLDS_CMD */
 
 /***********************************
  * TDLS API
@@ -1858,6 +1953,31 @@ struct iwl_shared_mem_cfg {
         __le32 page_buff_size;
 } __packed; /* SHARED_MEM_ALLOC_API_S_VER_1 */
 
+/**
+ * VHT MU-MIMO group configuration
+ *
+ * @membership_status: a bitmap of MU groups
+ * @user_position:the position of station in a group. If the station is in the
+ *      group then bits (group * 2) is the position -1
+ */
+struct iwl_mu_group_mgmt_cmd {
+        __le32 reserved;
+        __le32 membership_status[2];
+        __le32 user_position[4];
+} __packed; /* MU_GROUP_ID_MNG_TABLE_API_S_VER_1 */
+
+/**
+ * struct iwl_mu_group_mgmt_notif - VHT MU-MIMO group id notification
+ *
+ * @membership_status: a bitmap of MU groups
+ * @user_position: the position of station in a group. If the station is in the
+ *      group then bits (group * 2) is the position -1
+ */
+struct iwl_mu_group_mgmt_notif {
+        __le32 membership_status[2];
+        __le32 user_position[4];
+} __packed; /* MU_GROUP_MNG_NTFY_API_S_VER_1 */
+
 #define MAX_STORED_BEACON_SIZE 600
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 62ae43d2ab7b..594cd0dc7df9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -121,7 +121,7 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 
         for (i = 0; i < ARRAY_SIZE(cmd.indirection_table); i++)
                 cmd.indirection_table[i] = i % mvm->trans->num_rx_queues;
-        memcpy(cmd.secret_key, mvm->secret_key, ARRAY_SIZE(cmd.secret_key));
+        memcpy(cmd.secret_key, mvm->secret_key, sizeof(cmd.secret_key));
 
         return iwl_mvm_send_cmd_pdu(mvm, RSS_CONFIG_CMD, 0, sizeof(cmd), &cmd);
 }
@@ -539,7 +539,9 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
         struct iwl_sf_region st_fwrd_space;
 
         if (ucode_type == IWL_UCODE_REGULAR &&
-            iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE))
+            iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE) &&
+            !(fw_has_capa(&mvm->fw->ucode_capa,
+                          IWL_UCODE_TLV_CAPA_USNIFFER_UNIFIED)))
                 fw = iwl_get_ucode_image(mvm, IWL_UCODE_REGULAR_USNIFFER);
         else
                 fw = iwl_get_ucode_image(mvm, ucode_type);
@@ -954,8 +956,26 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                         goto error;
         }
 
+#ifdef CONFIG_THERMAL
+        if (iwl_mvm_is_tt_in_fw(mvm)) {
+                /* in order to give the responsibility of ct-kill and
+                 * TX backoff to FW we need to send empty temperature reporting
+                 * cmd during init time
+                 */
+                iwl_mvm_send_temp_report_ths_cmd(mvm);
+        } else {
+                /* Initialize tx backoffs to the minimal possible */
+                iwl_mvm_tt_tx_backoff(mvm, 0);
+        }
+
+        /* TODO: read the budget from BIOS / Platform NVM */
+        if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0)
+                ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START,
+                                           mvm->cooling_dev.cur_state);
+#else
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
+#endif
 
         WARN_ON(iwl_mvm_config_ltr(mvm));
 
@@ -991,7 +1011,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         IWL_DEBUG_INFO(mvm, "RT uCode started.\n");
         return 0;
  error:
-        iwl_trans_stop_device(mvm->trans);
+        iwl_mvm_stop_device(mvm);
         return ret;
 }
 
@@ -1035,7 +1055,7 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm)
 
         return 0;
  error:
-        iwl_trans_stop_device(mvm->trans);
+        iwl_mvm_stop_device(mvm);
         return ret;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 535134d639e0..e885db3464b0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1484,6 +1484,8 @@ void iwl_mvm_rx_stored_beacon_notif(struct iwl_mvm *mvm,
         /* update rx_status according to the notification's metadata */
         memset(&rx_status, 0, sizeof(rx_status));
         rx_status.mactime = le64_to_cpu(sb->tsf);
+        /* TSF as indicated by the firmware  is at INA time */
+        rx_status.flag |= RX_FLAG_MACTIME_PLCP_START;
         rx_status.device_timestamp = le32_to_cpu(sb->system_time);
         rx_status.band =
                 (sb->phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_BAND_24)) ?
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 53156810185d..ec6b07282e7d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -69,7 +70,6 @@
 #include <linux/etherdevice.h>
 #include <linux/ip.h>
 #include <linux/if_arp.h>
-#include <linux/devcoredump.h>
 #include <linux/time.h>
 #include <net/mac80211.h>
 #include <net/ieee80211_radiotap.h>
@@ -85,7 +85,6 @@
 #include "testmode.h"
 #include "iwl-fw-error-dump.h"
 #include "iwl-prph.h"
-#include "iwl-csr.h"
 #include "iwl-nvm-parse.h"
 #include "fw-dbg.h"
 
@@ -611,6 +610,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 
+        wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_RRM);
+
         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 
 #ifdef CONFIG_PM_SLEEP
@@ -847,6 +848,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
         u16 tid = params->tid;
         u16 *ssn = &params->ssn;
         u8 buf_size = params->buf_size;
+        bool amsdu = params->amsdu;
 
         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
                      sta->addr, tid, action);
@@ -907,7 +909,8 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
-                ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid, buf_size);
+                ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
+                                              buf_size, amsdu);
                 break;
         default:
                 WARN_ON_ONCE(1);
@@ -969,7 +972,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
          */
         iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
 
-        iwl_trans_stop_device(mvm->trans);
+        iwl_mvm_stop_device(mvm);
 
         mvm->scan_status = 0;
         mvm->ps_disabled = false;
@@ -1138,7 +1141,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
          */
         flush_work(&mvm->roc_done_wk);
 
-        iwl_trans_stop_device(mvm->trans);
+        iwl_mvm_stop_device(mvm);
 
         iwl_mvm_async_handlers_purge(mvm);
         /* async_handlers_list is empty and will stay empty: HW is stopped */
@@ -1169,8 +1172,6 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
                                 mvm->scan_uid_status[i] = 0;
                 }
         }
-
-        mvm->ucode_loaded = false;
 }
 
 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
@@ -1762,6 +1763,50 @@ static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
 }
 #endif
 
+static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif)
+{
+        struct iwl_mu_group_mgmt_cmd cmd = {};
+
+        memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
+               WLAN_MEMBERSHIP_LEN);
+        memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
+               WLAN_USER_POSITION_LEN);
+
+        return iwl_mvm_send_cmd_pdu(mvm,
+                                    WIDE_ID(DATA_PATH_GROUP,
+                                            UPDATE_MU_GROUPS_CMD),
+                                    0, sizeof(cmd), &cmd);
+}
+
+static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
+                                           struct ieee80211_vif *vif)
+{
+        if (vif->mu_mimo_owner) {
+                struct iwl_mu_group_mgmt_notif *notif = _data;
+
+                /*
+                 * MU-MIMO Group Id action frame is little endian. We treat
+                 * the data received from firmware as if it came from the
+                 * action frame, so no conversion is needed.
+                 */
+                ieee80211_update_mu_groups(vif,
+                                           (u8 *)&notif->membership_status,
+                                           (u8 *)&notif->user_position);
+        }
+}
+
+void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
+                               struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
+
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_mu_mimo_iface_iterator, notif);
+}
+
 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                              struct ieee80211_vif *vif,
                                              struct ieee80211_bss_conf *bss_conf,
@@ -1870,6 +1915,18 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                         vif->addr);
                 }
 
+                /*
+                 * The firmware tracks the MU-MIMO group on its own.
+                 * However, on HW restart we should restore this data.
+                 */
+                if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
+                    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
+                        ret = iwl_mvm_update_mu_groups(mvm, vif);
+                        if (ret)
+                                IWL_ERR(mvm,
+                                        "failed to update VHT MU_MIMO groups\n");
+                }
+
                 iwl_mvm_recalc_multicast(mvm);
                 iwl_mvm_configure_bcast_filter(mvm);
 
@@ -1896,7 +1953,12 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
         }
 
-        if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS)) {
+        if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
+                       /*
+                        * Send power command on every beacon change,
+                        * because we may have not enabled beacon abort yet.
+                        */
+                       BSS_CHANGED_BEACON_INFO)) {
                 ret = iwl_mvm_power_update_mac(mvm);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
@@ -2083,7 +2145,6 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
                                 bss_conf->txpower);
                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
         }
-
 }
 
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -2276,6 +2337,11 @@ static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
                 return;
 
+        if (vif->p2p && !iwl_mvm_is_p2p_standalone_uapsd_supported(mvm)) {
+                vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
+                return;
+        }
+
         if (iwlwifi_mod_params.uapsd_disable) {
                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index cc279e0961fa..ab410b4659f3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016        Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016        Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -71,6 +73,10 @@
 #include <linux/leds.h>
 #include <linux/in6.h>
 
+#ifdef CONFIG_THERMAL
+#include <linux/thermal.h>
+#endif
+
 #include "iwl-op-mode.h"
 #include "iwl-trans.h"
 #include "iwl-notif-wait.h"
@@ -487,6 +493,12 @@ enum iwl_mvm_scan_type {
         IWL_SCAN_TYPE_FRAGMENTED,
 };
 
+enum iwl_mvm_sched_scan_pass_all_states {
+        SCHED_SCAN_PASS_ALL_DISABLED,
+        SCHED_SCAN_PASS_ALL_ENABLED,
+        SCHED_SCAN_PASS_ALL_FOUND,
+};
+
 /**
  * struct iwl_nvm_section - describes an NVM section in memory.
  *
@@ -517,6 +529,30 @@ struct iwl_mvm_tt_mgmt {
         bool throttle;
 };
 
+#ifdef CONFIG_THERMAL
+/**
+ *struct iwl_mvm_thermal_device - thermal zone related data
+ * @temp_trips: temperature thresholds for report
+ * @fw_trips_index: keep indexes to original array - temp_trips
+ * @tzone: thermal zone device data
+*/
+struct iwl_mvm_thermal_device {
+        s16 temp_trips[IWL_MAX_DTS_TRIPS];
+        u8 fw_trips_index[IWL_MAX_DTS_TRIPS];
+        struct thermal_zone_device *tzone;
+};
+
+/*
+ * iwl_mvm_cooling_device
+ * @cur_state: current state in milliwatts
+ * @cdev: struct thermal cooling device
+ */
+struct iwl_mvm_cooling_device {
+        u32 cur_state;
+        struct thermal_cooling_device *cdev;
+};
+#endif
+
 #define IWL_MVM_NUM_LAST_FRAMES_UCODE_RATES 8
 
 struct iwl_mvm_frame_stats {
@@ -657,6 +693,7 @@ struct iwl_mvm {
         void *scan_cmd;
         struct iwl_mcast_filter_cmd *mcast_filter_cmd;
         enum iwl_mvm_scan_type scan_type;
+        enum iwl_mvm_sched_scan_pass_all_states sched_scan_pass_all;
 
         /* max number of simultaneous scans the FW supports */
         unsigned int max_scans;
@@ -797,6 +834,11 @@ struct iwl_mvm {
 
         /* Thermal Throttling and CTkill */
         struct iwl_mvm_tt_mgmt thermal_throttle;
+#ifdef CONFIG_THERMAL
+        struct iwl_mvm_thermal_device tz_device;
+        struct iwl_mvm_cooling_device cooling_dev;
+#endif
+
         s32 temperature;        /* Celsius */
         /*
          * Debug option to set the NIC temperature. This option makes the
@@ -819,6 +861,7 @@ struct iwl_mvm {
 
         /* Indicate if device power save is allowed */
         u8 ps_disabled; /* u8 instead of bool to ease debugfs_create_* usage */
+        unsigned int max_amsdu_len; /* used for debugfs only */
 
         struct ieee80211_vif __rcu *csa_vif;
         struct ieee80211_vif __rcu *csa_tx_blocked_vif;
@@ -943,8 +986,9 @@ static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
 
 static inline bool iwl_mvm_is_dqa_supported(struct iwl_mvm *mvm)
 {
-        return fw_has_capa(&mvm->fw->ucode_capa,
-                           IWL_UCODE_TLV_CAPA_DQA_SUPPORT);
+        /* Make sure DQA isn't allowed in driver until feature is complete */
+        return false && fw_has_capa(&mvm->fw->ucode_capa,
+                                    IWL_UCODE_TLV_CAPA_DQA_SUPPORT);
 }
 
 static inline bool iwl_mvm_enter_d0i3_on_suspend(struct iwl_mvm *mvm)
@@ -1028,6 +1072,28 @@ static inline bool iwl_mvm_has_new_rx_api(struct iwl_mvm *mvm)
                            IWL_UCODE_TLV_CAPA_MULTI_QUEUE_RX_SUPPORT);
 }
 
+static inline bool iwl_mvm_is_tt_in_fw(struct iwl_mvm *mvm)
+{
+#ifdef CONFIG_THERMAL
+        /* these two TLV are redundant since the responsibility to CT-kill by
+         * FW happens only after we send at least one command of
+         * temperature THs report.
+         */
+        return fw_has_capa(&mvm->fw->ucode_capa,
+                           IWL_UCODE_TLV_CAPA_CT_KILL_BY_FW) &&
+               fw_has_capa(&mvm->fw->ucode_capa,
+                           IWL_UCODE_TLV_CAPA_TEMP_THS_REPORT_SUPPORT);
+#else /* CONFIG_THERMAL */
+        return false;
+#endif /* CONFIG_THERMAL */
+}
+
+static inline bool iwl_mvm_is_ctdp_supported(struct iwl_mvm *mvm)
+{
+        return fw_has_capa(&mvm->fw->ucode_capa,
+                           IWL_UCODE_TLV_CAPA_CTDP_SUPPORT);
+}
+
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
 
 struct iwl_rate_info {
@@ -1160,6 +1226,10 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                         struct iwl_rx_cmd_buffer *rxb, int queue);
 void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm,
                               struct iwl_rx_cmd_buffer *rxb, int queue);
+int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
+                            const u8 *data, u32 count);
+void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+                            int queue);
 void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
@@ -1203,6 +1273,10 @@ void iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
                                      struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_stored_beacon_notif(struct iwl_mvm *mvm,
                                     struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
+                               struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_mac_ctxt_recalc_tsf_id(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif);
 unsigned long iwl_mvm_get_used_hw_queues(struct iwl_mvm *mvm,
@@ -1479,32 +1553,30 @@ void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue, int mac80211_queue,
         iwl_mvm_enable_txq(mvm, queue, mac80211_queue, ssn, &cfg, wdg_timeout);
 }
 
-static inline void iwl_mvm_enable_agg_txq(struct iwl_mvm *mvm, int queue,
-                                          int mac80211_queue, int fifo,
-                                          int sta_id, int tid, int frame_limit,
-                                          u16 ssn, unsigned int wdg_timeout)
+static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
 {
-        struct iwl_trans_txq_scd_cfg cfg = {
-                .fifo = fifo,
-                .sta_id = sta_id,
-                .tid = tid,
-                .frame_limit = frame_limit,
-                .aggregate = true,
-        };
-
-        iwl_mvm_enable_txq(mvm, queue, mac80211_queue, ssn, &cfg, wdg_timeout);
+        mvm->ucode_loaded = false;
+        iwl_trans_stop_device(mvm->trans);
 }
 
+/* Stop/start all mac queues in a given bitmap */
+void iwl_mvm_start_mac_queues(struct iwl_mvm *mvm, unsigned long mq);
+void iwl_mvm_stop_mac_queues(struct iwl_mvm *mvm, unsigned long mq);
+
 /* Thermal management and CT-kill */
 void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff);
 void iwl_mvm_tt_temp_changed(struct iwl_mvm *mvm, u32 temp);
 void iwl_mvm_temp_notif(struct iwl_mvm *mvm,
                         struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_tt_handler(struct iwl_mvm *mvm);
-void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff);
-void iwl_mvm_tt_exit(struct iwl_mvm *mvm);
+void iwl_mvm_thermal_initialize(struct iwl_mvm *mvm, u32 min_backoff);
+void iwl_mvm_thermal_exit(struct iwl_mvm *mvm);
 void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state);
 int iwl_mvm_get_temp(struct iwl_mvm *mvm, s32 *temp);
+void iwl_mvm_ct_kill_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
+int iwl_mvm_send_temp_report_ths_cmd(struct iwl_mvm *mvm);
+int iwl_mvm_cooling_device_register(struct iwl_mvm *mvm);
+int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 budget);
 
 /* Location Aware Regulatory */
 struct iwl_mcc_update_resp *
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index fd8f4a80ddfc..699a80863e86 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -236,6 +236,9 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(ANTENNA_COUPLING_NOTIFICATION,
                    iwl_mvm_rx_ant_coupling_notif, true),
 
+        RX_HANDLER(BA_WINDOW_STATUS_NOTIFICATION_ID,
+                   iwl_mvm_window_status_notif, false),
+
         RX_HANDLER(TIME_EVENT_NOTIFICATION, iwl_mvm_rx_time_event_notif, false),
         RX_HANDLER(MCC_CHUB_UPDATE_CMD, iwl_mvm_rx_chub_update_mcc, true),
 
@@ -263,6 +266,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(DTS_MEASUREMENT_NOTIFICATION, iwl_mvm_temp_notif, true),
         RX_HANDLER_GRP(PHY_OPS_GROUP, DTS_MEASUREMENT_NOTIF_WIDE,
                        iwl_mvm_temp_notif, true),
+        RX_HANDLER_GRP(PHY_OPS_GROUP, CT_KILL_NOTIFICATION,
+                       iwl_mvm_ct_kill_notif, false),
 
         RX_HANDLER(TDLS_CHANNEL_SWITCH_NOTIFICATION, iwl_mvm_rx_tdls_notif,
                    true),
@@ -270,6 +275,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(TOF_NOTIFICATION, iwl_mvm_tof_resp_handler, true),
         RX_HANDLER_GRP(PROT_OFFLOAD_GROUP, STORED_BEACON_NTF,
                        iwl_mvm_rx_stored_beacon_notif, false),
+        RX_HANDLER_GRP(DATA_PATH_GROUP, MU_GROUP_MGMT_NOTIF,
+                       iwl_mvm_mu_mimo_grp_notif, false),
 
 };
 #undef RX_HANDLER
@@ -292,6 +299,7 @@ static const struct iwl_hcmd_names iwl_mvm_legacy_names[] = {
         HCMD_NAME(SCAN_COMPLETE_UMAC),
         HCMD_NAME(TOF_CMD),
         HCMD_NAME(TOF_NOTIFICATION),
+        HCMD_NAME(BA_WINDOW_STATUS_NOTIFICATION_ID),
         HCMD_NAME(ADD_STA_KEY),
         HCMD_NAME(ADD_STA),
         HCMD_NAME(REMOVE_STA),
@@ -387,12 +395,25 @@ static const struct iwl_hcmd_names iwl_mvm_legacy_names[] = {
  */
 static const struct iwl_hcmd_names iwl_mvm_phy_names[] = {
         HCMD_NAME(CMD_DTS_MEASUREMENT_TRIGGER_WIDE),
+        HCMD_NAME(CTDP_CONFIG_CMD),
+        HCMD_NAME(TEMP_REPORTING_THRESHOLDS_CMD),
+        HCMD_NAME(CT_KILL_NOTIFICATION),
         HCMD_NAME(DTS_MEASUREMENT_NOTIF_WIDE),
 };
 
 /* Please keep this array *SORTED* by hex value.
  * Access is done through binary search
  */
+static const struct iwl_hcmd_names iwl_mvm_data_path_names[] = {
+        HCMD_NAME(UPDATE_MU_GROUPS_CMD),
+        HCMD_NAME(TRIGGER_RX_QUEUES_NOTIF_CMD),
+        HCMD_NAME(MU_GROUP_MGMT_NOTIF),
+        HCMD_NAME(RX_QUEUES_NOTIFICATION),
+};
+
+/* Please keep this array *SORTED* by hex value.
+ * Access is done through binary search
+ */
 static const struct iwl_hcmd_names iwl_mvm_prot_offload_names[] = {
         HCMD_NAME(STORED_BEACON_NTF),
 };
@@ -401,6 +422,7 @@ static const struct iwl_hcmd_arr iwl_mvm_groups[] = {
         [LEGACY_GROUP] = HCMD_ARR(iwl_mvm_legacy_names),
         [LONG_GROUP] = HCMD_ARR(iwl_mvm_legacy_names),
         [PHY_OPS_GROUP] = HCMD_ARR(iwl_mvm_phy_names),
+        [DATA_PATH_GROUP] = HCMD_ARR(iwl_mvm_data_path_names),
         [PROT_OFFLOAD_GROUP] = HCMD_ARR(iwl_mvm_prot_offload_names),
 };
 
@@ -474,8 +496,11 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         if (iwl_mvm_has_new_rx_api(mvm)) {
                 op_mode->ops = &iwl_mvm_ops_mq;
+                trans->rx_mpdu_cmd_hdr_size = sizeof(struct iwl_rx_mpdu_desc);
         } else {
                 op_mode->ops = &iwl_mvm_ops;
+                trans->rx_mpdu_cmd_hdr_size =
+                        sizeof(struct iwl_rx_mpdu_res_start);
 
                 if (WARN_ON(trans->num_rx_queues > 1))
                         goto out_free;
@@ -567,7 +592,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_trans_configure(mvm->trans, &trans_cfg);
 
         trans->rx_mpdu_cmd = REPLY_RX_MPDU_CMD;
-        trans->rx_mpdu_cmd_hdr_size = sizeof(struct iwl_rx_mpdu_res_start);
         trans->dbg_dest_tlv = mvm->fw->dbg_dest_tlv;
         trans->dbg_dest_reg_num = mvm->fw->dbg_dest_reg_num;
         memcpy(trans->dbg_conf_tlv, mvm->fw->dbg_conf_tlv,
@@ -588,7 +612,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
                  mvm->cfg->name, mvm->trans->hw_rev);
 
         min_backoff = calc_min_backoff(trans, cfg);
-        iwl_mvm_tt_initialize(mvm, min_backoff);
+        iwl_mvm_thermal_initialize(mvm, min_backoff);
 
         if (iwlwifi_mod_params.nvm_file)
                 mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
@@ -619,7 +643,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
                 iwl_mvm_ref(mvm, IWL_MVM_REF_INIT_UCODE);
                 err = iwl_run_init_mvm_ucode(mvm, true);
                 if (!err || !iwlmvm_mod_params.init_dbg)
-                        iwl_trans_stop_device(trans);
+                        iwl_mvm_stop_device(mvm);
                 iwl_mvm_unref(mvm, IWL_MVM_REF_INIT_UCODE);
                 mutex_unlock(&mvm->mutex);
                 /* returns 0 if successful, 1 if success but in rfkill */
@@ -648,19 +672,22 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         memset(&mvm->rx_stats, 0, sizeof(struct mvm_statistics_rx));
 
-        /* rpm starts with a taken reference, we can release it now */
-        iwl_trans_unref(mvm->trans);
+        /* The transport always starts with a taken reference, we can
+         * release it now if d0i3 is supported */
+        if (iwl_mvm_is_d0i3_supported(mvm))
+                iwl_trans_unref(mvm->trans);
 
         iwl_mvm_tof_init(mvm);
 
         /* init RSS hash key */
-        get_random_bytes(mvm->secret_key, ARRAY_SIZE(mvm->secret_key));
+        get_random_bytes(mvm->secret_key, sizeof(mvm->secret_key));
 
         return op_mode;
 
  out_unregister:
         ieee80211_unregister_hw(mvm->hw);
         iwl_mvm_leds_exit(mvm);
+        iwl_mvm_thermal_exit(mvm);
  out_free:
         flush_delayed_work(&mvm->fw_dump_wk);
         iwl_phy_db_free(mvm->phy_db);
@@ -676,9 +703,16 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         int i;
 
+        /* If d0i3 is supported, we have released the reference that
+         * the transport started with, so we should take it back now
+         * that we are leaving.
+         */
+        if (iwl_mvm_is_d0i3_supported(mvm))
+                iwl_trans_ref(mvm->trans);
+
         iwl_mvm_leds_exit(mvm);
 
-        iwl_mvm_tt_exit(mvm);
+        iwl_mvm_thermal_exit(mvm);
 
         ieee80211_unregister_hw(mvm->hw);
 
@@ -858,28 +892,24 @@ static void iwl_mvm_rx_mq(struct iwl_op_mode *op_mode,
                 iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, 0);
         else if (pkt->hdr.cmd == REPLY_RX_PHY_CMD)
                 iwl_mvm_rx_phy_cmd_mq(mvm, rxb);
+        else if (unlikely(pkt->hdr.group_id == DATA_PATH_GROUP &&
+                          pkt->hdr.cmd == RX_QUEUES_NOTIFICATION))
+                iwl_mvm_rx_queue_notif(mvm, rxb, 0);
         else
                 iwl_mvm_rx_common(mvm, rxb, pkt);
 }
 
-static void iwl_mvm_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
+void iwl_mvm_stop_mac_queues(struct iwl_mvm *mvm, unsigned long mq)
 {
-        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
-        unsigned long mq;
         int q;
 
-        spin_lock_bh(&mvm->queue_info_lock);
-        mq = mvm->queue_info[queue].hw_queue_to_mac80211;
-        spin_unlock_bh(&mvm->queue_info_lock);
-
         if (WARN_ON_ONCE(!mq))
                 return;
 
         for_each_set_bit(q, &mq, IEEE80211_MAX_QUEUES) {
                 if (atomic_inc_return(&mvm->mac80211_queue_stop_count[q]) > 1) {
                         IWL_DEBUG_TX_QUEUES(mvm,
-                                            "queue %d (mac80211 %d) already stopped\n",
-                                            queue, q);
+                                            "mac80211 %d already stopped\n", q);
                         continue;
                 }
 
@@ -899,24 +929,29 @@ static void iwl_mvm_async_cb(struct iwl_op_mode *op_mode,
         iwl_trans_block_txq_ptrs(mvm->trans, false);
 }
 
-static void iwl_mvm_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
+static void iwl_mvm_stop_sw_queue(struct iwl_op_mode *op_mode, int hw_queue)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         unsigned long mq;
-        int q;
 
         spin_lock_bh(&mvm->queue_info_lock);
-        mq = mvm->queue_info[queue].hw_queue_to_mac80211;
+        mq = mvm->queue_info[hw_queue].hw_queue_to_mac80211;
         spin_unlock_bh(&mvm->queue_info_lock);
 
+        iwl_mvm_stop_mac_queues(mvm, mq);
+}
+
+void iwl_mvm_start_mac_queues(struct iwl_mvm *mvm, unsigned long mq)
+{
+        int q;
+
         if (WARN_ON_ONCE(!mq))
                 return;
 
         for_each_set_bit(q, &mq, IEEE80211_MAX_QUEUES) {
                 if (atomic_dec_return(&mvm->mac80211_queue_stop_count[q]) > 0) {
                         IWL_DEBUG_TX_QUEUES(mvm,
-                                            "queue %d (mac80211 %d) still stopped\n",
-                                            queue, q);
+                                            "mac80211 %d still stopped\n", q);
                         continue;
                 }
 
@@ -924,6 +959,18 @@ static void iwl_mvm_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
         }
 }
 
+static void iwl_mvm_wake_sw_queue(struct iwl_op_mode *op_mode, int hw_queue)
+{
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        unsigned long mq;
+
+        spin_lock_bh(&mvm->queue_info_lock);
+        mq = mvm->queue_info[hw_queue].hw_queue_to_mac80211;
+        spin_unlock_bh(&mvm->queue_info_lock);
+
+        iwl_mvm_start_mac_queues(mvm, mq);
+}
+
 void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
 {
         if (state)
@@ -1530,6 +1577,9 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode,
 
         if (unlikely(pkt->hdr.cmd == FRAME_RELEASE))
                 iwl_mvm_rx_frame_release(mvm, rxb, queue);
+        else if (unlikely(pkt->hdr.cmd == RX_QUEUES_NOTIFICATION &&
+                          pkt->hdr.group_id == DATA_PATH_GROUP))
+                iwl_mvm_rx_queue_notif(mvm, rxb, queue);
         else
                 iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, queue);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 6e7e78a37879..61d0a8cd13f9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -556,6 +556,7 @@ static char *rs_pretty_rate(const struct rs_rate *rate)
         if (is_type_legacy(rate->type) && (rate->index <= IWL_RATE_54M_INDEX))
                 rate_str = legacy_rates[rate->index];
         else if ((is_type_ht(rate->type) || is_type_vht(rate->type)) &&
+                 (rate->index >= IWL_RATE_MCS_0_INDEX) &&
                  (rate->index <= IWL_RATE_MCS_9_INDEX))
                 rate_str = ht_vht_rates[rate->index];
         else
@@ -1672,6 +1673,20 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
         }
 }
 
+static void rs_set_amsdu_len(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                             struct iwl_scale_tbl_info *tbl,
+                             enum rs_action scale_action)
+{
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
+
+        if ((!is_vht(&tbl->rate) && !is_ht(&tbl->rate)) ||
+            tbl->rate.index < IWL_RATE_MCS_5_INDEX ||
+            scale_action == RS_ACTION_DOWNSCALE)
+                sta_priv->tlc_amsdu = false;
+        else
+                sta_priv->tlc_amsdu = true;
+}
+
 /*
  * setup rate table in uCode
  */
@@ -2415,6 +2430,7 @@ lq_update:
                 tbl->rate.index = index;
                 if (IWL_MVM_RS_80_20_FAR_RANGE_TWEAK)
                         rs_tweak_rate_tbl(mvm, sta, lq_sta, tbl, scale_action);
+                rs_set_amsdu_len(mvm, sta, tbl, scale_action);
                 rs_update_rate_tbl(mvm, sta, lq_sta, tbl);
         }
 
@@ -3098,6 +3114,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         sband = hw->wiphy->bands[band];
 
         lq_sta->lq.sta_id = sta_priv->sta_id;
+        sta_priv->tlc_amsdu = false;
 
         for (j = 0; j < LQ_SIZE; j++)
                 rs_rate_scale_clear_tbl_windows(mvm, &lq_sta->lq_info[j]);
@@ -3657,10 +3674,13 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         ssize_t ret;
 
         struct iwl_lq_sta *lq_sta = file->private_data;
+        struct iwl_mvm_sta *mvmsta =
+                container_of(lq_sta, struct iwl_mvm_sta, lq_sta);
         struct iwl_mvm *mvm;
         struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
         struct rs_rate *rate = &tbl->rate;
         u32 ss_params;
+
         mvm = lq_sta->pers.drv;
         buff = kmalloc(2048, GFP_KERNEL);
         if (!buff)
@@ -3686,10 +3706,11 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                                 (is_ht20(rate)) ? "20MHz" :
                                 (is_ht40(rate)) ? "40MHz" :
                                 (is_ht80(rate)) ? "80Mhz" : "BAD BW");
-                desc += sprintf(buff + desc, " %s %s %s\n",
+                desc += sprintf(buff + desc, " %s %s %s %s\n",
                                 (rate->sgi) ? "SGI" : "NGI",
                                 (rate->ldpc) ? "LDPC" : "BCC",
-                                (lq_sta->is_agg) ? "AGG on" : "");
+                                (lq_sta->is_agg) ? "AGG on" : "",
+                                (mvmsta->tlc_amsdu) ? "AMSDU on" : "");
         }
         desc += sprintf(buff+desc, "last tx rate=0x%X\n",
                         lq_sta->last_rate_n_flags);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 145ec68ce6f9..485cfc1a4daa 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -322,11 +323,9 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
         rx_status->freq =
                 ieee80211_channel_to_frequency(le16_to_cpu(phy_info->channel),
                                                rx_status->band);
-        /*
-         * TSF as indicated by the fw is at INA time, but mac80211 expects the
-         * TSF at the beginning of the MPDU.
-         */
-        /*rx_status->flag |= RX_FLAG_MACTIME_MPDU;*/
+
+        /* TSF as indicated by the firmware  is at INA time */
+        rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
 
         iwl_mvm_get_signal_strength(mvm, phy_info, rx_status);
 
@@ -448,6 +447,12 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
         iwl_mvm_update_frame_stats(mvm, rate_n_flags,
                                    rx_status->flag & RX_FLAG_AMPDU_DETAILS);
 #endif
+
+        if (unlikely((ieee80211_is_beacon(hdr->frame_control) ||
+                      ieee80211_is_probe_resp(hdr->frame_control)) &&
+                     mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED))
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_FOUND;
+
         iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, hdr, len, ampdu_status,
                                         crypt_len, rxb);
 }
@@ -622,3 +627,51 @@ void iwl_mvm_rx_statistics(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 {
         iwl_mvm_handle_rx_statistics(mvm, rxb_addr(rxb));
 }
+
+void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_ba_window_status_notif *notif = (void *)pkt->data;
+        int i;
+        u32 pkt_len = iwl_rx_packet_payload_len(pkt);
+
+        if (WARN_ONCE(pkt_len != sizeof(*notif),
+                      "Received window status notification of wrong size (%u)\n",
+                      pkt_len))
+                return;
+
+        rcu_read_lock();
+        for (i = 0; i < BA_WINDOW_STREAMS_MAX; i++) {
+                struct ieee80211_sta *sta;
+                u8 sta_id, tid;
+                u64 bitmap;
+                u32 ssn;
+                u16 ratid;
+                u16 received_mpdu;
+
+                ratid = le16_to_cpu(notif->ra_tid[i]);
+                /* check that this TID is valid */
+                if (!(ratid & BA_WINDOW_STATUS_VALID_MSK))
+                        continue;
+
+                received_mpdu = le16_to_cpu(notif->mpdu_rx_count[i]);
+                if (received_mpdu == 0)
+                        continue;
+
+                tid = ratid & BA_WINDOW_STATUS_TID_MSK;
+                /* get the station */
+                sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK)
+                         >> BA_WINDOW_STATUS_STA_ID_POS;
+                sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+                if (IS_ERR_OR_NULL(sta))
+                        continue;
+                bitmap = le64_to_cpu(notif->bitmap[i]);
+                ssn = le32_to_cpu(notif->start_seq_num[i]);
+
+                /* update mac80211 with the bitmap for the reordering buffer */
+                ieee80211_mark_rx_ba_filtered_frames(sta, tid, ssn, bitmap,
+                                                     received_mpdu);
+        }
+        rcu_read_unlock();
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 615dea143d4e..cd6ca374e5d3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -7,7 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -156,7 +156,14 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
                                u16 len, u8 crypt_len,
                                struct iwl_rx_cmd_buffer *rxb)
 {
-        unsigned int hdrlen, fraglen;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
+        unsigned int headlen, fraglen, pad_len = 0;
+        unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD)
+                pad_len = 2;
+        len -= pad_len;
 
         /* If frame is small enough to fit in skb->head, pull it completely.
          * If not, only pull ieee80211_hdr (including crypto if present, and
@@ -170,14 +177,23 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
          * If the latter changes (there are efforts in the standards group
          * to do so) we should revisit this and ieee80211_data_to_8023().
          */
-        hdrlen = (len <= skb_tailroom(skb)) ? len :
-                                              sizeof(*hdr) + crypt_len + 8;
+        headlen = (len <= skb_tailroom(skb)) ? len :
+                                               hdrlen + crypt_len + 8;
 
+        /* The firmware may align the packet to DWORD.
+         * The padding is inserted after the IV.
+         * After copying the header + IV skip the padding if
+         * present before copying packet data.
+         */
+        hdrlen += crypt_len;
         memcpy(skb_put(skb, hdrlen), hdr, hdrlen);
-        fraglen = len - hdrlen;
+        memcpy(skb_put(skb, headlen - hdrlen), (u8 *)hdr + hdrlen + pad_len,
+               headlen - hdrlen);
+
+        fraglen = len - headlen;
 
         if (fraglen) {
-                int offset = (void *)hdr + hdrlen -
+                int offset = (void *)hdr + headlen + pad_len -
                              rxb_addr(rxb) + rxb_offset(rxb);
 
                 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
@@ -285,6 +301,114 @@ static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
+/*
+ * returns true if a packet outside BA session is a duplicate and
+ * should be dropped
+ */
+static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
+                                  struct ieee80211_rx_status *rx_status,
+                                  struct ieee80211_hdr *hdr,
+                                  struct iwl_rx_mpdu_desc *desc)
+{
+        struct iwl_mvm_sta *mvm_sta;
+        struct iwl_mvm_rxq_dup_data *dup_data;
+        u8 baid, tid, sub_frame_idx;
+
+        if (WARN_ON(IS_ERR_OR_NULL(sta)))
+                return false;
+
+        baid = (le32_to_cpu(desc->reorder_data) &
+                IWL_RX_MPDU_REORDER_BAID_MASK) >>
+                IWL_RX_MPDU_REORDER_BAID_SHIFT;
+
+        if (baid != IWL_RX_REORDER_DATA_INVALID_BAID)
+                return false;
+
+        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+        dup_data = &mvm_sta->dup_data[queue];
+
+        /*
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (ieee80211_is_ctl(hdr->frame_control) ||
+            ieee80211_is_qos_nullfunc(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1)) {
+                rx_status->flag |= RX_FLAG_DUP_VALIDATED;
+                return false;
+        }
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                /* frame has qos control */
+                tid = *ieee80211_get_qos_ctl(hdr) &
+                        IEEE80211_QOS_CTL_TID_MASK;
+        else
+                tid = IWL_MAX_TID_COUNT;
+
+        /* If this wasn't a part of an A-MSDU the sub-frame index will be 0 */
+        sub_frame_idx = desc->amsdu_info & IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
+
+        if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+                     dup_data->last_seq[tid] == hdr->seq_ctrl &&
+                     dup_data->last_sub_frame[tid] >= sub_frame_idx))
+                return true;
+
+        dup_data->last_seq[tid] = hdr->seq_ctrl;
+        dup_data->last_sub_frame[tid] = sub_frame_idx;
+
+        rx_status->flag |= RX_FLAG_DUP_VALIDATED;
+
+        return false;
+}
+
+int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
+                            const u8 *data, u32 count)
+{
+        struct iwl_rxq_sync_cmd *cmd;
+        u32 data_size = sizeof(*cmd) + count;
+        int ret;
+
+        /* should be DWORD aligned */
+        if (WARN_ON(count & 3 || count > IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE))
+                return -EINVAL;
+
+        cmd = kzalloc(data_size, GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->rxq_mask = cpu_to_le32(rxq_mask);
+        cmd->count =  cpu_to_le32(count);
+        cmd->flags = 0;
+        memcpy(cmd->payload, data, count);
+
+        ret = iwl_mvm_send_cmd_pdu(mvm,
+                                   WIDE_ID(DATA_PATH_GROUP,
+                                           TRIGGER_RX_QUEUES_NOTIF_CMD),
+                                   0, data_size, cmd);
+
+        kfree(cmd);
+        return ret;
+}
+
+void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
+                            int queue)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_rxq_sync_notification *notif;
+        struct iwl_mvm_internal_rxq_notif *internal_notif;
+
+        notif = (void *)pkt->data;
+        internal_notif = (void *)notif->payload;
+
+        switch (internal_notif->type) {
+        case IWL_MVM_RXQ_NOTIF_DEL_BA:
+                /* TODO */
+                break;
+        default:
+                WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
+        }
+}
+
 void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                         struct iwl_rx_cmd_buffer *rxb, int queue)
 {
@@ -332,6 +456,8 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
         rx_status->freq = ieee80211_channel_to_frequency(desc->channel,
                                                          rx_status->band);
         iwl_mvm_get_signal_strength(mvm, desc, rx_status);
+        /* TSF as indicated by the firmware is at INA time */
+        rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
 
         rcu_read_lock();
 
@@ -387,6 +513,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 
                 if (ieee80211_is_data(hdr->frame_control))
                         iwl_mvm_rx_csum(sta, skb, desc);
+
+                if (iwl_mvm_is_nonagg_dup(sta, queue, rx_status, hdr, desc)) {
+                        kfree_skb(skb);
+                        rcu_read_unlock();
+                        return;
+                }
         }
 
         /*
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index aa6d8074f63a..09eb72c4ae43 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -297,6 +299,12 @@ void iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
                        iwl_mvm_dump_channel_list(notif->results,
                                                  notif->scanned_channels, buf,
                                                  sizeof(buf)));
+
+        if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
+                IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
+                ieee80211_sched_scan_results(mvm->hw);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
+        }
 }
 
 void iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
@@ -380,6 +388,7 @@ void iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 
                 mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
                 ieee80211_sched_scan_stopped(mvm->hw);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
         } else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
                                aborted ? "aborted" : "completed",
@@ -533,10 +542,13 @@ static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
                 IWL_DEBUG_SCAN(mvm,
                                "Sending scheduled scan with filtering, n_match_sets %d\n",
                                req->n_match_sets);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
                 return false;
         }
 
         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
+
+        mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
         return true;
 }
 
@@ -788,6 +800,9 @@ static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 #endif
 
+        if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
+                flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
+
         if (iwl_mvm_is_regular_scan(params) &&
             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
             params->type != IWL_SCAN_TYPE_FRAGMENTED)
@@ -1074,6 +1089,9 @@ static u32 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
 #endif
 
+        if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
+                flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
+
         if (iwl_mvm_is_regular_scan(params) &&
             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
             params->type != IWL_SCAN_TYPE_FRAGMENTED)
@@ -1301,10 +1319,6 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                 return -EBUSY;
         }
 
-        /* we don't support "match all" in the firmware */
-        if (!req->n_match_sets)
-                return -EOPNOTSUPP;
-
         ret = iwl_mvm_check_running_scans(mvm, type);
         if (ret)
                 return ret;
@@ -1400,6 +1414,7 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
         } else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
                 ieee80211_sched_scan_stopped(mvm->hw);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
         }
 
         mvm->scan_status &= ~mvm->scan_uid_status[uid];
@@ -1434,6 +1449,12 @@ void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
                        iwl_mvm_dump_channel_list(notif->results,
                                                  notif->scanned_channels, buf,
                                                  sizeof(buf)));
+
+        if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
+                IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
+                ieee80211_sched_scan_results(mvm->hw);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
+        }
 }
 
 static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
@@ -1528,6 +1549,7 @@ void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
                 if (uid >= 0 && !mvm->restart_fw) {
                         ieee80211_sched_scan_stopped(mvm->hw);
+                        mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
                         mvm->scan_uid_status[uid] = 0;
                 }
 
@@ -1549,8 +1571,11 @@ void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
                  * restart_hw, so do not report if FW is about to be
                  * restarted.
                  */
-                if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) && !mvm->restart_fw)
+                if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) &&
+                    !mvm->restart_fw) {
                         ieee80211_sched_scan_stopped(mvm->hw);
+                        mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
+                }
         }
 }
 
@@ -1586,6 +1611,7 @@ out:
                         ieee80211_scan_completed(mvm->hw, true);
         } else if (notify) {
                 ieee80211_sched_scan_stopped(mvm->hw);
+                mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
         }
 
         return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 4854e79cbda8..ef99942d7169 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -280,6 +280,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_mvm_rxq_dup_data *dup_data;
         int i, ret, sta_id;
 
         lockdep_assert_held(&mvm->mutex);
@@ -327,6 +328,16 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
         }
         mvm_sta->agg_tids = 0;
 
+        if (iwl_mvm_has_new_rx_api(mvm) &&
+            !test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                dup_data = kcalloc(mvm->trans->num_rx_queues,
+                                   sizeof(*dup_data),
+                                   GFP_KERNEL);
+                if (!dup_data)
+                        return -ENOMEM;
+                mvm_sta->dup_data = dup_data;
+        }
+
         ret = iwl_mvm_sta_send_to_fw(mvm, sta, false);
         if (ret)
                 goto err;
@@ -508,6 +519,9 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
+        if (iwl_mvm_has_new_rx_api(mvm))
+                kfree(mvm_sta->dup_data);
+
         if (vif->type == NL80211_IFTYPE_STATION &&
             mvmvif->ap_sta_id == mvm_sta->sta_id) {
                 ret = iwl_mvm_drain_sta(mvm, mvm_sta, true);
@@ -1031,15 +1045,23 @@ release_locks:
 }
 
 int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                            struct ieee80211_sta *sta, u16 tid, u8 buf_size)
+                            struct ieee80211_sta *sta, u16 tid, u8 buf_size,
+                            bool amsdu)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         unsigned int wdg_timeout =
                 iwl_mvm_get_wd_timeout(mvm, vif, sta->tdls, false);
-        int queue, fifo, ret;
+        int queue, ret;
         u16 ssn;
 
+        struct iwl_trans_txq_scd_cfg cfg = {
+                .sta_id = mvmsta->sta_id,
+                .tid = tid,
+                .frame_limit = buf_size,
+                .aggregate = true,
+        };
+
         BUILD_BUG_ON((sizeof(mvmsta->agg_tids) * BITS_PER_BYTE)
                      != IWL_MAX_TID_COUNT);
 
@@ -1051,13 +1073,13 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         tid_data->state = IWL_AGG_ON;
         mvmsta->agg_tids |= BIT(tid);
         tid_data->ssn = 0xffff;
+        tid_data->amsdu_in_ampdu_allowed = amsdu;
         spin_unlock_bh(&mvmsta->lock);
 
-        fifo = iwl_mvm_ac_to_tx_fifo[tid_to_mac80211_ac[tid]];
+        cfg.fifo = iwl_mvm_ac_to_tx_fifo[tid_to_mac80211_ac[tid]];
 
-        iwl_mvm_enable_agg_txq(mvm, queue,
-                               vif->hw_queue[tid_to_mac80211_ac[tid]], fifo,
-                               mvmsta->sta_id, tid, buf_size, ssn, wdg_timeout);
+        iwl_mvm_enable_txq(mvm, queue, vif->hw_queue[tid_to_mac80211_ac[tid]],
+                           ssn, &cfg, wdg_timeout);
 
         ret = iwl_mvm_sta_tx_agg(mvm, sta, tid, queue, true);
         if (ret)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index e3b9446ee995..1a8f69a41405 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -258,8 +258,7 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
- * @reduced_tpc: Reduced tx power. Holds the data between the
- *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session
  * @ssn: the first packet to be sent in AGG HW queue in Tx AGG start flow, or
@@ -273,7 +272,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
-        u8 reduced_tpc;
+        bool amsdu_in_ampdu_allowed;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
         u16 ssn;
@@ -294,6 +293,16 @@ struct iwl_mvm_key_pn {
 };
 
 /**
+ * struct iwl_mvm_rxq_dup_data - per station per rx queue data
+ * @last_seq: last sequence per tid for duplicate packet detection
+ * @last_sub_frame: last subframe packet
+ */
+struct iwl_mvm_rxq_dup_data {
+        __le16 last_seq[IWL_MAX_TID_COUNT + 1];
+        u8 last_sub_frame[IWL_MAX_TID_COUNT + 1];
+} ____cacheline_aligned_in_smp;
+
+/**
  * struct iwl_mvm_sta - representation of a station in the driver
  * @sta_id: the index of the station in the fw (will be replaced by id_n_color)
  * @tfd_queue_msk: the tfd queues used by the station
@@ -311,6 +320,7 @@ struct iwl_mvm_key_pn {
  * @tx_protection: reference counter for controlling the Tx protection.
  * @tt_tx_protection: is thermal throttling enable Tx protection?
  * @disable_tx: is tx to this STA disabled?
+ * @tlc_amsdu: true if A-MSDU is allowed
  * @agg_tids: bitmap of tids whose status is operational aggregated (IWL_AGG_ON)
  * @sleep_tx_count: the number of frames that we told the firmware to let out
  *      even when that station is asleep. This is useful in case the queue
@@ -318,6 +328,7 @@ struct iwl_mvm_key_pn {
  *      we are sending frames from an AMPDU queue and there was a hole in
  *      the BA window. To be used for UAPSD only.
  * @ptk_pn: per-queue PTK PN data structures
+ * @dup_data: per queue duplicate packet detection data
  *
  * When mac80211 creates a station it reserves some space (hw->sta_data_size)
  * in the structure for use by driver. This structure is placed in that
@@ -337,14 +348,15 @@ struct iwl_mvm_sta {
         struct iwl_mvm_tid_data tid_data[IWL_MAX_TID_COUNT];
         struct iwl_lq_sta lq_sta;
         struct ieee80211_vif *vif;
-
         struct iwl_mvm_key_pn __rcu *ptk_pn[4];
+        struct iwl_mvm_rxq_dup_data *dup_data;
 
         /* Temporary, until the new TLC will control the Tx protection */
         s8 tx_protection;
         bool tt_tx_protection;
 
         bool disable_tx;
+        bool tlc_amsdu;
         u8 agg_tids;
         u8 sleep_tx_count;
 };
@@ -405,7 +417,8 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                        struct ieee80211_sta *sta, u16 tid, u8 buf_size);
+                            struct ieee80211_sta *sta, u16 tid, u8 buf_size,
+                            bool amsdu);
 int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, u16 tid);
 int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 758d05a8c6aa..999bcb898be8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,7 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -64,6 +65,8 @@
  *
  *****************************************************************************/
 
+#include <linux/sort.h>
+
 #include "mvm.h"
 
 #define IWL_MVM_TEMP_NOTIF_WAIT_TIMEOUT HZ
@@ -79,8 +82,10 @@ static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
         IWL_ERR(mvm, "Enter CT Kill\n");
         iwl_mvm_set_hw_ctkill_state(mvm, true);
 
-        tt->throttle = false;
-        tt->dynamic_smps = false;
+        if (!iwl_mvm_is_tt_in_fw(mvm)) {
+                tt->throttle = false;
+                tt->dynamic_smps = false;
+        }
 
         /* Don't schedule an exit work if we're in test mode, since
          * the temperature will not change unless we manually set it
@@ -116,18 +121,21 @@ void iwl_mvm_tt_temp_changed(struct iwl_mvm *mvm, u32 temp)
 static int iwl_mvm_temp_notif_parse(struct iwl_mvm *mvm,
                                     struct iwl_rx_packet *pkt)
 {
-        struct iwl_dts_measurement_notif *notif;
+        struct iwl_dts_measurement_notif_v1 *notif_v1;
         int len = iwl_rx_packet_payload_len(pkt);
         int temp;
 
-        if (WARN_ON_ONCE(len < sizeof(*notif))) {
+        /* we can use notif_v1 only, because v2 only adds an additional
+         * parameter, which is not used in this function.
+        */
+        if (WARN_ON_ONCE(len < sizeof(*notif_v1))) {
                 IWL_ERR(mvm, "Invalid DTS_MEASUREMENT_NOTIFICATION\n");
                 return -EINVAL;
         }
 
-        notif = (void *)pkt->data;
+        notif_v1 = (void *)pkt->data;
 
-        temp = le32_to_cpu(notif->temp);
+        temp = le32_to_cpu(notif_v1->temp);
 
         /* shouldn't be negative, but since it's s32, make sure it isn't */
         if (WARN_ON_ONCE(temp < 0))
@@ -158,17 +166,74 @@ static bool iwl_mvm_temp_notif_wait(struct iwl_notif_wait_data *notif_wait,
 void iwl_mvm_temp_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_dts_measurement_notif_v2 *notif_v2;
+        int len = iwl_rx_packet_payload_len(pkt);
         int temp;
+        u32 ths_crossed;
 
         /* the notification is handled synchronously in ctkill, so skip here */
         if (test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status))
                 return;
 
         temp = iwl_mvm_temp_notif_parse(mvm, pkt);
-        if (temp < 0)
+
+        if (!iwl_mvm_is_tt_in_fw(mvm)) {
+                if (temp >= 0)
+                        iwl_mvm_tt_temp_changed(mvm, temp);
                 return;
+        }
+
+        if (WARN_ON_ONCE(len < sizeof(*notif_v2))) {
+                IWL_ERR(mvm, "Invalid DTS_MEASUREMENT_NOTIFICATION\n");
+                return;
+        }
+
+        notif_v2 = (void *)pkt->data;
+        ths_crossed = le32_to_cpu(notif_v2->threshold_idx);
 
-        iwl_mvm_tt_temp_changed(mvm, temp);
+        /* 0xFF in ths_crossed means the notification is not related
+         * to a trip, so we can ignore it here.
+         */
+        if (ths_crossed == 0xFF)
+                return;
+
+        IWL_DEBUG_TEMP(mvm, "Temp = %d Threshold crossed = %d\n",
+                       temp, ths_crossed);
+
+#ifdef CONFIG_THERMAL
+        if (WARN_ON(ths_crossed >= IWL_MAX_DTS_TRIPS))
+                return;
+
+        /*
+         * We are now handling a temperature notification from the firmware
+         * in ASYNC and hold the mutex. thermal_notify_framework will call
+         * us back through get_temp() which ought to send a SYNC command to
+         * the firmware and hence to take the mutex.
+         * Avoid the deadlock by unlocking the mutex here.
+         */
+        mutex_unlock(&mvm->mutex);
+        thermal_notify_framework(mvm->tz_device.tzone,
+                                 mvm->tz_device.fw_trips_index[ths_crossed]);
+        mutex_lock(&mvm->mutex);
+#endif /* CONFIG_THERMAL */
+}
+
+void iwl_mvm_ct_kill_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct ct_kill_notif *notif;
+        int len = iwl_rx_packet_payload_len(pkt);
+
+        if (WARN_ON_ONCE(len != sizeof(*notif))) {
+                IWL_ERR(mvm, "Invalid CT_KILL_NOTIFICATION\n");
+                return;
+        }
+
+        notif = (struct ct_kill_notif *)pkt->data;
+        IWL_DEBUG_TEMP(mvm, "CT Kill notification temperature = %d\n",
+                       notif->temperature);
+
+        iwl_mvm_enter_ctkill(mvm);
 }
 
 static int iwl_mvm_get_temp_cmd(struct iwl_mvm *mvm)
@@ -236,6 +301,12 @@ static void check_exit_ctkill(struct work_struct *work)
         tt = container_of(work, struct iwl_mvm_tt_mgmt, ct_kill_exit.work);
         mvm = container_of(tt, struct iwl_mvm, thermal_throttle);
 
+        if (iwl_mvm_is_tt_in_fw(mvm)) {
+                iwl_mvm_exit_ctkill(mvm);
+
+                return;
+        }
+
         duration = tt->params.ct_kill_duration;
 
         mutex_lock(&mvm->mutex);
@@ -435,7 +506,365 @@ static const struct iwl_tt_params iwl_mvm_default_tt_params = {
         .support_tx_backoff = true,
 };
 
-void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff)
+#ifdef CONFIG_THERMAL
+static int compare_temps(const void *a, const void *b)
+{
+        return ((s16)le16_to_cpu(*(__le16 *)a) -
+                (s16)le16_to_cpu(*(__le16 *)b));
+}
+
+int iwl_mvm_send_temp_report_ths_cmd(struct iwl_mvm *mvm)
+{
+        struct temp_report_ths_cmd cmd = {0};
+        int ret, i, j, idx = 0;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        /* The driver holds array of temperature trips that are unsorted
+         * and uncompressed, the FW should get it compressed and sorted
+         */
+
+        /* compress temp_trips to cmd array, remove uninitialized values*/
+        for (i = 0; i < IWL_MAX_DTS_TRIPS; i++)
+                if (mvm->tz_device.temp_trips[i] != S16_MIN) {
+                        cmd.thresholds[idx++] =
+                                cpu_to_le16(mvm->tz_device.temp_trips[i]);
+                }
+        cmd.num_temps = cpu_to_le32(idx);
+
+        if (!idx)
+                goto send;
+
+        /*sort cmd array*/
+        sort(cmd.thresholds, idx, sizeof(s16), compare_temps, NULL);
+
+        /* we should save the indexes of trips because we sort
+         * and compress the orginal array
+         */
+        for (i = 0; i < idx; i++) {
+                for (j = 0; j < IWL_MAX_DTS_TRIPS; j++) {
+                        if (le16_to_cpu(cmd.thresholds[i]) ==
+                                mvm->tz_device.temp_trips[j])
+                                mvm->tz_device.fw_trips_index[i] = j;
+                }
+        }
+
+send:
+        ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(PHY_OPS_GROUP,
+                                                TEMP_REPORTING_THRESHOLDS_CMD),
+                                   0, sizeof(cmd), &cmd);
+        if (ret)
+                IWL_ERR(mvm, "TEMP_REPORT_THS_CMD command failed (err=%d)\n",
+                        ret);
+
+        return ret;
+}
+
+static int iwl_mvm_tzone_get_temp(struct thermal_zone_device *device,
+                                  int *temperature)
+{
+        struct iwl_mvm *mvm = (struct iwl_mvm *)device->devdata;
+        int ret;
+        int temp;
+
+        mutex_lock(&mvm->mutex);
+
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto out;
+        }
+
+        ret = iwl_mvm_get_temp(mvm, &temp);
+        if (ret)
+                goto out;
+
+        *temperature = temp * 1000;
+
+out:
+        mutex_unlock(&mvm->mutex);
+        return ret;
+}
+
+static int iwl_mvm_tzone_get_trip_temp(struct thermal_zone_device *device,
+                                       int trip, int *temp)
+{
+        struct iwl_mvm *mvm = (struct iwl_mvm *)device->devdata;
+
+        if (trip < 0 || trip >= IWL_MAX_DTS_TRIPS)
+                return -EINVAL;
+
+        *temp = mvm->tz_device.temp_trips[trip] * 1000;
+
+        return 0;
+}
+
+static int iwl_mvm_tzone_get_trip_type(struct thermal_zone_device *device,
+                                       int trip, enum thermal_trip_type *type)
+{
+        if (trip < 0 || trip >= IWL_MAX_DTS_TRIPS)
+                return -EINVAL;
+
+        *type = THERMAL_TRIP_PASSIVE;
+
+        return 0;
+}
+
+static int iwl_mvm_tzone_set_trip_temp(struct thermal_zone_device *device,
+                                       int trip, int temp)
+{
+        struct iwl_mvm *mvm = (struct iwl_mvm *)device->devdata;
+        struct iwl_mvm_thermal_device *tzone;
+        int i, ret;
+        s16 temperature;
+
+        mutex_lock(&mvm->mutex);
+
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto out;
+        }
+
+        if (trip < 0 || trip >= IWL_MAX_DTS_TRIPS) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if ((temp / 1000) > S16_MAX) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        temperature = (s16)(temp / 1000);
+        tzone = &mvm->tz_device;
+
+        if (!tzone) {
+                ret = -EIO;
+                goto out;
+        }
+
+        /* no updates*/
+        if (tzone->temp_trips[trip] == temperature) {
+                ret = 0;
+                goto out;
+        }
+
+        /* already existing temperature */
+        for (i = 0; i < IWL_MAX_DTS_TRIPS; i++) {
+                if (tzone->temp_trips[i] == temperature) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+        tzone->temp_trips[trip] = temperature;
+
+        ret = iwl_mvm_send_temp_report_ths_cmd(mvm);
+out:
+        mutex_unlock(&mvm->mutex);
+        return ret;
+}
+
+static  struct thermal_zone_device_ops tzone_ops = {
+        .get_temp = iwl_mvm_tzone_get_temp,
+        .get_trip_temp = iwl_mvm_tzone_get_trip_temp,
+        .get_trip_type = iwl_mvm_tzone_get_trip_type,
+        .set_trip_temp = iwl_mvm_tzone_set_trip_temp,
+};
+
+/* make all trips writable */
+#define IWL_WRITABLE_TRIPS_MSK (BIT(IWL_MAX_DTS_TRIPS) - 1)
+
+static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+{
+        int i;
+        char name[] = "iwlwifi";
+
+        if (!iwl_mvm_is_tt_in_fw(mvm)) {
+                mvm->tz_device.tzone = NULL;
+
+                return;
+        }
+
+        BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+
+        mvm->tz_device.tzone = thermal_zone_device_register(name,
+                                                        IWL_MAX_DTS_TRIPS,
+                                                        IWL_WRITABLE_TRIPS_MSK,
+                                                        mvm, &tzone_ops,
+                                                        NULL, 0, 0);
+        if (IS_ERR(mvm->tz_device.tzone)) {
+                IWL_DEBUG_TEMP(mvm,
+                               "Failed to register to thermal zone (err = %ld)\n",
+                               PTR_ERR(mvm->tz_device.tzone));
+                return;
+        }
+
+        /* 0 is a valid temperature,
+         * so initialize the array with S16_MIN which invalid temperature
+         */
+        for (i = 0 ; i < IWL_MAX_DTS_TRIPS; i++)
+                mvm->tz_device.temp_trips[i] = S16_MIN;
+}
+
+static const u32 iwl_mvm_cdev_budgets[] = {
+        2000,   /* cooling state 0 */
+        1800,   /* cooling state 1 */
+        1600,   /* cooling state 2 */
+        1400,   /* cooling state 3 */
+        1200,   /* cooling state 4 */
+        1000,   /* cooling state 5 */
+        900,    /* cooling state 6 */
+        800,    /* cooling state 7 */
+        700,    /* cooling state 8 */
+        650,    /* cooling state 9 */
+        600,    /* cooling state 10 */
+        550,    /* cooling state 11 */
+        500,    /* cooling state 12 */
+        450,    /* cooling state 13 */
+        400,    /* cooling state 14 */
+        350,    /* cooling state 15 */
+        300,    /* cooling state 16 */
+        250,    /* cooling state 17 */
+        200,    /* cooling state 18 */
+        150,    /* cooling state 19 */
+};
+
+int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 budget)
+{
+        struct iwl_mvm_ctdp_cmd cmd = {
+                .operation = cpu_to_le32(op),
+                .budget = cpu_to_le32(budget),
+                .window_size = 0,
+        };
+        int ret;
+        u32 status;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, WIDE_ID(PHY_OPS_GROUP,
+                                                       CTDP_CONFIG_CMD),
+                                          sizeof(cmd), &cmd, &status);
+
+        if (ret) {
+                IWL_ERR(mvm, "cTDP command failed (err=%d)\n", ret);
+                return ret;
+        }
+
+        if (op == CTDP_CMD_OPERATION_START)
+                mvm->cooling_dev.cur_state = budget;
+
+        else if (op == CTDP_CMD_OPERATION_REPORT)
+                IWL_DEBUG_TEMP(mvm, "cTDP avg energy in mWatt = %d\n", status);
+
+        return 0;
+}
+
+static int iwl_mvm_tcool_get_max_state(struct thermal_cooling_device *cdev,
+                                       unsigned long *state)
+{
+        *state = ARRAY_SIZE(iwl_mvm_cdev_budgets) - 1;
+
+        return 0;
+}
+
+static int iwl_mvm_tcool_get_cur_state(struct thermal_cooling_device *cdev,
+                                       unsigned long *state)
+{
+        struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
+
+        if (test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
+                return -EBUSY;
+
+        *state = mvm->cooling_dev.cur_state;
+        return 0;
+}
+
+static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
+                                       unsigned long new_state)
+{
+        struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
+        int ret;
+
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
+                return -EIO;
+
+        if (test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
+                return -EBUSY;
+
+        mutex_lock(&mvm->mutex);
+
+        if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
+                ret = -EINVAL;
+                goto unlock;
+        }
+
+        ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START,
+                                   iwl_mvm_cdev_budgets[new_state]);
+
+unlock:
+        mutex_unlock(&mvm->mutex);
+        return ret;
+}
+
+static struct thermal_cooling_device_ops tcooling_ops = {
+        .get_max_state = iwl_mvm_tcool_get_max_state,
+        .get_cur_state = iwl_mvm_tcool_get_cur_state,
+        .set_cur_state = iwl_mvm_tcool_set_cur_state,
+};
+
+int iwl_mvm_cooling_device_register(struct iwl_mvm *mvm)
+{
+        char name[] = "iwlwifi";
+
+        if (!iwl_mvm_is_ctdp_supported(mvm)) {
+                mvm->cooling_dev.cdev = NULL;
+
+                return 0;
+        }
+
+        BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+
+        mvm->cooling_dev.cdev =
+                thermal_cooling_device_register(name,
+                                                mvm,
+                                                &tcooling_ops);
+
+        if (IS_ERR(mvm->cooling_dev.cdev)) {
+                IWL_DEBUG_TEMP(mvm,
+                               "Failed to register to cooling device (err = %ld)\n",
+                               PTR_ERR(mvm->cooling_dev.cdev));
+                return PTR_ERR(mvm->cooling_dev.cdev);
+        }
+
+        return 0;
+}
+
+static void iwl_mvm_thermal_zone_unregister(struct iwl_mvm *mvm)
+{
+        if (!iwl_mvm_is_tt_in_fw(mvm))
+                return;
+
+        if (mvm->tz_device.tzone) {
+                IWL_DEBUG_TEMP(mvm, "Thermal zone device unregister\n");
+                thermal_zone_device_unregister(mvm->tz_device.tzone);
+                mvm->tz_device.tzone = NULL;
+        }
+}
+
+static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
+{
+        if (!iwl_mvm_is_ctdp_supported(mvm))
+                return;
+
+        if (mvm->cooling_dev.cdev) {
+                IWL_DEBUG_TEMP(mvm, "Cooling device unregister\n");
+                thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
+                mvm->cooling_dev.cdev = NULL;
+        }
+}
+#endif /* CONFIG_THERMAL */
+
+void iwl_mvm_thermal_initialize(struct iwl_mvm *mvm, u32 min_backoff)
 {
         struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
 
@@ -450,10 +879,20 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff)
         tt->dynamic_smps = false;
         tt->min_backoff = min_backoff;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
+
+#ifdef CONFIG_THERMAL
+        iwl_mvm_cooling_device_register(mvm);
+        iwl_mvm_thermal_zone_register(mvm);
+#endif
 }
 
-void iwl_mvm_tt_exit(struct iwl_mvm *mvm)
+void iwl_mvm_thermal_exit(struct iwl_mvm *mvm)
 {
         cancel_delayed_work_sync(&mvm->thermal_throttle.ct_kill_exit);
         IWL_DEBUG_TEMP(mvm, "Exit Thermal Throttling\n");
+
+#ifdef CONFIG_THERMAL
+        iwl_mvm_cooling_device_unregister(mvm);
+        iwl_mvm_thermal_zone_unregister(mvm);
+#endif
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dae2c40d605c..271e8da6d140 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -65,6 +65,7 @@
 #include <linux/ieee80211.h>
 #include <linux/etherdevice.h>
 #include <linux/tcp.h>
+#include <net/ip.h>
 
 #include "iwl-trans.h"
 #include "iwl-eeprom-parse.h"
@@ -182,7 +183,8 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         tx_cmd->tx_flags = cpu_to_le32(tx_flags);
         /* Total # bytes to be transmitted */
-        tx_cmd->len = cpu_to_le16((u16)skb->len);
+        tx_cmd->len = cpu_to_le16((u16)skb->len +
+                (uintptr_t)info->driver_data[0]);
         tx_cmd->next_frame_len = 0;
         tx_cmd->life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         tx_cmd->sta_id = sta_id;
@@ -372,6 +374,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                           info->hw_queue != info->control.vif->cab_queue)))
                 return -1;
 
+        /* This holds the amsdu headers length */
+        info->driver_data[0] = (void *)(uintptr_t)0;
+
         /*
          * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
          * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
@@ -437,33 +442,194 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
         return 0;
 }
 
-static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb_gso,
+#ifdef CONFIG_INET
+static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
                           struct ieee80211_sta *sta,
                           struct sk_buff_head *mpdus_skb)
 {
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (void *)skb->data;
+        unsigned int mss = skb_shinfo(skb)->gso_size;
         struct sk_buff *tmp, *next;
-        char cb[sizeof(skb_gso->cb)];
+        char cb[sizeof(skb->cb)];
+        unsigned int num_subframes, tcp_payload_len, subf_len, max_amsdu_len;
+        bool ipv4 = (skb->protocol == htons(ETH_P_IP));
+        u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0;
+        u16 amsdu_add, snap_ip_tcp, pad, i = 0;
+        unsigned int dbg_max_amsdu_len;
+        u8 *qc, tid, txf;
+
+        snap_ip_tcp = 8 + skb_transport_header(skb) - skb_network_header(skb) +
+                tcp_hdrlen(skb);
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+        if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+                return -EINVAL;
+
+        if (!sta->max_amsdu_len ||
+            !ieee80211_is_data_qos(hdr->frame_control) ||
+            !mvmsta->tlc_amsdu) {
+                num_subframes = 1;
+                pad = 0;
+                goto segment;
+        }
+
+        /*
+         * No need to lock amsdu_in_ampdu_allowed since it can't be modified
+         * during an BA session.
+         */
+        if (info->flags & IEEE80211_TX_CTL_AMPDU &&
+            !mvmsta->tid_data[tid].amsdu_in_ampdu_allowed) {
+                num_subframes = 1;
+                pad = 0;
+                goto segment;
+        }
+
+        max_amsdu_len = sta->max_amsdu_len;
+        dbg_max_amsdu_len = ACCESS_ONCE(mvm->max_amsdu_len);
+
+        /* the Tx FIFO to which this A-MSDU will be routed */
+        txf = iwl_mvm_ac_to_tx_fifo[tid_to_mac80211_ac[tid]];
+
+        /*
+         * Don't send an AMSDU that will be longer than the TXF.
+         * Add a security margin of 256 for the TX command + headers.
+         * We also want to have the start of the next packet inside the
+         * fifo to be able to send bursts.
+         */
+        max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+                              mvm->shared_mem_cfg.txfifo_size[txf] - 256);
+
+        if (dbg_max_amsdu_len)
+                max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+                                      dbg_max_amsdu_len);
+
+        /*
+         * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not
+         * supported. This is a spec requirement (IEEE 802.11-2015
+         * section 8.7.3 NOTE 3).
+         */
+        if (info->flags & IEEE80211_TX_CTL_AMPDU &&
+            !sta->vht_cap.vht_supported)
+                max_amsdu_len = min_t(unsigned int, max_amsdu_len, 4095);
+
+        /* Sub frame header + SNAP + IP header + TCP header + MSS */
+        subf_len = sizeof(struct ethhdr) + snap_ip_tcp + mss;
+        pad = (4 - subf_len) & 0x3;
+
+        /*
+         * If we have N subframes in the A-MSDU, then the A-MSDU's size is
+         * N * subf_len + (N - 1) * pad.
+         */
+        num_subframes = (max_amsdu_len + pad) / (subf_len + pad);
+        if (num_subframes > 1)
+                *qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 
-        memcpy(cb, skb_gso->cb, sizeof(cb));
-        next = skb_gso_segment(skb_gso, 0);
-        if (IS_ERR(next))
+        tcp_payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -
+                tcp_hdrlen(skb) + skb->data_len;
+
+        /*
+         * Make sure we have enough TBs for the A-MSDU:
+         *      2 for each subframe
+         *      1 more for each fragment
+         *      1 more for the potential data in the header
+         */
+        num_subframes =
+                min_t(unsigned int, num_subframes,
+                      (mvm->trans->max_skb_frags - 1 -
+                       skb_shinfo(skb)->nr_frags) / 2);
+
+        /* This skb fits in one single A-MSDU */
+        if (num_subframes * mss >= tcp_payload_len) {
+                /*
+                 * Compute the length of all the data added for the A-MSDU.
+                 * This will be used to compute the length to write in the TX
+                 * command. We have: SNAP + IP + TCP for n -1 subframes and
+                 * ETH header for n subframes. Note that the original skb
+                 * already had one set of SNAP / IP / TCP headers.
+                 */
+                num_subframes = DIV_ROUND_UP(tcp_payload_len, mss);
+                info = IEEE80211_SKB_CB(skb);
+                amsdu_add = num_subframes * sizeof(struct ethhdr) +
+                        (num_subframes - 1) * (snap_ip_tcp + pad);
+                /* This holds the amsdu headers length */
+                info->driver_data[0] = (void *)(uintptr_t)amsdu_add;
+
+                __skb_queue_tail(mpdus_skb, skb);
+                return 0;
+        }
+
+        /*
+         * Trick the segmentation function to make it
+         * create SKBs that can fit into one A-MSDU.
+         */
+segment:
+        skb_shinfo(skb)->gso_size = num_subframes * mss;
+        memcpy(cb, skb->cb, sizeof(cb));
+
+        next = skb_gso_segment(skb, NETIF_F_CSUM_MASK | NETIF_F_SG);
+        skb_shinfo(skb)->gso_size = mss;
+        if (WARN_ON_ONCE(IS_ERR(next)))
                 return -EINVAL;
         else if (next)
-                consume_skb(skb_gso);
+                consume_skb(skb);
 
         while (next) {
                 tmp = next;
                 next = tmp->next;
+
                 memcpy(tmp->cb, cb, sizeof(tmp->cb));
+                /*
+                 * Compute the length of all the data added for the A-MSDU.
+                 * This will be used to compute the length to write in the TX
+                 * command. We have: SNAP + IP + TCP for n -1 subframes and
+                 * ETH header for n subframes.
+                 */
+                tcp_payload_len = skb_tail_pointer(tmp) -
+                        skb_transport_header(tmp) -
+                        tcp_hdrlen(tmp) + tmp->data_len;
+
+                if (ipv4)
+                        ip_hdr(tmp)->id = htons(ip_base_id + i * num_subframes);
+
+                if (tcp_payload_len > mss) {
+                        num_subframes = DIV_ROUND_UP(tcp_payload_len, mss);
+                        info = IEEE80211_SKB_CB(tmp);
+                        amsdu_add = num_subframes * sizeof(struct ethhdr) +
+                                (num_subframes - 1) * (snap_ip_tcp + pad);
+                        info->driver_data[0] = (void *)(uintptr_t)amsdu_add;
+                        skb_shinfo(tmp)->gso_size = mss;
+                } else {
+                        qc = ieee80211_get_qos_ctl((void *)tmp->data);
+
+                        if (ipv4)
+                                ip_send_check(ip_hdr(tmp));
+                        *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+                        skb_shinfo(tmp)->gso_size = 0;
+                }
 
                 tmp->prev = NULL;
                 tmp->next = NULL;
 
                 __skb_queue_tail(mpdus_skb, tmp);
+                i++;
         }
 
         return 0;
 }
+#else /* CONFIG_INET */
+static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff_head *mpdus_skb)
+{
+        /* Impossible to get TSO with CONFIG_INET */
+        WARN_ON(1);
+
+        return -1;
+}
+#endif
 
 /*
  * Sets the fields in the Tx cmd that are crypto related
@@ -569,6 +735,7 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
                    struct ieee80211_sta *sta)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct sk_buff_head mpdus_skbs;
         unsigned int payload_len;
         int ret;
@@ -579,6 +746,9 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_STATION_COUNT))
                 return -1;
 
+        /* This holds the amsdu headers length */
+        info->driver_data[0] = (void *)(uintptr_t)0;
+
         if (!skb_is_gso(skb))
                 return iwl_mvm_tx_mpdu(mvm, skb, sta);
 
@@ -598,7 +768,7 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
                 return ret;
 
         while (!skb_queue_empty(&mpdus_skbs)) {
-                struct sk_buff *skb = __skb_dequeue(&mpdus_skbs);
+                skb = __skb_dequeue(&mpdus_skbs);
 
                 ret = iwl_mvm_tx_mpdu(mvm, skb, sta);
                 if (ret) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 753ec6785912..d33b6baf5f98 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -811,6 +811,45 @@ static int iwl_pci_runtime_resume(struct device *device)
 
         return 0;
 }
+
+static int iwl_pci_system_prepare(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct iwl_trans *trans = pci_get_drvdata(pdev);
+
+        IWL_DEBUG_RPM(trans, "preparing for system suspend\n");
+
+        /* This is called before entering system suspend and before
+         * the runtime resume is called.  Set the suspending flag to
+         * prevent the wakelock from being taken.
+         */
+        trans->suspending = true;
+
+        /* Wake the device up from runtime suspend before going to
+         * platform suspend.  This is needed because we don't know
+         * whether wowlan any is set and, if it's not, mac80211 will
+         * disconnect (in which case, we can't be in D0i3).
+         */
+        pm_runtime_resume(device);
+
+        return 0;
+}
+
+static void iwl_pci_system_complete(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct iwl_trans *trans = pci_get_drvdata(pdev);
+
+        IWL_DEBUG_RPM(trans, "completing system suspend\n");
+
+        /* This is called as a counterpart to the prepare op.  It is
+         * called either when suspending fails or when suspend
+         * completed successfully.  Now there's no risk of grabbing
+         * the wakelock anymore, so we can release the suspending
+         * flag.
+         */
+        trans->suspending = false;
+}
 #endif /* CONFIG_IWLWIFI_PCIE_RTPM */
 
 static const struct dev_pm_ops iwl_dev_pm_ops = {
@@ -820,6 +859,8 @@ static const struct dev_pm_ops iwl_dev_pm_ops = {
         SET_RUNTIME_PM_OPS(iwl_pci_runtime_suspend,
                            iwl_pci_runtime_resume,
                            NULL)
+        .prepare = iwl_pci_system_prepare,
+        .complete = iwl_pci_system_complete,
 #endif /* CONFIG_IWLWIFI_PCIE_RTPM */
 };
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 542bbc5e2b24..6677f3122226 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -336,6 +336,14 @@ struct iwl_tso_hdr_page {
  * @fw_mon_phys: physical address of the buffer for the firmware monitor
  * @fw_mon_page: points to the first page of the buffer for the firmware monitor
  * @fw_mon_size: size of the buffer for the firmware monitor
+ * @msix_entries: array of MSI-X entries
+ * @msix_enabled: true if managed to enable MSI-X
+ * @allocated_vector: the number of interrupt vector allocated by the OS
+ * @default_irq_num: default irq for non rx interrupt
+ * @fh_init_mask: initial unmasked fh causes
+ * @hw_init_mask: initial unmasked hw causes
+ * @fh_mask: current unmasked fh causes
+ * @hw_mask: current unmasked hw causes
  */
 struct iwl_trans_pcie {
         struct iwl_rxq *rxq;
@@ -402,6 +410,15 @@ struct iwl_trans_pcie {
         dma_addr_t fw_mon_phys;
         struct page *fw_mon_page;
         u32 fw_mon_size;
+
+        struct msix_entry msix_entries[IWL_MAX_RX_HW_QUEUES];
+        bool msix_enabled;
+        u32 allocated_vector;
+        u32 default_irq_num;
+        u32 fh_init_mask;
+        u32 hw_init_mask;
+        u32 fh_mask;
+        u32 hw_mask;
 };
 
 static inline struct iwl_trans_pcie *
@@ -430,7 +447,10 @@ void iwl_trans_pcie_free(struct iwl_trans *trans);
 * RX
 ******************************************************/
 int iwl_pcie_rx_init(struct iwl_trans *trans);
+irqreturn_t iwl_pcie_msix_isr(int irq, void *data);
 irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id);
+irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id);
+irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id);
 int iwl_pcie_rx_stop(struct iwl_trans *trans);
 void iwl_pcie_rx_free(struct iwl_trans *trans);
 
@@ -485,15 +505,24 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans);
 ******************************************************/
 static inline void iwl_disable_interrupts(struct iwl_trans *trans)
 {
-        clear_bit(STATUS_INT_ENABLED, &trans->status);
-
-        /* disable interrupts from uCode/NIC to host */
-        iwl_write32(trans, CSR_INT_MASK, 0x00000000);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
-        /* acknowledge/clear/reset any interrupts still pending
-         * from uCode or flow handler (Rx/Tx DMA) */
-        iwl_write32(trans, CSR_INT, 0xffffffff);
-        iwl_write32(trans, CSR_FH_INT_STATUS, 0xffffffff);
+        clear_bit(STATUS_INT_ENABLED, &trans->status);
+        if (!trans_pcie->msix_enabled) {
+                /* disable interrupts from uCode/NIC to host */
+                iwl_write32(trans, CSR_INT_MASK, 0x00000000);
+
+                /* acknowledge/clear/reset any interrupts still pending
+                 * from uCode or flow handler (Rx/Tx DMA) */
+                iwl_write32(trans, CSR_INT, 0xffffffff);
+                iwl_write32(trans, CSR_FH_INT_STATUS, 0xffffffff);
+        } else {
+                /* disable all the interrupt we might use */
+                iwl_write32(trans, CSR_MSIX_FH_INT_MASK_AD,
+                            trans_pcie->fh_init_mask);
+                iwl_write32(trans, CSR_MSIX_HW_INT_MASK_AD,
+                            trans_pcie->hw_init_mask);
+        }
         IWL_DEBUG_ISR(trans, "Disabled interrupts\n");
 }
 
@@ -503,8 +532,37 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
 
         IWL_DEBUG_ISR(trans, "Enabling interrupts\n");
         set_bit(STATUS_INT_ENABLED, &trans->status);
-        trans_pcie->inta_mask = CSR_INI_SET_MASK;
-        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        if (!trans_pcie->msix_enabled) {
+                trans_pcie->inta_mask = CSR_INI_SET_MASK;
+                iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        } else {
+                /*
+                 * fh/hw_mask keeps all the unmasked causes.
+                 * Unlike msi, in msix cause is enabled when it is unset.
+                 */
+                trans_pcie->hw_mask = trans_pcie->hw_init_mask;
+                trans_pcie->fh_mask = trans_pcie->fh_init_mask;
+                iwl_write32(trans, CSR_MSIX_FH_INT_MASK_AD,
+                            ~trans_pcie->fh_mask);
+                iwl_write32(trans, CSR_MSIX_HW_INT_MASK_AD,
+                            ~trans_pcie->hw_mask);
+        }
+}
+
+static inline void iwl_enable_hw_int_msk_msix(struct iwl_trans *trans, u32 msk)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        iwl_write32(trans, CSR_MSIX_HW_INT_MASK_AD, ~msk);
+        trans_pcie->hw_mask = msk;
+}
+
+static inline void iwl_enable_fh_int_msk_msix(struct iwl_trans *trans, u32 msk)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        iwl_write32(trans, CSR_MSIX_FH_INT_MASK_AD, ~msk);
+        trans_pcie->fh_mask = msk;
 }
 
 static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
@@ -512,8 +570,15 @@ static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         IWL_DEBUG_ISR(trans, "Enabling FW load interrupt\n");
-        trans_pcie->inta_mask = CSR_INT_BIT_FH_TX;
-        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        if (!trans_pcie->msix_enabled) {
+                trans_pcie->inta_mask = CSR_INT_BIT_FH_TX;
+                iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        } else {
+                iwl_write32(trans, CSR_MSIX_HW_INT_MASK_AD,
+                            trans_pcie->hw_init_mask);
+                iwl_enable_fh_int_msk_msix(trans,
+                                           MSIX_FH_INT_CAUSES_D2S_CH0_NUM);
+        }
 }
 
 static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
@@ -521,8 +586,15 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         IWL_DEBUG_ISR(trans, "Enabling rfkill interrupt\n");
-        trans_pcie->inta_mask = CSR_INT_BIT_RF_KILL;
-        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        if (!trans_pcie->msix_enabled) {
+                trans_pcie->inta_mask = CSR_INT_BIT_RF_KILL;
+                iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+        } else {
+                iwl_write32(trans, CSR_MSIX_FH_INT_MASK_AD,
+                            trans_pcie->fh_init_mask);
+                iwl_enable_hw_int_msk_msix(trans,
+                                           MSIX_HW_INT_CAUSES_REG_RF_KILL);
+        }
 }
 
 static inline void iwl_wake_queue(struct iwl_trans *trans,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 07973ef826c1..489b07a9e471 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -783,16 +783,26 @@ static void iwl_pcie_rx_mq_hw_init(struct iwl_trans *trans)
          * Single frame mode
          * Rx buffer size 4 or 8k or 12k
          * Min RB size 4 or 8
+         * Drop frames that exceed RB size
          * 512 RBDs
          */
         iwl_write_prph(trans, RFH_RXF_DMA_CFG,
                        RFH_DMA_EN_ENABLE_VAL |
                        rb_size | RFH_RXF_DMA_SINGLE_FRAME_MASK |
                        RFH_RXF_DMA_MIN_RB_4_8 |
+                       RFH_RXF_DMA_DROP_TOO_LARGE_MASK |
                        RFH_RXF_DMA_RBDCB_SIZE_512);
 
+        /*
+         * Activate DMA snooping.
+         * Set RX DMA chunk size to 128 bit
+         * Default queue is 0
+         */
         iwl_write_prph(trans, RFH_GEN_CFG, RFH_GEN_CFG_RFH_DMA_SNOOP |
-                                          RFH_GEN_CFG_SERVICE_DMA_SNOOP);
+                       RFH_GEN_CFG_RB_CHUNK_SIZE |
+                       (DEFAULT_RXQ_NUM << RFH_GEN_CFG_DEFAULT_RXQ_NUM_POS) |
+                       RFH_GEN_CFG_SERVICE_DMA_SNOOP);
+        /* Enable the relevant rx queues */
         iwl_write_prph(trans, RFH_RXF_RXQ_ACTIVE, enabled);
 
         /* Set interrupt coalescing timer to default (2048 usecs) */
@@ -1135,10 +1145,10 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
 /*
  * iwl_pcie_rx_handle - Main entry function for receiving responses from fw
  */
-static void iwl_pcie_rx_handle(struct iwl_trans *trans)
+static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rxq *rxq = &trans_pcie->rxq[0];
+        struct iwl_rxq *rxq = &trans_pcie->rxq[queue];
         u32 r, i, j, count = 0;
         bool emergency = false;
 
@@ -1149,9 +1159,12 @@ restart:
         r = le16_to_cpu(ACCESS_ONCE(rxq->rb_stts->closed_rb_num)) & 0x0FFF;
         i = rxq->read;
 
+        /* W/A 9000 device step A0 wrap-around bug */
+        r &= (rxq->queue_size - 1);
+
         /* Rx interrupt, but nothing sent from uCode */
         if (i == r)
-                IWL_DEBUG_RX(trans, "HW = SW = %d\n", r);
+                IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
 
         while (i != r) {
                 struct iwl_rx_mem_buffer *rxb;
@@ -1164,15 +1177,18 @@ restart:
                          * used_bd is a 32 bit but only 12 are used to retrieve
                          * the vid
                          */
-                        u16 vid = (u16)le32_to_cpu(rxq->used_bd[i]);
+                        u16 vid = le32_to_cpu(rxq->used_bd[i]) & 0x0FFF;
 
+                        if (WARN(vid >= ARRAY_SIZE(trans_pcie->global_table),
+                                 "Invalid rxb index from HW %u\n", (u32)vid))
+                                goto out;
                         rxb = trans_pcie->global_table[vid];
                 } else {
                         rxb = rxq->queue[i];
                         rxq->queue[i] = NULL;
                 }
 
-                IWL_DEBUG_RX(trans, "rxbuf: HW = %d, SW = %d\n", r, i);
+                IWL_DEBUG_RX(trans, "Q %d: HW = %d, SW = %d\n", rxq->id, r, i);
                 iwl_pcie_rx_handle_rb(trans, rxq, rxb, emergency);
 
                 i = (i + 1) & (rxq->queue_size - 1);
@@ -1235,7 +1251,7 @@ restart:
                         goto restart;
                 }
         }
-
+out:
         /* Backtrack one entry */
         rxq->read = i;
         spin_unlock(&rxq->lock);
@@ -1259,6 +1275,54 @@ restart:
                 napi_gro_flush(&rxq->napi, false);
 }
 
+static struct iwl_trans_pcie *iwl_pcie_get_trans_pcie(struct msix_entry *entry)
+{
+        u8 queue = entry->entry;
+        struct msix_entry *entries = entry - queue;
+
+        return container_of(entries, struct iwl_trans_pcie, msix_entries[0]);
+}
+
+static inline void iwl_pcie_clear_irq(struct iwl_trans *trans,
+                                      struct msix_entry *entry)
+{
+        /*
+         * Before sending the interrupt the HW disables it to prevent
+         * a nested interrupt. This is done by writing 1 to the corresponding
+         * bit in the mask register. After handling the interrupt, it should be
+         * re-enabled by clearing this bit. This register is defined as
+         * write 1 clear (W1C) register, meaning that it's being clear
+         * by writing 1 to the bit.
+         */
+        iwl_write_direct32(trans, CSR_MSIX_AUTOMASK_ST_AD, BIT(entry->entry));
+}
+
+/*
+ * iwl_pcie_rx_msix_handle - Main entry function for receiving responses from fw
+ * This interrupt handler should be used with RSS queue only.
+ */
+irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id)
+{
+        struct msix_entry *entry = dev_id;
+        struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry);
+        struct iwl_trans *trans = trans_pcie->trans;
+
+        if (WARN_ON(entry->entry >= trans->num_rx_queues))
+                return IRQ_NONE;
+
+        lock_map_acquire(&trans->sync_cmd_lockdep_map);
+
+        local_bh_disable();
+        iwl_pcie_rx_handle(trans, entry->entry);
+        local_bh_enable();
+
+        iwl_pcie_clear_irq(trans, entry);
+
+        lock_map_release(&trans->sync_cmd_lockdep_map);
+
+        return IRQ_HANDLED;
+}
+
 /*
  * iwl_pcie_irq_handle_error - called for HW or SW error interrupt from card
  */
@@ -1589,7 +1653,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                 isr_stats->rx++;
 
                 local_bh_disable();
-                iwl_pcie_rx_handle(trans);
+                iwl_pcie_rx_handle(trans, 0);
                 local_bh_enable();
         }
 
@@ -1732,3 +1796,129 @@ irqreturn_t iwl_pcie_isr(int irq, void *data)
 
         return IRQ_WAKE_THREAD;
 }
+
+irqreturn_t iwl_pcie_msix_isr(int irq, void *data)
+{
+        return IRQ_WAKE_THREAD;
+}
+
+irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+{
+        struct msix_entry *entry = dev_id;
+        struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry);
+        struct iwl_trans *trans = trans_pcie->trans;
+        struct isr_statistics *isr_stats = isr_stats = &trans_pcie->isr_stats;
+        u32 inta_fh, inta_hw;
+
+        lock_map_acquire(&trans->sync_cmd_lockdep_map);
+
+        spin_lock(&trans_pcie->irq_lock);
+        inta_fh = iwl_read_direct32(trans, CSR_MSIX_FH_INT_CAUSES_AD);
+        inta_hw = iwl_read_direct32(trans, CSR_MSIX_HW_INT_CAUSES_AD);
+        /*
+         * Clear causes registers to avoid being handling the same cause.
+         */
+        iwl_write_direct32(trans, CSR_MSIX_FH_INT_CAUSES_AD, inta_fh);
+        iwl_write_direct32(trans, CSR_MSIX_HW_INT_CAUSES_AD, inta_hw);
+        spin_unlock(&trans_pcie->irq_lock);
+
+        if (unlikely(!(inta_fh | inta_hw))) {
+                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
+                lock_map_release(&trans->sync_cmd_lockdep_map);
+                return IRQ_NONE;
+        }
+
+        if (iwl_have_debug_level(IWL_DL_ISR))
+                IWL_DEBUG_ISR(trans, "ISR inta_fh 0x%08x, enabled 0x%08x\n",
+                              inta_fh,
+                              iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD));
+
+        /* This "Tx" DMA channel is used only for loading uCode */
+        if (inta_fh & MSIX_FH_INT_CAUSES_D2S_CH0_NUM) {
+                IWL_DEBUG_ISR(trans, "uCode load interrupt\n");
+                isr_stats->tx++;
+                /*
+                 * Wake up uCode load routine,
+                 * now that load is complete
+                 */
+                trans_pcie->ucode_write_complete = true;
+                wake_up(&trans_pcie->ucode_write_waitq);
+        }
+
+        /* Error detected by uCode */
+        if ((inta_fh & MSIX_FH_INT_CAUSES_FH_ERR) ||
+            (inta_hw & MSIX_HW_INT_CAUSES_REG_SW_ERR)) {
+                IWL_ERR(trans,
+                        "Microcode SW error detected. Restarting 0x%X.\n",
+                        inta_fh);
+                isr_stats->sw++;
+                iwl_pcie_irq_handle_error(trans);
+        }
+
+        /* After checking FH register check HW register */
+        if (iwl_have_debug_level(IWL_DL_ISR))
+                IWL_DEBUG_ISR(trans,
+                              "ISR inta_hw 0x%08x, enabled 0x%08x\n",
+                              inta_hw,
+                              iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD));
+
+        /* Alive notification via Rx interrupt will do the real work */
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_ALIVE) {
+                IWL_DEBUG_ISR(trans, "Alive interrupt\n");
+                isr_stats->alive++;
+        }
+
+        /* uCode wakes up after power-down sleep */
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_WAKEUP) {
+                IWL_DEBUG_ISR(trans, "Wakeup interrupt\n");
+                iwl_pcie_rxq_check_wrptr(trans);
+                iwl_pcie_txq_check_wrptrs(trans);
+
+                isr_stats->wakeup++;
+        }
+
+        /* Chip got too hot and stopped itself */
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_CT_KILL) {
+                IWL_ERR(trans, "Microcode CT kill error detected.\n");
+                isr_stats->ctkill++;
+        }
+
+        /* HW RF KILL switch toggled */
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_RF_KILL) {
+                bool hw_rfkill;
+
+                hw_rfkill = iwl_is_rfkill_set(trans);
+                IWL_WARN(trans, "RF_KILL bit toggled to %s.\n",
+                         hw_rfkill ? "disable radio" : "enable radio");
+
+                isr_stats->rfkill++;
+
+                mutex_lock(&trans_pcie->mutex);
+                iwl_trans_pcie_rf_kill(trans, hw_rfkill);
+                mutex_unlock(&trans_pcie->mutex);
+                if (hw_rfkill) {
+                        set_bit(STATUS_RFKILL, &trans->status);
+                        if (test_and_clear_bit(STATUS_SYNC_HCMD_ACTIVE,
+                                               &trans->status))
+                                IWL_DEBUG_RF_KILL(trans,
+                                                  "Rfkill while SYNC HCMD in flight\n");
+                        wake_up(&trans_pcie->wait_command_queue);
+                } else {
+                        clear_bit(STATUS_RFKILL, &trans->status);
+                }
+        }
+
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_HW_ERR) {
+                IWL_ERR(trans,
+                        "Hardware error detected. Restarting.\n");
+
+                isr_stats->hw++;
+                iwl_pcie_irq_handle_error(trans);
+        }
+
+        iwl_pcie_clear_irq(trans, entry);
+
+        lock_map_release(&trans->sync_cmd_lockdep_map);
+
+        return IRQ_HANDLED;
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 58591ca051fd..e67957d6ac79 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -616,38 +616,38 @@ static int iwl_pcie_load_firmware_chunk(struct iwl_trans *trans, u32 dst_addr,
                                    dma_addr_t phy_addr, u32 byte_cnt)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
         int ret;
 
         trans_pcie->ucode_write_complete = false;
 
-        iwl_write_direct32(trans,
-                           FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
+        if (!iwl_trans_grab_nic_access(trans, &flags))
+                return -EIO;
+
+        iwl_write32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                    FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
 
-        iwl_write_direct32(trans,
-                           FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL),
-                           dst_addr);
+        iwl_write32(trans, FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL),
+                    dst_addr);
 
-        iwl_write_direct32(trans,
-                           FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
-                           phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
+        iwl_write32(trans, FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
+                    phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
 
-        iwl_write_direct32(trans,
-                           FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
-                           (iwl_get_dma_hi_addr(phy_addr)
-                                << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
+        iwl_write32(trans, FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                    (iwl_get_dma_hi_addr(phy_addr)
+                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
 
-        iwl_write_direct32(trans,
-                           FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
-                           1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
-                           1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
-                           FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
+        iwl_write32(trans, FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
+                    BIT(FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM) |
+                    BIT(FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX) |
+                    FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
 
-        iwl_write_direct32(trans,
-                           FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE    |
-                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
-                           FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
+        iwl_write32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                    FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
+                    FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
+                    FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
+
+        iwl_trans_release_nic_access(trans, &flags);
 
         ret = wait_event_timeout(trans_pcie->ucode_write_waitq,
                                  trans_pcie->ucode_write_complete, 5 * HZ);
@@ -1123,6 +1123,20 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
         iwl_pcie_prepare_card_hw(trans);
 }
 
+static void iwl_pcie_synchronize_irqs(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        if (trans_pcie->msix_enabled) {
+                int i;
+
+                for (i = 0; i < trans_pcie->allocated_vector; i++)
+                        synchronize_irq(trans_pcie->msix_entries[i].vector);
+        } else {
+                synchronize_irq(trans_pcie->pci_dev->irq);
+        }
+}
+
 static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                                    const struct fw_img *fw, bool run_in_rfkill)
 {
@@ -1149,7 +1163,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
         iwl_disable_interrupts(trans);
 
         /* Make sure it finished running */
-        synchronize_irq(trans_pcie->pci_dev->irq);
+        iwl_pcie_synchronize_irqs(trans);
 
         mutex_lock(&trans_pcie->mutex);
 
@@ -1252,8 +1266,6 @@ void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state)
 static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test,
                                       bool reset)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
         if (!reset) {
                 /* Enable persistence mode to avoid reset */
                 iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
@@ -1271,7 +1283,7 @@ static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test,
 
         iwl_pcie_disable_ict(trans);
 
-        synchronize_irq(trans_pcie->pci_dev->irq);
+        iwl_pcie_synchronize_irqs(trans);
 
         iwl_clear_bit(trans, CSR_GP_CNTRL,
                       CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -1350,6 +1362,153 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
         return 0;
 }
 
+struct iwl_causes_list {
+        u32 cause_num;
+        u32 mask_reg;
+        u8 addr;
+};
+
+static struct iwl_causes_list causes_list[] = {
+        {MSIX_FH_INT_CAUSES_D2S_CH0_NUM,        CSR_MSIX_FH_INT_MASK_AD, 0},
+        {MSIX_FH_INT_CAUSES_D2S_CH1_NUM,        CSR_MSIX_FH_INT_MASK_AD, 0x1},
+        {MSIX_FH_INT_CAUSES_S2D,                CSR_MSIX_FH_INT_MASK_AD, 0x3},
+        {MSIX_FH_INT_CAUSES_FH_ERR,             CSR_MSIX_FH_INT_MASK_AD, 0x5},
+        {MSIX_HW_INT_CAUSES_REG_ALIVE,          CSR_MSIX_HW_INT_MASK_AD, 0x10},
+        {MSIX_HW_INT_CAUSES_REG_WAKEUP,         CSR_MSIX_HW_INT_MASK_AD, 0x11},
+        {MSIX_HW_INT_CAUSES_REG_CT_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x16},
+        {MSIX_HW_INT_CAUSES_REG_RF_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x17},
+        {MSIX_HW_INT_CAUSES_REG_PERIODIC,       CSR_MSIX_HW_INT_MASK_AD, 0x18},
+        {MSIX_HW_INT_CAUSES_REG_SW_ERR,         CSR_MSIX_HW_INT_MASK_AD, 0x29},
+        {MSIX_HW_INT_CAUSES_REG_SCD,            CSR_MSIX_HW_INT_MASK_AD, 0x2A},
+        {MSIX_HW_INT_CAUSES_REG_FH_TX,          CSR_MSIX_HW_INT_MASK_AD, 0x2B},
+        {MSIX_HW_INT_CAUSES_REG_HW_ERR,         CSR_MSIX_HW_INT_MASK_AD, 0x2D},
+        {MSIX_HW_INT_CAUSES_REG_HAP,            CSR_MSIX_HW_INT_MASK_AD, 0x2E},
+};
+
+static void iwl_pcie_init_msix(struct iwl_trans_pcie *trans_pcie)
+{
+        u32 val, max_rx_vector, i;
+        struct iwl_trans *trans = trans_pcie->trans;
+
+        max_rx_vector = trans_pcie->allocated_vector - 1;
+
+        if (!trans_pcie->msix_enabled)
+                return;
+
+        iwl_write_prph(trans, UREG_CHICK, UREG_CHICK_MSIX_ENABLE);
+
+        /*
+         * Each cause from the list above and the RX causes is represented as
+         * a byte in the IVAR table. We access the first (N - 1) bytes and map
+         * them to the (N - 1) vectors so these vectors will be used as rx
+         * vectors. Then access all non rx causes and map them to the
+         * default queue (N'th queue).
+         */
+        for (i = 0; i < max_rx_vector; i++) {
+                iwl_write8(trans, CSR_MSIX_RX_IVAR(i), MSIX_FH_INT_CAUSES_Q(i));
+                iwl_clear_bit(trans, CSR_MSIX_FH_INT_MASK_AD,
+                              BIT(MSIX_FH_INT_CAUSES_Q(i)));
+        }
+
+        for (i = 0; i < ARRAY_SIZE(causes_list); i++) {
+                val = trans_pcie->default_irq_num |
+                        MSIX_NON_AUTO_CLEAR_CAUSE;
+                iwl_write8(trans, CSR_MSIX_IVAR(causes_list[i].addr), val);
+                iwl_clear_bit(trans, causes_list[i].mask_reg,
+                              causes_list[i].cause_num);
+        }
+        trans_pcie->fh_init_mask =
+                ~iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD);
+        trans_pcie->fh_mask = trans_pcie->fh_init_mask;
+        trans_pcie->hw_init_mask =
+                ~iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD);
+        trans_pcie->hw_mask = trans_pcie->hw_init_mask;
+}
+
+static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
+                                        struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u16 pci_cmd;
+        int max_vector;
+        int ret, i;
+
+        if (trans->cfg->mq_rx_supported) {
+                max_vector = min_t(u32, (num_possible_cpus() + 1),
+                                   IWL_MAX_RX_HW_QUEUES);
+                for (i = 0; i < max_vector; i++)
+                        trans_pcie->msix_entries[i].entry = i;
+
+                ret = pci_enable_msix_range(pdev, trans_pcie->msix_entries,
+                                            MSIX_MIN_INTERRUPT_VECTORS,
+                                            max_vector);
+                if (ret > 1) {
+                        IWL_DEBUG_INFO(trans,
+                                       "Enable MSI-X allocate %d interrupt vector\n",
+                                       ret);
+                        trans_pcie->allocated_vector = ret;
+                        trans_pcie->default_irq_num =
+                                trans_pcie->allocated_vector - 1;
+                        trans_pcie->trans->num_rx_queues =
+                                trans_pcie->allocated_vector - 1;
+                        trans_pcie->msix_enabled = true;
+
+                        return;
+                }
+                IWL_DEBUG_INFO(trans,
+                               "ret = %d %s move to msi mode\n", ret,
+                               (ret == 1) ?
+                               "can't allocate more than 1 interrupt vector" :
+                               "failed to enable msi-x mode");
+                pci_disable_msix(pdev);
+        }
+
+        ret = pci_enable_msi(pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", ret);
+                /* enable rfkill interrupt: hw bug w/a */
+                pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
+                if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
+                        pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
+                        pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
+                }
+        }
+}
+
+static int iwl_pcie_init_msix_handler(struct pci_dev *pdev,
+                                      struct iwl_trans_pcie *trans_pcie)
+{
+        int i, last_vector;
+
+        last_vector = trans_pcie->trans->num_rx_queues;
+
+        for (i = 0; i < trans_pcie->allocated_vector; i++) {
+                int ret;
+
+                ret = request_threaded_irq(trans_pcie->msix_entries[i].vector,
+                                           iwl_pcie_msix_isr,
+                                           (i == last_vector) ?
+                                           iwl_pcie_irq_msix_handler :
+                                           iwl_pcie_irq_rx_msix_handler,
+                                           IRQF_SHARED,
+                                           DRV_NAME,
+                                           &trans_pcie->msix_entries[i]);
+                if (ret) {
+                        int j;
+
+                        IWL_ERR(trans_pcie->trans,
+                                "Error allocating IRQ %d\n", i);
+                        for (j = 0; j < i; j++)
+                                free_irq(trans_pcie->msix_entries[i].vector,
+                                         &trans_pcie->msix_entries[i]);
+                        pci_disable_msix(pdev);
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
 static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -1371,6 +1530,7 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
 
         iwl_pcie_apm_init(trans);
 
+        iwl_pcie_init_msix(trans_pcie);
         /* From now on, the op_mode will be kept updated about RF kill state */
         iwl_enable_rfkill_int(trans);
 
@@ -1425,7 +1585,7 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
 
         mutex_unlock(&trans_pcie->mutex);
 
-        synchronize_irq(trans_pcie->pci_dev->irq);
+        iwl_pcie_synchronize_irqs(trans);
 }
 
 static void iwl_trans_pcie_write8(struct iwl_trans *trans, u32 ofs, u8 val)
@@ -1506,15 +1666,25 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
         /* TODO: check if this is really needed */
         pm_runtime_disable(trans->dev);
 
-        synchronize_irq(trans_pcie->pci_dev->irq);
+        iwl_pcie_synchronize_irqs(trans);
 
         iwl_pcie_tx_free(trans);
         iwl_pcie_rx_free(trans);
 
-        free_irq(trans_pcie->pci_dev->irq, trans);
-        iwl_pcie_free_ict(trans);
+        if (trans_pcie->msix_enabled) {
+                for (i = 0; i < trans_pcie->allocated_vector; i++)
+                        free_irq(trans_pcie->msix_entries[i].vector,
+                                 &trans_pcie->msix_entries[i]);
+
+                pci_disable_msix(trans_pcie->pci_dev);
+                trans_pcie->msix_enabled = false;
+        } else {
+                free_irq(trans_pcie->pci_dev->irq, trans);
 
-        pci_disable_msi(trans_pcie->pci_dev);
+                iwl_pcie_free_ict(trans);
+
+                pci_disable_msi(trans_pcie->pci_dev);
+        }
         iounmap(trans_pcie->hw_base);
         pci_release_regions(trans_pcie->pci_dev);
         pci_disable_device(trans_pcie->pci_dev);
@@ -2069,7 +2239,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
                 } else {
                         pos += scnprintf(buf + pos, bufsz - pos,
                                          "\tclosed_rb_num: Not Allocated\n");
-        }
+                }
         }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
@@ -2615,7 +2785,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 {
         struct iwl_trans_pcie *trans_pcie;
         struct iwl_trans *trans;
-        u16 pci_cmd;
         int ret, addr_size;
 
         trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
@@ -2698,17 +2867,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->pci_dev = pdev;
         iwl_disable_interrupts(trans);
 
-        ret = pci_enable_msi(pdev);
-        if (ret) {
-                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", ret);
-                /* enable rfkill interrupt: hw bug w/a */
-                pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
-                if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
-                        pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
-                        pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
-                }
-        }
-
         trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
         /*
          * In the 8000 HW family the format of the 4 bytes of CSR_HW_REV have
@@ -2760,6 +2918,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         }
 
+        iwl_pcie_set_interrupt_capa(pdev, trans);
         trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
         snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
                  "PCI ID: 0x%04X:0x%04X", pdev->device, pdev->subsystem_device);
@@ -2769,19 +2928,23 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         init_waitqueue_head(&trans_pcie->d0i3_waitq);
 
-        ret = iwl_pcie_alloc_ict(trans);
-        if (ret)
-                goto out_pci_disable_msi;
-
-        ret = request_threaded_irq(pdev->irq, iwl_pcie_isr,
-                                   iwl_pcie_irq_handler,
-                                   IRQF_SHARED, DRV_NAME, trans);
-        if (ret) {
-                IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
-                goto out_free_ict;
-        }
+        if (trans_pcie->msix_enabled) {
+                if (iwl_pcie_init_msix_handler(pdev, trans_pcie))
+                        goto out_pci_release_regions;
+         } else {
+                ret = iwl_pcie_alloc_ict(trans);
+                if (ret)
+                        goto out_pci_disable_msi;
 
-        trans_pcie->inta_mask = CSR_INI_SET_MASK;
+                ret = request_threaded_irq(pdev->irq, iwl_pcie_isr,
+                                           iwl_pcie_irq_handler,
+                                           IRQF_SHARED, DRV_NAME, trans);
+                if (ret) {
+                        IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
+                        goto out_free_ict;
+                }
+                trans_pcie->inta_mask = CSR_INI_SET_MASK;
+         }
 
 #ifdef CONFIG_IWLWIFI_PCIE_RTPM
         trans->runtime_pm_mode = IWL_PLAT_PM_MODE_D0I3;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 837a7d536874..16ad820ca824 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -1062,10 +1062,10 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         if (iwl_queue_space(&txq->q) > txq->q.low_mark &&
             test_bit(txq_id, trans_pcie->queue_stopped)) {
-                struct sk_buff_head skbs;
+                struct sk_buff_head overflow_skbs;
 
-                __skb_queue_head_init(&skbs);
-                skb_queue_splice_init(&txq->overflow_q, &skbs);
+                __skb_queue_head_init(&overflow_skbs);
+                skb_queue_splice_init(&txq->overflow_q, &overflow_skbs);
 
                 /*
                  * This is tricky: we are in reclaim path which is non
@@ -1076,8 +1076,8 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                  */
                 spin_unlock_bh(&txq->lock);
 
-                while (!skb_queue_empty(&skbs)) {
-                        struct sk_buff *skb = __skb_dequeue(&skbs);
+                while (!skb_queue_empty(&overflow_skbs)) {
+                        struct sk_buff *skb = __skb_dequeue(&overflow_skbs);
                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                         u8 dev_cmd_idx = IWL_TRANS_FIRST_DRIVER_DATA + 1;
                         struct iwl_device_cmd *dev_cmd =
diff --git a/drivers/net/wireless/marvell/mwifiex/11h.c b/drivers/net/wireless/marvell/mwifiex/11h.c
index 71a1b580796f..81c60d0a1bda 100644
--- a/drivers/net/wireless/marvell/mwifiex/11h.c
+++ b/drivers/net/wireless/marvell/mwifiex/11h.c
@@ -123,8 +123,7 @@ void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
 void mwifiex_dfs_cac_work_queue(struct work_struct *work)
 {
         struct cfg80211_chan_def chandef;
-        struct delayed_work *delayed_work =
-                        container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work = to_delayed_work(work);
         struct mwifiex_private *priv =
                         container_of(delayed_work, struct mwifiex_private,
                                      dfs_cac_work);
@@ -289,8 +288,7 @@ int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,
 void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
 {
         struct mwifiex_uap_bss_param *bss_cfg;
-        struct delayed_work *delayed_work =
-                        container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work = to_delayed_work(work);
         struct mwifiex_private *priv =
                         container_of(delayed_work, struct mwifiex_private,
                                      dfs_chan_sw_work);
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index f2dce81ba36e..29b7f6eed240 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -676,7 +676,7 @@ mwifiex_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
                 }
                 break;
 
-                case MWIFIEX_BSS_ROLE_STA:
+        case MWIFIEX_BSS_ROLE_STA:
                 if (priv->media_connected) {
                         mwifiex_dbg(adapter, ERROR,
                                     "cannot change wiphy params when connected");
diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h
index 14cfa37deb00..a5a48c183d37 100644
--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
+++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h
@@ -184,6 +184,7 @@ struct mwifiex_ds_tx_ba_stream_tbl {
 };
 
 #define DBG_CMD_NUM    5
+#define MWIFIEX_DBG_SDIO_MP_NUM    10
 
 struct tdls_peer_info {
         u8 peer_addr[ETH_ALEN];
@@ -235,6 +236,11 @@ struct mwifiex_debug_info {
         u8 cmd_sent;
         u8 cmd_resp_received;
         u8 event_received;
+        u32 last_mp_wr_bitmap[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_wr_ports[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_wr_len[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_curr_wr_port[MWIFIEX_DBG_SDIO_MP_NUM];
+        u8 last_sdio_mp_index;
 };
 
 #define MWIFIEX_KEY_INDEX_UNICAST       0x40000000
diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
index aea7aee46cf7..aafc4ab4e5ae 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.h
+++ b/drivers/net/wireless/marvell/mwifiex/main.h
@@ -223,6 +223,11 @@ struct mwifiex_dbg {
         u16 last_cmd_resp_index;
         u16 last_event[DBG_CMD_NUM];
         u16 last_event_index;
+        u32 last_mp_wr_bitmap[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_wr_ports[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_wr_len[MWIFIEX_DBG_SDIO_MP_NUM];
+        u32 last_mp_curr_wr_port[MWIFIEX_DBG_SDIO_MP_NUM];
+        u8 last_sdio_mp_index;
 };
 
 enum MWIFIEX_HARDWARE_STATUS {
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index cc072142411a..de364381fe7b 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -1401,7 +1401,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 return -1;
         }
 
-        if (mwifiex_map_pci_memory(adapter, skb, skb->len , PCI_DMA_TODEVICE))
+        if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
                 return -1;
 
         buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
@@ -2452,7 +2452,7 @@ static void mwifiex_pcie_fw_dump(struct mwifiex_adapter *adapter)
                         for (i = 0; i < 4; i++) {
                                 mwifiex_read_reg_byte(adapter, reg, &read_reg);
                                 memory_size |= (read_reg << (i * 8));
-                        reg++;
+                                reg++;
                         }
                 } else {
                         memory_size = MWIFIEX_FW_DUMP_MAX_MEMSIZE;
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index abf15dbdfe08..b2c839ae2c3c 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -1355,6 +1355,9 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
                                  card->mpa_rx.start_port;
                 }
 
+                if (card->mpa_rx.pkt_cnt == 1)
+                        mport = adapter->ioport + port;
+
                 if (mwifiex_read_data_sync(adapter, card->mpa_rx.buf,
                                            card->mpa_rx.buf_len, mport, 1))
                         goto error;
@@ -1684,6 +1687,7 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
         s32 f_precopy_cur_buf = 0;
         s32 f_postcopy_cur_buf = 0;
         u32 mport;
+        int index;
 
         if (!card->mpa_tx.enabled ||
             (card->has_control_mask && (port == CTRL_PORT)) ||
@@ -1785,9 +1789,21 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
                                  card->mpa_tx.start_port;
                 }
 
+                if (card->mpa_tx.pkt_cnt == 1)
+                        mport = adapter->ioport + port;
+
                 ret = mwifiex_write_data_to_card(adapter, card->mpa_tx.buf,
                                                  card->mpa_tx.buf_len, mport);
 
+                /* Save the last multi port tx aggreagation info to debug log */
+                index = adapter->dbg.last_sdio_mp_index;
+                index = (index + 1) % MWIFIEX_DBG_SDIO_MP_NUM;
+                adapter->dbg.last_sdio_mp_index = index;
+                adapter->dbg.last_mp_wr_ports[index] = mport;
+                adapter->dbg.last_mp_wr_bitmap[index] = card->mp_wr_bitmap;
+                adapter->dbg.last_mp_wr_len[index] = card->mpa_tx.buf_len;
+                adapter->dbg.last_mp_curr_wr_port[index] = card->curr_wr_port;
+
                 MP_TX_AGGR_BUF_RESET(card);
         }
 
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
index 5cbee58f8781..d5c56eb9e985 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -314,6 +314,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                         mwifiex_dbg(adapter, ERROR,
                                     "Attempt to reconnect on csa closed chan(%d)\n",
                                     bss_desc->channel);
+                        ret = -1;
                         goto done;
                 }
 
diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
index 9275f9c3f869..150649602e98 100644
--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -680,6 +680,13 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
         __net_timestamp(skb);
         mwifiex_queue_tx_pkt(priv, skb);
 
+        /* Delay 10ms to make sure tdls setup confirm/teardown frame
+         * is received by peer
+        */
+        if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
+            action_code == WLAN_TDLS_TEARDOWN)
+                msleep_interruptible(10);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
index e791166d90c4..16d95b22fe5c 100644
--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
@@ -192,7 +192,7 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
                 }
                 priv->ap_11n_enabled = 1;
         } else {
-                memset(&bss_cfg->ht_cap , 0, sizeof(struct ieee80211_ht_cap));
+                memset(&bss_cfg->ht_cap, 0, sizeof(struct ieee80211_ht_cap));
                 bss_cfg->ht_cap.cap_info = cpu_to_le16(MWIFIEX_DEF_HT_CAP);
                 bss_cfg->ht_cap.ampdu_params_info = MWIFIEX_DEF_AMPDU;
         }
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index e43aff932360..05108618430d 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -244,9 +244,9 @@ setup_for_next:
         if (card->rx_cmd_ep == context->ep) {
                 mwifiex_usb_submit_rx_urb(context, size);
         } else {
-                if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING){
+                if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING) {
                         mwifiex_usb_submit_rx_urb(context, size);
-                }else{
+                } else {
                         context->skb = NULL;
                 }
         }
diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index 0cec8a64473e..6681be0511c7 100644
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -78,6 +78,16 @@ static struct mwifiex_debug_data items[] = {
          item_addr(last_event), DBG_CMD_NUM},
         {"last_event_index", item_size(last_event_index),
          item_addr(last_event_index), 1},
+        {"last_mp_wr_bitmap", item_size(last_mp_wr_bitmap),
+         item_addr(last_mp_wr_bitmap), MWIFIEX_DBG_SDIO_MP_NUM},
+        {"last_mp_wr_ports", item_size(last_mp_wr_ports),
+         item_addr(last_mp_wr_ports), MWIFIEX_DBG_SDIO_MP_NUM},
+        {"last_mp_wr_len", item_size(last_mp_wr_len),
+         item_addr(last_mp_wr_len), MWIFIEX_DBG_SDIO_MP_NUM},
+        {"last_mp_curr_wr_port", item_size(last_mp_curr_wr_port),
+         item_addr(last_mp_curr_wr_port), MWIFIEX_DBG_SDIO_MP_NUM},
+        {"last_sdio_mp_index", item_size(last_sdio_mp_index),
+         item_addr(last_sdio_mp_index), 1},
         {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
          item_addr(num_cmd_host_to_card_failure), 1},
         {"num_cmd_sleep_cfm_fail",
@@ -233,6 +243,16 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
                 memcpy(info->last_event, adapter->dbg.last_event,
                        sizeof(adapter->dbg.last_event));
                 info->last_event_index = adapter->dbg.last_event_index;
+                memcpy(info->last_mp_wr_bitmap, adapter->dbg.last_mp_wr_bitmap,
+                       sizeof(adapter->dbg.last_mp_wr_bitmap));
+                memcpy(info->last_mp_wr_ports, adapter->dbg.last_mp_wr_ports,
+                       sizeof(adapter->dbg.last_mp_wr_ports));
+                memcpy(info->last_mp_curr_wr_port,
+                       adapter->dbg.last_mp_curr_wr_port,
+                       sizeof(adapter->dbg.last_mp_curr_wr_port));
+                memcpy(info->last_mp_wr_len, adapter->dbg.last_mp_wr_len,
+                       sizeof(adapter->dbg.last_mp_wr_len));
+                info->last_sdio_mp_index = adapter->dbg.last_sdio_mp_index;
                 info->data_sent = adapter->data_sent;
                 info->cmd_sent = adapter->cmd_sent;
                 info->cmd_resp_received = adapter->cmd_resp_received;
diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c
index fbb1986eda3c..91c4b3427965 100644
--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c
+++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c
@@ -362,7 +362,9 @@ mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw)
         int i, ret;
 
         ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL);
-        if (!ivb || mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) {
+        if (!ivb)
+                return -ENOMEM;
+        if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) {
                 ret = -ENOMEM;
                 goto error;
         }
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
index bf9afbf46c1b..4b0bb6b4f6f1 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
@@ -1026,6 +1026,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0411, 0x01a2) },
         { USB_DEVICE(0x0411, 0x01ee) },
         { USB_DEVICE(0x0411, 0x01a8) },
+        { USB_DEVICE(0x0411, 0x01fd) },
         /* Corega */
         { USB_DEVICE(0x07aa, 0x002f) },
         { USB_DEVICE(0x07aa, 0x003c) },
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
index 25ee3cb8e982..72ae530e4a3b 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
@@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,	\
 {                                                               \
         struct rt2x00debug_intf *intf = file->private_data;     \
         const struct rt2x00debug *debug = intf->debug;          \
-        char line[16];                                          \
+        char line[17];                                          \
         size_t size;                                            \
         unsigned int index = intf->offset_##__name;             \
         __type value;                                           \
@@ -494,7 +494,8 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,	\
                                                                 \
         if (copy_from_user(line, buf, length))                  \
                 return -EFAULT;                                 \
-                                                                \
+        line[16] = 0;                                           \
+                                                \
         size = strlen(line);                                    \
         value = simple_strtoul(line, NULL, 0);                  \
                                                                 \
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/Kconfig b/drivers/net/wireless/realtek/rtl8xxxu/Kconfig
index dd4d626aecbc..8f053c350227 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/Kconfig
+++ b/drivers/net/wireless/realtek/rtl8xxxu/Kconfig
@@ -13,7 +13,7 @@ config RTL8XXXU
           This driver is under development and has a limited feature
           set. In particular it does not yet support 40MHz channels
           and power management. However it should have a smaller
-          memory footprint than the vendor drivers and benetifs
+          memory footprint than the vendor drivers and benefits
           from the in kernel mac80211 stack.
 
           It can coexist with drivers from drivers/staging/rtl8723au,
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
index 7d820c395375..e654bd33b434 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
@@ -1599,9 +1599,9 @@ rtl8723a_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40)
 static void rtl8xxxu_set_linktype(struct rtl8xxxu_priv *priv,
                                   enum nl80211_iftype linktype)
 {
-        u16 val8;
+        u8 val8;
 
-        val8 = rtl8xxxu_read16(priv, REG_MSR);
+        val8 = rtl8xxxu_read8(priv, REG_MSR);
         val8 &= ~MSR_LINKTYPE_MASK;
 
         switch (linktype) {
@@ -1704,6 +1704,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv)
                         priv->has_bluetooth = 1;
                 if (val32 & MULTI_GPS_FUNC_EN)
                         priv->has_gps = 1;
+                priv->is_multi_func = 1;
         } else if (val32 & SYS_CFG_TYPE_ID) {
                 bonding = rtl8xxxu_read32(priv, REG_HPON_FSM);
                 bonding &= HPON_FSM_BONDING_MASK;
@@ -1938,9 +1939,11 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)
         if (val16 & EEPROM_BOOT)
                 priv->boot_eeprom = 1;
 
-        val32 = rtl8xxxu_read32(priv, REG_EFUSE_TEST);
-        val32 = (val32 & ~EFUSE_SELECT_MASK) | EFUSE_WIFI_SELECT;
-        rtl8xxxu_write32(priv, REG_EFUSE_TEST, val32);
+        if (priv->is_multi_func) {
+                val32 = rtl8xxxu_read32(priv, REG_EFUSE_TEST);
+                val32 = (val32 & ~EFUSE_SELECT_MASK) | EFUSE_WIFI_SELECT;
+                rtl8xxxu_write32(priv, REG_EFUSE_TEST, val32);
+        }
 
         dev_dbg(dev, "Booting from %s\n",
                 priv->boot_eeprom ? "EEPROM" : "EFUSE");
@@ -2043,6 +2046,24 @@ exit:
         return ret;
 }
 
+static void rtl8xxxu_reset_8051(struct rtl8xxxu_priv *priv)
+{
+        u8 val8;
+        u16 sys_func;
+
+        val8 = rtl8xxxu_read8(priv, REG_RSV_CTRL + 1);
+        val8 &= ~BIT(0);
+        rtl8xxxu_write8(priv, REG_RSV_CTRL + 1, val8);
+        sys_func = rtl8xxxu_read16(priv, REG_SYS_FUNC);
+        sys_func &= ~SYS_FUNC_CPU_ENABLE;
+        rtl8xxxu_write16(priv, REG_SYS_FUNC, sys_func);
+        val8 = rtl8xxxu_read8(priv, REG_RSV_CTRL + 1);
+        val8 |= BIT(0);
+        rtl8xxxu_write8(priv, REG_RSV_CTRL + 1, val8);
+        sys_func |= SYS_FUNC_CPU_ENABLE;
+        rtl8xxxu_write16(priv, REG_SYS_FUNC, sys_func);
+}
+
 static int rtl8xxxu_start_firmware(struct rtl8xxxu_priv *priv)
 {
         struct device *dev = &priv->udev->dev;
@@ -2067,6 +2088,12 @@ static int rtl8xxxu_start_firmware(struct rtl8xxxu_priv *priv)
         val32 &= ~MCU_WINT_INIT_READY;
         rtl8xxxu_write32(priv, REG_MCU_FW_DL, val32);
 
+        /*
+         * Reset the 8051 in order for the firmware to start running,
+         * otherwise it won't come up on the 8192eu
+         */
+        rtl8xxxu_reset_8051(priv);
+
         /* Wait for firmware to become ready */
         for (i = 0; i < RTL8XXXU_FIRMWARE_POLL_MAX; i++) {
                 val32 = rtl8xxxu_read32(priv, REG_MCU_FW_DL);
@@ -2100,19 +2127,30 @@ static int rtl8xxxu_download_firmware(struct rtl8xxxu_priv *priv)
 
         /* 8051 enable */
         val16 = rtl8xxxu_read16(priv, REG_SYS_FUNC);
-        rtl8xxxu_write16(priv, REG_SYS_FUNC, val16 | SYS_FUNC_CPU_ENABLE);
+        val16 |= SYS_FUNC_CPU_ENABLE;
+        rtl8xxxu_write16(priv, REG_SYS_FUNC, val16);
+
+        val8 = rtl8xxxu_read8(priv, REG_MCU_FW_DL);
+        if (val8 & MCU_FW_RAM_SEL) {
+                pr_info("do the RAM reset\n");
+                rtl8xxxu_write8(priv, REG_MCU_FW_DL, 0x00);
+                rtl8xxxu_reset_8051(priv);
+        }
 
         /* MCU firmware download enable */
         val8 = rtl8xxxu_read8(priv, REG_MCU_FW_DL);
-        rtl8xxxu_write8(priv, REG_MCU_FW_DL, val8 | MCU_FW_DL_ENABLE);
+        val8 |= MCU_FW_DL_ENABLE;
+        rtl8xxxu_write8(priv, REG_MCU_FW_DL, val8);
 
         /* 8051 reset */
         val32 = rtl8xxxu_read32(priv, REG_MCU_FW_DL);
-        rtl8xxxu_write32(priv, REG_MCU_FW_DL, val32 & ~BIT(19));
+        val32 &= ~BIT(19);
+        rtl8xxxu_write32(priv, REG_MCU_FW_DL, val32);
 
         /* Reset firmware download checksum */
         val8 = rtl8xxxu_read8(priv, REG_MCU_FW_DL);
-        rtl8xxxu_write8(priv, REG_MCU_FW_DL, val8 | MCU_FW_DL_CSUM_REPORT);
+        val8 |= MCU_FW_DL_CSUM_REPORT;
+        rtl8xxxu_write8(priv, REG_MCU_FW_DL, val8);
 
         pages = priv->fw_size / RTL_FW_PAGE_SIZE;
         remainder = priv->fw_size % RTL_FW_PAGE_SIZE;
@@ -2121,7 +2159,8 @@ static int rtl8xxxu_download_firmware(struct rtl8xxxu_priv *priv)
 
         for (i = 0; i < pages; i++) {
                 val8 = rtl8xxxu_read8(priv, REG_MCU_FW_DL + 2) & 0xF8;
-                rtl8xxxu_write8(priv, REG_MCU_FW_DL + 2, val8 | i);
+                val8 |= i;
+                rtl8xxxu_write8(priv, REG_MCU_FW_DL + 2, val8);
 
                 ret = rtl8xxxu_writeN(priv, REG_FW_START_ADDRESS,
                                       fwptr, RTL_FW_PAGE_SIZE);
@@ -2135,7 +2174,8 @@ static int rtl8xxxu_download_firmware(struct rtl8xxxu_priv *priv)
 
         if (remainder) {
                 val8 = rtl8xxxu_read8(priv, REG_MCU_FW_DL + 2) & 0xF8;
-                rtl8xxxu_write8(priv, REG_MCU_FW_DL + 2, val8 | i);
+                val8 |= i;
+                rtl8xxxu_write8(priv, REG_MCU_FW_DL + 2, val8);
                 ret = rtl8xxxu_writeN(priv, REG_FW_START_ADDRESS,
                                       fwptr, remainder);
                 if (ret != remainder) {
@@ -2148,8 +2188,8 @@ static int rtl8xxxu_download_firmware(struct rtl8xxxu_priv *priv)
 fw_abort:
         /* MCU firmware download disable */
         val16 = rtl8xxxu_read16(priv, REG_MCU_FW_DL);
-        rtl8xxxu_write16(priv, REG_MCU_FW_DL,
-                         val16 & (~MCU_FW_DL_ENABLE & 0xff));
+        val16 &= ~MCU_FW_DL_ENABLE;
+        rtl8xxxu_write16(priv, REG_MCU_FW_DL, val16);
 
         return ret;
 }
@@ -2174,6 +2214,10 @@ static int rtl8xxxu_load_firmware(struct rtl8xxxu_priv *priv, char *fw_name)
         }
 
         priv->fw_data = kmemdup(fw->data, fw->size, GFP_KERNEL);
+        if (!priv->fw_data) {
+                ret = -ENOMEM;
+                goto exit;
+        }
         priv->fw_size = fw->size - sizeof(struct rtl8xxxu_firmware_header);
 
         signature = le16_to_cpu(priv->fw_data->signature);
@@ -2492,8 +2536,6 @@ static int rtl8xxxu_init_rf_regs(struct rtl8xxxu_priv *priv,
                         continue;
                 }
 
-                reg &= 0x3f;
-
                 ret = rtl8xxxu_write_rfreg(priv, path, reg, val);
                 if (ret) {
                         dev_warn(&priv->udev->dev,
@@ -4155,7 +4197,6 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
          * Configure initial WMAC settings
          */
         val32 = RCR_ACCEPT_PHYS_MATCH | RCR_ACCEPT_MCAST | RCR_ACCEPT_BCAST |
-                /* RCR_CHECK_BSSID_MATCH | RCR_CHECK_BSSID_BEACON | */
                 RCR_ACCEPT_MGMT_FRAME | RCR_HTC_LOC_CTRL |
                 RCR_APPEND_PHYSTAT | RCR_APPEND_ICV | RCR_APPEND_MIC;
         rtl8xxxu_write32(priv, REG_RCR, val32);
@@ -4248,17 +4289,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
 
         rtl8xxxu_write16(priv, REG_FAST_EDCA_CTRL, 0);
 
-        /*
-         * Not sure if we should get into this at all
-         */
-        if (priv->iqk_initialized) {
-                rtl8xxxu_restore_regs(priv, rtl8723au_iqk_phy_iq_bb_reg,
-                                      priv->bb_recovery_backup,
-                                      RTL8XXXU_BB_REGS);
-        } else {
-                rtl8723a_phy_iq_calibrate(priv);
-                priv->iqk_initialized = true;
-        }
+        rtl8723a_phy_iq_calibrate(priv);
 
         /*
          * This should enable thermal meter
@@ -4312,14 +4343,17 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
         val8 = ((30000 + NAV_UPPER_UNIT - 1) / NAV_UPPER_UNIT);
         rtl8xxxu_write8(priv, REG_NAV_UPPER, val8);
 
-        /*
-         * 2011/03/09 MH debug only, UMC-B cut pass 2500 S5 test,
-         * but we need to fin root cause.
-         */
-        val32 = rtl8xxxu_read32(priv, REG_FPGA0_RF_MODE);
-        if ((val32 & 0xff000000) != 0x83000000) {
-                val32 |= FPGA_RF_MODE_CCK;
-                rtl8xxxu_write32(priv, REG_FPGA0_RF_MODE, val32);
+        if (priv->rtlchip == 0x8723a) {
+                /*
+                 * 2011/03/09 MH debug only, UMC-B cut pass 2500 S5 test,
+                 * but we need to find root cause.
+                 * This is 8723au only.
+                 */
+                val32 = rtl8xxxu_read32(priv, REG_FPGA0_RF_MODE);
+                if ((val32 & 0xff000000) != 0x83000000) {
+                        val32 |= FPGA_RF_MODE_CCK;
+                        rtl8xxxu_write32(priv, REG_FPGA0_RF_MODE, val32);
+                }
         }
 
         val32 = rtl8xxxu_read32(priv, REG_FWHW_TXQ_CTRL);
@@ -4381,7 +4415,7 @@ static void rtl8xxxu_cam_write(struct rtl8xxxu_priv *priv,
 }
 
 static void rtl8xxxu_sw_scan_start(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif, const u8* mac)
+                                   struct ieee80211_vif *vif, const u8 *mac)
 {
         struct rtl8xxxu_priv *priv = hw->priv;
         u8 val8;
@@ -4488,13 +4522,6 @@ rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
                         rtl8xxxu_update_rate_mask(priv, ramask, sgi);
 
-                        val32 = rtl8xxxu_read32(priv, REG_RCR);
-                        val32 |= RCR_CHECK_BSSID_MATCH | RCR_CHECK_BSSID_BEACON;
-                        rtl8xxxu_write32(priv, REG_RCR, val32);
-
-                        /* Enable RX of data frames */
-                        rtl8xxxu_write16(priv, REG_RXFLTMAP2, 0xffff);
-
                         rtl8xxxu_write8(priv, REG_BCN_MAX_ERR, 0xff);
 
                         rtl8723a_stop_tx_beacon(priv);
@@ -4505,17 +4532,10 @@ rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
                         h2c.joinbss.data = H2C_JOIN_BSS_CONNECT;
                 } else {
-                        val32 = rtl8xxxu_read32(priv, REG_RCR);
-                        val32 &= ~(RCR_CHECK_BSSID_MATCH |
-                                   RCR_CHECK_BSSID_BEACON);
-                        rtl8xxxu_write32(priv, REG_RCR, val32);
-
                         val8 = rtl8xxxu_read8(priv, REG_BEACON_CTRL);
                         val8 |= BEACON_DISABLE_TSF_UPDATE;
                         rtl8xxxu_write8(priv, REG_BEACON_CTRL, val8);
 
-                        /* Disable RX of data frames */
-                        rtl8xxxu_write16(priv, REG_RXFLTMAP2, 0x0000);
                         h2c.joinbss.data = H2C_JOIN_BSS_DISCONNECT;
                 }
                 h2c.joinbss.cmd = H2C_JOIN_BSS_REPORT;
@@ -5012,17 +5032,14 @@ static void rtl8xxxu_rx_complete(struct urb *urb)
         struct rtl8xxxu_rx_desc *rx_desc = (struct rtl8xxxu_rx_desc *)skb->data;
         struct rtl8723au_phy_stats *phy_stats;
         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_mgmt *mgmt;
         struct device *dev = &priv->udev->dev;
         __le32 *_rx_desc_le = (__le32 *)skb->data;
         u32 *_rx_desc = (u32 *)skb->data;
-        int cnt, len, drvinfo_sz, desc_shift, i;
+        int drvinfo_sz, desc_shift, i;
 
         for (i = 0; i < (sizeof(struct rtl8xxxu_rx_desc) / sizeof(u32)); i++)
                 _rx_desc[i] = le32_to_cpu(_rx_desc_le[i]);
 
-        cnt = rx_desc->frag;
-        len = rx_desc->pktlen;
         drvinfo_sz = rx_desc->drvinfo_sz * 8;
         desc_shift = rx_desc->shift;
         skb_put(skb, urb->actual_length);
@@ -5033,8 +5050,6 @@ static void rtl8xxxu_rx_complete(struct urb *urb)
 
                 skb_pull(skb, drvinfo_sz + desc_shift);
 
-                mgmt = (struct ieee80211_mgmt *)skb->data;
-
                 memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
 
                 if (rx_desc->phy_stats)
@@ -5284,11 +5299,56 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,
                                       unsigned int *total_flags, u64 multicast)
 {
         struct rtl8xxxu_priv *priv = hw->priv;
+        u32 rcr = rtl8xxxu_read32(priv, REG_RCR);
 
         dev_dbg(&priv->udev->dev, "%s: changed_flags %08x, total_flags %08x\n",
                 __func__, changed_flags, *total_flags);
 
-        *total_flags &= (FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC);
+        /*
+         * FIF_ALLMULTI ignored as all multicast frames are accepted (REG_MAR)
+         */
+
+        if (*total_flags & FIF_FCSFAIL)
+                rcr |= RCR_ACCEPT_CRC32;
+        else
+                rcr &= ~RCR_ACCEPT_CRC32;
+
+        /*
+         * FIF_PLCPFAIL not supported?
+         */
+
+        if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
+                rcr &= ~RCR_CHECK_BSSID_BEACON;
+        else
+                rcr |= RCR_CHECK_BSSID_BEACON;
+
+        if (*total_flags & FIF_CONTROL)
+                rcr |= RCR_ACCEPT_CTRL_FRAME;
+        else
+                rcr &= ~RCR_ACCEPT_CTRL_FRAME;
+
+        if (*total_flags & FIF_OTHER_BSS) {
+                rcr |= RCR_ACCEPT_AP;
+                rcr &= ~RCR_CHECK_BSSID_MATCH;
+        } else {
+                rcr &= ~RCR_ACCEPT_AP;
+                rcr |= RCR_CHECK_BSSID_MATCH;
+        }
+
+        if (*total_flags & FIF_PSPOLL)
+                rcr |= RCR_ACCEPT_PM;
+        else
+                rcr &= ~RCR_ACCEPT_PM;
+
+        /*
+         * FIF_PROBE_REQ ignored as probe requests always seem to be accepted
+         */
+
+        rtl8xxxu_write32(priv, REG_RCR, rcr);
+
+        *total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_BCN_PRBRESP_PROMISC |
+                         FIF_CONTROL | FIF_OTHER_BSS | FIF_PSPOLL |
+                         FIF_PROBE_REQ);
 }
 
 static int rtl8xxxu_set_rts_threshold(struct ieee80211_hw *hw, u32 rts)
@@ -5473,12 +5533,9 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
         }
 exit:
         /*
-         * Disable all data frames
-         */
-        rtl8xxxu_write16(priv, REG_RXFLTMAP2, 0x0000);
-        /*
-         * Accept all mgmt frames
+         * Accept all data and mgmt frames
          */
+        rtl8xxxu_write16(priv, REG_RXFLTMAP2, 0xffff);
         rtl8xxxu_write16(priv, REG_RXFLTMAP0, 0xffff);
 
         rtl8xxxu_write32(priv, REG_OFDM0_XA_AGC_CORE1, 0x6954341e);
@@ -5891,8 +5948,6 @@ static struct usb_device_id dev_table[] = {
         .driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0xcdab, 0x8010, 0xff, 0xff, 0xff),
         .driver_info = (unsigned long)&rtl8192cu_fops},
-{USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x317f, 0xff, 0xff, 0xff),
-        .driver_info = (unsigned long)&rtl8192cu_fops}, /* Netcore 8188RU */
 {USB_DEVICE_AND_INTERFACE_INFO(0x04f2, 0xaff7, 0xff, 0xff, 0xff),
         .driver_info = (unsigned long)&rtl8192cu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(0x04f2, 0xaff9, 0xff, 0xff, 0xff),
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index f2a1bac6c8ec..bbd0f6b76b82 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -597,6 +597,7 @@ struct rtl8xxxu_priv {
         struct rtl8723au_idx ht20_max_power_offset[3];
         u32 chip_cut:4;
         u32 rom_rev:4;
+        u32 is_multi_func:1;
         u32 has_wifi:1;
         u32 has_bluetooth:1;
         u32 enable_bluetooth:1;
@@ -652,7 +653,6 @@ struct rtl8xxxu_priv {
         u32 bb_recovery_backup[RTL8XXXU_BB_REGS];
         u32 rtlchip;
         u8 pi_enabled:1;
-        u8 iqk_initialized:1;
         u8 int_buf[USB_INTR_CONTENT_LENGTH];
 };
 
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
index 23208f79b97c..8f6c9c6c7c09 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
@@ -45,6 +45,7 @@
 #define  APS_FSMCO_ENABLE_POWERDOWN     BIT(4)
 #define  APS_FSMCO_MAC_ENABLE           BIT(8)
 #define  APS_FSMCO_MAC_OFF              BIT(9)
+#define  APS_FSMCO_SW_LPS               BIT(10)
 #define  APS_FSMCO_HW_SUSPEND           BIT(11)
 #define  APS_FSMCO_PCIE                 BIT(12)
 #define  APS_FSMCO_HW_POWERDOWN         BIT(15)
@@ -213,6 +214,7 @@
 #define  SYS_CFG_PCIRSTB                BIT(4)
 #define  SYS_CFG_V15_VLD                BIT(5)
 #define  SYS_CFG_TRP_B15V_EN            BIT(7)
+#define  SYS_CFG_SW_OFFLOAD_EN          BIT(7)  /* For chips with IOL support */
 #define  SYS_CFG_SIC_IDLE               BIT(8)
 #define  SYS_CFG_BD_MAC2                BIT(9)
 #define  SYS_CFG_BD_MAC1                BIT(10)
@@ -340,6 +342,11 @@
 #define REG_BB_ACCEESS_CTRL             0x01e8
 #define REG_BB_ACCESS_DATA              0x01ec
 
+#define REG_HMBOX_EXT0_8723B            0x01f0
+#define REG_HMBOX_EXT1_8723B            0x01f4
+#define REG_HMBOX_EXT2_8723B            0x01f8
+#define REG_HMBOX_EXT3_8723B            0x01fc
+
 /* 0x0200 ~ 0x027F      TXDMA Configuration */
 #define REG_RQPN                        0x0200
 #define  RQPN_HI_PQ_SHIFT               0
@@ -352,6 +359,8 @@
 #define REG_TXDMA_OFFSET_CHK            0x020c
 #define REG_TXDMA_STATUS                0x0210
 #define REG_RQPN_NPQ                    0x0214
+#define  RQPN_NPQ_SHIFT                 0
+#define  RQPN_EPQ_SHIFT                 16
 
 /* 0x0280 ~ 0x02FF      RXDMA Configuration */
 #define REG_RXDMA_AGG_PG_TH             0x0280
@@ -453,6 +462,8 @@
 #define REG_NEED_CPU_HANDLE             0x04e0
 #define REG_PKT_LOSE_RPT                0x04e1
 #define REG_PTCL_ERR_STATUS             0x04e2
+#define REG_TX_REPORT_CTRL              0x04ec
+#define REG_TX_REPORT_TIME              0x04f0
 #define REG_DUMMY                       0x04fc
 
 /* 0x0500 ~ 0x05FF      EDCA Configuration */
@@ -559,13 +570,25 @@
                                                  (Rx beacon, probe rsp) */
 #define  RCR_ACCEPT_CRC32               BIT(8)  /* Accept CRC32 error packet */
 #define  RCR_ACCEPT_ICV                 BIT(9)  /* Accept ICV error packet */
-#define  RCR_ACCEPT_DATA_FRAME          BIT(11)
-#define  RCR_ACCEPT_CTRL_FRAME          BIT(12)
-#define  RCR_ACCEPT_MGMT_FRAME          BIT(13)
+#define  RCR_ACCEPT_DATA_FRAME          BIT(11) /* Accept all data pkt or use
+                                                   REG_RXFLTMAP2 */
+#define  RCR_ACCEPT_CTRL_FRAME          BIT(12) /* Accept all control pkt or use
+                                                   REG_RXFLTMAP1 */
+#define  RCR_ACCEPT_MGMT_FRAME          BIT(13) /* Accept all mgmt pkt or use
+                                                   REG_RXFLTMAP0 */
 #define  RCR_HTC_LOC_CTRL               BIT(14) /* MFC<--HTC=1 MFC-->HTC=0 */
+#define  RCR_UC_DATA_PKT_INT_ENABLE     BIT(16) /* Enable unicast data packet
+                                                   interrupt */
+#define  RCR_BM_DATA_PKT_INT_ENABLE     BIT(17) /* Enable broadcast data packet
+                                                   interrupt */
+#define  RCR_TIM_PARSER_ENABLE          BIT(18) /* Enable RX beacon TIM parser*/
 #define  RCR_MFBEN                      BIT(22)
-#define  RCR_LSIGEN                     BIT(23)
+#define  RCR_LSIG_ENABLE                BIT(23) /* Enable LSIG TXOP Protection
+                                                   function. Search KEYCAM for
+                                                   each rx packet to check if
+                                                   LSIGEN bit is set. */
 #define  RCR_MULTI_BSSID_ENABLE         BIT(24) /* Enable Multiple BssId */
+#define  RCR_FORCE_ACK                  BIT(26)
 #define  RCR_ACCEPT_BA_SSN              BIT(27) /* Accept BA SSN */
 #define  RCR_APPEND_PHYSTAT             BIT(28)
 #define  RCR_APPEND_ICV                 BIT(29)
@@ -632,9 +655,20 @@
 #define REG_LPNAV_CTRL                  0x0694
 #define REG_WKFMCAM_CMD                 0x0698
 #define REG_WKFMCAM_RWD                 0x069c
-#define REG_RXFLTMAP0                   0x06a0
-#define REG_RXFLTMAP1                   0x06a2
-#define REG_RXFLTMAP2                   0x06a4
+
+/*
+ * RX Filters: each bit corresponds to the numerical value of the subtype.
+ * If it is set the subtype frame type is passed. The filter is only used when
+ * the RCR_ACCEPT_DATA_FRAME, RCR_ACCEPT_CTRL_FRAME, RCR_ACCEPT_MGMT_FRAME bit
+ * in the RCR are low.
+ *
+ * Example: Beacon subtype is binary 1000 which is decimal 8 so we have to set
+ * bit 8 (0x100) in REG_RXFLTMAP0 to enable reception.
+ */
+#define REG_RXFLTMAP0                   0x06a0  /* Management frames */
+#define REG_RXFLTMAP1                   0x06a2  /* Control frames */
+#define REG_RXFLTMAP2                   0x06a4  /* Data frames */
+
 #define REG_BCN_PSR_RPT                 0x06a8
 #define REG_CALB32K_CTRL                0x06ac
 #define REG_PKT_MON_CTRL                0x06b4
@@ -742,6 +776,10 @@
 #define REG_FPGA1_RF_MODE               0x0900
 
 #define REG_FPGA1_TX_INFO               0x090c
+#define REG_DPDT_CTRL                   0x092c  /* 8723BU */
+#define REG_RFE_CTRL_ANTA_SRC           0x0930  /* 8723BU */
+#define REG_RFE_PATH_SELECT             0x0940  /* 8723BU */
+#define REG_RFE_BUFFER                  0x0944  /* 8723BU */
 
 #define REG_CCK0_SYSTEM                 0x0a00
 #define  CCK0_SIDEBAND                  BIT(4)
@@ -770,6 +808,9 @@
 
 #define REG_OFDM0_ENERGY_CCA_THRES      0x0c4c
 
+#define REG_OFDM0_RX_D_SYNC_PATH        0x0c40
+#define  OFDM0_SYNC_PATH_NOTCH_FILTER   BIT(1)
+
 #define REG_OFDM0_XA_AGC_CORE1          0x0c50
 #define REG_OFDM0_XA_AGC_CORE2          0x0c54
 #define REG_OFDM0_XB_AGC_CORE1          0x0c58
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index f2507610314b..0f48048b8654 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -35,62 +35,58 @@
 #include <linux/export.h>
 #include <net/cfg80211.h>
 
+u8 channel5g[CHANNEL_MAX_NUMBER_5G] = {
+        36, 38, 40, 42, 44, 46, 48,             /* Band 1 */
+        52, 54, 56, 58, 60, 62, 64,             /* Band 2 */
+        100, 102, 104, 106, 108, 110, 112,      /* Band 3 */
+        116, 118, 120, 122, 124, 126, 128,      /* Band 3 */
+        132, 134, 136, 138, 140, 142, 144,      /* Band 3 */
+        149, 151, 153, 155, 157, 159, 161,      /* Band 4 */
+        165, 167, 169, 171, 173, 175, 177       /* Band 4 */
+};
+EXPORT_SYMBOL(channel5g);
+
+u8 channel5g_80m[CHANNEL_MAX_NUMBER_5G_80M] = {
+        42, 58, 106, 122, 138, 155, 171
+};
+EXPORT_SYMBOL(channel5g_80m);
+
 void rtl_addr_delay(u32 addr)
 {
         if (addr == 0xfe)
-                mdelay(50);
+                msleep(50);
         else if (addr == 0xfd)
-                mdelay(5);
+                msleep(5);
         else if (addr == 0xfc)
-                mdelay(1);
+                msleep(1);
         else if (addr == 0xfb)
-                udelay(50);
+                usleep_range(50, 100);
         else if (addr == 0xfa)
-                udelay(5);
+                usleep_range(5, 10);
         else if (addr == 0xf9)
-                udelay(1);
+                usleep_range(1, 2);
 }
 EXPORT_SYMBOL(rtl_addr_delay);
 
 void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data)
 {
-        if (addr == 0xfe) {
-                mdelay(50);
-        } else if (addr == 0xfd) {
-                mdelay(5);
-        } else if (addr == 0xfc) {
-                mdelay(1);
-        } else if (addr == 0xfb) {
-                udelay(50);
-        } else if (addr == 0xfa) {
-                udelay(5);
-        } else if (addr == 0xf9) {
-                udelay(1);
+        if (addr >= 0xf9 && addr <= 0xfe) {
+                rtl_addr_delay(addr);
         } else {
                 rtl_set_rfreg(hw, rfpath, addr, mask, data);
-                udelay(1);
+                usleep_range(1, 2);
         }
 }
 EXPORT_SYMBOL(rtl_rfreg_delay);
 
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data)
 {
-        if (addr == 0xfe) {
-                mdelay(50);
-        } else if (addr == 0xfd) {
-                mdelay(5);
-        } else if (addr == 0xfc) {
-                mdelay(1);
-        } else if (addr == 0xfb) {
-                udelay(50);
-        } else if (addr == 0xfa) {
-                udelay(5);
-        } else if (addr == 0xf9) {
-                udelay(1);
+        if (addr >= 0xf9 && addr <= 0xfe) {
+                rtl_addr_delay(addr);
         } else {
                 rtl_set_bbreg(hw, addr, MASKDWORD, data);
-                udelay(1);
+                usleep_range(1, 2);
         }
 }
 EXPORT_SYMBOL(rtl_bb_delay);
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 7f471bff435c..283d608b9973 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -855,7 +855,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                 }
                 /* handle command packet here */
                 if (rtlpriv->cfg->ops->rx_command_packet &&
-                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                    rtlpriv->cfg->ops->rx_command_packet(hw, &stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto new_trx_end;
                 }
@@ -2392,7 +2392,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
         rtlpriv->cfg->ops->deinit_sw_vars(hw);
 
         if (rtlpci->irq_alloc) {
-                synchronize_irq(rtlpci->pdev->irq);
                 free_irq(rtlpci->pdev->irq, hw);
                 rtlpci->irq_alloc = 0;
         }
diff --git a/drivers/net/wireless/realtek/rtlwifi/rc.c b/drivers/net/wireless/realtek/rtlwifi/rc.c
index 28f7010e7108..1aca77719521 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rc.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rc.c
@@ -41,7 +41,7 @@ static u8 _rtl_rc_get_highest_rix(struct rtl_priv *rtlpriv,
         struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
         struct rtl_phy *rtlphy = &(rtlpriv->phy);
         struct rtl_sta_info *sta_entry = NULL;
-        u8 wireless_mode = 0;
+        u16 wireless_mode = 0;
 
         /*
          *this rate is no use for true rate, firmware
@@ -99,7 +99,7 @@ static void _rtl_rc_rate_set_series(struct rtl_priv *rtlpriv,
 {
         struct rtl_mac *mac = rtl_mac(rtlpriv);
         struct rtl_sta_info *sta_entry = NULL;
-        u8 wireless_mode = 0;
+        u16 wireless_mode = 0;
         u8 sgi_20 = 0, sgi_40 = 0, sgi_80 = 0;
 
         if (sta) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.c
index 791efbe6b18c..11701064b0e1 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.c
@@ -851,7 +851,7 @@ void rtl88ee_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 }
 
 u32 rtl88ee_rx_command_packet(struct ieee80211_hw *hw,
-                              struct rtl_stats status,
+                              const struct rtl_stats *status,
                               struct sk_buff *skb)
 {
         return 0;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
index eab5ae0eb46c..5a24d194ac76 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
@@ -790,7 +790,7 @@ void rtl88ee_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
                              bool firstseg, bool lastseg,
                              struct sk_buff *skb);
 u32 rtl88ee_rx_command_packet(struct ieee80211_hw *hw,
-                              struct rtl_stats status,
+                              const struct rtl_stats *status,
                               struct sk_buff *skb);
 
 #endif
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
index bb06fe836fe7..7810fe87dca7 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
@@ -924,19 +924,11 @@ static void _rtl92d_ccxpower_index_check(struct ieee80211_hw *hw,
 
 static u8 _rtl92c_phy_get_rightchnlplace(u8 chnl)
 {
-        u8 channel_5g[59] = {
-                1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
-                60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
-                114, 116, 118, 120, 122, 124, 126, 128,
-                130, 132, 134, 136, 138, 140, 149, 151,
-                153, 155, 157, 159, 161, 163, 165
-        };
         u8 place = chnl;
 
         if (chnl > 14) {
-                for (place = 14; place < sizeof(channel_5g); place++) {
-                        if (channel_5g[place] == chnl) {
+                for (place = 14; place < sizeof(channel5g); place++) {
+                        if (channel5g[place] == chnl) {
                                 place++;
                                 break;
                         }
@@ -2471,16 +2463,9 @@ static bool _rtl92d_is_legal_5g_channel(struct ieee80211_hw *hw, u8 channel)
 {
 
         int i;
-        u8 channel_5g[45] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
-                60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
-                114, 116, 118, 120, 122, 124, 126, 128, 130, 132,
-                134, 136, 138, 140, 149, 151, 153, 155, 157, 159,
-                161, 163, 165
-        };
 
-        for (i = 0; i < sizeof(channel_5g); i++)
-                if (channel == channel_5g[i])
+        for (i = 0; i < sizeof(channel5g); i++)
+                if (channel == channel5g[i])
                         return true;
         return false;
 }
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c
index 5f14308e8eb3..9fd3f1b6e4a8 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c
@@ -2018,18 +2018,6 @@ static void _rtl92ee_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
         struct rtl_efuse *efu = rtl_efuse(rtl_priv(hw));
         struct txpower_info_2g pwr2g;
         struct txpower_info_5g pwr5g;
-        u8 channel5g[CHANNEL_MAX_NUMBER_5G] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54,
-                56, 58, 60, 62, 64, 100, 102, 104, 106,
-                108, 110, 112, 114, 116, 118, 120, 122,
-                124, 126, 128, 130, 132, 134, 136, 138,
-                140, 142, 144, 149, 151, 153, 155, 157,
-                159, 161, 163, 165, 167, 168, 169, 171,
-                173, 175, 177
-        };
-        u8 channel5g_80m[CHANNEL_MAX_NUMBER_5G_80M] = {
-                42, 58, 106, 122, 138, 155, 171
-        };
         u8 rf, idx;
         u8 i;
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.c
index d39ee67f6113..24eff8ea4c2e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.c
@@ -1105,13 +1105,13 @@ void rtl92ee_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 }
 
 u32 rtl92ee_rx_command_packet(struct ieee80211_hw *hw,
-                              struct rtl_stats status,
+                              const struct rtl_stats *status,
                               struct sk_buff *skb)
 {
         u32 result = 0;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
-        switch (status.packet_report_type) {
+        switch (status->packet_report_type) {
         case NORMAL_RX:
                 result = 0;
                 break;
@@ -1121,7 +1121,7 @@ u32 rtl92ee_rx_command_packet(struct ieee80211_hw *hw,
                 break;
         default:
                 RT_TRACE(rtlpriv, COMP_RECV, DBG_TRACE,
-                         "Unknown packet type %d\n", status.packet_report_type);
+                         "Unknown packet type %d\n", status->packet_report_type);
                 break;
         }
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.h
index 8f78ac9e6040..a4c38345233e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/trx.h
@@ -857,6 +857,6 @@ void rtl92ee_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
                              bool firstseg, bool lastseg,
                              struct sk_buff *skb);
 u32 rtl92ee_rx_command_packet(struct ieee80211_hw *hw,
-                              struct rtl_stats status,
+                              const struct rtl_stats *status,
                               struct sk_buff *skb);
 #endif
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.c
index 2f7c144d7980..7b4a9b63583b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.c
@@ -710,7 +710,7 @@ void rtl8723e_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 }
 
 u32 rtl8723e_rx_command_packet(struct ieee80211_hw *hw,
-                               struct rtl_stats status,
+                               const struct rtl_stats *status,
                                struct sk_buff *skb)
 {
         return 0;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.h
index 017da7e194d8..32970bf18856 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/trx.h
@@ -716,6 +716,6 @@ void rtl8723e_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
                               bool firstseg, bool lastseg,
                               struct sk_buff *skb);
 u32 rtl8723e_rx_command_packet(struct ieee80211_hw *hw,
-                               struct rtl_stats status,
+                               const struct rtl_stats *status,
                                struct sk_buff *skb);
 #endif
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.c
index 338ec9a9d09b..60345975f9fd 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.c
@@ -758,13 +758,13 @@ void rtl8723be_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 }
 
 u32 rtl8723be_rx_command_packet(struct ieee80211_hw *hw,
-                                struct rtl_stats status,
+                                const struct rtl_stats *status,
                                 struct sk_buff *skb)
 {
         u32 result = 0;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
-        switch (status.packet_report_type) {
+        switch (status->packet_report_type) {
         case NORMAL_RX:
                         result = 0;
                         break;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.h
index 45949ac4854c..40c36607b8b9 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/trx.h
@@ -620,6 +620,6 @@ void rtl8723be_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
                                bool firstseg, bool lastseg,
                                struct sk_buff *skb);
 u32 rtl8723be_rx_command_packet(struct ieee80211_hw *hw,
-                                struct rtl_stats status,
+                                const struct rtl_stats *status,
                                 struct sk_buff *skb);
 #endif
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
index 525eb234627c..a4fc70e8c9c0 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
@@ -271,7 +271,7 @@ int rtl8821ae_download_fw(struct ieee80211_hw *hw, bool buse_wake_on_wlan_fw)
 
         err = _rtl8821ae_fw_free_to_go(hw);
         if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "Firmware is not ready to run!\n");
         } else {
                 RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index bbb789f8990b..fe900badd468 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -2786,14 +2786,6 @@ static void _rtl8812ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
         struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
         struct txpower_info_2g pwrinfo24g;
         struct txpower_info_5g pwrinfo5g;
-        u8 channel5g[CHANNEL_MAX_NUMBER_5G] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54,
-                56, 58, 60, 62, 64, 100, 102, 104, 106,
-                108, 110, 112, 114, 116, 118, 120, 122,
-                124, 126, 128, 130, 132, 134, 136, 138,
-                140, 142, 144, 149, 151, 153, 155, 157,
-                159, 161, 163, 165, 167, 168, 169, 171, 173, 175, 177};
-        u8 channel5g_80m[CHANNEL_MAX_NUMBER_5G_80M] = {42, 58, 106, 122, 138, 155, 171};
         u8 rf_path, index;
         u8 i;
 
@@ -2872,16 +2864,6 @@ static void _rtl8821ae_read_txpower_info_from_hwpg(struct ieee80211_hw *hw,
         struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
         struct txpower_info_2g pwrinfo24g;
         struct txpower_info_5g pwrinfo5g;
-        u8 channel5g[CHANNEL_MAX_NUMBER_5G] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54,
-                56, 58, 60, 62, 64, 100, 102, 104, 106,
-                108, 110, 112, 114, 116, 118, 120, 122,
-                124, 126, 128, 130, 132, 134, 136, 138,
-                140, 142, 144, 149, 151, 153, 155, 157,
-                159, 161, 163, 165, 167, 168, 169, 171,
-                173, 175, 177};
-        u8 channel5g_80m[CHANNEL_MAX_NUMBER_5G_80M] = {
-                42, 58, 106, 122, 138, 155, 171};
         u8 rf_path, index;
         u8 i;
 
@@ -3855,7 +3837,7 @@ void rtl8821ae_update_channel_access_setting(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u8 wireless_mode = mac->mode;
+        u16 wireless_mode = mac->mode;
         u8 sifs_timer, r2t_sifs;
 
         rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_SLOT_TIME,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
index 9b4d8a637915..74165b3eb362 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
@@ -1472,18 +1472,13 @@ static char _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         char channel_index = -1;
-        u8 channel_5g[CHANNEL_MAX_NUMBER_5G] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64,
-                100, 102, 104, 106, 108, 110, 112, 114, 116, 118, 120, 122,
-                124, 126, 128, 130, 132, 134, 136, 138, 140, 142, 144, 149,
-                151, 153, 155, 157, 159, 161, 163, 165, 167, 168, 169, 171,
-                173, 175, 177};
         u8  i = 0;
+
         if (band == BAND_ON_2_4G)
                 channel_index = channel - 1;
         else if (band == BAND_ON_5G) {
-                for (i = 0; i < sizeof(channel_5g)/sizeof(u8); ++i) {
-                        if (channel_5g[i] == channel)
+                for (i = 0; i < sizeof(channel5g)/sizeof(u8); ++i) {
+                        if (channel5g[i] == channel)
                                 channel_index = i;
                 }
         } else
@@ -2240,13 +2235,6 @@ void rtl8821ae_phy_get_txpower_level(struct ieee80211_hw *hw, long *powerlevel)
 
 static bool _rtl8821ae_phy_get_chnl_index(u8 channel, u8 *chnl_index)
 {
-        u8 channel_5g[CHANNEL_MAX_NUMBER_5G] = {
-                36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62,
-                64, 100, 102, 104, 106, 108, 110, 112, 114, 116, 118,
-                120, 122, 124, 126, 128, 130, 132, 134, 136, 138, 140,
-                142, 144, 149, 151, 153, 155, 157, 159, 161, 163, 165,
-                167, 168, 169, 171, 173, 175, 177
-        };
         u8 i = 0;
         bool in_24g = true;
 
@@ -2257,7 +2245,7 @@ static bool _rtl8821ae_phy_get_chnl_index(u8 channel, u8 *chnl_index)
                 in_24g = false;
 
                 for (i = 0; i < CHANNEL_MAX_NUMBER_5G; ++i) {
-                        if (channel_5g[i] == channel) {
+                        if (channel5g[i] == channel) {
                                 *chnl_index = i;
                                 return in_24g;
                         }
@@ -2728,13 +2716,10 @@ static u8 _rtl8821ae_get_txpower_index(struct ieee80211_hw *hw, u8 path,
                              rate <= DESC_RATEVHT2SS_MCS9))
                                 txpower += rtlefuse->txpwr_5g_bw40diff[path][TX_2S];
                 } else if (bandwidth == HT_CHANNEL_WIDTH_80) {
-                        u8 channel_5g_80m[CHANNEL_MAX_NUMBER_5G_80M] = {
-                                42, 58, 106, 122, 138, 155, 171
-                        };
                         u8 i;
 
-                        for (i = 0; i < sizeof(channel_5g_80m) / sizeof(u8); ++i)
-                                if (channel_5g_80m[i] == channel)
+                        for (i = 0; i < sizeof(channel5g_80m) / sizeof(u8); ++i)
+                                if (channel5g_80m[i] == channel)
                                         index = i;
 
                         if ((DESC_RATEMCS0 <= rate && rate <= DESC_RATEMCS15) ||
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.c
index 174743aef943..41efaa148d13 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.c
@@ -998,13 +998,13 @@ void rtl8821ae_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 }
 
 u32 rtl8821ae_rx_command_packet(struct ieee80211_hw *hw,
-                                struct rtl_stats status,
+                                const struct rtl_stats *status,
                                 struct sk_buff *skb)
 {
         u32 result = 0;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
-        switch (status.packet_report_type) {
+        switch (status->packet_report_type) {
         case NORMAL_RX:
                 result = 0;
                 break;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.h
index 31409042d8dd..ad565bebf1d5 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.h
@@ -615,6 +615,6 @@ void rtl8821ae_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
                                bool firstseg, bool lastseg,
                                struct sk_buff *skb);
 u32 rtl8821ae_rx_command_packet(struct ieee80211_hw *hw,
-                                struct rtl_stats status,
+                                const struct rtl_stats *status,
                                 struct sk_buff *skb);
 #endif
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index 4544752a2ba8..554d81420f19 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -116,17 +116,12 @@
 
 #define CHANNEL_MAX_NUMBER      (14 + 24 + 21)  /* 14 is the max channel no */
 #define CHANNEL_MAX_NUMBER_2G           14
-#define CHANNEL_MAX_NUMBER_5G           54 /* Please refer to
+#define CHANNEL_MAX_NUMBER_5G           49 /* Please refer to
                                             *"phy_GetChnlGroup8812A" and
                                             * "Hal_ReadTxPowerInfo8812A"
                                             */
 #define CHANNEL_MAX_NUMBER_5G_80M       7
 #define CHANNEL_GROUP_MAX       (3 + 9) /*  ch1~3, 4~9, 10~14 = three groups */
-#define CHANNEL_MAX_NUMBER_5G           54 /* Please refer to
-                                            *"phy_GetChnlGroup8812A" and
-                                            * "Hal_ReadTxPowerInfo8812A"
-                                            */
-#define CHANNEL_MAX_NUMBER_5G_80M       7
 #define MAX_PG_GROUP                    13
 #define CHANNEL_GROUP_MAX_2G            3
 #define CHANNEL_GROUP_IDX_5GL           3
@@ -1323,14 +1318,13 @@ struct rtl_tid_data {
 
 struct rtl_sta_info {
         struct list_head list;
-        u8 ratr_index;
-        u8 wireless_mode;
-        u8 mimo_ps;
-        u8 mac_addr[ETH_ALEN];
         struct rtl_tid_data tids[MAX_TID_COUNT];
-
         /* just used for ap adhoc or mesh*/
         struct rssi_sta rssi_stat;
+        u16 wireless_mode;
+        u8 ratr_index;
+        u8 mimo_ps;
+        u8 mac_addr[ETH_ALEN];
 } __packed;
 
 struct rtl_priv;
@@ -2194,7 +2188,7 @@ struct rtl_hal_ops {
         bool (*get_btc_status) (void);
         bool (*is_fw_header)(struct rtlwifi_firmware_header *hdr);
         u32 (*rx_command_packet)(struct ieee80211_hw *hw,
-                                 struct rtl_stats status, struct sk_buff *skb);
+                                 const struct rtl_stats *status, struct sk_buff *skb);
         void (*add_wowlan_pattern)(struct ieee80211_hw *hw,
                                    struct rtl_wow_pattern *rtl_pattern,
                                    u8 index);
@@ -2904,6 +2898,10 @@ value to host byte ordering.*/
 #define STBC_VHT_TEST_TX_ENABLE                 BIT(2)
 #define STBC_VHT_CAP_TX                         BIT(3)
 
+extern u8 channel5g[CHANNEL_MAX_NUMBER_5G];
+
+extern u8 channel5g_80m[CHANNEL_MAX_NUMBER_5G_80M];
+
 static inline u8 rtl_read_byte(struct rtl_priv *rtlpriv, u32 addr)
 {
         return rtlpriv->io.read8_sync(rtlpriv, addr);
diff --git a/drivers/net/wireless/st/cw1200/cw1200_spi.c b/drivers/net/wireless/st/cw1200/cw1200_spi.c
index a740083634d8..63f95e9c2992 100644
--- a/drivers/net/wireless/st/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/st/cw1200/cw1200_spi.c
@@ -446,8 +446,7 @@ static int cw1200_spi_disconnect(struct spi_device *func)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int cw1200_spi_suspend(struct device *dev)
+static int __maybe_unused cw1200_spi_suspend(struct device *dev)
 {
         struct hwbus_priv *self = spi_get_drvdata(to_spi_device(dev));
 
@@ -460,16 +459,12 @@ static int cw1200_spi_suspend(struct device *dev)
 
 static SIMPLE_DEV_PM_OPS(cw1200_pm_ops, cw1200_spi_suspend, NULL);
 
-#endif
-
 static struct spi_driver spi_driver = {
         .probe          = cw1200_spi_probe,
         .remove         = cw1200_spi_disconnect,
         .driver = {
                 .name           = "cw1200_wlan_spi",
-#ifdef CONFIG_PM
-                .pm             = &cw1200_pm_ops,
-#endif
+                .pm             = IS_ENABLED(CONFIG_PM) ? &cw1200_pm_ops : NULL,
         },
 };
 
diff --git a/drivers/net/wireless/st/cw1200/pm.h b/drivers/net/wireless/st/cw1200/pm.h
index 3ed90ff22bb8..534548470ebc 100644
--- a/drivers/net/wireless/st/cw1200/pm.h
+++ b/drivers/net/wireless/st/cw1200/pm.h
@@ -31,13 +31,18 @@ int cw1200_pm_init(struct cw1200_pm_state *pm,
 void cw1200_pm_deinit(struct cw1200_pm_state *pm);
 int cw1200_wow_suspend(struct ieee80211_hw *hw,
                        struct cfg80211_wowlan *wowlan);
-int cw1200_wow_resume(struct ieee80211_hw *hw);
 int cw1200_can_suspend(struct cw1200_common *priv);
+int cw1200_wow_resume(struct ieee80211_hw *hw);
 void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
                           unsigned long tmo);
 #else
 static inline void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
-                                        unsigned long tmo) {
+                                        unsigned long tmo)
+{
+}
+static inline int cw1200_can_suspend(struct cw1200_common *priv)
+{
+        return 0;
 }
 #endif
 #endif
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 700d0c6f7480..846513c73606 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -576,13 +576,11 @@ struct bcma_chipcommon_pmu {
         u32 crystalfreq;        /* The active crystal frequency (in kHz) */
 };
 
-#ifdef CONFIG_BCMA_DRIVER_MIPS
+#ifdef CONFIG_BCMA_PFLASH
 struct bcma_pflash {
         bool present;
-        u8 buswidth;
-        u32 window;
-        u32 window_size;
 };
+#endif
 
 #ifdef CONFIG_BCMA_SFLASH
 struct mtd_info;
@@ -606,6 +604,7 @@ struct bcma_nflash {
 };
 #endif
 
+#ifdef CONFIG_BCMA_DRIVER_MIPS
 struct bcma_serial_port {
         void *regs;
         unsigned long clockspeed;
@@ -625,8 +624,9 @@ struct bcma_drv_cc {
         /* Fast Powerup Delay constant */
         u16 fast_pwrup_delay;
         struct bcma_chipcommon_pmu pmu;
-#ifdef CONFIG_BCMA_DRIVER_MIPS
+#ifdef CONFIG_BCMA_PFLASH
         struct bcma_pflash pflash;
+#endif
 #ifdef CONFIG_BCMA_SFLASH
         struct bcma_sflash sflash;
 #endif
@@ -634,6 +634,7 @@ struct bcma_drv_cc {
         struct bcma_nflash nflash;
 #endif
 
+#ifdef CONFIG_BCMA_DRIVER_MIPS
         int nr_serial_ports;
         struct bcma_serial_port serial_ports[4];
 #endif /* CONFIG_BCMA_DRIVER_MIPS */
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
deleted file mode 100644
index e75dcbf2b230..000000000000
--- a/include/linux/platform_data/brcmfmac-sdio.h
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * Copyright (c) 2013 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _LINUX_BRCMFMAC_PLATFORM_H
-#define _LINUX_BRCMFMAC_PLATFORM_H
-
-/*
- * Platform specific driver functions and data. Through the platform specific
- * device data functions can be provided to help the brcmfmac driver to
- * operate with the device in combination with the used platform.
- *
- * Use the platform data in the following (similar) way:
- *
- *
-#include <brcmfmac_platform.h>
-
-
-static void brcmfmac_power_on(void)
-{
-}
-
-static void brcmfmac_power_off(void)
-{
-}
-
-static void brcmfmac_reset(void)
-{
-}
-
-static struct brcmfmac_sdio_platform_data brcmfmac_sdio_pdata = {
-        .power_on               = brcmfmac_power_on,
-        .power_off              = brcmfmac_power_off,
-        .reset                  = brcmfmac_reset
-};
-
-static struct platform_device brcmfmac_device = {
-        .name                   = BRCMFMAC_SDIO_PDATA_NAME,
-        .id                     = PLATFORM_DEVID_NONE,
-        .dev.platform_data      = &brcmfmac_sdio_pdata
-};
-
-void __init brcmfmac_init_pdata(void)
-{
-        brcmfmac_sdio_pdata.oob_irq_supported = true;
-        brcmfmac_sdio_pdata.oob_irq_nr = gpio_to_irq(GPIO_BRCMF_SDIO_OOB);
-        brcmfmac_sdio_pdata.oob_irq_flags = IORESOURCE_IRQ |
-                                            IORESOURCE_IRQ_HIGHLEVEL;
-        platform_device_register(&brcmfmac_device);
-}
- *
- *
- * Note: the brcmfmac can be loaded as module or be statically built-in into
- * the kernel. If built-in then do note that it uses module_init (and
- * module_exit) routines which equal device_initcall. So if you intend to
- * create a module with the platform specific data for the brcmfmac and have
- * it built-in to the kernel then use a higher initcall then device_initcall
- * (see init.h). If this is not done then brcmfmac will load without problems
- * but will not pickup the platform data.
- *
- * When the driver does not "detect" platform driver data then it will continue
- * without reporting anything and just assume there is no data needed. Which is
- * probably true for most platforms.
- *
- * Explanation of the platform_data fields:
- *
- * drive_strength: is the preferred drive_strength to be used for the SDIO
- * pins. If 0 then a default value will be used. This is the target drive
- * strength, the exact drive strength which will be used depends on the
- * capabilities of the device.
- *
- * oob_irq_supported: does the board have support for OOB interrupts. SDIO
- * in-band interrupts are relatively slow and for having less overhead on
- * interrupt processing an out of band interrupt can be used. If the HW
- * supports this then enable this by setting this field to true and configure
- * the oob related fields.
- *
- * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
- * used for registering the irq using request_irq function.
- *
- * broken_sg_support: flag for broken sg list support of SDIO host controller.
- * Set this to true if the SDIO host controller has higher align requirement
- * than 32 bytes for each scatterlist item.
- *
- * sd_head_align: alignment requirement for start of data buffer
- *
- * sd_sgentry_align: length alignment requirement for each sg entry
- *
- * power_on: This function is called by the brcmfmac when the module gets
- * loaded. This can be particularly useful for low power devices. The platform
- * spcific routine may for example decide to power up the complete device.
- * If there is no use-case for this function then provide NULL.
- *
- * power_off: This function is called by the brcmfmac when the module gets
- * unloaded. At this point the device can be powered down or otherwise be reset.
- * So if an actual power_off is not supported but reset is then reset the device
- * when this function gets called. This can be particularly useful for low power
- * devices. If there is no use-case for this function (either power-down or
- * reset) then provide NULL.
- *
- * reset: This function can get called if the device communication broke down.
- * This functionality is particularly useful in case of SDIO type devices. It is
- * possible to reset a dongle via sdio data interface, but it requires that
- * this is fully functional. This function is chip/module specific and this
- * function should return only after the complete reset has completed.
- */
-
-#define BRCMFMAC_SDIO_PDATA_NAME        "brcmfmac_sdio"
-
-struct brcmfmac_sdio_platform_data {
-        unsigned int drive_strength;
-        bool oob_irq_supported;
-        unsigned int oob_irq_nr;
-        unsigned long oob_irq_flags;
-        bool broken_sg_support;
-        unsigned short sd_head_align;
-        unsigned short sd_sgentry_align;
-        void (*power_on)(void);
-        void (*power_off)(void);
-        void (*reset)(void);
-};
-
-#endif /* _LINUX_BRCMFMAC_PLATFORM_H */
diff --git a/include/linux/platform_data/brcmfmac.h b/include/linux/platform_data/brcmfmac.h
new file mode 100644
index 000000000000..1d30bf278231
--- /dev/null
+++ b/include/linux/platform_data/brcmfmac.h
@@ -0,0 +1,185 @@
+/*
+ * Copyright (c) 201 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LINUX_BRCMFMAC_PLATFORM_H
+#define _LINUX_BRCMFMAC_PLATFORM_H
+
+
+#define BRCMFMAC_PDATA_NAME             "brcmfmac"
+
+#define BRCMFMAC_COUNTRY_BUF_SZ         4
+
+
+/*
+ * Platform specific driver functions and data. Through the platform specific
+ * device data functions and data can be provided to help the brcmfmac driver to
+ * operate with the device in combination with the used platform.
+ */
+
+
+/**
+ * Note: the brcmfmac can be loaded as module or be statically built-in into
+ * the kernel. If built-in then do note that it uses module_init (and
+ * module_exit) routines which equal device_initcall. So if you intend to
+ * create a module with the platform specific data for the brcmfmac and have
+ * it built-in to the kernel then use a higher initcall then device_initcall
+ * (see init.h). If this is not done then brcmfmac will load without problems
+ * but will not pickup the platform data.
+ *
+ * When the driver does not "detect" platform driver data then it will continue
+ * without reporting anything and just assume there is no data needed. Which is
+ * probably true for most platforms.
+ */
+
+/**
+ * enum brcmf_bus_type - Bus type identifier. Currently SDIO, USB and PCIE are
+ *                       supported.
+ */
+enum brcmf_bus_type {
+        BRCMF_BUSTYPE_SDIO,
+        BRCMF_BUSTYPE_USB,
+        BRCMF_BUSTYPE_PCIE
+};
+
+
+/**
+ * struct brcmfmac_sdio_pd - SDIO Device specific platform data.
+ *
+ * @txglomsz:           SDIO txglom size. Use 0 if default of driver is to be
+ *                      used.
+ * @drive_strength:     is the preferred drive_strength to be used for the SDIO
+ *                      pins. If 0 then a default value will be used. This is
+ *                      the target drive strength, the exact drive strength
+ *                      which will be used depends on the capabilities of the
+ *                      device.
+ * @oob_irq_supported:  does the board have support for OOB interrupts. SDIO
+ *                      in-band interrupts are relatively slow and for having
+ *                      less overhead on interrupt processing an out of band
+ *                      interrupt can be used. If the HW supports this then
+ *                      enable this by setting this field to true and configure
+ *                      the oob related fields.
+ * @oob_irq_nr,
+ * @oob_irq_flags:      the OOB interrupt information. The values are used for
+ *                      registering the irq using request_irq function.
+ * @broken_sg_support:  flag for broken sg list support of SDIO host controller.
+ *                      Set this to true if the SDIO host controller has higher
+ *                      align requirement than 32 bytes for each scatterlist
+ *                      item.
+ * @sd_head_align:      alignment requirement for start of data buffer.
+ * @sd_sgentry_align:   length alignment requirement for each sg entry.
+ * @reset:              This function can get called if the device communication
+ *                      broke down. This functionality is particularly useful in
+ *                      case of SDIO type devices. It is possible to reset a
+ *                      dongle via sdio data interface, but it requires that
+ *                      this is fully functional. This function is chip/module
+ *                      specific and this function should return only after the
+ *                      complete reset has completed.
+ */
+struct brcmfmac_sdio_pd {
+        int             txglomsz;
+        unsigned int    drive_strength;
+        bool            oob_irq_supported;
+        unsigned int    oob_irq_nr;
+        unsigned long   oob_irq_flags;
+        bool            broken_sg_support;
+        unsigned short  sd_head_align;
+        unsigned short  sd_sgentry_align;
+        void            (*reset)(void);
+};
+
+/**
+ * struct brcmfmac_pd_cc_entry - Struct for translating user space country code
+ *                               (iso3166) to firmware country code and
+ *                               revision.
+ *
+ * @iso3166:    iso3166 alpha 2 country code string.
+ * @cc:         firmware country code string.
+ * @rev:        firmware country code revision.
+ */
+struct brcmfmac_pd_cc_entry {
+        char    iso3166[BRCMFMAC_COUNTRY_BUF_SZ];
+        char    cc[BRCMFMAC_COUNTRY_BUF_SZ];
+        s32     rev;
+};
+
+/**
+ * struct brcmfmac_pd_cc - Struct for translating country codes as set by user
+ *                         space to a country code and rev which can be used by
+ *                         firmware.
+ *
+ * @table_size: number of entries in table (> 0)
+ * @table:      array of 1 or more elements with translation information.
+ */
+struct brcmfmac_pd_cc {
+        int                             table_size;
+        struct brcmfmac_pd_cc_entry     table[0];
+};
+
+/**
+ * struct brcmfmac_pd_device - Device specific platform data. (id/rev/bus_type)
+ *                             is the unique identifier of the device.
+ *
+ * @id:                 ID of the device for which this data is. In case of SDIO
+ *                      or PCIE this is the chipid as identified by chip.c In
+ *                      case of USB this is the chipid as identified by the
+ *                      device query.
+ * @rev:                chip revision, see id.
+ * @bus_type:           The type of bus. Some chipid/rev exist for different bus
+ *                      types. Each bus type has its own set of settings.
+ * @feature_disable:    Bitmask of features to disable (override), See feature.c
+ *                      in brcmfmac for details.
+ * @country_codes:      If available, pointer to struct for translating country
+ *                      codes.
+ * @bus:                Bus specific (union) device settings. Currently only
+ *                      SDIO.
+ */
+struct brcmfmac_pd_device {
+        unsigned int            id;
+        unsigned int            rev;
+        enum brcmf_bus_type     bus_type;
+        unsigned int            feature_disable;
+        struct brcmfmac_pd_cc   *country_codes;
+        union {
+                struct brcmfmac_sdio_pd sdio;
+        } bus;
+};
+
+/**
+ * struct brcmfmac_platform_data - BRCMFMAC specific platform data.
+ *
+ * @power_on:   This function is called by the brcmfmac driver when the module
+ *              gets loaded. This can be particularly useful for low power
+ *              devices. The platform spcific routine may for example decide to
+ *              power up the complete device. If there is no use-case for this
+ *              function then provide NULL.
+ * @power_off:  This function is called by the brcmfmac when the module gets
+ *              unloaded. At this point the devices can be powered down or
+ *              otherwise be reset. So if an actual power_off is not supported
+ *              but reset is supported by the devices then reset the devices
+ *              when this function gets called. This can be particularly useful
+ *              for low power devices. If there is no use-case for this
+ *              function then provide NULL.
+ */
+struct brcmfmac_platform_data {
+        void    (*power_on)(void);
+        void    (*power_off)(void);
+        char    *fw_alternative_path;
+        int     device_count;
+        struct brcmfmac_pd_device devices[0];
+};
+
+
+#endif /* _LINUX_BRCMFMAC_PLATFORM_H */