Merge tag 'wireless-drivers-next-for-davem-2016-11-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers-next patches for 4.10

Major changes:

iwlwifi

* finalize and enable dynamic queue allocation
* use dev_coredumpmsg() to prevent locking the driver
* small fix to pass the AID to the FW
* use FW PS decisions with multi-queue

ath9k

* add device tree bindings
* switch to use mac80211 intermediate software queues to reduce
  latency and fix bufferbloat

wl18xx

* allow scanning in AP mode
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

27 files changed, 716 insertions, 291 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index da7a7c8dafb2..f3f2784f6ebd 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -327,4 +327,10 @@ static inline const char *ath_opmode_to_string(enum nl80211_iftype opmode)
 }
 #endif
 
+extern const char *ath_bus_type_strings[];
+static inline const char *ath_bus_type_to_string(enum ath_bus_type bustype)
+{
+        return ath_bus_type_strings[bustype];
+}
+
 #endif /* ATH_H */
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 21ae8d663e67..7005e2a98726 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -198,6 +198,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .name = "qca9984/qca9994 hw1.0",
                 .patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
                 .uart_pin = 7,
+                .cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
                 .otp_exe_param = 0x00000700,
                 .continuous_frag_desc = true,
                 .cck_rate_map_rev2 = true,
@@ -223,6 +224,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .name = "qca9888 hw2.0",
                 .patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
                 .uart_pin = 7,
+                .cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
                 .otp_exe_param = 0x00000700,
                 .continuous_frag_desc = true,
                 .channel_counters_freq_hz = 150000,
@@ -1560,6 +1562,15 @@ static void ath10k_core_restart(struct work_struct *work)
         mutex_unlock(&ar->conf_mutex);
 }
 
+static void ath10k_core_set_coverage_class_work(struct work_struct *work)
+{
+        struct ath10k *ar = container_of(work, struct ath10k,
+                                         set_coverage_class_work);
+
+        if (ar->hw_params.hw_ops->set_coverage_class)
+                ar->hw_params.hw_ops->set_coverage_class(ar, -1);
+}
+
 static int ath10k_core_init_firmware_features(struct ath10k *ar)
 {
         struct ath10k_fw_file *fw_file = &ar->normal_mode_fw.fw_file;
@@ -2342,6 +2353,8 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         INIT_WORK(&ar->register_work, ath10k_core_register_work);
         INIT_WORK(&ar->restart_work, ath10k_core_restart);
+        INIT_WORK(&ar->set_coverage_class_work,
+                  ath10k_core_set_coverage_class_work);
 
         init_dummy_netdev(&ar->napi_dev);
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 521f1c55c19e..e8decfaba5b6 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -557,10 +557,8 @@ enum ath10k_fw_features {
          */
         ATH10K_FW_FEATURE_BTCOEX_PARAM = 14,
 
-        /* Older firmware with HTT delivers incorrect tx status for null func
-         * frames to driver, but this fixed in 10.2 and 10.4 firmware versions.
-         * Also this workaround results in reporting of incorrect null func
-         * status for 10.4. This flag is used to skip the workaround.
+        /* Unused flag and proven to be not working, enable this if you want
+         * to experiment sending NULL func data frames in HTT TX
          */
         ATH10K_FW_FEATURE_SKIP_NULL_FUNC_WAR = 15,
 
@@ -714,6 +712,7 @@ struct ath10k {
         u32 phy_capability;
         u32 hw_min_tx_power;
         u32 hw_max_tx_power;
+        u32 hw_eeprom_rd;
         u32 ht_cap_info;
         u32 vht_cap_info;
         u32 num_rf_chains;
@@ -912,6 +911,19 @@ struct ath10k {
         struct net_device napi_dev;
         struct napi_struct napi;
 
+        struct work_struct set_coverage_class_work;
+        /* protected by conf_mutex */
+        struct {
+                /* writing also protected by data_lock */
+                s16 coverage_class;
+
+                u32 reg_phyclk;
+                u32 reg_slottime_conf;
+                u32 reg_slottime_orig;
+                u32 reg_ack_cts_timeout_conf;
+                u32 reg_ack_cts_timeout_orig;
+        } fw_coverage;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index c458fa96a6d4..335512b11ca2 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -94,7 +94,19 @@ int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
 void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct ethtool_stats *stats, u64 *data);
+
+static inline u64 ath10k_debug_get_fw_dbglog_mask(struct ath10k *ar)
+{
+        return ar->debug.fw_dbglog_mask;
+}
+
+static inline u32 ath10k_debug_get_fw_dbglog_level(struct ath10k *ar)
+{
+        return ar->debug.fw_dbglog_level;
+}
+
 #else
+
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
         return 0;
@@ -144,6 +156,16 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
         return NULL;
 }
 
+static inline u64 ath10k_debug_get_fw_dbglog_mask(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline u32 ath10k_debug_get_fw_dbglog_level(struct ath10k *ar)
+{
+        return 0;
+}
+
 #define ATH10K_DFS_STAT_INC(ar, c) do { } while (0)
 
 #define ath10k_debug_get_et_strings NULL
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 0b4c1562420f..285b235268d7 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1463,8 +1463,7 @@ static int ath10k_unchain_msdu(struct sk_buff_head *amsdu)
 }
 
 static void ath10k_htt_rx_h_unchain(struct ath10k *ar,
-                                    struct sk_buff_head *amsdu,
-                                    bool chained)
+                                    struct sk_buff_head *amsdu)
 {
         struct sk_buff *first;
         struct htt_rx_desc *rxd;
@@ -1475,9 +1474,6 @@ static void ath10k_htt_rx_h_unchain(struct ath10k *ar,
         decap = MS(__le32_to_cpu(rxd->msdu_start.common.info1),
                    RX_MSDU_START_INFO1_DECAP_FORMAT);
 
-        if (!chained)
-                return;
-
         /* FIXME: Current unchaining logic can only handle simple case of raw
          * msdu chaining. If decapping is other than raw the chaining may be
          * more complex and this isn't handled by the current code. Don't even
@@ -1555,7 +1551,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 
         num_msdus = skb_queue_len(&amsdu);
         ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
-        ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
+
+        /* only for ret = 1 indicates chained msdus */
+        if (ret > 0)
+                ath10k_htt_rx_h_unchain(ar, &amsdu);
+
         ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
         ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
         ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index ae5b33fe5ba8..ccbc8c03abc1 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -229,6 +229,32 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
         idr_remove(&htt->pending_tx, msdu_id);
 }
 
+static void ath10k_htt_tx_free_cont_txbuf(struct ath10k_htt *htt)
+{
+        struct ath10k *ar = htt->ar;
+        size_t size;
+
+        if (!htt->txbuf.vaddr)
+                return;
+
+        size = htt->max_num_pending_tx * sizeof(struct ath10k_htt_txbuf);
+        dma_free_coherent(ar->dev, size, htt->txbuf.vaddr, htt->txbuf.paddr);
+}
+
+static int ath10k_htt_tx_alloc_cont_txbuf(struct ath10k_htt *htt)
+{
+        struct ath10k *ar = htt->ar;
+        size_t size;
+
+        size = htt->max_num_pending_tx * sizeof(struct ath10k_htt_txbuf);
+        htt->txbuf.vaddr = dma_alloc_coherent(ar->dev, size, &htt->txbuf.paddr,
+                                              GFP_KERNEL);
+        if (!htt->txbuf.vaddr)
+                return -ENOMEM;
+
+        return 0;
+}
+
 static void ath10k_htt_tx_free_cont_frag_desc(struct ath10k_htt *htt)
 {
         size_t size;
@@ -256,10 +282,8 @@ static int ath10k_htt_tx_alloc_cont_frag_desc(struct ath10k_htt *htt)
         htt->frag_desc.vaddr = dma_alloc_coherent(ar->dev, size,
                                                   &htt->frag_desc.paddr,
                                                   GFP_KERNEL);
-        if (!htt->frag_desc.vaddr) {
-                ath10k_err(ar, "failed to alloc fragment desc memory\n");
+        if (!htt->frag_desc.vaddr)
                 return -ENOMEM;
-        }
 
         return 0;
 }
@@ -310,10 +334,26 @@ static int ath10k_htt_tx_alloc_txq(struct ath10k_htt *htt)
         return 0;
 }
 
+static void ath10k_htt_tx_free_txdone_fifo(struct ath10k_htt *htt)
+{
+        WARN_ON(!kfifo_is_empty(&htt->txdone_fifo));
+        kfifo_free(&htt->txdone_fifo);
+}
+
+static int ath10k_htt_tx_alloc_txdone_fifo(struct ath10k_htt *htt)
+{
+        int ret;
+        size_t size;
+
+        size = roundup_pow_of_two(htt->max_num_pending_tx);
+        ret = kfifo_alloc(&htt->txdone_fifo, size, GFP_KERNEL);
+        return ret;
+}
+
 int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
-        int ret, size;
+        int ret;
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
@@ -321,13 +361,9 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
         spin_lock_init(&htt->tx_lock);
         idr_init(&htt->pending_tx);
 
-        size = htt->max_num_pending_tx * sizeof(struct ath10k_htt_txbuf);
-        htt->txbuf.vaddr = dma_alloc_coherent(ar->dev, size,
-                                                  &htt->txbuf.paddr,
-                                                  GFP_KERNEL);
-        if (!htt->txbuf.vaddr) {
-                ath10k_err(ar, "failed to alloc tx buffer\n");
-                ret = -ENOMEM;
+        ret = ath10k_htt_tx_alloc_cont_txbuf(htt);
+        if (ret) {
+                ath10k_err(ar, "failed to alloc cont tx buffer: %d\n", ret);
                 goto free_idr_pending_tx;
         }
 
@@ -343,8 +379,7 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
                 goto free_frag_desc;
         }
 
-        size = roundup_pow_of_two(htt->max_num_pending_tx);
-        ret = kfifo_alloc(&htt->txdone_fifo, size, GFP_KERNEL);
+        ret = ath10k_htt_tx_alloc_txdone_fifo(htt);
         if (ret) {
                 ath10k_err(ar, "failed to alloc txdone fifo: %d\n", ret);
                 goto free_txq;
@@ -359,10 +394,7 @@ free_frag_desc:
         ath10k_htt_tx_free_cont_frag_desc(htt);
 
 free_txbuf:
-        size = htt->max_num_pending_tx *
-                          sizeof(struct ath10k_htt_txbuf);
-        dma_free_coherent(htt->ar->dev, size, htt->txbuf.vaddr,
-                          htt->txbuf.paddr);
+        ath10k_htt_tx_free_cont_txbuf(htt);
 
 free_idr_pending_tx:
         idr_destroy(&htt->pending_tx);
@@ -388,22 +420,13 @@ static int ath10k_htt_tx_clean_up_pending(int msdu_id, void *skb, void *ctx)
 
 void ath10k_htt_tx_free(struct ath10k_htt *htt)
 {
-        int size;
-
         idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar);
         idr_destroy(&htt->pending_tx);
 
-        if (htt->txbuf.vaddr) {
-                size = htt->max_num_pending_tx *
-                                  sizeof(struct ath10k_htt_txbuf);
-                dma_free_coherent(htt->ar->dev, size, htt->txbuf.vaddr,
-                                  htt->txbuf.paddr);
-        }
-
+        ath10k_htt_tx_free_cont_txbuf(htt);
         ath10k_htt_tx_free_txq(htt);
         ath10k_htt_tx_free_cont_frag_desc(htt);
-        WARN_ON(!kfifo_is_empty(&htt->txdone_fifo));
-        kfifo_free(&htt->txdone_fifo);
+        ath10k_htt_tx_free_txdone_fifo(htt);
 }
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 675e75d66db2..33fb26833cd0 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -17,11 +17,14 @@
 #include <linux/types.h>
 #include "core.h"
 #include "hw.h"
+#include "hif.h"
+#include "wmi-ops.h"
 
 const struct ath10k_hw_regs qca988x_regs = {
         .rtc_soc_base_address           = 0x00004000,
         .rtc_wmac_base_address          = 0x00005000,
         .soc_core_base_address          = 0x00009000,
+        .wlan_mac_base_address          = 0x00020000,
         .ce_wrapper_base_address        = 0x00057000,
         .ce0_base_address               = 0x00057400,
         .ce1_base_address               = 0x00057800,
@@ -48,6 +51,7 @@ const struct ath10k_hw_regs qca6174_regs = {
         .rtc_soc_base_address                   = 0x00000800,
         .rtc_wmac_base_address                  = 0x00001000,
         .soc_core_base_address                  = 0x0003a000,
+        .wlan_mac_base_address                  = 0x00020000,
         .ce_wrapper_base_address                = 0x00034000,
         .ce0_base_address                       = 0x00034400,
         .ce1_base_address                       = 0x00034800,
@@ -74,6 +78,7 @@ const struct ath10k_hw_regs qca99x0_regs = {
         .rtc_soc_base_address                   = 0x00080000,
         .rtc_wmac_base_address                  = 0x00000000,
         .soc_core_base_address                  = 0x00082000,
+        .wlan_mac_base_address                  = 0x00030000,
         .ce_wrapper_base_address                = 0x0004d000,
         .ce0_base_address                       = 0x0004a000,
         .ce1_base_address                       = 0x0004a400,
@@ -109,6 +114,7 @@ const struct ath10k_hw_regs qca99x0_regs = {
 const struct ath10k_hw_regs qca4019_regs = {
         .rtc_soc_base_address                   = 0x00080000,
         .soc_core_base_address                  = 0x00082000,
+        .wlan_mac_base_address                  = 0x00030000,
         .ce_wrapper_base_address                = 0x0004d000,
         .ce0_base_address                       = 0x0004a000,
         .ce1_base_address                       = 0x0004a400,
@@ -220,7 +226,143 @@ void ath10k_hw_fill_survey_time(struct ath10k *ar, struct survey_info *survey,
         survey->time_busy = CCNT_TO_MSEC(ar, rcc);
 }
 
+/* The firmware does not support setting the coverage class. Instead this
+ * function monitors and modifies the corresponding MAC registers.
+ */
+static void ath10k_hw_qca988x_set_coverage_class(struct ath10k *ar,
+                                                 s16 value)
+{
+        u32 slottime_reg;
+        u32 slottime;
+        u32 timeout_reg;
+        u32 ack_timeout;
+        u32 cts_timeout;
+        u32 phyclk_reg;
+        u32 phyclk;
+        u64 fw_dbglog_mask;
+        u32 fw_dbglog_level;
+
+        mutex_lock(&ar->conf_mutex);
+
+        /* Only modify registers if the core is started. */
+        if ((ar->state != ATH10K_STATE_ON) &&
+            (ar->state != ATH10K_STATE_RESTARTED))
+                goto unlock;
+
+        /* Retrieve the current values of the two registers that need to be
+         * adjusted.
+         */
+        slottime_reg = ath10k_hif_read32(ar, WLAN_MAC_BASE_ADDRESS +
+                                             WAVE1_PCU_GBL_IFS_SLOT);
+        timeout_reg = ath10k_hif_read32(ar, WLAN_MAC_BASE_ADDRESS +
+                                            WAVE1_PCU_ACK_CTS_TIMEOUT);
+        phyclk_reg = ath10k_hif_read32(ar, WLAN_MAC_BASE_ADDRESS +
+                                           WAVE1_PHYCLK);
+        phyclk = MS(phyclk_reg, WAVE1_PHYCLK_USEC) + 1;
+
+        if (value < 0)
+                value = ar->fw_coverage.coverage_class;
+
+        /* Break out if the coverage class and registers have the expected
+         * value.
+         */
+        if (value == ar->fw_coverage.coverage_class &&
+            slottime_reg == ar->fw_coverage.reg_slottime_conf &&
+            timeout_reg == ar->fw_coverage.reg_ack_cts_timeout_conf &&
+            phyclk_reg == ar->fw_coverage.reg_phyclk)
+                goto unlock;
+
+        /* Store new initial register values from the firmware. */
+        if (slottime_reg != ar->fw_coverage.reg_slottime_conf)
+                ar->fw_coverage.reg_slottime_orig = slottime_reg;
+        if (timeout_reg != ar->fw_coverage.reg_ack_cts_timeout_conf)
+                ar->fw_coverage.reg_ack_cts_timeout_orig = timeout_reg;
+        ar->fw_coverage.reg_phyclk = phyclk_reg;
+
+        /* Calculat new value based on the (original) firmware calculation. */
+        slottime_reg = ar->fw_coverage.reg_slottime_orig;
+        timeout_reg = ar->fw_coverage.reg_ack_cts_timeout_orig;
+
+        /* Do some sanity checks on the slottime register. */
+        if (slottime_reg % phyclk) {
+                ath10k_warn(ar,
+                            "failed to set coverage class: expected integer microsecond value in register\n");
+
+                goto store_regs;
+        }
+
+        slottime = MS(slottime_reg, WAVE1_PCU_GBL_IFS_SLOT);
+        slottime = slottime / phyclk;
+        if (slottime != 9 && slottime != 20) {
+                ath10k_warn(ar,
+                            "failed to set coverage class: expected slot time of 9 or 20us in HW register. It is %uus.\n",
+                            slottime);
+
+                goto store_regs;
+        }
+
+        /* Recalculate the register values by adding the additional propagation
+         * delay (3us per coverage class).
+         */
+
+        slottime = MS(slottime_reg, WAVE1_PCU_GBL_IFS_SLOT);
+        slottime += value * 3 * phyclk;
+        slottime = min_t(u32, slottime, WAVE1_PCU_GBL_IFS_SLOT_MAX);
+        slottime = SM(slottime, WAVE1_PCU_GBL_IFS_SLOT);
+        slottime_reg = (slottime_reg & ~WAVE1_PCU_GBL_IFS_SLOT_MASK) | slottime;
+
+        /* Update ack timeout (lower halfword). */
+        ack_timeout = MS(timeout_reg, WAVE1_PCU_ACK_CTS_TIMEOUT_ACK);
+        ack_timeout += 3 * value * phyclk;
+        ack_timeout = min_t(u32, ack_timeout, WAVE1_PCU_ACK_CTS_TIMEOUT_MAX);
+        ack_timeout = SM(ack_timeout, WAVE1_PCU_ACK_CTS_TIMEOUT_ACK);
+
+        /* Update cts timeout (upper halfword). */
+        cts_timeout = MS(timeout_reg, WAVE1_PCU_ACK_CTS_TIMEOUT_CTS);
+        cts_timeout += 3 * value * phyclk;
+        cts_timeout = min_t(u32, cts_timeout, WAVE1_PCU_ACK_CTS_TIMEOUT_MAX);
+        cts_timeout = SM(cts_timeout, WAVE1_PCU_ACK_CTS_TIMEOUT_CTS);
+
+        timeout_reg = ack_timeout | cts_timeout;
+
+        ath10k_hif_write32(ar,
+                           WLAN_MAC_BASE_ADDRESS + WAVE1_PCU_GBL_IFS_SLOT,
+                           slottime_reg);
+        ath10k_hif_write32(ar,
+                           WLAN_MAC_BASE_ADDRESS + WAVE1_PCU_ACK_CTS_TIMEOUT,
+                           timeout_reg);
+
+        /* Ensure we have a debug level of WARN set for the case that the
+         * coverage class is larger than 0. This is important as we need to
+         * set the registers again if the firmware does an internal reset and
+         * this way we will be notified of the event.
+         */
+        fw_dbglog_mask = ath10k_debug_get_fw_dbglog_mask(ar);
+        fw_dbglog_level = ath10k_debug_get_fw_dbglog_level(ar);
+
+        if (value > 0) {
+                if (fw_dbglog_level > ATH10K_DBGLOG_LEVEL_WARN)
+                        fw_dbglog_level = ATH10K_DBGLOG_LEVEL_WARN;
+                fw_dbglog_mask = ~0;
+        }
+
+        ath10k_wmi_dbglog_cfg(ar, fw_dbglog_mask, fw_dbglog_level);
+
+store_regs:
+        /* After an error we will not retry setting the coverage class. */
+        spin_lock_bh(&ar->data_lock);
+        ar->fw_coverage.coverage_class = value;
+        spin_unlock_bh(&ar->data_lock);
+
+        ar->fw_coverage.reg_slottime_conf = slottime_reg;
+        ar->fw_coverage.reg_ack_cts_timeout_conf = timeout_reg;
+
+unlock:
+        mutex_unlock(&ar->conf_mutex);
+}
+
 const struct ath10k_hw_ops qca988x_ops = {
+        .set_coverage_class = ath10k_hw_qca988x_set_coverage_class,
 };
 
 static int ath10k_qca99x0_rx_desc_get_l3_pad_bytes(struct htt_rx_desc *rxd)
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 6038b7486f1d..883547f3347c 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -230,6 +230,7 @@ struct ath10k_hw_regs {
         u32 rtc_soc_base_address;
         u32 rtc_wmac_base_address;
         u32 soc_core_base_address;
+        u32 wlan_mac_base_address;
         u32 ce_wrapper_base_address;
         u32 ce0_base_address;
         u32 ce1_base_address;
@@ -418,6 +419,7 @@ struct htt_rx_desc;
 /* Defines needed for Rx descriptor abstraction */
 struct ath10k_hw_ops {
         int (*rx_desc_get_l3_pad_bytes)(struct htt_rx_desc *rxd);
+        void (*set_coverage_class)(struct ath10k *ar, s16 value);
 };
 
 extern const struct ath10k_hw_ops qca988x_ops;
@@ -614,7 +616,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
 #define WLAN_SI_BASE_ADDRESS                    0x00010000
 #define WLAN_GPIO_BASE_ADDRESS                  0x00014000
 #define WLAN_ANALOG_INTF_BASE_ADDRESS           0x0001c000
-#define WLAN_MAC_BASE_ADDRESS                   0x00020000
+#define WLAN_MAC_BASE_ADDRESS                   ar->regs->wlan_mac_base_address
 #define EFUSE_BASE_ADDRESS                      0x00030000
 #define FPGA_REG_BASE_ADDRESS                   0x00039000
 #define WLAN_UART2_BASE_ADDRESS                 0x00054c00
@@ -814,4 +816,28 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
 
 #define RTC_STATE_V_GET(x) (((x) & RTC_STATE_V_MASK) >> RTC_STATE_V_LSB)
 
+/* Register definitions for first generation ath10k cards. These cards include
+ * a mac thich has a register allocation similar to ath9k and at least some
+ * registers including the ones relevant for modifying the coverage class are
+ * identical to the ath9k definitions.
+ * These registers are usually managed by the ath10k firmware. However by
+ * overriding them it is possible to support coverage class modifications.
+ */
+#define WAVE1_PCU_ACK_CTS_TIMEOUT               0x8014
+#define WAVE1_PCU_ACK_CTS_TIMEOUT_MAX           0x00003FFF
+#define WAVE1_PCU_ACK_CTS_TIMEOUT_ACK_MASK      0x00003FFF
+#define WAVE1_PCU_ACK_CTS_TIMEOUT_ACK_LSB       0
+#define WAVE1_PCU_ACK_CTS_TIMEOUT_CTS_MASK      0x3FFF0000
+#define WAVE1_PCU_ACK_CTS_TIMEOUT_CTS_LSB       16
+
+#define WAVE1_PCU_GBL_IFS_SLOT                  0x1070
+#define WAVE1_PCU_GBL_IFS_SLOT_MASK             0x0000FFFF
+#define WAVE1_PCU_GBL_IFS_SLOT_MAX              0x0000FFFF
+#define WAVE1_PCU_GBL_IFS_SLOT_LSB              0
+#define WAVE1_PCU_GBL_IFS_SLOT_RESV0            0xFFFF0000
+
+#define WAVE1_PHYCLK                            0x801C
+#define WAVE1_PHYCLK_USEC_MASK                  0x0000007F
+#define WAVE1_PHYCLK_USEC_LSB                   0
+
 #endif /* _HW_H_ */
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e322b6df0ebc..717b2fad9a8a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -19,6 +19,7 @@
 
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
+#include <linux/acpi.h>
 
 #include "hif.h"
 #include "core.h"
@@ -3179,7 +3180,8 @@ static void ath10k_mac_vif_handle_tx_pause(struct ath10k_vif *arvif,
                 ath10k_mac_vif_tx_unlock(arvif, pause_id);
                 break;
         default:
-                ath10k_warn(ar, "received unknown tx pause action %d on vdev %i, ignoring\n",
+                ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                           "received unknown tx pause action %d on vdev %i, ignoring\n",
                             action, arvif->vdev_id);
                 break;
         }
@@ -3255,8 +3257,6 @@ ath10k_mac_tx_h_get_txmode(struct ath10k *ar,
         if (ar->htt.target_version_major < 3 &&
             (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
             !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
-                      ar->running_fw->fw_file.fw_features) &&
-            !test_bit(ATH10K_FW_FEATURE_SKIP_NULL_FUNC_WAR,
                       ar->running_fw->fw_file.fw_features))
                 return ATH10K_HW_TXRX_MGMT;
 
@@ -4929,7 +4929,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         }
 
         ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
+        spin_lock_bh(&ar->data_lock);
         list_add(&arvif->list, &ar->arvifs);
+        spin_unlock_bh(&ar->data_lock);
 
         /* It makes no sense to have firmware do keepalives. mac80211 already
          * takes care of this with idle connection polling.
@@ -5080,7 +5082,9 @@ err_peer_delete:
 err_vdev_delete:
         ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
         ar->free_vdev_map |= 1LL << arvif->vdev_id;
+        spin_lock_bh(&ar->data_lock);
         list_del(&arvif->list);
+        spin_unlock_bh(&ar->data_lock);
 
 err:
         if (arvif->beacon_buf) {
@@ -5126,7 +5130,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                             arvif->vdev_id, ret);
 
         ar->free_vdev_map |= 1LL << arvif->vdev_id;
+        spin_lock_bh(&ar->data_lock);
         list_del(&arvif->list);
+        spin_unlock_bh(&ar->data_lock);
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
             arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
@@ -5410,6 +5416,20 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
         mutex_unlock(&ar->conf_mutex);
 }
 
+static void ath10k_mac_op_set_coverage_class(struct ieee80211_hw *hw, s16 value)
+{
+        struct ath10k *ar = hw->priv;
+
+        /* This function should never be called if setting the coverage class
+         * is not supported on this hardware.
+         */
+        if (!ar->hw_params.hw_ops->set_coverage_class) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+        ar->hw_params.hw_ops->set_coverage_class(ar, value);
+}
+
 static int ath10k_hw_scan(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
                           struct ieee80211_scan_request *hw_req)
@@ -7435,6 +7455,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .remove_interface               = ath10k_remove_interface,
         .configure_filter               = ath10k_configure_filter,
         .bss_info_changed               = ath10k_bss_info_changed,
+        .set_coverage_class             = ath10k_mac_op_set_coverage_class,
         .hw_scan                        = ath10k_hw_scan,
         .cancel_hw_scan                 = ath10k_cancel_hw_scan,
         .set_key                        = ath10k_set_key,
@@ -7789,6 +7810,109 @@ struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
         return arvif_iter.arvif;
 }
 
+#define WRD_METHOD "WRDD"
+#define WRDD_WIFI  (0x07)
+
+static u32 ath10k_mac_wrdd_get_mcc(struct ath10k *ar, union acpi_object *wrdd)
+{
+        union acpi_object *mcc_pkg;
+        union acpi_object *domain_type;
+        union acpi_object *mcc_value;
+        u32 i;
+
+        if (wrdd->type != ACPI_TYPE_PACKAGE ||
+            wrdd->package.count < 2 ||
+            wrdd->package.elements[0].type != ACPI_TYPE_INTEGER ||
+            wrdd->package.elements[0].integer.value != 0) {
+                ath10k_warn(ar, "ignoring malformed/unsupported wrdd structure\n");
+                return 0;
+        }
+
+        for (i = 1; i < wrdd->package.count; ++i) {
+                mcc_pkg = &wrdd->package.elements[i];
+
+                if (mcc_pkg->type != ACPI_TYPE_PACKAGE)
+                        continue;
+                if (mcc_pkg->package.count < 2)
+                        continue;
+                if (mcc_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
+                    mcc_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
+                        continue;
+
+                domain_type = &mcc_pkg->package.elements[0];
+                if (domain_type->integer.value != WRDD_WIFI)
+                        continue;
+
+                mcc_value = &mcc_pkg->package.elements[1];
+                return mcc_value->integer.value;
+        }
+        return 0;
+}
+
+static int ath10k_mac_get_wrdd_regulatory(struct ath10k *ar, u16 *rd)
+{
+        struct pci_dev __maybe_unused *pdev = to_pci_dev(ar->dev);
+        acpi_handle root_handle;
+        acpi_handle handle;
+        struct acpi_buffer wrdd = {ACPI_ALLOCATE_BUFFER, NULL};
+        acpi_status status;
+        u32 alpha2_code;
+        char alpha2[3];
+
+        root_handle = ACPI_HANDLE(&pdev->dev);
+        if (!root_handle)
+                return -EOPNOTSUPP;
+
+        status = acpi_get_handle(root_handle, (acpi_string)WRD_METHOD, &handle);
+        if (ACPI_FAILURE(status)) {
+                ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                           "failed to get wrd method %d\n", status);
+                return -EIO;
+        }
+
+        status = acpi_evaluate_object(handle, NULL, NULL, &wrdd);
+        if (ACPI_FAILURE(status)) {
+                ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                           "failed to call wrdc %d\n", status);
+                return -EIO;
+        }
+
+        alpha2_code = ath10k_mac_wrdd_get_mcc(ar, wrdd.pointer);
+        kfree(wrdd.pointer);
+        if (!alpha2_code)
+                return -EIO;
+
+        alpha2[0] = (alpha2_code >> 8) & 0xff;
+        alpha2[1] = (alpha2_code >> 0) & 0xff;
+        alpha2[2] = '\0';
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "regulatory hint from WRDD (alpha2-code): %s\n", alpha2);
+
+        *rd = ath_regd_find_country_by_name(alpha2);
+        if (*rd == 0xffff)
+                return -EIO;
+
+        *rd |= COUNTRY_ERD_FLAG;
+        return 0;
+}
+
+static int ath10k_mac_init_rd(struct ath10k *ar)
+{
+        int ret;
+        u16 rd;
+
+        ret = ath10k_mac_get_wrdd_regulatory(ar, &rd);
+        if (ret) {
+                ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                           "fallback to eeprom programmed regulatory settings\n");
+                rd = ar->hw_eeprom_rd;
+        }
+
+        ar->ath_common.regulatory.current_rd = rd;
+        return 0;
+}
+
 int ath10k_mac_register(struct ath10k *ar)
 {
         static const u32 cipher_suites[] = {
@@ -8013,6 +8137,16 @@ int ath10k_mac_register(struct ath10k *ar)
                       ar->running_fw->fw_file.fw_features))
                 ar->ops->wake_tx_queue = NULL;
 
+        ret = ath10k_mac_init_rd(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to derive regdom: %d\n", ret);
+                goto err_dfs_detector_exit;
+        }
+
+        /* Disable set_coverage_class for chipsets that do not support it. */
+        if (!ar->hw_params.hw_ops->set_coverage_class)
+                ar->ops->set_coverage_class = NULL;
+
         ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                             ath10k_reg_notifier);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 7d9b0da1b010..2ffc1fe4923b 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -338,7 +338,7 @@ static ssize_t write_file_spec_scan_ctl(struct file *file,
                 } else {
                         res = -EINVAL;
                 }
-        } else if (strncmp("background", buf, 9) == 0) {
+        } else if (strncmp("background", buf, 10) == 0) {
                 res = ath10k_spectral_scan_config(ar, SPECTRAL_BACKGROUND);
         } else if (strncmp("manual", buf, 6) == 0) {
                 res = ath10k_spectral_scan_config(ar, SPECTRAL_MANUAL);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 54df425bb0fc..387c4eede388 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -4676,7 +4676,7 @@ static void ath10k_wmi_event_service_ready_work(struct work_struct *work)
         ar->fw_version_build = (__le32_to_cpu(arg.sw_ver1) & 0x0000ffff);
         ar->phy_capability = __le32_to_cpu(arg.phy_capab);
         ar->num_rf_chains = __le32_to_cpu(arg.num_rf_chains);
-        ar->ath_common.regulatory.current_rd = __le32_to_cpu(arg.eeprom_rd);
+        ar->hw_eeprom_rd = __le32_to_cpu(arg.eeprom_rd);
 
         ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
                         arg.service_map, arg.service_map_len);
@@ -4931,6 +4931,23 @@ exit:
         return 0;
 }
 
+static inline void ath10k_wmi_queue_set_coverage_class_work(struct ath10k *ar)
+{
+        if (ar->hw_params.hw_ops->set_coverage_class) {
+                spin_lock_bh(&ar->data_lock);
+
+                /* This call only ensures that the modified coverage class
+                 * persists in case the firmware sets the registers back to
+                 * their default value. So calling it is only necessary if the
+                 * coverage class has a non-zero value.
+                 */
+                if (ar->fw_coverage.coverage_class)
+                        queue_work(ar->workqueue, &ar->set_coverage_class_work);
+
+                spin_unlock_bh(&ar->data_lock);
+        }
+}
+
 static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
@@ -4951,6 +4968,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 return;
         case WMI_SCAN_EVENTID:
                 ath10k_wmi_event_scan(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_CHAN_INFO_EVENTID:
                 ath10k_wmi_event_chan_info(ar, skb);
@@ -4960,15 +4978,18 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_DEBUG_MESG_EVENTID:
                 ath10k_wmi_event_debug_mesg(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_UPDATE_STATS_EVENTID:
                 ath10k_wmi_event_update_stats(ar, skb);
                 break;
         case WMI_VDEV_START_RESP_EVENTID:
                 ath10k_wmi_event_vdev_start_resp(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_VDEV_STOPPED_EVENTID:
                 ath10k_wmi_event_vdev_stopped(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_PEER_STA_KICKOUT_EVENTID:
                 ath10k_wmi_event_peer_sta_kickout(ar, skb);
@@ -4984,12 +5005,14 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_ROAM_EVENTID:
                 ath10k_wmi_event_roam(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_PROFILE_MATCH:
                 ath10k_wmi_event_profile_match(ar, skb);
                 break;
         case WMI_DEBUG_PRINT_EVENTID:
                 ath10k_wmi_event_debug_print(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_PDEV_QVIT_EVENTID:
                 ath10k_wmi_event_pdev_qvit(ar, skb);
@@ -5038,6 +5061,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 return;
         case WMI_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         default:
                 ath10k_warn(ar, "Unknown eventid: %d\n", id);
@@ -5081,6 +5105,7 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 return;
         case WMI_10X_SCAN_EVENTID:
                 ath10k_wmi_event_scan(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_CHAN_INFO_EVENTID:
                 ath10k_wmi_event_chan_info(ar, skb);
@@ -5090,15 +5115,18 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10X_DEBUG_MESG_EVENTID:
                 ath10k_wmi_event_debug_mesg(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_UPDATE_STATS_EVENTID:
                 ath10k_wmi_event_update_stats(ar, skb);
                 break;
         case WMI_10X_VDEV_START_RESP_EVENTID:
                 ath10k_wmi_event_vdev_start_resp(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_VDEV_STOPPED_EVENTID:
                 ath10k_wmi_event_vdev_stopped(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_PEER_STA_KICKOUT_EVENTID:
                 ath10k_wmi_event_peer_sta_kickout(ar, skb);
@@ -5114,12 +5142,14 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10X_ROAM_EVENTID:
                 ath10k_wmi_event_roam(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_PROFILE_MATCH:
                 ath10k_wmi_event_profile_match(ar, skb);
                 break;
         case WMI_10X_DEBUG_PRINT_EVENTID:
                 ath10k_wmi_event_debug_print(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_PDEV_QVIT_EVENTID:
                 ath10k_wmi_event_pdev_qvit(ar, skb);
@@ -5159,6 +5189,7 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 return;
         case WMI_10X_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10X_PDEV_UTF_EVENTID:
                 /* ignore utf events */
@@ -5205,6 +5236,7 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 return;
         case WMI_10_2_SCAN_EVENTID:
                 ath10k_wmi_event_scan(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_CHAN_INFO_EVENTID:
                 ath10k_wmi_event_chan_info(ar, skb);
@@ -5214,15 +5246,18 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_2_DEBUG_MESG_EVENTID:
                 ath10k_wmi_event_debug_mesg(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_UPDATE_STATS_EVENTID:
                 ath10k_wmi_event_update_stats(ar, skb);
                 break;
         case WMI_10_2_VDEV_START_RESP_EVENTID:
                 ath10k_wmi_event_vdev_start_resp(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_VDEV_STOPPED_EVENTID:
                 ath10k_wmi_event_vdev_stopped(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_PEER_STA_KICKOUT_EVENTID:
                 ath10k_wmi_event_peer_sta_kickout(ar, skb);
@@ -5238,12 +5273,14 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_2_ROAM_EVENTID:
                 ath10k_wmi_event_roam(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_PROFILE_MATCH:
                 ath10k_wmi_event_profile_match(ar, skb);
                 break;
         case WMI_10_2_DEBUG_PRINT_EVENTID:
                 ath10k_wmi_event_debug_print(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_PDEV_QVIT_EVENTID:
                 ath10k_wmi_event_pdev_qvit(ar, skb);
@@ -5274,15 +5311,18 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_2_VDEV_STANDBY_REQ_EVENTID:
                 ath10k_wmi_event_vdev_standby_req(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_VDEV_RESUME_REQ_EVENTID:
                 ath10k_wmi_event_vdev_resume_req(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_SERVICE_READY_EVENTID:
                 ath10k_wmi_event_service_ready(ar, skb);
                 return;
         case WMI_10_2_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_2_PDEV_TEMPERATURE_EVENTID:
                 ath10k_wmi_event_temperature(ar, skb);
@@ -5345,12 +5385,14 @@ static void ath10k_wmi_10_4_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_4_DEBUG_MESG_EVENTID:
                 ath10k_wmi_event_debug_mesg(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_SERVICE_READY_EVENTID:
                 ath10k_wmi_event_service_ready(ar, skb);
                 return;
         case WMI_10_4_SCAN_EVENTID:
                 ath10k_wmi_event_scan(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_CHAN_INFO_EVENTID:
                 ath10k_wmi_event_chan_info(ar, skb);
@@ -5360,12 +5402,14 @@ static void ath10k_wmi_10_4_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_4_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_PEER_STA_KICKOUT_EVENTID:
                 ath10k_wmi_event_peer_sta_kickout(ar, skb);
                 break;
         case WMI_10_4_ROAM_EVENTID:
                 ath10k_wmi_event_roam(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_HOST_SWBA_EVENTID:
                 ath10k_wmi_event_host_swba(ar, skb);
@@ -5375,12 +5419,15 @@ static void ath10k_wmi_10_4_op_rx(struct ath10k *ar, struct sk_buff *skb)
                 break;
         case WMI_10_4_DEBUG_PRINT_EVENTID:
                 ath10k_wmi_event_debug_print(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_VDEV_START_RESP_EVENTID:
                 ath10k_wmi_event_vdev_start_resp(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_VDEV_STOPPED_EVENTID:
                 ath10k_wmi_event_vdev_stopped(ar, skb);
+                ath10k_wmi_queue_set_coverage_class_work(ar);
                 break;
         case WMI_10_4_WOW_WAKEUP_HOST_EVENTID:
         case WMI_10_4_PEER_RATECODE_LIST_EVENTID:
@@ -5397,6 +5444,9 @@ static void ath10k_wmi_10_4_op_rx(struct ath10k *ar, struct sk_buff *skb)
         case WMI_10_4_PDEV_BSS_CHAN_INFO_EVENTID:
                 ath10k_wmi_event_pdev_bss_chan_info(ar, skb);
                 break;
+        case WMI_10_4_PDEV_TPC_CONFIG_EVENTID:
+                ath10k_wmi_event_pdev_tpc_config(ar, skb);
+                break;
         default:
                 ath10k_warn(ar, "Unknown eventid: %d\n", id);
                 break;
@@ -6096,6 +6146,7 @@ void ath10k_wmi_start_scan_init(struct ath10k *ar,
                 | WMI_SCAN_EVENT_COMPLETED
                 | WMI_SCAN_EVENT_BSS_CHANNEL
                 | WMI_SCAN_EVENT_FOREIGN_CHANNEL
+                | WMI_SCAN_EVENT_FOREIGN_CHANNEL_EXIT
                 | WMI_SCAN_EVENT_DEQUEUED;
         arg->scan_ctrl_flags |= WMI_SCAN_CHAN_STAT_EVENT;
         arg->n_bssids = 1;
@@ -8153,6 +8204,7 @@ static const struct wmi_ops wmi_10_4_ops = {
         .get_vdev_subtype = ath10k_wmi_10_4_op_get_vdev_subtype,
         .gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
         .gen_echo = ath10k_wmi_op_gen_echo,
+        .gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
 };
 
 int ath10k_wmi_attach(struct ath10k *ar)
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index 76eb33679d4b..8ec66e74d06d 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -75,6 +75,8 @@ struct ath6kl_sdio {
 #define CMD53_ARG_FIXED_ADDRESS 0
 #define CMD53_ARG_INCR_ADDRESS  1
 
+static int ath6kl_sdio_config(struct ath6kl *ar);
+
 static inline struct ath6kl_sdio *ath6kl_sdio_priv(struct ath6kl *ar)
 {
         return ar->hif_priv;
@@ -526,8 +528,15 @@ static int ath6kl_sdio_power_on(struct ath6kl *ar)
          */
         msleep(10);
 
+        ret = ath6kl_sdio_config(ar);
+        if (ret) {
+                ath6kl_err("Failed to config sdio: %d\n", ret);
+                goto out;
+        }
+
         ar_sdio->is_disabled = false;
 
+out:
         return ret;
 }
 
@@ -703,8 +712,10 @@ static void ath6kl_sdio_cleanup_scatter(struct ath6kl *ar)
                  * ath6kl_hif_rw_comp_handler() with status -ECANCELED so
                  * that the packet is properly freed?
                  */
-                if (s_req->busrequest)
+                if (s_req->busrequest) {
+                        s_req->busrequest->scat_req = 0;
                         ath6kl_sdio_free_bus_req(ar_sdio, s_req->busrequest);
+                }
                 kfree(s_req->virt_dma_buf);
                 kfree(s_req->sgentries);
                 kfree(s_req);
@@ -712,6 +723,8 @@ static void ath6kl_sdio_cleanup_scatter(struct ath6kl *ar)
                 spin_lock_bh(&ar_sdio->scat_lock);
         }
         spin_unlock_bh(&ar_sdio->scat_lock);
+
+        ar_sdio->scatter_enabled = false;
 }
 
 /* setup of HIF scatter resources */
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 3fd1cc98fd2f..84a6d12c3f8a 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -421,10 +421,6 @@ int ath6kl_wmi_dot11_hdr_remove(struct wmi *wmi, struct sk_buff *skb)
 
         switch ((le16_to_cpu(wh.frame_control)) &
                 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-        case 0:
-                memcpy(eth_hdr.h_dest, wh.addr1, ETH_ALEN);
-                memcpy(eth_hdr.h_source, wh.addr2, ETH_ALEN);
-                break;
         case IEEE80211_FCTL_TODS:
                 memcpy(eth_hdr.h_dest, wh.addr3, ETH_ALEN);
                 memcpy(eth_hdr.h_source, wh.addr2, ETH_ALEN);
@@ -435,6 +431,10 @@ int ath6kl_wmi_dot11_hdr_remove(struct wmi *wmi, struct sk_buff *skb)
                 break;
         case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
                 break;
+        default:
+                memcpy(eth_hdr.h_dest, wh.addr1, ETH_ALEN);
+                memcpy(eth_hdr.h_source, wh.addr2, ETH_ALEN);
+                break;
         }
 
         skb_pull(skb, sizeof(struct ath6kl_llc_snap_hdr));
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 26fc8ecfe8c4..378d3458fddb 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -91,7 +91,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 #define ATH_RXBUF               512
 #define ATH_TXBUF               512
 #define ATH_TXBUF_RESERVE       5
-#define ATH_MAX_QDEPTH          (ATH_TXBUF / 4 - ATH_TXBUF_RESERVE)
 #define ATH_TXMAXTRY            13
 #define ATH_MAX_SW_RETRIES      30
 
@@ -145,7 +144,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
         ((((_seqno) - (_start)) & 4095) < (_bawsz))
 
-#define ATH_AN_2_TID(_an, _tidno)  (&(_an)->tid[(_tidno)])
+#define ATH_AN_2_TID(_an, _tidno) ath_node_to_tid(_an, _tidno)
 
 #define IS_HT_RATE(rate)   (rate & 0x80)
 #define IS_CCK_RATE(rate)  ((rate >= 0x18) && (rate <= 0x1e))
@@ -164,7 +163,6 @@ struct ath_txq {
         spinlock_t axq_lock;
         u32 axq_depth;
         u32 axq_ampdu_depth;
-        bool stopped;
         bool axq_tx_inprogress;
         struct list_head txq_fifo[ATH_TXFIFO_DEPTH];
         u8 txq_headidx;
@@ -232,7 +230,6 @@ struct ath_buf {
 
 struct ath_atx_tid {
         struct list_head list;
-        struct sk_buff_head buf_q;
         struct sk_buff_head retry_q;
         struct ath_node *an;
         struct ath_txq *txq;
@@ -247,13 +244,13 @@ struct ath_atx_tid {
         s8 bar_index;
         bool active;
         bool clear_ps_filter;
+        bool has_queued;
 };
 
 struct ath_node {
         struct ath_softc *sc;
         struct ieee80211_sta *sta; /* station struct we're part of */
         struct ieee80211_vif *vif; /* interface with which we're associated */
-        struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
 
         u16 maxampdu;
         u8 mpdudensity;
@@ -276,7 +273,6 @@ struct ath_tx_control {
         struct ath_node *an;
         struct ieee80211_sta *sta;
         u8 paprd;
-        bool force_channel;
 };
 
 
@@ -293,7 +289,6 @@ struct ath_tx {
         struct ath_descdma txdma;
         struct ath_txq *txq_map[IEEE80211_NUM_ACS];
         struct ath_txq *uapsdq;
-        u32 txq_max_pending[IEEE80211_NUM_ACS];
         u16 max_aggr_framelen[IEEE80211_NUM_ACS][4][32];
 };
 
@@ -421,6 +416,22 @@ struct ath_offchannel {
         int duration;
 };
 
+static inline struct ath_atx_tid *
+ath_node_to_tid(struct ath_node *an, u8 tidno)
+{
+        struct ieee80211_sta *sta = an->sta;
+        struct ieee80211_vif *vif = an->vif;
+        struct ieee80211_txq *txq;
+
+        BUG_ON(!vif);
+        if (sta)
+                txq = sta->txq[tidno % ARRAY_SIZE(sta->txq)];
+        else
+                txq = vif->txq;
+
+        return (struct ath_atx_tid *) txq->drv_priv;
+}
+
 #define case_rtn_string(val) case val: return #val
 
 #define ath_for_each_chanctx(_sc, _ctx)                             \
@@ -575,7 +586,6 @@ void ath_tx_edma_tasklet(struct ath_softc *sc);
 int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                       u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
-void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 
 void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an);
 void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
@@ -585,6 +595,7 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                                    u16 tids, int nframes,
                                    enum ieee80211_frame_release_type reason,
                                    bool more_data);
+void ath9k_wake_tx_queue(struct ieee80211_hw *hw, struct ieee80211_txq *queue);
 
 /********/
 /* VIFs */
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 57e26a640477..929dd70f48eb 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1010,7 +1010,6 @@ static void ath_scan_send_probe(struct ath_softc *sc,
                 goto error;
 
         txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
-        txctl.force_channel = true;
         if (ath_tx_start(sc->hw, skb, &txctl))
                 goto error;
 
@@ -1133,7 +1132,6 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp,
         memset(&txctl, 0, sizeof(txctl));
         txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
         txctl.sta = sta;
-        txctl.force_channel = true;
         if (ath_tx_start(sc->hw, skb, &txctl)) {
                 ieee80211_free_txskb(sc->hw, skb);
                 return false;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index c56e40ff35e5..89a94dd5f2cb 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -600,7 +600,6 @@ static int read_file_xmit(struct seq_file *file, void *data)
         PR("MPDUs XRetried:  ", xretries);
         PR("Aggregates:      ", a_aggr);
         PR("AMPDUs Queued HW:", a_queued_hw);
-        PR("AMPDUs Queued SW:", a_queued_sw);
         PR("AMPDUs Completed:", a_completed);
         PR("AMPDUs Retried:  ", a_retries);
         PR("AMPDUs XRetried: ", a_xretries);
@@ -629,8 +628,7 @@ static void print_queue(struct ath_softc *sc, struct ath_txq *txq,
         seq_printf(file, "%s: %d ", "qnum", txq->axq_qnum);
         seq_printf(file, "%s: %2d ", "qdepth", txq->axq_depth);
         seq_printf(file, "%s: %2d ", "ampdu-depth", txq->axq_ampdu_depth);
-        seq_printf(file, "%s: %3d ", "pending", txq->pending_frames);
-        seq_printf(file, "%s: %d\n", "stopped", txq->stopped);
+        seq_printf(file, "%s: %3d\n", "pending", txq->pending_frames);
 
         ath_txq_unlock(sc, txq);
 }
@@ -1208,7 +1206,6 @@ static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
         AMKSTR(d_tx_mpdu_xretries),
         AMKSTR(d_tx_aggregates),
         AMKSTR(d_tx_ampdus_queued_hw),
-        AMKSTR(d_tx_ampdus_queued_sw),
         AMKSTR(d_tx_ampdus_completed),
         AMKSTR(d_tx_ampdu_retries),
         AMKSTR(d_tx_ampdu_xretries),
@@ -1288,7 +1285,6 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
         AWDATA(xretries);
         AWDATA(a_aggr);
         AWDATA(a_queued_hw);
-        AWDATA(a_queued_sw);
         AWDATA(a_completed);
         AWDATA(a_retries);
         AWDATA(a_xretries);
@@ -1346,14 +1342,6 @@ int ath9k_init_debug(struct ath_hw *ah)
                                     read_file_xmit);
         debugfs_create_devm_seqfile(sc->dev, "queues", sc->debug.debugfs_phy,
                                     read_file_queues);
-        debugfs_create_u32("qlen_bk", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
-                           &sc->tx.txq_max_pending[IEEE80211_AC_BK]);
-        debugfs_create_u32("qlen_be", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
-                           &sc->tx.txq_max_pending[IEEE80211_AC_BE]);
-        debugfs_create_u32("qlen_vi", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
-                           &sc->tx.txq_max_pending[IEEE80211_AC_VI]);
-        debugfs_create_u32("qlen_vo", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
-                           &sc->tx.txq_max_pending[IEEE80211_AC_VO]);
         debugfs_create_devm_seqfile(sc->dev, "misc", sc->debug.debugfs_phy,
                                     read_file_misc);
         debugfs_create_devm_seqfile(sc->dev, "reset", sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index cd68c5f0e751..a078cdd3170d 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -147,7 +147,6 @@ struct ath_interrupt_stats {
  * @completed: Total MPDUs (non-aggr) completed
  * @a_aggr: Total no. of aggregates queued
  * @a_queued_hw: Total AMPDUs queued to hardware
- * @a_queued_sw: Total AMPDUs queued to software queues
  * @a_completed: Total AMPDUs completed
  * @a_retries: No. of AMPDUs retried (SW)
  * @a_xretries: No. of AMPDUs dropped due to xretries
@@ -174,7 +173,6 @@ struct ath_tx_stats {
         u32 xretries;
         u32 a_aggr;
         u32 a_queued_hw;
-        u32 a_queued_sw;
         u32 a_completed;
         u32 a_retries;
         u32 a_xretries;
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
index b66cfa91364f..2a3a3c4671bc 100644
--- a/drivers/net/wireless/ath/ath9k/debug_sta.c
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -52,8 +52,8 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                          "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
                          "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
 
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+        for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+                tid = ath_node_to_tid(an, tidno);
                 txq = tid->txq;
                 ath_txq_lock(sc, txq);
                 if (tid->active) {
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index fd85f996c554..8e6dae23669b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -244,8 +244,8 @@ int htc_connect_service(struct htc_target *target,
         /* Find an available endpoint */
         endpoint = get_next_avail_ep(target->endpoint);
         if (!endpoint) {
-                dev_err(target->dev, "Endpoint is not available for"
-                        "service %d\n", service_connreq->service_id);
+                dev_err(target->dev, "Endpoint is not available for service %d\n",
+                        service_connreq->service_id);
                 return -EINVAL;
         }
 
@@ -382,7 +382,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
                 break;
                 }
         default:
-                dev_err(htc_handle->dev, "ath: uknown panic pattern!\n");
+                dev_err(htc_handle->dev, "ath: unknown panic pattern!\n");
                 break;
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 368d9b313823..20794660d6ae 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -20,6 +20,8 @@
 #include <linux/slab.h>
 #include <linux/ath9k_platform.h>
 #include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
 #include <linux/relay.h>
 #include <net/ieee80211_radiotap.h>
 
@@ -358,7 +360,6 @@ static int ath9k_init_queues(struct ath_softc *sc)
         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                 sc->tx.txq_map[i] = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, i);
                 sc->tx.txq_map[i]->mac80211_qnum = i;
-                sc->tx.txq_max_pending[i] = ATH_MAX_QDEPTH;
         }
         return 0;
 }
@@ -555,6 +556,42 @@ static int ath9k_init_platform(struct ath_softc *sc)
         return 0;
 }
 
+static int ath9k_of_init(struct ath_softc *sc)
+{
+        struct device_node *np = sc->dev->of_node;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        enum ath_bus_type bus_type = common->bus_ops->ath_bus_type;
+        const char *mac;
+        char eeprom_name[100];
+        int ret;
+
+        if (!of_device_is_available(np))
+                return 0;
+
+        ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
+
+        if (of_property_read_bool(np, "qca,no-eeprom")) {
+                /* ath9k-eeprom-<bus>-<id>.bin */
+                scnprintf(eeprom_name, sizeof(eeprom_name),
+                          "ath9k-eeprom-%s-%s.bin",
+                          ath_bus_type_to_string(bus_type), dev_name(ah->dev));
+
+                ret = ath9k_eeprom_request(sc, eeprom_name);
+                if (ret)
+                        return ret;
+        }
+
+        mac = of_get_mac_address(np);
+        if (mac)
+                ether_addr_copy(common->macaddr, mac);
+
+        ah->ah_flags &= ~AH_USE_EEPROM;
+        ah->ah_flags |= AH_NO_EEP_SWAP;
+
+        return 0;
+}
+
 static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
                             const struct ath_bus_ops *bus_ops)
 {
@@ -611,6 +648,10 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         if (ret)
                 return ret;
 
+        ret = ath9k_of_init(sc);
+        if (ret)
+                return ret;
+
         if (ath9k_led_active_high != -1)
                 ah->config.led_active_high = ath9k_led_active_high == 1;
 
@@ -883,6 +924,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->max_rate_tries = 10;
         hw->sta_data_size = sizeof(struct ath_node);
         hw->vif_data_size = sizeof(struct ath_vif);
+        hw->txq_data_size = sizeof(struct ath_atx_tid);
         hw->extra_tx_headroom = 4;
 
         hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e9f32b52fc8c..59e3bd0f4c20 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1902,9 +1902,11 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         bool flush = false;
         int ret = 0;
         struct ieee80211_sta *sta = params->sta;
+        struct ath_node *an = (struct ath_node *)sta->drv_priv;
         enum ieee80211_ampdu_mlme_action action = params->action;
         u16 tid = params->tid;
         u16 *ssn = &params->ssn;
+        struct ath_atx_tid *atid;
 
         mutex_lock(&sc->mutex);
 
@@ -1937,9 +1939,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
-                ath9k_ps_wakeup(sc);
-                ath_tx_aggr_resume(sc, sta, tid);
-                ath9k_ps_restore(sc);
+                atid = ath_node_to_tid(an, tid);
+                atid->baw_size = IEEE80211_MIN_AMPDU_BUF <<
+                                sta->ht_cap.ampdu_factor;
                 break;
         default:
                 ath_err(ath9k_hw_common(sc->sc_ah), "Unknown AMPDU action\n");
@@ -2701,4 +2703,5 @@ struct ieee80211_ops ath9k_ops = {
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
         .get_txpower        = ath9k_get_txpower,
+        .wake_tx_queue      = ath9k_wake_tx_queue,
 };
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 0dd454acf22a..aff473dfa10d 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
-        { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
         /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_LED_ACT_HI },
 #endif
 
-        { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+        { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          0x10CF, /* Fujitsu */
                          0x1536),
           .driver_data = ATH9K_PCI_D3_L1_WAR },
+#endif
 
+        { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+
+#ifdef CONFIG_ATH9K_PCOEM
         /* AR9285 card for Asus */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x002B,
diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c
index d38e50f96db7..568b1c6c2b2b 100644
--- a/drivers/net/wireless/ath/ath9k/rng.c
+++ b/drivers/net/wireless/ath/ath9k/rng.c
@@ -22,7 +22,7 @@
 #include "ar9003_phy.h"
 
 #define ATH9K_RNG_BUF_SIZE      320
-#define ATH9K_RNG_ENTROPY(x)    (((x) * 8 * 320) >> 10) /* quality: 320/1024 */
+#define ATH9K_RNG_ENTROPY(x)    (((x) * 8 * 10) >> 5) /* quality: 10/32 */
 
 static int ath9k_rng_data_read(struct ath_softc *sc, u32 *buf, u32 buf_size)
 {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 52bfbb988611..486afa98a5b8 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -67,6 +67,8 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
                                            struct ath_txq *txq,
                                            struct ath_atx_tid *tid,
                                            struct sk_buff *skb);
+static int ath_tx_prepare(struct ieee80211_hw *hw, struct sk_buff *skb,
+                          struct ath_tx_control *txctl);
 
 enum {
         MCS_HT20,
@@ -137,6 +139,26 @@ static void ath_tx_queue_tid(struct ath_softc *sc, struct ath_txq *txq,
                 list_add_tail(&tid->list, list);
 }
 
+void ath9k_wake_tx_queue(struct ieee80211_hw *hw, struct ieee80211_txq *queue)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_atx_tid *tid = (struct ath_atx_tid *) queue->drv_priv;
+        struct ath_txq *txq = tid->txq;
+
+        ath_dbg(common, QUEUE, "Waking TX queue: %pM (%d)\n",
+                queue->sta ? queue->sta->addr : queue->vif->addr,
+                tid->tidno);
+
+        ath_txq_lock(sc, txq);
+
+        tid->has_queued = true;
+        ath_tx_queue_tid(sc, txq, tid);
+        ath_txq_schedule(sc, txq);
+
+        ath_txq_unlock(sc, txq);
+}
+
 static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -164,7 +186,6 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
                              struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_frame_info *fi = get_frame_info(skb);
         int q = fi->txq;
 
@@ -175,14 +196,6 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
         if (WARN_ON(--txq->pending_frames < 0))
                 txq->pending_frames = 0;
 
-        if (txq->stopped &&
-            txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                if (ath9k_is_chanctx_enabled())
-                        ieee80211_wake_queue(sc->hw, info->hw_queue);
-                else
-                        ieee80211_wake_queue(sc->hw, q);
-                txq->stopped = false;
-        }
 }
 
 static struct ath_atx_tid *
@@ -192,9 +205,48 @@ ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
         return ATH_AN_2_TID(an, tidno);
 }
 
+static struct sk_buff *
+ath_tid_pull(struct ath_atx_tid *tid)
+{
+        struct ieee80211_txq *txq = container_of((void*)tid, struct ieee80211_txq, drv_priv);
+        struct ath_softc *sc = tid->an->sc;
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_tx_control txctl = {
+                .txq = tid->txq,
+                .sta = tid->an->sta,
+        };
+        struct sk_buff *skb;
+        struct ath_frame_info *fi;
+        int q;
+
+        if (!tid->has_queued)
+                return NULL;
+
+        skb = ieee80211_tx_dequeue(hw, txq);
+        if (!skb) {
+                tid->has_queued = false;
+                return NULL;
+        }
+
+        if (ath_tx_prepare(hw, skb, &txctl)) {
+                ieee80211_free_txskb(hw, skb);
+                return NULL;
+        }
+
+        q = skb_get_queue_mapping(skb);
+        if (tid->txq == sc->tx.txq_map[q]) {
+                fi = get_frame_info(skb);
+                fi->txq = q;
+                ++tid->txq->pending_frames;
+        }
+
+        return skb;
+ }
+
+
 static bool ath_tid_has_buffered(struct ath_atx_tid *tid)
 {
-        return !skb_queue_empty(&tid->buf_q) || !skb_queue_empty(&tid->retry_q);
+        return !skb_queue_empty(&tid->retry_q) || tid->has_queued;
 }
 
 static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
@@ -203,46 +255,11 @@ static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
 
         skb = __skb_dequeue(&tid->retry_q);
         if (!skb)
-                skb = __skb_dequeue(&tid->buf_q);
+                skb = ath_tid_pull(tid);
 
         return skb;
 }
 
-/*
- * ath_tx_tid_change_state:
- * - clears a-mpdu flag of previous session
- * - force sequence number allocation to fix next BlockAck Window
- */
-static void
-ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
-{
-        struct ath_txq *txq = tid->txq;
-        struct ieee80211_tx_info *tx_info;
-        struct sk_buff *skb, *tskb;
-        struct ath_buf *bf;
-        struct ath_frame_info *fi;
-
-        skb_queue_walk_safe(&tid->buf_q, skb, tskb) {
-                fi = get_frame_info(skb);
-                bf = fi->bf;
-
-                tx_info = IEEE80211_SKB_CB(skb);
-                tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-
-                if (bf)
-                        continue;
-
-                bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-                if (!bf) {
-                        __skb_unlink(skb, &tid->buf_q);
-                        ath_txq_skb_done(sc, txq, skb);
-                        ieee80211_free_txskb(sc->hw, skb);
-                        continue;
-                }
-        }
-
-}
-
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = tid->txq;
@@ -883,20 +900,16 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
 
 static struct ath_buf *
 ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
-                        struct ath_atx_tid *tid, struct sk_buff_head **q)
+                        struct ath_atx_tid *tid)
 {
         struct ieee80211_tx_info *tx_info;
         struct ath_frame_info *fi;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *first_skb = NULL;
         struct ath_buf *bf;
         u16 seqno;
 
         while (1) {
-                *q = &tid->retry_q;
-                if (skb_queue_empty(*q))
-                        *q = &tid->buf_q;
-
-                skb = skb_peek(*q);
+                skb = ath_tid_dequeue(tid);
                 if (!skb)
                         break;
 
@@ -908,7 +921,6 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
                         bf->bf_state.stale = false;
 
                 if (!bf) {
-                        __skb_unlink(skb, *q);
                         ath_txq_skb_done(sc, txq, skb);
                         ieee80211_free_txskb(sc->hw, skb);
                         continue;
@@ -937,8 +949,20 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
                 seqno = bf->bf_state.seqno;
 
                 /* do not step over block-ack window */
-                if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno))
+                if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
+                        __skb_queue_tail(&tid->retry_q, skb);
+
+                        /* If there are other skbs in the retry q, they are
+                         * probably within the BAW, so loop immediately to get
+                         * one of them. Otherwise the queue can get stuck. */
+                        if (!skb_queue_is_first(&tid->retry_q, skb) &&
+                            !WARN_ON(skb == first_skb)) {
+                                if(!first_skb) /* infinite loop prevention */
+                                        first_skb = skb;
+                                continue;
+                        }
                         break;
+                }
 
                 if (tid->bar_index > ATH_BA_INDEX(tid->seq_start, seqno)) {
                         struct ath_tx_status ts = {};
@@ -946,7 +970,6 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                         INIT_LIST_HEAD(&bf_head);
                         list_add(&bf->list, &bf_head);
-                        __skb_unlink(skb, *q);
                         ath_tx_update_baw(sc, tid, seqno);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
                         continue;
@@ -958,11 +981,10 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
         return NULL;
 }
 
-static bool
+static int
 ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  struct ath_atx_tid *tid, struct list_head *bf_q,
-                 struct ath_buf *bf_first, struct sk_buff_head *tid_q,
-                 int *aggr_len)
+                 struct ath_buf *bf_first)
 {
 #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
         struct ath_buf *bf = bf_first, *bf_prev = NULL;
@@ -972,12 +994,13 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
         struct ieee80211_tx_info *tx_info;
         struct ath_frame_info *fi;
         struct sk_buff *skb;
-        bool closed = false;
+
 
         bf = bf_first;
         aggr_limit = ath_lookup_rate(sc, bf, tid);
 
-        do {
+        while (bf)
+        {
                 skb = bf->bf_mpdu;
                 fi = get_frame_info(skb);
 
@@ -986,12 +1009,12 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 if (nframes) {
                         if (aggr_limit < al + bpad + al_delta ||
                             ath_lookup_legacy(bf) || nframes >= h_baw)
-                                break;
+                                goto stop;
 
                         tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
                         if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
                             !(tx_info->flags & IEEE80211_TX_CTL_AMPDU))
-                                break;
+                                goto stop;
                 }
 
                 /* add padding for previous frame to aggregation length */
@@ -1013,20 +1036,18 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         ath_tx_addto_baw(sc, tid, bf);
                 bf->bf_state.ndelim = ndelim;
 
-                __skb_unlink(skb, tid_q);
                 list_add_tail(&bf->list, bf_q);
                 if (bf_prev)
                         bf_prev->bf_next = bf;
 
                 bf_prev = bf;
 
-                bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
-                if (!bf) {
-                        closed = true;
-                        break;
-                }
-        } while (ath_tid_has_buffered(tid));
-
+                bf = ath_tx_get_tid_subframe(sc, txq, tid);
+        }
+        goto finish;
+stop:
+        __skb_queue_tail(&tid->retry_q, bf->bf_mpdu);
+finish:
         bf = bf_first;
         bf->bf_lastbf = bf_prev;
 
@@ -1037,9 +1058,7 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 TX_STAT_INC(txq->axq_qnum, a_aggr);
         }
 
-        *aggr_len = al;
-
-        return closed;
+        return al;
 #undef PADBYTES
 }
 
@@ -1416,18 +1435,15 @@ static void ath_tx_fill_desc(struct ath_softc *sc, struct ath_buf *bf,
 static void
 ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
                   struct ath_atx_tid *tid, struct list_head *bf_q,
-                  struct ath_buf *bf_first, struct sk_buff_head *tid_q)
+                  struct ath_buf *bf_first)
 {
         struct ath_buf *bf = bf_first, *bf_prev = NULL;
-        struct sk_buff *skb;
         int nframes = 0;
 
         do {
                 struct ieee80211_tx_info *tx_info;
-                skb = bf->bf_mpdu;
 
                 nframes++;
-                __skb_unlink(skb, tid_q);
                 list_add_tail(&bf->list, bf_q);
                 if (bf_prev)
                         bf_prev->bf_next = bf;
@@ -1436,13 +1452,15 @@ ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
                 if (nframes >= 2)
                         break;
 
-                bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
+                bf = ath_tx_get_tid_subframe(sc, txq, tid);
                 if (!bf)
                         break;
 
                 tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                        __skb_queue_tail(&tid->retry_q, bf->bf_mpdu);
                         break;
+                }
 
                 ath_set_rates(tid->an->vif, tid->an->sta, bf);
         } while (1);
@@ -1453,34 +1471,33 @@ static bool ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 {
         struct ath_buf *bf;
         struct ieee80211_tx_info *tx_info;
-        struct sk_buff_head *tid_q;
         struct list_head bf_q;
         int aggr_len = 0;
-        bool aggr, last = true;
+        bool aggr;
 
         if (!ath_tid_has_buffered(tid))
                 return false;
 
         INIT_LIST_HEAD(&bf_q);
 
-        bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
+        bf = ath_tx_get_tid_subframe(sc, txq, tid);
         if (!bf)
                 return false;
 
         tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
         aggr = !!(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
         if ((aggr && txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) ||
-                (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
+            (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
+                __skb_queue_tail(&tid->retry_q, bf->bf_mpdu);
                 *stop = true;
                 return false;
         }
 
         ath_set_rates(tid->an->vif, tid->an->sta, bf);
         if (aggr)
-                last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
-                                        tid_q, &aggr_len);
+                aggr_len = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf);
         else
-                ath_tx_form_burst(sc, txq, tid, &bf_q, bf, tid_q);
+                ath_tx_form_burst(sc, txq, tid, &bf_q, bf);
 
         if (list_empty(&bf_q))
                 return false;
@@ -1523,9 +1540,6 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                 an->mpdudensity = density;
         }
 
-        /* force sequence number allocation for pending frames */
-        ath_tx_tid_change_state(sc, txtid);
-
         txtid->active = true;
         *ssn = txtid->seq_start = txtid->seq_next;
         txtid->bar_index = -1;
@@ -1550,7 +1564,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         ath_txq_lock(sc, txq);
         txtid->active = false;
         ath_tx_flush_tid(sc, txtid);
-        ath_tx_tid_change_state(sc, txtid);
         ath_txq_unlock_complete(sc, txq);
 }
 
@@ -1560,14 +1573,12 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_atx_tid *tid;
         struct ath_txq *txq;
-        bool buffered;
         int tidno;
 
         ath_dbg(common, XMIT, "%s called\n", __func__);
 
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-
+        for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+                tid = ath_node_to_tid(an, tidno);
                 txq = tid->txq;
 
                 ath_txq_lock(sc, txq);
@@ -1577,13 +1588,12 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
                         continue;
                 }
 
-                buffered = ath_tid_has_buffered(tid);
+                if (!skb_queue_empty(&tid->retry_q))
+                        ieee80211_sta_set_buffered(sta, tid->tidno, true);
 
                 list_del_init(&tid->list);
 
                 ath_txq_unlock(sc, txq);
-
-                ieee80211_sta_set_buffered(sta, tidno, buffered);
         }
 }
 
@@ -1596,49 +1606,20 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
 
         ath_dbg(common, XMIT, "%s called\n", __func__);
 
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-
+        for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+                tid = ath_node_to_tid(an, tidno);
                 txq = tid->txq;
 
                 ath_txq_lock(sc, txq);
                 tid->clear_ps_filter = true;
-
                 if (ath_tid_has_buffered(tid)) {
                         ath_tx_queue_tid(sc, txq, tid);
                         ath_txq_schedule(sc, txq);
                 }
-
                 ath_txq_unlock_complete(sc, txq);
         }
 }
 
-void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
-                        u16 tidno)
-{
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_atx_tid *tid;
-        struct ath_node *an;
-        struct ath_txq *txq;
-
-        ath_dbg(common, XMIT, "%s called\n", __func__);
-
-        an = (struct ath_node *)sta->drv_priv;
-        tid = ATH_AN_2_TID(an, tidno);
-        txq = tid->txq;
-
-        ath_txq_lock(sc, txq);
-
-        tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-
-        if (ath_tid_has_buffered(tid)) {
-                ath_tx_queue_tid(sc, txq, tid);
-                ath_txq_schedule(sc, txq);
-        }
-
-        ath_txq_unlock_complete(sc, txq);
-}
-
 void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                                    struct ieee80211_sta *sta,
                                    u16 tids, int nframes,
@@ -1651,7 +1632,6 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info;
         struct list_head bf_q;
         struct ath_buf *bf_tail = NULL, *bf;
-        struct sk_buff_head *tid_q;
         int sent = 0;
         int i;
 
@@ -1666,11 +1646,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
 
                 ath_txq_lock(sc, tid->txq);
                 while (nframes > 0) {
-                        bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
+                        bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
                         if (!bf)
                                 break;
 
-                        __skb_unlink(bf->bf_mpdu, tid_q);
                         list_add_tail(&bf->list, &bf_q);
                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
                         if (bf_isampdu(bf)) {
@@ -1685,7 +1664,7 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                         sent++;
                         TX_STAT_INC(txq->axq_qnum, a_queued_hw);
 
-                        if (an->sta && !ath_tid_has_buffered(tid))
+                        if (an->sta && skb_queue_empty(&tid->retry_q))
                                 ieee80211_sta_set_buffered(an->sta, i, false);
                 }
                 ath_txq_unlock_complete(sc, tid->txq);
@@ -1914,13 +1893,7 @@ bool ath_drain_all_txq(struct ath_softc *sc)
                 if (!ATH_TXQ_SETUP(sc, i))
                         continue;
 
-                /*
-                 * The caller will resume queues with ieee80211_wake_queues.
-                 * Mark the queue as not stopped to prevent ath_tx_complete
-                 * from waking the queue too early.
-                 */
                 txq = &sc->tx.txq[i];
-                txq->stopped = false;
                 ath_draintxq(sc, txq);
         }
 
@@ -2319,16 +2292,14 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ath_softc *sc = hw->priv;
         struct ath_txq *txq = txctl->txq;
         struct ath_atx_tid *tid = NULL;
+        struct ath_node *an = NULL;
         struct ath_buf *bf;
-        bool queue, skip_uapsd = false, ps_resp;
+        bool ps_resp;
         int q, ret;
 
         if (vif)
                 avp = (void *)vif->drv_priv;
 
-        if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
-                txctl->force_channel = true;
-
         ps_resp = !!(info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE);
 
         ret = ath_tx_prepare(hw, skb, txctl);
@@ -2343,63 +2314,18 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         q = skb_get_queue_mapping(skb);
 
-        ath_txq_lock(sc, txq);
-        if (txq == sc->tx.txq_map[q]) {
-                fi->txq = q;
-                if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
-                    !txq->stopped) {
-                        if (ath9k_is_chanctx_enabled())
-                                ieee80211_stop_queue(sc->hw, info->hw_queue);
-                        else
-                                ieee80211_stop_queue(sc->hw, q);
-                        txq->stopped = true;
-                }
-        }
-
-        queue = ieee80211_is_data_present(hdr->frame_control);
-
-        /* If chanctx, queue all null frames while NOA could be there */
-        if (ath9k_is_chanctx_enabled() &&
-            ieee80211_is_nullfunc(hdr->frame_control) &&
-            !txctl->force_channel)
-                queue = true;
-
-        /* Force queueing of all frames that belong to a virtual interface on
-         * a different channel context, to ensure that they are sent on the
-         * correct channel.
-         */
-        if (((avp && avp->chanctx != sc->cur_chan) ||
-             sc->cur_chan->stopped) && !txctl->force_channel) {
-                if (!txctl->an)
-                        txctl->an = &avp->mcast_node;
-                queue = true;
-                skip_uapsd = true;
-        }
-
-        if (txctl->an && queue)
-                tid = ath_get_skb_tid(sc, txctl->an, skb);
-
-        if (!skip_uapsd && ps_resp) {
-                ath_txq_unlock(sc, txq);
+        if (ps_resp)
                 txq = sc->tx.uapsdq;
-                ath_txq_lock(sc, txq);
-        } else if (txctl->an && queue) {
-                WARN_ON(tid->txq != txctl->txq);
 
-                if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
-                        tid->clear_ps_filter = true;
-
-                /*
-                 * Add this frame to software queue for scheduling later
-                 * for aggregation.
-                 */
-                TX_STAT_INC(txq->axq_qnum, a_queued_sw);
-                __skb_queue_tail(&tid->buf_q, skb);
-                if (!txctl->an->sleeping)
-                        ath_tx_queue_tid(sc, txq, tid);
+        if (txctl->sta) {
+                an = (struct ath_node *) sta->drv_priv;
+                tid = ath_get_skb_tid(sc, an, skb);
+        }
 
-                ath_txq_schedule(sc, txq);
-                goto out;
+        ath_txq_lock(sc, txq);
+        if (txq == sc->tx.txq_map[q]) {
+                fi->txq = q;
+                ++txq->pending_frames;
         }
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
@@ -2892,9 +2818,8 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
         struct ath_atx_tid *tid;
         int tidno, acno;
 
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS;
-             tidno++, tid++) {
+        for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+                tid = ath_node_to_tid(an, tidno);
                 tid->an        = an;
                 tid->tidno     = tidno;
                 tid->seq_start = tid->seq_next = 0;
@@ -2902,11 +2827,14 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
                 tid->baw_head  = tid->baw_tail = 0;
                 tid->active        = false;
                 tid->clear_ps_filter = true;
-                __skb_queue_head_init(&tid->buf_q);
+                tid->has_queued  = false;
                 __skb_queue_head_init(&tid->retry_q);
                 INIT_LIST_HEAD(&tid->list);
                 acno = TID_TO_WME_AC(tidno);
                 tid->txq = sc->tx.txq_map[acno];
+
+                if (!an->sta)
+                        break; /* just one multicast ath_atx_tid */
         }
 }
 
@@ -2916,9 +2844,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
         struct ath_txq *txq;
         int tidno;
 
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-
+        for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+                tid = ath_node_to_tid(an, tidno);
                 txq = tid->txq;
 
                 ath_txq_lock(sc, txq);
@@ -2930,6 +2857,9 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                 tid->active = false;
 
                 ath_txq_unlock(sc, txq);
+
+                if (!an->sta)
+                        break; /* just one multicast ath_atx_tid */
         }
 }
 
diff --git a/drivers/net/wireless/ath/main.c b/drivers/net/wireless/ath/main.c
index 338d72337604..89f4b0513946 100644
--- a/drivers/net/wireless/ath/main.c
+++ b/drivers/net/wireless/ath/main.c
@@ -90,3 +90,10 @@ void ath_printk(const char *level, const struct ath_common* common,
         va_end(args);
 }
 EXPORT_SYMBOL(ath_printk);
+
+const char *ath_bus_type_strings[] = {
+        [ATH_PCI] = "pci",
+        [ATH_AHB] = "ahb",
+        [ATH_USB] = "usb",
+};
+EXPORT_SYMBOL(ath_bus_type_strings);
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index f8506037736f..43afa83a9f0c 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -449,7 +449,7 @@ static void ath_reg_apply_world_flags(struct wiphy *wiphy,
         }
 }
 
-static u16 ath_regd_find_country_by_name(char *alpha2)
+u16 ath_regd_find_country_by_name(char *alpha2)
 {
         unsigned int i;
 
@@ -460,6 +460,7 @@ static u16 ath_regd_find_country_by_name(char *alpha2)
 
         return -1;
 }
+EXPORT_SYMBOL(ath_regd_find_country_by_name);
 
 static int __ath_reg_dyn_country(struct wiphy *wiphy,
                                  struct ath_regulatory *reg,
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index 565d3075f06e..5d80be213fac 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -251,6 +251,7 @@ enum CountryCode {
 
 bool ath_is_world_regd(struct ath_regulatory *reg);
 bool ath_is_49ghz_allowed(u16 redomain);
+u16 ath_regd_find_country_by_name(char *alpha2);
 int ath_regd_init(struct ath_regulatory *reg, struct wiphy *wiphy,
                   void (*reg_notifier)(struct wiphy *wiphy,
                                        struct regulatory_request *request));